UNIVERSITY OF THE PHILIPPINES (UP) PRIVACY NOTICE FOR STUDENT LEARNING ASSISTANCE SYSTEM (SLAS) REVISED AS OF THE SECOND SEMESTER OF 2024-2025

To exercise and safeguard academic freedom, uphold your right to quality education and perform its functions under RA 9500, the University of the Philippines (UP) needs to process information that identifies you as an individual (personal and sensitive personal information e.g. information regarding your education). UP is committed to comply with the Philippine Data Privacy Act of 2012 (PDPA) in order to protect your right to data privacy.

This notice explains in general terms the purposes and legal bases for the processing of the personal data (personal and sensitive personal information) that UP collects from users of the Student Learning Assistance System (SLAS), the measures in place to protect your data privacy, and the rights that you may exercise in relation to such information.

The terms UP/University/us/we refer to the University of the Philippines System and its Constituent University (CU) offices.

The terms you/your refers to SLAS applicants and, where the context so indicates, your parent or guardian if you are a minor.

PERSONAL DATA PROCESSED THROUGH SLAS, THE PURPOSES AND LEGAL BASIS/ES FOR PROCESSING SUCH DATA

The UP System Office of Student Development Services (OSDS) under the Office of the Vice President for Academic Affairs (OVPAA), which is in charge of administering the SLAS, collects and processes your personal data through the SLAS online portal at https://slasonline.up.edu.ph/. If you are unable to file your application due to lack of internet access please request assistance from the Office of Student Affairs or Office of Scholarships and Grants of your campus.

The OSDS, in coordination with the Offices of the Vice Chancellor for Student Affairs (OVCSAs) and the Offices of Student Affairs or Office of Scholarships and Grants of the Constituent Universities may organize fact finding teams. These teams are tasked with verifying the information provided by applicants using the SLAS to apply for assistance.

The above CU offices also oversee the application, screening and referral activities at the CU level.

When you submit your SLAS application online, you provide us through the forms you submit (and in the case of minors, the certification and consent form that your parent/guardian also agree to through your act of submitting your application containing the required information through the SLAS electronic portal), among others, your full name, access credentials for the SLAS portal, sex assigned at birth (male/female), date of birth, civil status, student number, the UP Campus you will enroll in, as well as your College or School and course, all of which are essential for verifying your identity.

We also ask if you are a member of an Indigenous People’s group, and/or if you have any physical disability or medical condition and the name(s) of your sibling(s) studying in UP who is/are the recipient(s) of any financial assistance for their studies. Aside from using such information to verify your identity as indicated above, such processing is also done pursuant to Section 9 of RA 9500 http://www.officialgazette.gov.ph/2008/04/19/republic-act-no-9500/ which requires UP to take affirmative steps to enhance the access of disadvantaged students to the University’s programs and services.

We ask you to indicate if you are already receiving financial assistance for your studies from UP, the government or the private sector in order for UP to equitably allocate financial assistance to other applicants who have yet to receive such financial assistance from the University.

UP also processes information about your citizenship based on the latest information provided by the Constituent University Registrars as only Filipino citizens are qualified to receive learning assistance.

Contact information (e.g. landline, mobile number, current address, permanent address, UP mail or other email address if you have no UP mail yet) is processed by UP in order to be able to communicate effectively with you and to enable us to contact and/or visit your household in case UP needs to verify your submitted information. As a general rule, UP will inform you regarding the results of your application through the email you indicated in the SLAS.

UP processes information about your household (i.e. names, the respective civil status, highest educational attainment, present occupation, employer, or information if they are self-employed or an independent contractor, employment status) of your parents or guardian and other household members if such other household members are receiving any income, pension or financial assistance; as well as information about the income, pension or financial assistance, including allowances and remittances from relatives or non-relatives from local sources and from abroad received by all members of the household including siblings and other persons who are part of such household; information about whether any household members are senior citizens; household location; properties owned (e.g. whether or not a member of the household owns the house you are living in, appliances, vehicles,etc.); goods and services used (e.g. domestic service, laundry, unsponsored airfare by your household, etc.) to be able to determine your household’s financial capacity and your eligibility for financial assistance pursuant to the UP Charter and other applicable laws. By providing us the personal data of other persons, you warrant that you have obtained their consent for UP to process their personal data and that you undertake to hold UP free and harmless from liability for the processing of their personal data.

We require you to certify that the information that you provide us is true and correct as we also use the information in order to prevent the commission of fraud. Such processing is necessary for compliance with our legal obligation as a publicly funded University and to uphold our legitimate interest as an educational institution, as well as that of taxpayers.

We compare the above information with other information in the custody of the University in order to be able to verify your identity and to prevent fraud.

As stated above, the University, through the concerned campus offices may also conduct field visits in order to verify the information you have submitted for the prevention of fraud.

We combine the above personal data with your household’s financial capacity as well as any of the documents that the OSDS or the proper campus office requires you to provide. This is done in order to determine whether you are qualified to receive financial assistance from UP using completely automated means via the SLAS portal. We use such fully automated decision making means in order to efficiently process the thousands of SLAS applications that we receive, prevent human error or bias and to enable us to treat applicants fairly.

Section 18 (c) of the Memo Circular 2023-04 of the National Privacy Commission states:

A PIC shall obtain the consent of the data subject when automated processing is the sole basis for a decision that produces legal effects on or may significantly affect the data subject.

We are therefore constrained to require you to grant us consent for the processing of your personal data for the purpose of determining whether you are qualified to receive financial assistance from UP using such fully automated means. If you do not grant us consent or withdraw such consent, we regret that we will not be able to process your application as consent is the only lawful basis for using fully automated decision-making means for processing personal data under the abovecited section of NPC MC 2023-04.

In the event you file an appeal, we ask you to provide further information about your present family condition, specific circumstances that may prevent you from pursuing your studies this semester, solutions you have taken to address these challenges, and how the COVID-19 pandemic affected you, your family, and your capacity to achieve your academic goals.

Kindly note that while any such appeal must be filed using the SLAS portal, appeals will be decided by the relevant CU Committee on Scholarships and Financial Assistance using the personal data found in your SLAS application and the abovementioned additional information in support of your appeal uploaded through the SLAS portal, and not through fully automated decision-making means. Our legal basis for such processing is UP’s right and responsibility to exercise academic freedom pursuant to the 1987 Constitution and its Charter which states among others that, as mentioned above, UP has the legal obligation to take affirmative steps to enhance the access of disadvantaged students to the University’s programs and services.

NPC Advisory Opinion 2022-14 https://privacy.gov.ph/wp-content/uploads/2022/08/Advisory-Opinion-No.-2022-014_Redacted.pdf states that:

At this juncture, the NPC would like to clarify that educational institutions may process personal data to achieve the purposes within its educational framework without the need for consent of the data subject. The data subject in an educational setting includes students, faculty and staff. It is then of utmost importance that the school delineates all processing operations, carefully identifying those that are core to the educational framework and those outside of it (e.g. marketing or public relations purposes).

x x x

… the NPC respects the same doctrine of Academic Freedom for the processing of personal data within the educational framework, if it is in accordance with the provisions of the DPA and other existing laws, rules and regulations. The NPC will remain neutral on the chosen methods and technology by the educational institution as long as it is within the bounds of the law.

Please also note that UP’s legal obligation to exercise the right and responsibility to uphold academic freedom pursuant to the 1987 Constitution and the UP Charter is our lawful basis for processing data for other purposes as explained below.

After your personal data is processed in order to determine whether you are eligible to receive financial assistance via SLAS, such electronic data is securely stored by the University.

We securely store and further process the same for several key reasons: to comply with legal obligations such as providing information required by public authorities like the Commission on Audit; to establish or defend legal claims; and to carry out other activities allowed or required by the Philippine Data Privacy Act as well as other applicable laws and issuances.

UP likewise stores your personal data pursuant to Sec. 11 (f) of the Philippine Data Privacy Act which states Provided, That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer

periods: Provided, further, That adequate safeguards are guaranteed by said laws authorizing their processing.

UP conducts research on stored previously processed de-identified SLAS data in order to comply with its legal obligations including its right and responsibility to exercise academic freedom under the 1987 Constitution and the UP Charter. UP as a research university must conduct scientific research in order to produce general demographic information and statistics regarding UP students who apply for and/or receive financial assistance via SLAS (or the previous Student Financial Assistance Online portal) across various time periods. Such research enables the University to assess whether its policies, programs, as well as procedures and revisions to the same in different years, enable the University, among others, to enhance the access of disadvantaged students to UPs programs and services (Sec. 9 of RA 9500 or the UP Charter), comply with the spirit of other applicable laws such as RA 10687 or the Unified Student Financial Assistance System for Tertiary Education (UniFAST) Act, and RA 10931 or the Universal Access to Quality Tertiary Education Act and to allow us to provide advice and technical assistance to public authorities such as Congress, the Commission on Higher Education, the UniFAST Board, etc. in accordance with Sec. 7 of the UP Charter.

Rest assured that before any research is conducted by UP, so that we will be able to comply with our ethical obligations and uphold your right to privacy, duly authorised UP personnel will remove identifiers from the SLAS dataset such that UP’s researcher or research teams who will perform operations on such dataset will not be able to associate your data with you. The research results will only include statistical data and general demographic information that does not identify you and any other data subjects.

Kindly note that Sec. 16.C.2 of Memorandum Circular 2023-4 issued by the National Privacy Commission provides that:

The conduct of research where the end results will be anonymized and will only disclose the general demographic of the research subjects does not require the consent of the data subject.

NON DISCLOSURE OF YOUR PERSONAL DATA TO THIRD PARTIES EXCEPT AS REQUIRED OR PERMITTED BY LAW

The University will disclose or share your personal data only when required or allowed by applicable laws, rules and regulations.

Examples of applicable laws and regulations that may require UP to disclose your information pursuant to law include issuances of the Commission on Audit, the Implementing Rules and Regulations and Implementing Guidelines for the Universal Access to Quality Tertiary Education Act of 2017 (RA 10931), and the UniFAST Act (RA 10687).

Please note that under the UniFAST Act, among others, the UniFAST Board is authorized under Section 15 to:

e. Promulgate the minimum guidelines, rules, and regulations for determining qualified Beneficiaries of student financial assistance for Tertiary Education;

f. Provide general guidelines for the drawing up of contracts with the student beneficiaries specifying the rights and obligations of the parties that may include a service clause or such other stipulations of cost recovery the Board may deem in the best interest of the public and consistent with, or responsive to, national, social, economic, and human resources development plans, subject to Section 12;

g. Monitor, assess, and make impact evaluation of StuFAPs and projects, with the end in view of determining whether these programs shall be adopted, continued, or terminated;

Kindly note that the following are examples of information that are not covered by the PDPA, as stated in Sec. 4 of such law:

c. Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

d. Personal information processed for journalistic, artistic, literary or research purposes;

e. Information necessary in order to carry out the functions of public authority,

HOW WE OBTAIN YOUR CONSENT FOR AUTOMATED DECISION MAKING DONE VIA SLAS AND HOW YOU CAN WITHDRAW CONSENT

UP will obtain your consent (or if you are a minor, the consent given by your parent or guardian for and in your behalf) for the processing of your personal data through entirely automated decision-making means via the SLAS portal as outlined in this privacy notice when you submit your online application.

If you wish to withdraw consent for the processing of your SLAS application or if you wish to withdraw your appeal, kindly write or send an email on or before the deadline for the submission of SLAS applications or appeals to the OSDS and the relevant CU Student Affairs Unit through the following official email addresses:

UP Office of the Student Development Services Email: [email protected]; UP Baguio Email: [email protected]; UP Cebu Email: [email protected]; UP Diliman - Quezon City Email: [email protected]; [email protected]; UP Diliman - Pampanga Email: [email protected]; [email protected]; UP Los Banos Email: [email protected]; UP Manila Email: [email protected]; UP Mindanao Email: [email protected]; UP Open University Email: [email protected]; UP Visayas Email: [email protected], and, UP Tacloban Email: [email protected])

In your letter or email you must identify the processing activity for which you are withdrawing consent i.e. SLAS application and or appeal and specific period. Please attach a copy of your UP ID (or if you have none, a valid government-issued ID card) so that we will be able to verify your identity. If you are a minor, your parent or guardian who granted consent for and in your behalf must write or send the proper email and also attach a copy of his or her government-issued ID card.

Please note that consent may be withdrawn only for a processing activity/ies for which consent is the only applicable lawful ground for such processing and will not affect any other processing which UP has to perform in order to comply with its contractual obligations or other legal obligations including the exercise of its right to academic freedom for example to process his or her enrollment, issue grades conduct investigations or disciplinary proceedings, disclose information required by public authorities etc or any such other processing allowed by the PDPA and other applicable laws.

Further note that withdrawal of consent can only have a prospective and not a retroactive effect such that the validity of any prior processing shall remain lawful and binding. Kindly await the OSDS and the CU Student Affairs Units action regarding your request.

RISKS AND HOW UP PROTECTS YOUR PERSONAL INFORMATION

The processing of personal data for your SLAS application and any appeal thereon carries risks that may involve the confidentiality, integrity, and availability of personal data or the risk that processing will violate the privacy principles and rights of data subjects. UP has put in place reasonable physical (e.g. access control measures such as locks, security personnel, etc.) organizational (e.g. only authorised personnel who have signed the required non-disclosure undertaking and need such personal data to perform their functions are allowed to process such personal data, etc. ) and technical measures (e.g. encryption, the conduct of vulnerability and penetration testing and other similar measures) to prevent or mitigate such risks. Kindly note that these measures do not guarantee absolute protection against such risks as when systems are subject to targeted cyberattacks, malware, ransomware, computer viruses, etc. However, UP has also adopted measures in order to deal with security incidents or personal data breaches in compliance with the PDPA and National Privacy Commission (NPC) issuances.

Please refer to the Board of Regents approved UP Data Privacy Manual CERTIFIED TRUE COPY_DATA PRIVACY MANUAL 2023 EDITION.pdf (up.edu.ph) which includes security incident and breach response procedures (Part 7, page) and the following forms:

Form 1 UNIVERSITY OF THE PHILIPPINES SYSTEM ADMINISTRATION INCIDENT OR BREACH REPORT FORM.docx (up.edu.ph)
Form 2 PRELIMINARY ASSESSMENT FORM FOR SECURITY INCIDENTS OR PERSONAL DATA BREACHES (up.edu.ph)
Form 3 Mandatory Notification to NPC.pdf (up.edu.ph)
Form 4 Mandatory Personal Data Breach Notification for Data Subjects.docx (up.edu.ph)
Form 5 SECURITY INCIDENT OR PERSONAL DATA BREACH REPORT (up.edu.ph)

We remind you in our various portals and privacy notices to keep your personal data secure by double checking that the email account you will be using or are using for UP portals has not been compromised by using Have I Been Pwned, using a strong password for such account https://itdc.up.edu.ph/about/advisories/2023%2012%2004%20REMINDER%20-%20Use%20Strong%20Passwords%20for%20UP%20Mail%20Accounts.pdf, when possible activating two factor authentication for your personal email accounts if you have yet to be issued a UP email account, using your UP email account for UP portals and communications with UP as required by UP memos [MEMO TJH 2021-10] Reminder that faculty and students must use UP Mail for official correspondence and data privacy and security measures required for sending attachments and sharing G.pdf not using public, unsecured networks for submitting personal data or at least using VPN if use of such unsecured networks is unavoidable and keeping all UP account credentials confidential.

From time to time, UP posts information on relevant sites and sends emails that explain how you can secure and maintain the confidentiality of your personal data.

Please be reminded to use UP mail for the SLAS portal, which employs two-factor authentication for your security once such UP mail has already been issued to you. It is also crucial to keep your access credentials confidential.

ACCESS TO AND CORRECTION OF YOUR PERSONAL DATA AND THAT OF RELEVANT THIRD PARTIES AND YOUR RIGHTS UNDER THE PDPA

UP allows you to access and update the personal information you provide in connection with your application via the SLAS portal. You are duty-bound to see to it that the personal data and other information you provide the University are accurate and corrected or updated within the deadline for processing applications or appeals. If you need to correct or update your information or that of relevant third parties after you have submitted your online application or appeal, you must seek the assistance of your Campus SLAS HelpDesk in order to correct your personal data.

Aside from the right to access and correct your personal data, you have the following rights, subject to the conditions and limitations provided under the PDPA and other applicable laws and regulations:

a. The right to be informed about the processing of your personal data through this and other applicable privacy notices.

b. The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. However, kindly note that, as mentioned above, there are various instances when the processing of personal data you have provided is necessary for us to comply with UP’s mandate, meet statutory and regulatory requirements, or is processed using a lawful basis other than consent.

c. The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject and

d. The right to lodge a complaint before the National Privacy Commission provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the proper DPO through the email address indicated below (for CU related concerns please email the proper CU DPO) regarding the processing of your information, or the handling of your requests for access, correction, blocking of the processing of your personal data, and the like.

REVISIONS TO THIS PRIVACY NOTICE AND QUERIES REGARDING DATA PRIVACY

It is your duty to visit this site from time to time to see any updates regarding the Privacy Notice for SLAS Online users. We shall alert you regarding changes to this Policy through this site.

This revised SLAS Privacy Notice will be effective starting from 2nd Semester Academic Year 2024-2025

If you have any queries or suggestions regarding this privacy notice, or if you have data privacy concerns regarding the handling of your personal information processed via SLAS you may contact the UP System Data Protection Officer through the following:

Via post

c/o Office of the President
2F North Wing Quezon Hall
(Admin Building) University Avenue,
UP Diliman, Quezon City 1101
Philippines

Through the following landlines

Phone | (632) 89280110; (632) 89818500 loc. 2521

Through email

[email protected]

For CU-related concerns, please direct your inquiries to your campus DPO via email.