ASEAN Model Contractual Clauses for Cross Border Data Flow mechanism (MCCs)
Digital data governance has become increasingly crucial in ASEAN. Appropriate regulation is needed to facilitate and protect cross-border data flow, which has been intensifying as the region is becoming more economically integrated and digitized. Recognizing this need and supporting the economic integration and digital transformation in the region, the ASEAN Digital Ministers has approved ASEAN Model Contractual Clauses for Cross Border Data Flow mechanism (MCCs) on 22 January 2021.
MCCs provides contractual terms and conditions that may be included in the legally binding agreements between parties transferring personal data to each other across borders. MCCs aims to harmonize cross-border data flow standards in the region and increase ASEAN Member States (AMSs) capacity in accelerating digital transformation agenda and building a trusted, transparent, and accountable digital environment for businesses. MCCs is developed based on the ASEAN Framework on Personal Data Protection which derives its principles upon the principles of the APEC Privacy Framework or OECD Privacy Guidelines, which lends itself to be interoperable with other global data protection systems such as APEC’s Cross-Border Privacy Rules (CBPR) and EU’s General Data Protection Regulation (GDPR).
The Obligations under the ASEAN MCCs
- The obligations in ASEAN MCCs are derived from the ASEAN Framework on Personal Data Protection (2016) that are in line with global best practices. The obligations encompass key principles of data protection, including:
- Providing Legal Basis for Collection, Use, and Disclosure: The Data Exporter warrants that the data is collected, used, disclosed, and transferred in a manner aligned with prevailing laws in AMS. In the absence of such law, Data Subject shall have been notified and given consent to the purposes, where and reasonable and practicable.
- Baseline Data Protection Clauses: The Data Importer will process the data in accordance with the baseline clauses in the ASEAN Framework on Personal Data Protection (2016) principles related to Collection, Notification, Purpose, Accuracy, Security Safeguards, Access and Correction, Transfers, Retention, and Accountability.
- Data Breach Notification: The Data Importer shall notify the relevant authorities and Data Exporter as soon as it becomes aware of any loss or unauthorized use, copying, modification, disclosure, destruction of, or access to, personal data under the contract.
- Due Diligence: Data Exporters are encouraged to conduct due diligence on other parties to meet the requirements of the MCCs. Data Importers are also encouraged to conduct due diligence on them if there is the onward transfer of the data by the Data Importers to third-party importers.
Using the MCCs
The private sectors in AMS may adopt the MCCs, in the transfer of data to other parties in other AMS or in non-AMS. To adopt the MCCs, the private sectors must include the key data protection obligations in their commercial contracts between the parties to the data transfers. The adoption of MCCs is voluntary for business entities in ASEAN, and the parties may modify the contractual clauses as long as it is aligned with the principles in the ASEAN Framework on Personal Data Protection (2016). The parties may also add clauses, as mutually agreed, that are specific to their business process or industry sector, including clauses on specific rules imposed by the sector’s regulatory authority.
Besides MCCs, private sectors are also free to use any other valid data transfer mechanisms recognized by some jurisdictions within ASEAN, including, but not limited to, self-assessment based assurance that data transferred from overseas is protected to a comparable level of protection, binding corporate rules, certifications, which may include ISO series relating to security and privacy techniques, APEC Cross Border Privacy Rules, and Privacy Recognition for Processor Systems, or other legally recognized mechanisms.
The ASEAN MCCs provide two modules for use in two common transfer scenarios, as follow:
- Controller-to-Processor Transfer: For use by the Data Exporters who transfer data to Data Importers who are contractors or vendors, who will process data on behalf of the Data Exporters. This also includes onward transfers from data processors to the downstream data processor.
- Controller-to-Controller Transfer: For use when the Data Exporter transfers data to the Data Importer for its own purposes and may have full control of the data upon receipt.
Benefits of ASEAN MCCs for Businesses
- Ready-to-use flexible template: MCCs reduce length of negation for contracts and are consistent with ASEAN PDP Principles.
- Easy ASEAN Adoption: No requirement for new laws and contractual disputes regarding MCCs may be resolved in civil courts. All private sectors, including SMEs may use MCCs.
The full text of the ASEAN MCCs is available at this link.
*****
Other Recent Updates
One-stop SME information portal for international oriented business launched
The ASEAN Coordinating Committee on Micro, Small, and Medium Enterprises (MSME) launched ASEAN Access in Bangkok on 16 June 2021. ASEAN Access is a one-stop business information gateway for international-oriented businesses to expand their market outreach in ASEAN and beyond. The web portal aims to provide trade-related information and market opportunities by connecting businesses to service providers in areas of distribution, transportation and logistics, market research, and consultancy on intellectual properties, laws, and regulations. The ASEAN Access is administered by the Office of SMEs Promotion Thailand, developed with the support of the Federal Government of Germany and technical assistance from the German Agency for International Cooperation (GIZ).
ASEAN-EU Comprehensive Air Transport Agreement (AE CATA)
ASEAN and the European Union (EU) and its Member States have concluded the negotiations on the ASEAN-EU Comprehensive Air Transport Agreement (AE CATA) at the Extraordinary ASEAN-EU Senior Transport Officials Meeting held virtually on 2 June 2021. The agreement facilitates the airlines of ASEAN and the EU to fly any number of services between both regions, and also fly up to 14 weekly passenger services and any number of cargo services via and beyond to any third country. The agreement is expected to rebuild air connectivity between ASEAN and Europe in the post-COVID 19 pandemic and open new growth opportunities for the aviation industry in ASEAN and the EU.
*****
The 30th Meeting of the ASEAN Director-General of Customs
The 30th Meeting of the ASEAN Customs Directors-General was held virtually on 8-10 June 2021. The meeting commended the achievements and work progress in the completion of the Strategic Plans of Customs Development (SPCDs) 2016-2020, which has been 99% implemented, and placed Customs as the body with the highest output delivery of 78% under Characteristic A, A Highly Integrated and Cohesive Economy, as reported in the final report of the Mid-Term Review of the ASEAN Economic Community Blueprint 2025. The meeting also welcomed the Live Operation of the ASEAN Customs Declaration Document (ACDD), which started on 31 December 2020 in Cambodia, Myanmar, and Singapore, and followed by Malaysia and Thailand on 31 March 2021. The meeting is looking forward to the Live Operation in the remaining AMS within 2021.
*****
ASEAN Workshop on the Circular Economy
The ASEAN Secretariat conducted an online workshop on Circular Economy (CE) on 30 June 2021, to gather relevant sectoral bodies and stakeholders, including the ASEAN Business Advisory Council and the Joint Business Councils, to discuss the draft Framework for Circular Economy for the ASEAN Economic Community (AEC). The Framework is hoped to guide the work of the AEC on CE, by identifying strategic priorities and priority initiatives, and exploring cross-pillar and cross-sectoral collaborations. The strong support of stakeholders, particularly the private sector, would be crucial in ensuring ASEAN’s transition towards CE. The draft Framework was developed with the Economic Research Institute for ASEAN and East Asia (ERIA).
*****
Unlocking RCEP for Business Webinar Series: Trade in Goods
The ASEAN Secretariat, in collaboration with the East Asia Business Council, organised a webinar on RCEP on 26 July, focusing on goods related chapters of the Agreement. The topics discussed included tariff liberalisation, non-tariff measures, and trade remedies. Noting the importance of SMEs for the region’s economy, panellists highlighted the importance of deeper engagement with the SMEs and recommended the ASEAN Secretariat to hold more sessions involving regional and national business councils. The webinar marked the launch of a series of webinars the ASEAN Secretariat will be hosting throughout the year and the video recording of the first session is available at this link.
*****
Upcoming Events
- ASEAN Senior Economic Officials’ Meeting 3/52 (SEOM) (2 - 4 August 2021)
- Senior Economic Officials Meetings – Dialogue Partners Consultations (5,11,16 August 2021)
- 12th ASEAN Connectivity Symposium: Promoting Recovery and Resilience through Connectivity (26 August 2021)
- 53rd ASEAN Economic Ministers’ (AEM) Meeting (9 September 2021)
- ASEAN Economic Ministers – Dialogue Partners Consultations (14 - 15 September 2021)
Click here for previous editions of the ASEAN for Business Bimonthly Bulletin
August 04, 2021
