NPC Issuance Wiki

Model Contractual Clauses for Cross-Border Transfers of Personal Data (Advisory No. 2024-01)

Issued Advisory

Issuance Text

NPC Advisory No. 2024 - 01

DATE: 30 May 2024

SUBJECT: MODEL CONTRACTUAL CLAUSES FOR CROSS-BORDER TRANSFERS OF PERSONAL DATA

WHEREAS, Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), provides that it is the policy of the State to protect the fundamental human right of privacy of communication while ensuring the free flow of information to promote innovation and growth. The State also recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected;

WHEREAS, the National Privacy Commission (NPC) is mandated to ensure proper and effective coordination with data privacy regulators in other countries and participate in international and regional initiatives for privacy and data privacy protection, such as the Global Privacy Assembly (GPA);

WHEREAS, the NPC is a member of the GPA Global Frameworks and Standards Working Group (GFSWG) that is tasked to advance the GPA’s work towards supporting secure cross-border flows of personal data across jurisdictions;

WHEREAS, the GPA GFSWG published a detailed comparison of model contractual clauses from different jurisdictions and regional organizations, including the Association of Southeast Asian Nations, Council of Europe, European Union, Ibero-American Network, Argentina, New Zealand, and the United Kingdom;

WHEREAS, the NPC previously issued Advisory No. 2021-02 or Guidance for the Use of the Association of Southeast Asian Nations (ASEAN) Model Contract Clauses and ASEAN Data Management Framework;

WHEREAS, the ASEAN and European Commission published a comparative guide to model contractual clauses of the ASEAN and European Commission to facilitate cross-border transfers of personal data from the ASEAN to the European Union (EU), from EU to ASEAN or between EU and ASEAN, and within ASEAN;

WHEREAS, the NPC acknowledges the importance of these initiatives as the use of model contractual clauses is one of the more widely used mechanisms for cross-border transfers of personal data;

WHEREAS, the DPA is not a barrier to cross-border transfers of personal data;

WHEREFORE, in consideration of these premises, the NPC hereby issues this Advisory on the availability of model contractual clauses for cross-border transfers of personal data.

SECTION 1. Purpose. This Advisory provides guidance to personal information controllers (PICs) and personal information processors (PIPs) on the availability of the various model contractual clauses for transfers of personal data across jurisdictions.

SECTION 2. Definition of Terms. The terms used in the DPA and its Implementing Rules and Regulations (IRR), and other NPC issuances, as amended, are adopted herein.

SECTION 3. Model Contractual Clauses (MCCs). MCCs are terms and conditions that PICs and PIPs may include in binding legal agreements that govern cross-border transfers of personal data. MCCs do not preclude PICs and PIPs from further negotiating legal agreements.

  • A. The GPA GFSWG published the Comparative Tables of Contractual Clauses document (Document).

    1. The Document provides an overview of select MCCs and serves as a comparative guide for PICs and PIPs on these MCCs for cross-border transfers of personal data.

    2. The Document provides a comparative analysis of the following MCCs for cross-border transfers of personal data:

      • i. Model Contractual Clauses of the Association of Southeast Asian Nations (ASEAN MCCs);
      • ii. Standard Contractual Clauses of the Council of Europe (CoE SCCs);
      • iii. Standard Contractual Clauses of the European Commission (EU SCCs);
      • iv. Model Contractual Clauses of the Ibero-American Data Protection Network (RIPD MCCs);
      • v. Model Contract of International Data Transfer of the Agency for the Access to Public Information of Argentina (AR Clauses);
      • vi. Model Contractual Clauses of the Office of the Privacy Commissioner of New Zealand (NZ MCCs); and
      • vii. International Data Transfer Agreements of the Information Commissioner’s Office in the United Kingdom (UK IDTA).

    3. The Document, which is composed of two parts, is available on the GPA website through the following links:

      • i. Contractual Clauses for transfers from Controllers to Controllers;1 and
      • ii. Contractual Clauses for transfers from Controllers to Processors.2

  • B. The ASEAN and the European Commission published a Joint Guide to ASEAN MCCs and EU SCCs (Joint Guide).

    1. The Joint Guide provides an overview and comparative analysis of the ASEAN MCCs and EU MCCs and best practices to operationalize safeguards under these MCCs for cross-border transfers of personal data from ASEAN to EU, from EU to ASEAN or between EU and ASEAN, and within ASEAN.

    2. The Document is available on the ASEAN website through the following link:

      • i. Joint Guide to ASEAN MCCs and EU SCCs.3

SECTION 6. Voluntary adoption. This guidance is intended for voluntary adoption and does not impose any additional rights or obligations.

  • A. The NPC does not require contractual parties to adopt the use of MCCs. It remains the PIC and PIP’s obligation to refer to the MCCs and determine for themselves whether applicable laws may impose additional obligations on the parties. Nevertheless, the use of MCCs may aid PICs in upholding the accountability principle in cross-border transfers of personal data.

  • B. The NPC will not accept any requests for review of agreements or contracts to determine conformity with any model contractual clauses.

SECTION 7. Effects. The Advisory does not amend the DPA, its IRR, and other relevant issuances of the NPC, and shall neither preclude, limit, nor constrain the NPC’s exercise of its mandate.

SECTION 8. Interpretation. Any doubt in the interpretation of any provision of this Advisory shall be liberally interpreted in a manner mindful of the rights and interests of the data subjects.

Approved:

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner

Footnotes

  1. Global Privacy Assembly, Working Group Reports, Global Frameworks and Standards WG Report GFSWG 2023- Annex B, available at https://globalprivacyassembly.org/wp-content/uploads/2023/10/1.1-GPA-Annual-Working-Group-Report-Annex-B-Controller-to-Controller-clause-comparison-tables-tracked-changes.pdf (last accessed: 18 December 2023). ↩

  2. Global Privacy Assembly, Working Group Reports, Global Frameworks and Standards WG Report GFSWG 2023- Annex C, available at https://globalprivacyassembly.org/wp-content/uploads/2023/10/1.2-GPA-Annual-Working-Group-Report-Annex-C-Controller-to-Processor-clause-comparison-tables-tracked-changes.pdf (last accessed: 18 December 2023). ↩

  3. Association of Southeast Asian Nations and European Commission, Joint Guide to ASEAN MCCs and EU MCCs, available at https://asean.org/wp-content/uploads/2024/02/Joint-Guide-to-ASEAN-Model-Contractual-Clauses-and-EU-Standard-Contractual-Clauses.pdf (last accessed: 07 February 2024). ↩

Backlinks