NPC Issuance Wiki

NPC Advisory Opinion No. 2020-013 — Access to Information in Relation to Disciplinary Records and Administrative Cases of Students and School Personnel

Issued Advisory Opinion

Official opinion tags

Text

21 February 2020

Re: ACCESS TO INFORMATION IN RELATION TO DISCIPLINARY RECORDS AND/OR ADMINISTRATIVE CASES OF STUDENTS AND SCHOOL PERSONNEL

Dear [Redacted],

We write in response to your inquiry received by the National Privacy Commission (NPC) seeking guidance and clarification in relation to the Ateneo de Manila University’s (“University”) protocols for the disclosure and sharing of information in relation to disciplinary records and administrative cases of students and school personnel.

We understand that the University receives, processes, and resolves complaints involving its students, faculty members and administrative personnel. We understand further that in the course of such proceedings and up until their conclusion, various parties would attempt to obtain – in some cases, demand – access to some or all information relating to such proceedings.

Thus, the University now seeks clarification on the following questions in relation to the Data Privacy Act of 20121 (DPA):

  1. Is the University required to disclose or share information (including personal data) about a particular administrative case to the following: a. parties to the case (i.e. complainant, respondent, and/or witnesses); b. other parties who may be affected by the case and/or its outcome (e.g. other students of a teacher who is the respondent in a case filed by one student, parents or guardian of an adult student, etc.); and c. public (e.g. other students/University personnel, other students’ parents, etc.)

  2. If the University is not required to make any such disclosure or to share any such information, is it at least allowed by the DPA to do so? If the answer is in the affirmative, on what possible ground/s in the law?

  3. In relation to Questions #1 and #2, would it matter if a case is still pending or has already been concluded?

  4. Regardless of the answers to Questions #1 and #2, may the University issue public reports that provide statistical information in relation to specific offenses, such as, but not limited to the following: (a) number of cases filed; (b) number of cases resulting in suspension or termination; (c) number of cases dismissed. In this wise, would the number of cases be relevant insofar as determining whether such information may constitute personal data?

  5. In relation to sexual harassment cases in particular, what is the implication of Sections 22 and 26 of Republic Act (RA) No. 11313, also known as the Safe Spaces Act, on the right to privacy of the accused or respondent, especially under the DPA? Of particular importance are the following provisions: a. Section 22(8). It provides that school heads have the duty to create an independent internal mechanism to investigate and address complaints of gender-based sexual harassment which shall guarantee to the greatest extent possible; b. Section 26 (on Confidentiality). It states that, at any stage of the investigation, prosecution and trial of an offense under the Safe Spaces Act, the rights of the victim and the accused who is a minor shall be recognized.

Discussion

As the above items 1, 2 and 3 are related, these will be collectively discussed.

The disclosure or sharing of personal and sensitive personal information (collectively, personal data) is considered as processing under the DPA. Hence, the same should be based on any of the lawful criteria for processing under Sections 12 and 13 of the law, depending on the nature of personal data being disclosed or shared.

In this case, information about any proceeding for any offense committed or alleged to have been committed by an individual, the disposal of such proceedings, or the sentence of any court in such proceedings are classified as sensitive personal information.3

In our Advisory Opinion No. 2019-011,4 the term “proceedings” has been interpreted to also include those non-judicial in nature, including administrative proceedings, to wit: “…case files of every data subject, in all types of proceedings, shall be provided a higher degree of protection ‘as the context of their processing could create significant risks to the fundamental rights and freedoms.’” Administrative cases in an educational institution are then included in such proceedings protected by the DPA.

Generally, the processing of sensitive personal information is prohibited, except in certain instances, i.e. when the processing is provided for by existing laws and regulations5 or necessary for establishment, exercise or defense of legal claims.6

In the given scenario, we refer to the Manual of Regulations for Private Higher Education (MORPHE) issued through Commission on Higher Education (CHED) Memorandum Order No. 40, s. 2008. Section 142 of the MORPHE states that, “In all matters that may result in the imposition of any sanction or penalty to a higher education institution, or to any personnel or student, administrative due process shall in all instances be observed.”7

Jurisprudence has provided for the procedural rights of students in disciplinary cases and the minimum standards to be followed in the imposition of disciplinary sanctions in academic institutions, to wit:

  1. The students must be informed in writing of the nature and cause of any accusation against them; 2. They shall have the right to answer the charges against them, with the assistance of counsel, if desired; 3. They shall be informed of the evidence against them; 4. They shall have the right to adduce evidence in their own behalf; and 5. The evidence must be duly considered by the investigating committee or official designated by the school authorities to hear and decide the case.8

Hence, as can be gleaned from the above, the parties involved in the administrative proceeding, specifically the complainant and respondent, have the right to be informed of the details of the case, including personal data, as a matter of procedural due process. This holds true whether the party to the case is a student, faculty or school personnel.

Meanwhile, third parties to the proceeding, including witnesses, other individuals who may be affected by the case and its outcome, and the public, are not accorded the same right.

With respect to item number 3, the above interpretation will apply whether the administrative case is pending or already concluded.

Statistical data not considered personal information

As to whether the University may issue public reports that provide statistical information in relation to specific offenses, the University may do so considering that purely statistical data falls outside the ambit of the DPA as the same does not identify a person.

However, the number of cases to be reported may be relevant in the determination of whether the same may constitute personal data when for instance, other data may be used or may allow a statistical unit to be identified.9 To determine whether a statistical unit is identifiable, account shall be taken of all relevant means that might reasonably be used by a third party to identify the statistical unit.10 With this, caution should be exercised in releasing reports on specific offenses to ensure that no personal data is inadvertently released.

Safe Spaces Act vis-à-vis the DPA

Lastly, the University seeks clarification on the implication of the Safe Spaces Act (SSA)11 on the right to privacy of the accused or the respondent.

We understand that the SSA requires school heads to create an independent internal mechanism to investigate and address complaints of gender-based sexual harassment which shall guarantee confidentiality to the greatest extent possible.12 Further, the law requires confidentiality at any stage of the investigation, prosecution and trial of an offense under the SSA, where the rights of the victim and the accused who is a minor shall be recognized.13

Upon a reading of both laws, the SSA and the DPA do not contradict each other. While Section 22 (8) of the SSA provides that the institution shall guarantee confidentiality to the greatest extent possible and Section 26 of the same law states that the rights of a minor, who may either be the victim or accused, shall be recognized in all stages of the proceedings for an offense under the SSA, these provisions do not contradict the provisions of the DPA which protects the data privacy of all individuals regardless of age.

In effect, the SSA complements the DPA’s requirement of having proper safeguards to ensure confidentiality of personal data being processed.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Tags: administrative cases, education sector, sensitive personal information. ↩

  3. Data Privacy Act of 2012, § 3 (l) (2). ↩

  4. National Privacy Commission, NPC Advisory Opinion No. 2019-011 (14 January 2019). ↩

  5. Data Privacy Act of 2012, § 13 (b). ↩

  6. Id., § 13 (f). ↩

  7. Commission on Higher Education, Manual of Regulations for Private Higher Education (MORPHE), available at https://ched.gov.ph/manual-regulations-private-higher-education-morphe/ (last accessed 7 January 2020). ↩

  8. See: Guzman v. National University, G.R. No. L-68288 (11 July 1986), cited in Spouses Go v. Colegio de San Juan de Letran, G.R. No. 169391 (10 October 2012) and Ateneo De Manila University v. Capulong, G.R. No. 99327 (27 May 1993). ↩

  9. See: Eurostat, Statistical Confidentiality and Personal Data Protection, available at https://ec.europa.eu/eurostat/web/microdata/statistical-confidentiality-and-personal-data-protection (last accessed Feb. 21, 2020). ↩

  10. Ibid. ↩

  11. An Act Defining Gender-Based Sexual Harassment in Streets, Public Spaces, Online, Workplaces, and Educational or Training Institutions, Providing Protective Measures and Prescribing Penalties Therefor [Safe Spaces Act], Republic Act No. 11313 (2019). ↩

  12. Id., § 22 (8). ↩

  13. Id., § 26. ↩

Backlinks