UNIVERSITY OF THE PHILIPPINES (UP) REVISED PRIVACY NOTICE FOR STUDENT LEARNING ASSISTANCE SYSTEM (SLAS) AS OF 1ST SEMESTER AY 2023-24

To exercise and safeguard academic freedom, uphold your right to quality education and perform its functions under RA 9500, the University of the Philippines (UP) needs to process information that identifies you as an individual (personal and sensitive personal information). UP is committed to comply with the Philippine Data Privacy Act of 2012 (PDPA) in order to protect your right to data privacy.

This notice explains in general terms the purposes and legal bases for the processing of the personal data (personal and sensitive personal information) that UP collects from users of the Student Learning Assistance System (SLAS), the measures in place to protect your data privacy, and the rights that you may exercise in relation to such information.

The term UP/University/us refers to the University of the Philippines System and Constituent University offices.

The term you/your refers to SLAS users and, where the context so indicates, your parent or guardian if you are a minor.

PERSONAL DATA PROCESSED THROUGH SLAS, THE PURPOSES AND LEGAL BASIS/ES FOR PROCESSING SUCH DATA

The UP System Office of Student Development Services (OSDS) under the Office of the Vice President for Academic Affairs (OVPAA), which is in charge of administering the SLAS, collects and processes your personal data through the SLAS online portal at https://slasonline.up.edu.ph/. If you are unable to file your application due to lack of internet access please request assistance from the Office of Student Affairs or Office of Scholarships and Grants of your campus.

The OSDS, in coordination with the Student Affairs and Scholarship and Financial Assistance units of the Constituent Universities, composed of the Offices of the Vice Chancellor for Student Affairs (OVCSAs) and the Offices of Student Affairs or Office of Scholarships and Grants of the relevant UP Campus may organize fact finding teams to check the information submitted by SLAS users applying for assistance.

The above CU offices oversee the application, screening and referral activities at the CU level.

In case you visit a UP Campus in order to use University facilities e.g. computer laboratories, WiFi etc to submit and check on your online application your image may be captured by UP's CCTV cameras.

When you submit your SLAS application online, you provide us through the forms you submit (and in the case of minors, the certification and consent form that your parent/guardian also agree to through your act of submitting your application through the SLAS electronic portal), among others, your name, access credentials for the SLAS portal, sex assigned at birth (male/female), date of birth, and civil status,your student number, the UP Campus you will enroll in, College or School and course in order to verify your identity.

We also ask if you are a member of an Indigenous People’s group, and/or if you have any physical disability or medical condition and the name(s) of your sibling(s) studying in UP who is/are the recipient(s) of any financial assistance for their studies. Aside from using such information to verify your identity as indicated above, such processing is also done pursuant to Section 9 of RA 9500 http://www.officialgazette.gov.ph/2008/04/19/republic-act-no-9500/ which requires UP to take affirmative steps to enhance the access of disadvantaged students to the University’s programs and services.

We ask you to indicate if you are already receiving financial assistance for your studies from UP, the government or the private sector in order for UP to equitably allocate financial assistance to other applicants who have yet to receive such financial assistance from the University.

UP also processes information about your citizenship based on the latest information provided by the Constituent University Registrars as only Filipino citizens are qualified to receive learning assistance.

Contact information (e.g. landline, mobile number, current address, permanent address, UP mail or other email address if you have no UP mail yet) is processed by UP in order to be able to communicate effectively with you and to enable us to contact and or visit your household in case UP needs to verify your submitted information. As a general rule, UP will inform you regarding results of your application through the email you indicated in the SLAS .

UP processes information about your household (i.e. names of your parents or guardian and other household members if they are receiving any income, pension or financial assistance, their respective civil status, highest educational attainment, present occupation, employer (or information if they are self employed or an independent contractor), addresses as well as information about the income, pension or financial assistance, including receipt of assistance from abroad, received by all members of the household including siblings, senior citizens etc), household location, properties owned ( e.g whether or not a member of the household owns the house you are living in, appliances, vehicles) etc goods and services used e.g. laundry, unsponsored airfare by your household to be able to determine your household’s financial capacity and your eligibility for financial assistance pursuant to the UP Charter and other applicable laws. By providing the personal date of other persons to us you warrant that you have obtained their consent for UP to process their personal data and that you undertake to hold UP free and harmless from liability for the processing of their personal data.

In the event you file an appeal we ask you to provide further information about your present family condition, specific circumstances that may prevent you from pursuing your studies this semester, solutions have you taken to address these challenges and how the Covid 19 pandemic affected you and your family and your capacity to achieve your academic goals.

We combine the above personal data with your household’s financial capacity using automated means via the SLAS portal as well as any of the documents OSDS or the proper campus office requires you to provide in support of your application or appeal in order to be able to determine whether you are qualified for financial and/or other learning assistance.

UP processes your personal data in order for the University to be able to exercise its right to academic freedom pursuant to the 1987 Constitution and its Charter which states among others that, as mentioned above, UP has the legal obligation to take affirmative steps to enhance the access of disadvantaged students to the University’s programs and services.

You may wish to read NPC Advisory Opinion 2022-14 https://privacy.gov.ph/wp-content/uploads/2022/08/Advisory-Opinion-No.-2022-014_Redacted.pdf which states that:

     Although the “fulfillment of a contract” requirement is not included in the enumeration in Section 13, the NPC anchors the processing of sensitive personal information within the school’s educational framework upon consent based on jurisprudence defining the contractual nature of the relationship between the school and the student. Hence, upon enrollment, the student and the school are deemed to have executed a contract imbued with public interest that necessarily carries with it the consent of both parties. A different interpretation would otherwise create an absurd situation where schools may not process or use their student’s educational information for his or her own education and benefit.

     At this juncture, the NPC would like to clarify that educational institutions may process personal data to achieve the purposes within its educational framework without the need for consent of the data subject. The data subject in an educational setting includes students, faculty and staff. It is then of utmost importance that the school delineates all processing operations, carefully identifying those that are core to the educational framework and those outside of it (e.g. marketing or public relations purposes).

     … the NPC respects the same doctrine of Academic Freedom for the processing of personal data within the educational framework, if it is in accordance with the provisions of the DPA and other existing laws, rules and regulations. The NPC will remain neutral on the chosen methods and technology by the educational institution as long as it is within the bounds of the law.

We compare the above information with other information in the custody of the University in order to be able to verify your identity and prevent fraud.

As stated above, the University through the concerned campus offices may also conduct field visits in order to verify the information you have submitted for the prevention of fraud.

UP may compile statistics and conduct research on information collected through SLAS subject to the applicable provisions of the PDPA and research ethics guidelines in order to carry out its mandate as the National University. In conducting policy and operations research in order to improve the delivery of services to students, UP will remove personal identifiers and process only aggregate or statistical information such that the same will no longer be subject to the provisions of PDPA.

We require you to attest that the information that you provide us is true and correct as we also use the information in order to prevent the commission of fraud. Such processing is necessary for compliance with our legal obligation as a publicly funded University and to uphold our legitimate interest as an educational institution as well as that of taxpayers.

UP shall retain and provide measures for the secure storage of your personal data for as long as the above purposes for processing such data subsist, in order to establish or defend legal claims, or as otherwise allowed or required by the PDPA and other applicable laws and issuances.

NONDISCLOSURE OF YOUR PERSONAL DATA TO THIRD PARTIES EXCEPT AS REQUIRED OR PERMITTED BY LAW

As a general rule, the University will disclose or share such information only when required or allowed by applicable laws.

Under the PDPA, personal information may be processed e.g. disclosed, for instance, when it is necessary in order for UP to comply with a legal obligation; to protect your vitally important interests including your right to quality education ; necessary to fulfill the functions of public authority (as mentioned above UP is duty bound to exercise the right and responsibility of academic freedom under the Constitution and its Charter) or when necessary for the purposes of the legitimate interests pursued by the University or a third party (for example disclosures done in order to comply with the requirements of the Commission on Audit, CHED UNIFAST etc .

Sensitive personal information (e.g. confidential educational records, age/birthdate, civil status, ) on the other hand may be processed when such is allowed by laws and regulations, such regulatory enactments provide for the protection of such information and the consent of the data subject is not required under such law or regulation, e.g. under the Constitutional provision on academic freedom read in relation to the UP Charter when needed for the protection of lawful rights and interests of natural or legal persons in court proceedings, for the establishment, exercise or defense of legal claims or where provided to government or public authority.

Consent is a lawful basis for processing personal or sensitive personal information under the PDPA.

Examples of applicable laws that may require UP to disclose your information pursuant to law include the Implementing Rules and Regulations and Implementing Guidelines for the Universal Access to Quality Tertiary Education Act of 2017 (RA 10931) and the UNIFAST Act (RA 10687) .

Please note that under the UNIFAST Act, among others, the UNIFAST Board is authorized under Section 15 to

     e Promulgate the minimum guidelines, rules, and regulations for determining qualified Beneficiaries of student financial assistance for Tertiary Education;

     f Provide general guidelines for the drawing up of contracts with the student Beneficiaries specifying the rights and obligations of the parties that may include a service clause or such other stipulations of cost recovery the Board may deem in the best interest of the public and consistent with, or responsive to, national, social, economic, and human resources development plans, subject to Section 12;

     g Monitor, assess, and make impact evaluation of StuFAPs and projects, with the end in view of determining whether these programs shall be adopted, continued, or terminated;

Kindly note that the following are examples of information that are not covered by the DPA as stated in Sec. 4 of such law:

     c Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

     d Personal information processed for journalistic, artistic, literary or research purposes;

     e Information necessary in order to carry out the functions of public authority,

HOW WE OBTAIN YOUR CONSENT AND HOW YOU CAN WITHDRAW CONSENT

UP obtains your consent (or if you are a minor, the consent given by your parent or guardian for and in your behalf) for the processing of your personal data through automated decision making pursuant to this privacy notice through the submission of your online application via the SLAS portal. If you wish to withdraw consent, as when you decide for example to withdraw your SLAS application, kindly write or send an email to the OSDS and the relevant Campus Student Affairs Unit, and identify the processing activity for which you are withdrawing consent. Please attach a copy of your UP ID (or if you have none, a valid government issued ID card ) so that we will be able to verify your identity. Note that consent may be withdrawn only for a processing activity/ies for which consent is the only applicable lawful ground for such processing.Kindly await OSDS and the Campus Student affairs Units action regarding your request. Rest assured that once the relevant UP offices confirm that you have validly withdrawn consent for a processing activity/ies the same shall be effective unless you thereafter send a letter or email that you are again consenting to such processing activity/ies.

HOW UP PROTECTS YOUR PERSONAL INFORMATION

Even prior to the effectivity of the PDPA, UP put in place physical, organizational, and technical measures to protect your right to privacy, and is committed to reviewing and improving them, so as to be able to comply, among others, with its obligations under the applicable provisions of the Education Act of 1982 which require us to keep your educational records confidential. You may wish for instance to read UP's Acceptable Use Policy for IT Resources (AUP).

From time to time, UP posts information on relevant sites and sends emails that explain how you can secure and maintain the confidentiality of your personal information. Rest assured that UP personnel are allowed to process your personal information only when such processing is part of their official duties. The OSDS only discloses your personal information to other offices and UP personnel, such as UP System offices that are in charge of soliciting donations for students, the Offices of Student Affairs and the University Registrars of the Constituent Universities, in order to perform their official functions.

ACCESS TO AND CORRECTION OF YOUR PERSONAL DATA AND THAT OF RELEVANT THIRD PARTIES AND YOUR RIGHTS UNDER THE PDPA

SLAS allows you to access and update the personal information you provide UP in connection with your application for learning assistance. You are duty bound to see to it that the personal data and other information you provide the University is accurate and updated when the need arises. The SLAS portal allows you to update or correct your personal data. If you need to correct or update your information or that of relevant third parties after you have submitted your online application, you must seek the assistance of your Campus SLAS HelpDesk in order to correct your personal data.

Aside from the right to access and correct your personal data, you have the following rights subject to the conditions and limitations provided under the PDPA and other applicable laws and regulations:

     a. The right to be informed about the processing of your personal data through this and other applicable privacy notices.

     b. The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. Kindly note however that, as mentioned above, there are various instances when the processing of personal data you have provided is necessary for us to comply with UP’s mandate, statutory and regulatory requirements, or is processed using a lawful basis other than consent. In the case of your UP ID it is your duty to immediately report the loss of such card to your University Registrar and the UP ITDC so that UP can prevent the unauthorized use of the same.

     c. The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject and

     d. The right to lodge a complaint before the National Privacy Commission provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the proper DPO through the email address indicated below (for CU related concerns please email the proper CU DPO) regarding the processing of your information, or the handling of your requests for access, correction, blocking of the processing of your personal data and the like.

REVISIONS TO THIS PRIVACY NOTICE AND QUERIES REGARDING DATA PRIVACY

It is your duty to visit this site from time to time to see any updates regarding the Privacy Notice for SLAS Online users. We shall alert you regarding changes to this Policy through this site.

This SLAS Privacy Notice was revised and will be effective as of the 1st semester AY 2023-24.

If you have any queries or suggestions regarding this privacy notice or data privacy concerns regarding your personal information processed via SLAS you may contact the UP System Data Protection Officer through the following:

Via post

c/o Office of the President

2F North Wing Quezon Hall

(Admin Building) University Avenue,

UP Diliman, Quezon City 1101

Philippines

Through the following landlines

Phone | (632) 89280110; (632) 89818500 loc. 2521

Through email

[email protected]

For CU related concerns please email your campus DPO