ASEAN DMF And MCCs: Expectations For National Implementation ' Cambodia

• Published date: 22 March 2021
• Subject Matter: Media, Telecoms, IT, Entertainment, Privacy, Technology, Mobile & Cable Communications, Privacy Protection, Security
• Law Firm: Tilleke & Gibbins
• Author: Mr Jay Cohen and Sochanmalisphoung Vannavuth

Since Cambodia does not have any dedicated laws on data protection, there are no regulatory or enforcement authorities that are specifically tasked with handling, overseeing, or implementing personal data protection matters. Consequently, the following governmental bodies may have substantial powers in this realm: the Ministry of Commerce, the Ministry of Post and Telecommunications, and the Ministry of Interior.

After reviewing the DMF [Data Management Framework adopted by ASEAN] and MCCs [Model Contractual Clauses for Cross-Border Data Flows], we are of the view that these standards broadly align with concepts of data protection that exist under Cambodian laws that implicate data protection issues. Therefore, Cambodian authorities may react positively to the guidelines provided under the DMF and MCCs.

However, implementing these guidelines can be challenging for a developing country such as Cambodia due to the following reasons:

• inadequate data protection and cybercrime regulations;
• lack of technological advancement in information and communication technology;
• lack of technology experts who can effectively deal with advanced computer crimes;
• the high cost of digital data governance; and
• the fact that it may be time-consuming to put these guidelines into place.

Positive and negative implications

Furthermore, we anticipate that the guidelines would provide both positive and negative impacts on businesses. In terms of positive impact, the DMF and MCCs will likely:

• increase the cybersecurity of all companies doing business in Cambodia;
• enable businesses to have better data processes and protection and more secure internal data...