ASEAN Model Contractual Clauses : Low and Ambiguous Data Privacy Standards

The Association of Southeast Asian Nations (ASEAN) Model Contractual Clauses (‘ASEAN MCCs’) are contractual terms and conditions that may be voluntarily included by companies in binding legal agreements for the cross-border transfer of personal data. The ASEAN Digital Ministers endorsed them in January 2021. This paper examines ASEAN’s MCCs including how they differ from the EU’s Standard Contractual Clauses (SCCs). Issues covered include whether the MCCs have any legal basis, either in international agreements or national laws in ASEAN member states. Their usefulness to SMEs as a low-cost basis for data exports is questioned. The MCCs are identified as part of the ‘low quality’ group of international data privacy standards that includes the OECD Guidelines, APEC Privacy Framework, and ASEAN Framework. However, they require two standards applying to data exporters in addition to the ASEAN Framework, so are not completely consistent with it. These raise some complex requirements. There are some extra obligations on data importers as well. However, there is no basis on which data subjects can enforce these clauses across ASEAN. Legislative endorsement of the MCCs could put at risk a country’s position in relation to ‘GDPR adequacy’.Despite all these issues, the ASEAN MCCs are likely to be a useful tool for transfers of data between countries which have a low level of statutory data privacy provisions