Text
18 April 2018
Re: POSTING OF THE LIST OF ADMITTED STUDENTS ON THE BULLETIN BOARD OF THE SCHOOL
Dear [Redacted]:
This refers to your inquiry received by the Privacy Policy Office of the National Privacy Commission (NPC) on 21 March 2018. You asked whether the Data Privacy Act (DPA) of 2012 allows your school to post on its bulletin board, the names of accepted first year medical students in the College of Medicine without the students’ consent.
We understand that it has been a common practice among universities such as the University of the East Ramon Magsaysay Memorial Medical Center, Inc. (UERMMMCI), a personal information controller (PIC),1 to post on its bulletin board, the names of successful applicants to the College of Medicine. This is done without the consent of the students. Under the DPA, such activity is considered as processing2 of personal information.
Discussion
The aforesaid publication of the names of admitted applicants is permitted even without the consent of the students, pursuant to Section 12(f) of the DPA, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
With regard to how this legitimate interest provision can be used as the appropriate basis for lawful processing, the UK Information Commissioner’s Office (ICO) produced a guide on the provisions of the Regulation (EU) 2016/679—which repeals the 1995 EU Directive from which the DPA is based on.
The guide states that legitimate interests is most likely to be an appropriate basis where you use data in ways that people would reasonably expect and that have a minimal privacy impact.3
In order to rely on legitimate interests as basis for lawful processing, the PIC must be able to satisfy its key elements which can be broken down into a three-part test as follows:
- Purpose test: are you pursuing a legitimate interest?
- Necessity test: is the processing necessary for that purpose?
- Balancing test: do the individual’s interests override the legitimate interest?
We note that there is a legitimate interest in the posting of the names on the bulletin board of your school, the main purpose of which is to simply inform the applicants that they successfully passed the examinations in the most transparent and practical way.
Likewise, the posting is necessary for the purpose as these applicants are most probably already eagerly waiting for the results of the examinations. It adheres to the principle of proportionality under the DPA because the processing is deemed necessary, adequate, and not excessive in relation to the purpose.
Finally, the balancing test means taking into account if the interests or fundamental rights and freedoms of the data subject do not override the PIC’s interests. Recital 47 of the GDPR says:
… At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing….
Presumably, when an applicant applies for admission, which involves submitting forms with his or her personal information, and subsequently taking the examination, the applicant is aware that the school will process the personal information, particularly his or her name for purposes that are relevant to his or her admission, such as publication of successful applicants’ names. This means that the applicant could reasonably expect that his or her name may be posted on the bulletin board of the school if one has successfully hurdled the examinations.
From the foregoing discussions on the legitimate interests provision as the basis for lawful processing, we reiterate that the said posting is permissible under the DPA.
This being said, it is still recommended, in the future, to obtain their consent. For instance, consent may be obtained in their application form for purpose of posting in bulletin boards the names of those accepted. This is a means to ensure that the PIC adheres to principles of transparency and legitimate purpose.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
R.A. No. 10173, §3(h) - Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. ↩
-
Id., §3(j) - Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩
-
Information Commissioner’s Office (ICO). (March 22, 2018). Guide on the General Data Protection Regulation (GDPR): Legitimate interests. Available at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/?template=pdf&patch=34#link10 ↩