The European Commission and the Association of Southeast Asian Nations (ASEAN) have published a first-of-its-kind guide[1] that identifies the similarities and differences between the ASEAN model contractual clauses (ASEAN MCCs) and the EU standard contractual clauses (EU SCCs).

A second guide will be issued in due course, which will provide best practices for meeting both sets of contractual clauses.

The objective of these guides is to:

• Help companies that export or import data across the ASEAN and EU regions understand the similarities and differences between the respective contractual clauses

• Aid these companies in meeting the respective requirements of the contractual clauses

• Facilitate overall compliance with ASEAN and EU data protection laws as may be applicable

As noted by Didier Reynders, the European Commissioner for Justice,[2] model clauses are a “ready-made, cost-effective solution” that are especially useful for small and medium enterprises (SMEs), and “currently by far the most used instrument for international data transfers” in the EU.

In the first comparative guide, issued on 24 May 2023, specific commonalities and distinctions between the contractual clauses were identified, based on the following areas:

1. Entering into the ASEAN MCCs or EU SCCs:

   1. Choosing appropriate modules to be adopted

   2. Execution and completion formalities

   3. How other contractual commitments between the parties are dealt with

   4. Any changes to the contracting parties

2. Interpretation of the clauses, and their governing law

3. Data protection safeguards:

   1. Lawfulness of the transfer

   2. Specifying the purpose of the transfer

   3. Data accuracy

   4. Data minimisation

   5. Storage limitation

   6. Security and confidentiality

   7. Sensitive personal data

   8. Onward transfers

4. Data subject rights, including third-party beneficiary rights

5. Accountability by the contracting parties

6. Supervisory authority

7. Government access

8. Termination and survival clauses

9. Dispute resolution

The guide provides the above comparisons for (i) controller-to-controller transfers and (ii) controller-to-processor transfers, to reflect where both sets of contractual clauses are structurally congruent.

Takeaways

MCCs are certainly continuing to gain significant traction globally.

Our team has prepared a detailed side-by-side comparison of the ASEAN MCCs and EU SCCs, together with China’s Standard Contract for Cross-Border Transfers of Personal Information,[3] as well as discussing the Latin American Data Protection Board SCCs and the Council of Europe’s SCCs that are being worked on. We expect to publish this article soon, so do subscribe to keep updated.

[1] https://asean.org/wp-content/uploads/2023/05/The-Joint-Guide-to-ASEAN-Model-Contractual-Clauses-and-EU-Standard-Contractual-Clauses.pdf.

[2] See Foreword to the guide, at paragraph 2.

[3] http://www.cac.gov.cn/2022-06/30/c_1658205969531631.htm