Adoption of Data Protection and Privacy Laws REF#6293

Good data protection and privacy are essential for the economic development of society because they create a climate of trust and confidence in which businesses can thrive. When people know that their personal data is safe and secure, they are more likely to participate in the digital economy, which can lead to increased innovation, investment, and economic growth. In addition, good data protection and privacy can help to protect consumers from fraud and abuse. When people know that their personal data is safe, they are more likely to trust businesses and share their data. This can lead to better products and services for consumers.

European countries have been at the forefront of designing detailed legal frameworks and regulations that introduce and promote several aspects of data protection and privacy for citizens. Below are some of the provisions contained in the EU’s General Data Protection Regulation (GDPR) and the Council of Europe’s Convention 108+ on Personal Protection in Automated Systems. Both the GDPR and Convention 108+ are designed to protect the privacy of individuals and to ensure that their personal data is processed in a fair and transparent manner. The GDPR is a more comprehensive and stringent set of rules, while Convention 108+ is a more general framework. Both regulations cover the following aspects that could be included in a strong data protection and privacy regulation:

• Consent: Both the GDPR and Convention 108+ require that individuals give their consent before their personal data can be collected or processed;
• Purpose limitation: Personal data must be collected and processed for specific, explicit, and legitimate purposes;
• Data minimisation: Only the minimum amount of personal data necessary for the intended purpose should be collected and processed;
• Storage limitation: Personal data should not be stored for longer than is necessary for the intended purpose;
• Data security: Personal data must be protected against unauthorised access, use, disclosure, alteration, or destruction;
• Data subject rights: Individuals have the right to access their personal data, to have their personal data corrected or deleted, and to object to the processing of their personal data.

The Royal Government of Cambodia (RGC) has committed itself to enhancing the regulatory framework to protect personal data and privacy. A recently published e-commerce law contains data protection provisions, which however apply only for data exchanged in commercial electronic transactions. Data protection falls under the right to privacy, which is protected in broad terms under the Constitution of the Kingdom of Cambodia 2010, the Civil Code of Cambodia 2007, the Criminal Code of the Kingdom of Cambodia 2009, and other specific laws such as the Banking Law. To date, however, there is no comprehensive data protection framework yet in Cambodia.

The Ministry of Post and Telecommunications (MPTC) announced in early 2021 that it intended to prepare a draft personal data protection law, in line with the RGC’s vision of a digital society laid out in the Cambodia Digital Economy and Social Policy Framework 2021-2035. However, such law has not yet been published.

New technologies are a significant contributor to the national development of Cambodia. However, without a robust legal framework governing the responsible use and storage of the data generated from new technology, including by third parties, the importance of data security can be overlooked and individuals, businesses or governments are potentially exposed to serious threats and instability.

The flow of data that enables digital economies to flourish is built on trust. If this trust is broken, confidence in the entity will be harmed and others will no longer trust that their information will be safe. This is a serious concern for businesses involved in the use and management of private data, as they will quickly become uncompetitive.

Furthermore, due to the growing concerns around how data is used, some countries are restricting the flow of data to countries with lax privacy and protection laws. Similarly, the laws governing the use of data are no longer bound by jurisdictions and are now being applied extraterritorially. For example, the European GDPR applies strict obligations on any business that processes the data of European citizens, regardless of a business’s physical location.

Therefore, without an effective regulatory framework that maintains progress with comparable markets, there is a risk that the competitiveness of Cambodia’s digital sector could diminish, which would increase the difficulty of attracting investment.

The absence of a personal data protection law in Cambodia also hinders the country’s regional digital integration in ASEAN, as it stifles the development of cross-border data flows. Businesses are unsure of whether the data exchanged across borders can be secured from breaches.

In conclusion, the lack of a robust legal framework governing data protection in Cambodia poses a serious threat to the country’s digital development.