Privacy Policies

UNIVERSITY OF THE PHILIPPINES DILIMAN

PRIVACY POLICY

To advance its commitment to protect and uphold the privacy of personal information, the University of the Philippines Diliman (“UP Diliman”) hereby establishes a framework for processing personal information through this UP Diliman Privacy Policy.

This Policy is complementary with the UP Diliman Data Subject Rights and Responsibilities.

I. Who are covered by this Policy?

This Policy governs refers to students, parents, guardians, faculty, visiting faculty, staff, Research, Extension and Professional Staff (REPS), UP contractual personnel, Non-UP contractual personnel, retirees, applicant students, applicant faculty, applicant staff, researchers, research subjects, patients, clients, customers, alumni, donors, donees, contract counterparties, partners, subcontractors, outsourcees, licensors, licensees and other persons with a juridical link with UP Diliman (“UP People”) whose personal information, sensitive personal information or privileged information (“Personal Data”) are processed by UP Diliman.

II. Why are Personal Data processed?

UP Diliman processes Personal Data to –

(1) Perform its obligations, exercise its rights, and conduct its associated functions as:

1. an instrumentality of the government;
2. a higher education institution.

(2) Pursue its purposes and mandates:

1. under Act No. 1870 as “a university for the Philippine Islands”;
2. under Republic Act 9500 as “the national university”.

(3) For each particular unit of UP Diliman, conduct all acts reasonably foreseeable from and customarily performed by similar bodies;

(4) Decide and act for the holistic welfare of its students, their parents and guardians, faculty, staff, researchers, alumni, and UP Diliman community; and

(5) Manage and administer its internal and external affairs as an academic institution, as an instrumentality of the government, and as a juridical entity with its own rights and interests.

III. What Personal Data are processed?

• UP Diliman processes Personal Data including but not limited to:
• Personal details such as name, birth, gender, civil status and affiliations;
• Contact information such as address, email, mobile and telephone numbers;
• Academic information such as grades, course and academic standing;
• Employment information such as government-issued numbers, position and functions;
• Applicant information such as academic background and previous employments;
• Medical information such as physical, psychiatric and psychological information.

UP Diliman processes other Personal Data necessary for the following purposes (the “Purposes”):

(1) Purposes applicable to all classes of UP People

(1) Purposes necessary for UP Diliman to perform its obligations, exercise its rights, and conduct its associated functions as an instrumentality of the government and as a higher education institution;

(2) Purposes to pursue UP Diliman’s mandates under existing laws and regulations;

(3) Purposes to perform acts and decisions necessary for UP Diliman to manage and administer its internal and external affairs as a juridical entity with its own rights and interests;

(4) Compliance with legal, regulatory, administrative or judicial requirements including audit, reporting and transparency requirements;

(5) Records and account purposes such as:

(a) Creation and update of record entries and accounts;

(b) Creation and maintenance of student, faculty or staff records and accounts, electronic or otherwise;

(6) Security and community affairs purposes

(a) Maintenance of safety, security, peace and order in and around UP Diliman campuses as well as venues which UP Diliman has presence or activities;

(b) Prevention of crimes and damages to persons or property within or outside the premises of UP Diliman.

(2) Students, parents and guardians

(1) Academic purposes such as:

a. Processing of raw or final grades, including evaluation and use of grades to make and act on decisions about students;

b. Formulation, study of, and implementation of UP Diliman’s policies, guidelines, procedures, processes, rules and regulations;

(2) Extra-curricular purposes such as:

(a) Regulation of student organizations and bodies;

(b) Collaborations with public and private agencies and institutions;

(3) Medical purposes such as:

(a) Rendering of medical, dental, psychiatric and psychological aid, whether in emergency situations or otherwise;

(b) Keeping of health records and medical histories to understand patient context and tendencies;

(4) Student assistance purposes such as:

(a) Provision of legal, scholarship, financial, athletic, dormitory assistance;

(b) Provision of tutorial, mentorship or internship assistance;

(5) Student disciplinary purposes such as:

(a) Conducting investigations, hearing of cases or evaluating matters related to UP Diliman policies, guidelines and rules;

(b) Implementation of laws or orders of government authorities.

(3) Faculty, including visiting faculty

(1) Administration, management and supervision of faculty as UP Diliman employees (see Purposes for Staff);

(2) Administration, management and supervision of faculty in academic and non- academic functions such as:

(a) Assignment of teaching load and functions, evaluation of performance, and promotion or transfer;

(b) Research, ethics and intellectual property matters.

(4) Staff, including Research, Extension and Professional Staff (REPS), UP contractual, Non-UP contractual personnel and retirees

(1) Administration of human resources such as:

(a) Processing and provision of employee rights;

(b) Provision of compensation and benefits;

(2) Management and supervision of employees and work conduct such as:

(a) Employee administration, assignment, work supervision, evaluation, promotion, discipline, and transfer;

(b) Preservation of labor relations and industrial peace.

(5) Applicant students, faculty and staff

(1) Application purposes such as:

(a) Processing of application and application requirements;

(b) Evaluation of eligibility to enroll, teach or work in the University of the Philippines;

(2) Verification purposes such as:

(a) Determination of veracity of claims;

(b) Background investigation relevant to the position applied for.

(6) Researchers and research subjects

The Data Privacy Act is not applicable if the processed personal information are used only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject: Provided, That the personal information shall be held under strict confidentiality and shall be used only for the declared purpose.

As such, this Policy’s Section VI on “What are the rights of UP People?” is not be applicable if the processed personal data are used only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject. However, this inapplicability shall only be to the minimum extent necessary to achieve the purpose of said research or investigation.

The Data Privacy Act and it’s Implementing Rules and Regulations shall not apply to specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned when personal information will be processed for research purpose, intended for a public benefit, subject to the requirements of applicable laws, regulations, or ethical standards adopted by UP Diliman.

(7) Patients, clients and customers

(1) Processing of medical, physical, psychiatric and psychological information of patients is necessary for the purpose of medical treatment: Provided, that it is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal data is ensured;

(2) Processing of Personal Data of clients and customers compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy wherein there is transparency in obtaining consent and proportionality in processing data.

(8) Alumni, donors and donees

(1) Alumni linkage purposes such as:

(a) Upkeep of alumni database for alumni linkage and job placement;

(b) Knowing career paths and performance of alumni.

(2) Donation processing such as:

(a) Legal requirements such as filing of tax returns and anti-money laundering requirements;

(b) Recording sources and uses of donations for transparency in the University’s funds.

(9) Contract counterparties, partners, subcontractors, outsourcees, licensors, licensees, lessors, lessees, vendors, purchasers and customers

(1) Timely realization of UP Diliman’s legitimate rights, interests, obligations and responsibilities in law, contract, equity or public policy;

(2) Compliance with the spirit and intent of UP Diliman in engaging the counterparty involved.

(10) Other persons with a juridical link with UP Diliman

(1) Any of the purposes above as applicable to the circumstances;

(2) For each particular UP Diliman unit, the purposes used by analogous bodies performing similar functions.

IV. How does UP Diliman process Personal Data and how long are Personal Data retained?

UP Diliman processes and retains Personal Data as necessary for the Purposes in accordance with:

(1) The Data Privacy Act of 2012, its Implementing Rules, and relevant issuances of the National Privacy Commission;

(2) The National Archives of the Philippines Act of 2007 its Implementing Rules, and relevant issuances of the National Archives of the Philippines;

(3) Policies, guidelines, and rules of the UP System and UP Diliman;

(4) Research guidelines and ethical codes of conduct adopted by the University of the Philippines Diliman; and

(5) Executive Order No. 2, series of 2016 on Freedom of Information and subsequent related executive orders.

In the absence of an applicable rule of retention, Personal Data shall be retained by a UP Diliman unit in accordance with the practices of government bodies with analogous functions.

V. Where are Personal Data stored and how are these transmitted?

Personal Data are stored in physical and electronic “Data Processing Systems” of UP Diliman as defined under National Privacy Commission Circular No. 17-01. Personal Data are transmitted in accordance with Chapter III of the Data Privacy Act of 2012 and Rule V of its Implementing Rules and Regulations.

VI. What are the rights of UP People?

Under the UP Diliman Data Subject Rights and Responsibilities, UP People have the following rights:

(1) Right to be informed;

(2) Right to object subject to UP Diliman’s possible consequent failure to conduct academic, administrative and other functions or services;

(3) Right to access;

(4) Right to rectification;

(5) Right to erasure or blocking of Personal Data which are not part of UP Diliman’s public records as an instrumentality of the government or as the national university; and

(6) Right to damages which is subordinate to the non-liability of UP Diliman arising from the incidental damages due to UP Diliman’s pursuance of its mandates or compliance with its legal obligations.

VII. What are the responsibilities of UP People?

Under the UP Diliman Data Subject Rights and Responsibilities, UP People have the following responsibilities:

(1) Respect the data privacy rights of others;

(2) Report any suspected Security Incident or Personal Data Breach to UP Diliman through the contact information in this Policy’s Section on “The UP Diliman Data Protection Officer”;

(3) Provide the University of the Philippines (“UP”) true and accurate Personal Data and other information. Before submitting Personal Data of other people to UP, obtain the consent of such people;

(4) Not disclose to any unauthorized party any non-public confidential, sensitive or personal information obtained or learned in confidence from UP; and

(5) Abide by the policies, guidelines and rules of the UP System and UP Diliman on data privacy, information security, records management, research and ethical conduct. From time-to-time check for and comply with updates on these policies, guidelines and rules. UP Diliman’s policies on data privacy are at https://privacy.upd.edu.ph. For students, the UP System’s UP Privacy Notice for Students can be found here.

VIII. Efffectivity of this Policy

The UP Diliman Data Protection Officer may promulgate policies, guidelines and rules which are not inconsistent with this Policy.

If any law or regulation cited in this Policy is amended or superseded, then it shall be considered that this Policy is referring to such amending or superseding law or regulation, without prejudice to a person’s right against retroactive effect of laws.

If any part of this Policy is declared null and void, then the other unaffected parts shall remain in full force and effect.

IX. Definition of terms

“Personal Data” refers to all types of personal information, sensitive personal information and privileged information under the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

“Personal Information” refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

“Sensitive Personal Information” refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or cm-rent health records, licenses or its denials, suspension or revocation, and tax returns; and

(4) Specifically established by an executive order or an act of Congress to be kept classified.

“Privileged information” refers to any and all forms of data which under the Rules of Court and other pertinent laws constitute privileged communication.

“Processing” in any of its verb tense refers to the collecting, recording, organizing, storing, retaining, using, analyzing, copying, transmitting, porting, sharing, exhibiting, deleting, or destroying of Personal Data regarding UP People.

“Security incident” is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach, if not for safeguards that have been put in place

“Personal Data Breach” refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of:

1. An availability breach resulting from loss, accidental or unlawful destruction of personal data;
2. Integrity breach resulting from alteration of personal data; and/or
3. A confidentiality breach resulting from the unauthorized disclosure of or access to personal data.

“Purposes” are the purposes of UP Diliman in processing Personal Data of UP People outlined in this Policy’s Section II on “What Personal Data are processed?”

“UP People” refers to students, parents, guardians, faculty, visiting faculty, staff, Research, Extension and Professional Staff (REPS), UP contractual personnel, Non-UP contractual personnel, retirees, applicant students, applicant faculty, applicant staff, researchers, research subjects, patients, clients, customers, alumni, donors, donees, contract counterparties, partners, subcontractors, outsourcees, licensors, licensees and other persons with a juridical link with UP Diliman.

“University of the Philippines Diliman” means the Diliman Constituent University of the University of the Philippines (“UP”), a university system entity established by Act No. 1870 and strengthened by Republic Act No. 9500. As UP is a single juridical entity and instrumentality of the government, all transmission and flow of information within the UP System, its constituent universities, and their respective units are neither sharing nor disclosure of information to third parties.

Any new or revised definition of any of the above terms under relevant laws shall accordingly supersede the definitions herein.

X. The UP Diliman Data Protection Officer

The UP Diliman Data Protection Officer, reporting to the UP Diliman Chancellor, is tasked to protect the privacy of personal information to, in, and from UP Diliman with the following functions:

1. Comply with data privacy laws and regulations including implementing data protection measures, submitting regulatory requirements, and managing privacy incidents.
2. Provide units of the University support services including formulating policies, training people, and conducting audits with remediation solutions.
3. Prevent legal, financial, and operational risks by improving current and future forms, contracts, processes, and I.T. systems to secure against leakage of information.
4. Develop in the University a culture of respect for privacy by formulating policies and establishing practices at par with domestic and international standards.

The UP Diliman Data Privacy Portal is at https://privacy.upd.edu.ph

For data protection concerns or to report privacy incidents, please contact the UP Diliman Data Protection Officer through any of the following channels:

Address:

UP Diliman Data Protection Office
L/GF, PHIVOLCS Bldg.
C.P. Garcia Avenue Diliman, Quezon City 1101

Landline: 8255-3561
Email: dpo.updiliman(at)up.edu.ph