NPC Issuance Wiki

NPC Advisory Opinion No. 2018-052 — CHED Memorandum Order No. 3, Series of 2012

Issued Advisory Opinion

Text

16 August 2018

Re: CHED MEMORANDUM ORDER NO. 3, SERIES OF 2012

Dear [Redacted],

We write in response to your letter to the National Privacy Commission (NPC), requesting comments on the authority of the Commission on Higher Education (CHED) to collect data for its “monitoring and validation activities” under CHED Memorandum Order No. 3, series of 2012, “Enhanced Policies, Guidelines and Procedures Governing Increases in Tuition and Other School Fees, Introduction of New Fees, and for Other Purposes” (CMO No. 03) in relation to the Data Privacy Act of 2012 (DPA).1 You have likewise provided us the following documents:

Discussion

  1. CMO No. 08, s. 2012 – “Amendment on CMO No. 03, s. 2012;”
  2. CHED Regional Offices’ Reportorial Requirements for the Applications to Increase in Tuition and Other School Fees (TOSF); and
  3. Prescribed templates as annexes to the proposed revision of CMO No. 03, s. 2012: a. Data requirement for the application to increase in TOSF; b. Report on the Actual Utilization of Incremental Proceeds in TOSF; and c. Monitoring and Evaluation Framework.

We understand that the CHED monitors compliance of the private HEIs with the prescribed percentage distribution of the incremental proceeds from the increase in TOSF. HEIs are required to use seventy percent (70%) of the incremental proceeds for the benefit of teaching and non-teaching personnel and other staff, except those who are principal stockholders of the HEI.2

HEIs then submit their payrolls, payslips, acknowledgement of increase remittances, notice of salary adjustments, faculty and staff benefits, and other relevant documents to substantiate this requirement.

You stated that the monitoring and validation activities of the CHED is being challenged by private Higher Education Institutions (HEIs) on the basis of the DPA. The CHED now seeks clarification on its authority to collect data for its mandatory reportorial requirement under CMO No. 03 vis-à-vis the DPA.

Lawful processing of personal data

The CHED, as a personal information controller (PIC), is allowed to process personal data taking into consideration the provisions of the DPA on upholding the rights of data subjects, adherence to the principles of transparency, legitimate purpose and proportionality, and implementing reasonable and appropriate organizational, physical and technical security measures intended for the protection of personal data.

The CHED has promulgated CMO No. 03 and its amendment, CMO No. 08, to govern its monitoring and validation activities and prescribed guidelines for the reportorial requirements relevant to TOSF. Under these regulations, CHED collects both personal information3 and sensitive personal information4 (collectively, personal data) from HEIs.

This processing is necessary in order for CHED to fulfill its mandate under various laws, including Batas Pambansa Blg. 2325 (Education Act of 1982) and Republic Act No. 77226 (Higher Education Act of 1994). As a regulatory agency, CHED is authorized to monitor and validate the utilization of the proceeds of TOSF and may collect relevant documentation for this purpose. In these cases, CHED should ensure that its regulatory enactments guarantee the protection of personal data.

Proportionality

The processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.7 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.8

While the CHED may require the submission of pertinent documentation necessary to verify the utilization of the incremental proceeds from the increase in TOSF, it is worth noting that the CHED may consider accepting aggregated data, i.e. information from an HEI’s audited financial statements on the revenues vis-à-vis amount of salaries and benefits given to its personnel and other staff, other forms of reports and certifications from an HEI’s responsible officers as to the utilization, instead of requiring the submission of documents containing personal data of the employees.

However, should the CHED still require the submission of sample payrolls, payslips, acknowledgement of increase remittances, notice of salary adjustments, among others, it may opt to accept documents where personal data unrelated to the purpose of the validation is duly redacted.

Security Measures

As a PIC, CHED should implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data. CHED should put in place policies and procedures on access controls, such that access shall be limited to only authorized personnel and personal data shall not be further processed except upon instructions or as authorized by law or policy.9 In addition, the security measures should ensure to maintain the availability, integrity, and confidentiality of personal data, protect the same from any accidental or unlawful destruction, alteration, disclosure and unlawful processing.10

We trust that the CHED is well aware of its obligations under the DPA, its IRR, and issuances of the NPC, specifically NPC Circular No. 16-01 on the Security of Personal Data in Government Agencies, which requires all government agencies engaged in the processing of personal data to observe the following duties and responsibilities:

A. through its head of agency, designate a Data Protection Officer;

B. conduct a Privacy Impact Assessment for each program, process or measure within the agency that involves personal data, Provided, that such assessment shall be updated as necessary;

C. create privacy and data protection policies, taking into account the privacy impact assessments, as well as Sections 25 to 29 of the IRR;

D. conduct a mandatory, agency-wide training on privacy and data protection policies once a year: Provided, that a similar training shall be provided during all agency personnel orientations.

E. register its data processing systems with the Commission in cases where processing involves personal data of at least one thousand (1,000) individuals, taking into account Sections 46 to 49 of the IRR;

F. cooperate with the Commission when the agency’s privacy and data protection policies are subjected to review and assessment, in terms of their compliance with the requirements of the Act, its IRR, and all issuances by the Commission.11

This advisory opinion is based on the limited information provided in the questions, and may vary based on additional information or when the facts are changed or elaborated. Please be advised that the Commission may issue further guidelines on this matter.

For your information.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. CMO No. 03, § 7.2.2 and 7.2.3, as amended by CMO No. 08. ↩

  3. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 3 (l): Personal information refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩

  4. Id. § 3 (t): Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩

  5. An Act Providing for the Establishment and Maintenance of an Integrated System of Education [Education Act of 1982], Batas Pambansa Blg. 232 (1982). ↩

  6. An Act Creating the Commission on Higher Education, Appropriating Funds Therefor and for Other Purposes [Higher Education Act of 1994], Republic Act No. 7722 (1994). ↩

  7. IRR of the Data Privacy Act of 2012, § 18 (c). ↩

  8. Ibid. ↩

  9. Id. § 25. ↩

  10. Ibid. ↩

  11. NPC Circular No. 16-01 dated 10 October 2016, § 4. ↩

Backlinks

  • No backlinks found