Guidance for the Use of the ASEAN Model Contract Clauses and ASEAN Data Management Framework (Advisory No. 2021-02)

Issuance Text

NPC Advisory No. 2021 - 02

DATE: 28 June 2021

SUBJECT: GUIDANCE FOR THE USE OF THE ASEAN MODEL CONTRACT CLAUSES AND ASEAN DATA MANAGEMENT FRAMEWORK

WHEREAS, Republic Act No. 10173, also known as the Data Privacy Act of 2012, provides that it is the policy of the State to protect the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth. The State also recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected;¹

WHEREAS, the National Privacy Commission has the mandate to ensure proper and effective coordination with data privacy regulators in other countries and private accountability agents, and participate in international and regional initiatives for data privacy protection, such as the Association of Southeast Nations (ASEAN);²

WHEREAS, the ASEAN Digital Ministers (ADGMIN), with a view to enable harmonized standards for data management and cross border data flows within ASEAN and to enable responsible, data-driven innovation necessary to the development of the digital economy, approved the ASEAN Model Contractual Clauses and ASEAN Data Management Framework as part of the ASEAN Framework on Digital Data Governance;

WHEREAS, as an ASEAN Member State,³ the Philippines, through the National Privacy Commission, recognizes the value of these initiatives to data privacy protection and trustworthy cross-border data flows and thus, promotes the adoption and use in its domestic legal framework;

WHEREFORE, in consideration of these premises, the National Privacy Commission hereby issues this advisory on the use of the ASEAN Model Contract Clauses and ASEAN Data Management Framework.

SECTION 1. Scope. This Advisory applies to all natural or juridical persons engaged in the processing of personal data, subject to the applicable provisions of the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and issuances by the National Privacy Commission (NPC).

SECTION 2. Rationale. This Advisory aims to provide additional guidance to supplement the ASEAN Model Contractual Clauses and ASEAN Data Management Framework as to how PICs and PIPs in the Philippines may use these in their respective personal data processing.

SECTION 3. Voluntary in nature. The ASEAN MCCs and ASEAN DMF are developed for voluntary adoption and do not create additional rights or obligations under domestic or international law. The NPC does not require or obligate parties, entities, or organizations to adopt these and will not accept any request for contract review to verify conformity with the ASEAN MCCs.

SECTION 4. Definition of Terms. Whenever used in this Advisory, the following terms shall have their respective meanings as hereinafter set forth:

• A. “Act” or “DPA” refers to Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012;

• B. “Data Management System” refers to a system which is concerned with the organization and control of data;⁴

• C. “Data Governance” refers to development and enforcement of policies related to the management of data;⁵

• D. “Personal data” refers to personal information and sensitive personal information;

• E. “Personal information controller” or “PIP” refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. The term excludes:

  • (1) A person or organization who performs such functions as instructed by another person or organization; and

  • (2) An individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs.

  There is control if the natural or juridical person or any other body decides on what information is collected, or the purpose or extent of its processing;⁶

• F. “Personal information processor” or “PIP” refers to any natural or juridical person or any other body to whom a PIC may outsource or instruct the processing of personal data pertaining to a data subject;⁷ and

• G. “Processing” refers to any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data;⁸

SECTION 5. ASEAN Model Contract Clauses (MCCs) and ASEAN Data Management Framework (DMF). The ASEAN MCCs and ASEAN DMF are vital resources and tools for ASEAN businesses to use in their data-related business operations and help build trust, transparency, and accountability.⁹

• A. The ASEAN MCCs are contractual terms and conditions that may be included in the binding legal agreements between parties or entities transferring personal information and/or sensitive personal information (collectively, personal data) across different jurisdictions. These are templates setting out the responsibilities, required personal data protection measures, and related obligations of the parties based on the ASEAN Framework on Personal Data Protection (2016).

  1. The ASEAN MCCs are voluntary standards designed to provide guidance on baseline considerations for transferring personal data. Contracting Parties, which include PICs and PIPs, in ASEAN Member States (AMS) may voluntarily adopt the MCCs in the transfer of personal data to other parties in other AMS.
  2. ASEAN MCCs may also be used by companies or organizations to fulfill its obligations under Section 21 of the DPA as one of the contractual or other reasonable means to provide a comparable level of protection while personal data are being processed by a third party.
  3. Parties may, by written agreement, adopt or modify the ASEAN MCCs in accordance with the principles set forth in the ASEAN Framework on Personal Data Protection (2016) or as required by the DPA, its IRR and other relevant issuances of the NPC.
  4. Parties are not precluded from negotiating the terms or adding clauses as appropriate for their commercial or business arrangements so long as they do not contradict the ASEAN MCCs.

• B. The ASEAN DMF is a guide for businesses to put in place a data management system, which includes data governance structures and safeguards based on data sets’ purpose throughout its lifecycle. The DMF can be used for the purpose of helping ASEAN businesses improve their data management and compliance with data protection requirements.

  1. The ASEAN DMF has six (6) foundational components:
     • a) Governance and oversight
     • b) Policies and procedural documents
     • c) Data inventory
     • d) Impact / Risk assessment
     • e) Controls
     • f) Monitoring and continuous improvement
  2. These foundational components, consistent with globally recognized personal data protection and privacy management programs, aim to enable the organization to define, manage, and monitor its data management processes.
  3. The ASEAN DMF is based on best practices in the area of data management for businesses within AMS and is intended for voluntary adoption by organizations.
  4. The DMF may be used as reference for Privacy Management Programs. Organizations may adopt it to varying business needs in their own systems of managing data. It may serve as basis for sound data governance practices by helping organizations to organize datasets they have, assign it within the appropriate categories, manage their data, and protect it accordingly in compliance with relevant regulations.

• C. Annex A provides for Frequently Asked Questions on the ASEAN MCCs and DMF.

SECTION 6. Effect. The ASEAN MCCs and ASEAN DMF do not amend the DPA, its IRR, and other related issuances of the NPC, and shall neither preclude, limit, nor constrain NPC’s exercise of its regulatory rights, powers, and discretion.

SECTION 7. Interpretation. Any doubt in the interpretation of any provision of this Advisory shall be liberally interpreted in a manner mindful of the rights and interests of the data subjects.

Approved:

(sgd.)
RAYMUND E. LIBORO
Privacy Commissioner

(sgd.)
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

(sgd.)
JOHN HENRY D. NAGA
Deputy Privacy Commissioner

ANNEX A

FAQs on the ASEAN MCCs and DMF

Background

On 21 and 22 January 2021, 1st ASEAN Digital Ministers’ Meeting (ADGMIN) has approved the ASEAN Data Management Framework (ASEAN DMF) and Model Contractual Clauses (ASEAN MCCs) for Cross Border Data Flows.

These initiatives under the ASEAN Framework on Digital Data Governance build on the principles of the ASEAN Framework on Personal Data Protection to harmonize data management and cross border data flows standards in the ASEAN region, raise the digital competitiveness of ASEAN Member States by building a trusted, transparent, and accountable environment for doing business, and build ASEAN’s readiness to take up new digital opportunities. The adoption of these frameworks are key developments to enable responsible, data-driven innovation necessary to the development of the digital economy.

The ASEAN DMF and ASEAN MCCs are vital resources and tools for ASEAN businesses to utilize in their data-related business operations and help build trust, transparency and accountability with partners and customers. It gives assurance to the customers and public in general that personal data held by businesses in the ASEAN digital economies are safe and protected.

ASEAN Member States (AMS) with Data Protection Authorities are then encouraged to help organizations implement these through public awareness, capacity building activities and guidelines, and are expected to promote their use, especially among Micro, Small and Medium Enterprises (MSMEs).

The ASEAN MCCs can be accessed at https://asean.org/storage/3-ASEAN-Model-Contractual-Clauses-for-Cross-Border-Data-Flows_Final.pdf and the ASEAN DMF document at https://asean.org/storage/2-ASEAN-Data-Management-Framework_Final.pdf

ASEAN Model Contract Clauses (ASEAN MCCs)

1. What are the ASEAN Model Contract Clauses (ASEAN MCCs)?

   The ASEAN MCCs are contractual terms and conditions that may be included in the binding legal agreements between parties transferring personal information and/or sensitive personal information (collectively, personal data) across different jurisdictions.

   These are templates setting out the responsibilities, required personal data protection measures, and related obligations of the parties based on the ASEAN Framework on Personal Data Protection (2016).

2. Is the use of the ASEAN MCCs mandatory?

   The ASEAN MCCs are a voluntary standard designed to provide guidance on baseline considerations for transferring personal data. PICs and PIPs in ASEAN Member States (AMS) may voluntarily adopt the MCCs in the transfer of personal data to other parties in other AMS.

   Ultimately, companies have the flexibility to choose the privacy-respecting data transfer mechanism most appropriate for their own operations.

3. Are the provisions under the ASEAN MCCs fixed/required?

   Unless otherwise marked as Optional, clauses must be included as part of a contract between parties. Clauses which are marked Optional can be included if relevant to or useful for the purposes of the commercial transaction. For clauses marked out with Choose the relevant clause, parties may choose the clause that is most relevant to the domestic laws in which parties reside or fill in the appropriate requirements under domestic laws.

4. What are the obligations under the ASEAN MCCs?

   The obligations under the ASEAN MCCs are derived from the fundamental principles of data protection under the ASEAN Framework on Personal Data Protection (2016), including:

   • Lawful/Legal Basis for Collection, Use and Disclosure
   • Baseline Data Protection Clauses relating to Collection, Notification, Purpose, Accuracy, Security Safeguards, Access and Correction, Transfers, Retention, and Accountability
   • Data Breach Notification

5. Is it possible to add provisions, responsibilities, or obligations?

   Parties may, by written agreement, adopt or modify the MCCs in accordance with the principles set forth in the ASEAN Framework on Personal Data Protection (2016) or as required by applicable domestic laws. Parties are not precluded from negotiating the terms or adding clauses as appropriate for their commercial or business arrangements so long as they do not contradict the MCCs.

6. What are the transfer relationships covered by the ASEAN MCCs?

   The MCCs cover two common transfer scenarios: (1) Controller-to-Processor Transfer and (2) Controller-to-Controller Transfer.

7. What are the benefits of the ASEAN MCCs to our organization?

   Implementing the MCCs and their underlying obligations helps parties ensure that the transfer of personal data is done in a manner that complies with the ASEAN Member States’ (AMS) legal and regulatory requirements, protects personal data of Data Subjects based on the principles of the ASEAN Framework on Personal Data Protection (2016), and promotes trust among citizens in the ASEAN digital ecosystem.

   To the extent possible and relevant to the ASEAN context, clauses are aligned with global best practices to ensure accountability and the security of personal data, when data is transferred between companies or organizations.

8. How do we apply the ASEAN MCCs in our organization?

   Though primarily designed for intra-ASEAN flow of personal data, parties may also adopt these clauses with appropriate modifications at their discretion for transfers between organizations intra-country in AMS, or transfers to non-AMS, particularly those with legal regimes based upon the principles of the APEC Privacy Framework or OECD Privacy Guidelines, from which the principles in the ASEAN Framework on Personal Data Protection (2016) are derived.

9. Are the ASEAN MCCs enforceable?

   The MCCs, when incorporated in a contract between parties, become legally enforceable as agreed upon. There are also clauses as to the applicable law, should there be disputes between the parties.

10. Will the adoption of ASEAN MCCs amend the DPA, its IRR and related issuances?

    The ASEAN MCCs do not amend the DPA, its IRR, and other related issuances of the National Privacy Commission (NPC). Rather, it may be used by companies to fulfill their obligations under Section 21 of the DPA as one of the contractual or other reasonable means to provide a comparable level of protection while personal data are being processed by a third party. Likewise, nothing in the MCCs shall preclude, limit, or constrain NPC’s exercise of its regulatory rights, powers, and discretion.

ASEAN Data Management Framework (ASEAN DMF)

1. What is the ASEAN Data Management Framework (ASEAN DMF)?

   The ASEAN DMF is a guide for businesses, particularly Small and Medium Enterprises (SMEs), to put in place a data management system, which includes data governance structures and safeguards based on the data sets’ purpose throughout its lifecycle.

2. Is the ASEAN DMF mandatory?

   The ASEAN DMF was developed for voluntary adoption by organizations. The NPC does not require mandatory adherence to its components.

3. What are the benefits of the ASEAN DMF to our organization?

   The DMF will help raise the knowledge and competence of ASEAN businesses in managing data and will assist them in complying with personal data protection requirements while enabling them to use the data for business growth.

   It is aimed at helping businesses operating in the ASEAN to practice data governance across all data types throughout the data lifecycle and consider adequate protection for different types of data. With a DMF in place, organizations would be better equipped to protect data and instill trust and confidence in their customers and the organizations they interact with, while the data is being leveraged for business innovation purposes.

4. What are the components of the ASEAN DMF?

   The ASEAN DMF has six foundational components consistent with globally recognized personal data protection and privacy management programs. These foundational components aim to enable the organization to define, manage, and monitor its data management processes.

   • Governance and oversight
   • Policies and procedural documents
   • Data inventory
   • Impact / Risk assessment
   • Controls
   • Monitoring and continuous improvement

5. How do we use the DMF in our organization?

   The DMF is intended to be adopted for varying business needs and for tailoring by the businesses to their own systems of managing data. Organizations may use the DMF as basis for sound data governance practices by helping organizations to organize the datasets they have, assign it with the appropriate categories, manage their data, and protect it accordingly in compliance with relevant regulations.

6. Will the adoption of ASEAN DMF amend the DPA, its IRR and related issuances?

   The adoption of the DMF does not require additions or amendments to existing domestic laws and regulations. They do not create additional rights or obligations under the domestic or international law of AMS.

7. Will the NPC consider compliance with the ASEAN DMF as compliance with the DPA, its IRR and related issuances?

   The DMF provides organizations with practical guidance to enable them to build their own policies and procedures using a risk-based data management methodology. The DMF is designed to provide voluntary and non-binding guidance based on best practices in the area of data management for businesses within AMS. The content should not be read as legal advice, nor construed as a tool for compliance to any law or regulation.

Official PDF

OCR used during extraction: no

Footnotes

1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012), § 2. ↩

2. Id., § 7(n). ↩

3. ASEAN Member States include Brunei Darussalam, Cambodia, Indonesia, Lao PDR, Malaysia, Myanmar, Philippines, Singapore, Thailand, and Viet Nam ↩

4. ISO, ISO/IEC TR 10032:2003(en) Information technology — Reference Model of Data Management, available at https://www.iso.org/obp/ui/#iso:std:iso-iec:38505:-1:ed-1:v1:en (last accessed April 15, 2021). ↩

5. ISO, ISO 8000-2:2020(en) Data quality — Part 2: Vocabulary, available at https://www.iso.org/obp/ui/#iso:std:iso:8000:-2:ed-4:v1:en:term:3.16.1 (last accessed April 15, 2021). ↩

6. Data Privacy Act of 2012, § 3 (m). ↩

7. Data Privacy Act of 2012, § 3 (n). ↩

8. Id. § 3(o). ↩

9. The ASEAN MCCs can be accessed at https://asean.org/storage/3-ASEAN-Model-Contractual-Clauses-for-Cross-Border-Data-Flows_Final.pdf and the ASEAN DMF document at https://asean.org/storage/2-ASEAN-Data-Management-Framework_Final.pdf ↩