Text
06 February 2018
RE: CONSENT OF DATA SUBJECT PRIOR TO RELEASE OF SCHOOL RECORDS BY THE LYCEUM OF THE PHILIPPINES UNIVERSITY (LPU)
Dear [Redacted],
This pertains to your inquiry received by the Privacy Policy Office of the National Privacy Commission (NPC) on 25 January 2018, which sought to clarify whether the regulation of the University Registrar of the Lyceum of the Philippines (LPU) on the release of school records is in consonance with the provisions of Republic Act No. 101731, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances.
In your letter, you stated that you have requested information regarding your biological father from the LPU Registrar and the Alumni Affairs Office, specifically the following information: a) middle name; b) last registered address; and c) parents’ names. We understand that you will use these information in relation to your personal search of your father whom you have not seen since you were a child.
Discussion
First and foremost, LPU, as an educational institution, is considered as a personal information controller3 (PIC), processing4 personal information5 of its students, employees, and alumni, thus, is covered by the law and under the jurisdiction of the NPC. The information that you requested are well within the definition of personal information in Section 3 of the DPA and are then subject to its rules and regulations.
As a PIC, LPU is bound to implement reasonable and appropriate organizational, physical, and technical measures to protect the personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.6 It is accountable for any personal information under its control and custody, including those transferred to a third party.7
Given the responsibility of LPU to secure personal information, its denial of your request for information may be justified due to the lack of consent of the data subject. Although consent is not the only condition for lawful disclosure8 or processing, in general, of personal information, it may be the most appropriate criterion in this scenario.
Likewise, LPU as the PIC is mandated to recognize and enforce the rights of the data subject9, including the right to be informed regarding the recipients to whom data will be disclosed. Thus, the data subject, your biological father, must be informed, and most importantly, approve of the disclosure of his personal information to you.
We truly understand your plight. However, this agency is mandated to protect the personal information of the data subjects from any unauthorized disclosure. Considering your purpose, LPU may not be the proper institution to provide you with the needed information. It is best to consider other avenues for your search.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩
-
Supra note 1, §3(h) - Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. ↩
-
Id., §3(j) – Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩
-
Id., §3(g) - Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩