DATA

PRIVACY IN
BASIC
EDUCATION
OUTLINE

• Salient points of R.A. 10173

(Data Privacy Act of 2012)
• Issues and Concerns
SALIENT
POINTS
OF DPA
Source: Screenshot from https://www.privacy.gov.ph
STATE POLICY (SEC. 2)

1. Protect the fundamental human

right of privacy, of
communication
2. Ensure free flow of information to
promote innovation and growth
 D ATA
SUBJECT
REFERS TO AN
WHO IS A DATA INDIVIDUAL
WHOSE
SUBJECT? PERSONAL
I N F O R M AT I O N
IS PROCESSED
[SEC. 3(C)].
WHAT IS PERSONAL
INFORMATION?
• Personal information refers to any
information whether recorded in a
material form or not, from which the
identity of an individual is apparent or
can be reasonably and directly
ascertained by the entity holding the
information, or when put together with
other information would directly and
certainly identify an individual [Sec.
 • Sensitive personal information refers to personal
information:
1. About an individual’s race, ethnic origin, marital status, age,
color, and religious, philosophical or political affiliations;
WHAT IS 2. About an individual’s health, education, genetic or sexual life
of a person, or to any proceeding for any offense committed or
SENSITIVE alleged to have been committed by such person, the disposal
PERSONAL of such proceedings, or the sentence of any court in such
INFORMATI proceedings;
ON? 3. Issued by government agencies peculiar to an individuals
which includes, but not limited to, social security numbers,
previous or current health records, licenses or its denials,
suspension or revocation, and tax returns; and
4. Specifically established by an executive order or an act of
Congress to be kept classified [Sec. 3(l)].
 WHAT IS PROCESSING?
• Processing refers to any operation or any set of operations
performed upon personal information including, but not
limited to, the collection, recording, organization, storage,
updating or modification, retrieval, consultation, use,
consolidation, blocking, erasure or destruction of data [Sec.
3(j)].
 • The DPA applies to processing of all types of
personal information;
• And to any natural or juridical person involved in
WHAT IS
personal information processing including those
THE SCOPE
OF THE personal information controllers and processors
DPA? who, although not found or established in the
Philippines, use equipment that are located in the
Philippines, or those who maintain an office,
branch or agency in the Philippines…[Sec. 4].
WILL THIS APPLY TO
FB?
Yes. Facebook has an office
in Bonifacio Global City,
Philippines.

Source: https://tinyurl.com/y4v8wx2k
 • PIC refers to a person or organization
who controls the collection, holding,
processing or use of personal
information, including a person or
organization who instructs another
person or organization to collect, hold,
WHO IS A process, use, transfer or disclose personal
information on his or her behalf.
PERSONAL • It excludes:

INFORMATION 1. A person or organization who

performs such functions as
CONTROLLER? instructed by another person or
organization; and
2. An individual who collects, holds
processes or uses personal
information in connection with
the individual’s personal, family
or household affairs [Sec. 3(h)].
 • PIP refers to any natural or
juridical person qualified to act as
such under this Act to whom a
WHO IS A personal information controller
may outsource the processing of
PERSONAL personal data pertaining to a data
INFORMATION subject [Sec. 3(i)].
PROCESSOR?
ADHERE TO
DATA UPHOLD IMPLEMEN
PRIVACY DATA T SECURITY
PRINCIPLES SUBJECT MEASURES
RIGHTS

OBLIGATIONS UNDER THE DPA

TRANSPARENCY LEGITIMATE ADHERE TO
PURPOSE
DATA
PRIVACY
PRINCIPLES
PROPORTIONALITY
 Source: https://www.privacy.gov.ph/know-your-
rights/

UPHOLD DATA SUBJECT RIGHTS

Student and pupil in all schools shall have
the “right to access to his own school
records, the confidentiality of which the
school shall maintain and preserve” [Sec. 9
(3), BP 232, Education Act of 1982]
 PIC must implement reasonable and
appropriate organizational, physical
and technical measures intended for
the protection of personal
information against any accidental
or unlawful destruction, alteration
IMPLEMENT and disclosure, as well as any other
SECURITY MEASURES unlawful processing [Sec. 20].
 • The processing of personal information shall be permitted
only if not otherwise prohibited by law, and when at least
one of the ff. conditions exists:
a. The data subject has given his or her consent;
b. The processing of personal information is
necessary and is related to the fulfillment of a
CRITERIA FOR contract with the data subject or in order to take
LAWFUL steps at the request of the data subject prior to
PROCESSING OF PI entering into a contract;
c. The processing is necessary for compliance with a
legal obligation to which the personal information
controller is subject;
d. The processing is necessary to protect vitally
important interests of the data subject, including
life and health;
 CRITERIA FOR LAWFUL
PROCESSING OF PI
e. The processing is necessary in order to respond to national
emergency, to comply with the requirements of public order
and safety, or to fulfill functions of public authority which
necessarily includes the processing of personal data for the
fulfillment of its mandate; or
f. The processing is necessary for the purpose of the
legitimate interests pursued by the personal information
controller or by a third party or parties to whom the data is
disclosed, except where such interests are overridden by
fundamental rights and freedoms of the data subject which
require protection under the Philippine Constitution.
• The aforesaid publication of the
names of admitted applicants is
permitted even without the
consent of the students,
pursuant to Section 12(f) of the
DPA .
• “Disclosure of school records may not be
warranted in this case due to the absence
of any of the circumstances which will
serve as a lawful basis for the processing
of sensitive personal information. The
letter-request of NBI does not establish
the criteria it relies upon to sufficiently
justify why the school should not
maintain the confidentiality of the
schools.”
ISSUES AND
CONCERNS
 1

Source: https://tinyurl.com/y5dmwvus 1. Taguig City University

2. DepEd – Bacoor, Cavite
3. DepEd – Calamba, Laguna
4. Bulacan Provincial Government
5. Philippine Carabao Center
6. Republic Center Colleges in Angeles City
7. Laguna State Polytechnic University
2 LRN (LEARNER REFERENCE NUMBER)

Sensitive Personal Information – Issued by DepEd

peculiar to student/pupil
“
”
Source: DepEd Order No. 26, s. 2015
Source: https://tinyurl.com/y4v2q6vt
The military
requested from
DepEd ROXI the
LRN of students
enrolled in these
schools.

DepEd ROXI Reply: Release of

such data must be approved by
DepEd Secretary.
THANK YOU.