NPC Issuance Wiki

NPC Advisory Opinion No. 2020-046 — Common Practices of Schools in Processing Personal Data of Students

Issued Advisory Opinion

Official opinion tags

Text

9 November 2020

Re: COMMON PRACTICES OF SCHOOLS IN PROCESSING PERSONAL DATA OF STUDENTS

Dear [Redacted],

We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) to provide clarification and guidance on school practices during this time of COVID-19 pandemic vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA). The following are your inquiries and our corresponding responses:

Discussion

  1. On posting of class list

We understand that before the school year starts, the class roster (which include the student’s full name, name of the school, grade level, section, and sometimes students’ test score when they took the school’s entrance/qualifying exam), are posted on the:

a. School’s bulletin board; and b. School’s official social media account (e.g. Facebook) and/or official website.

You ask whether NPC Advisory Opinion No. 2018-020 is applicable to Item A. You likewise ask if the above situations are not allowed under DPA, can it be remedied if such is clearly expressed in the Student Handbook, or in the enrolment form upon their enrolment (in a form of consent and disclosure)?

Sensitive personal information; education; lawful processing

Under the DPA, information about an individual’s education is categorized as sensitive personal information,2 the processing of which is generally prohibited unless covered by the criteria set forth under Section 13 of the law and other existing laws, rules and regulations.

Apart from the student’s name, the data set enumerated included in the class roster, i.e. student’s school name, grade level, section and test scores, are considered sensitive personal information as these are related to the student’s education. The processing, which includes disclosure or posting, of the enumerated information must be in accordance with Section 13 of the DPA, viz:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;

(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

Since the DPA should be read in parallel with existing laws, rules and regulations, the pertinent issuances of the Department of Education (DepEd) or the Commission on Higher Education (CHED) should also be consulted. If there is an existing issuance of the DepEd and/or CHED on this matter, the same may be relied on as a lawful basis for the posting in the bulletin board or official social media account, provided that the issuances guarantee the protection of personal data.

If there are no existing rules and regulations on the matter issued by the relevant regulatory agencies, the school should obtain the students’ or their legal guardians’, in case the students are minors, consent.

NPC Advisory Opinion No. 2018-0203 on the “Posting of the List of Admitted Students in Bulletin Board of the School” is not applicable to the case at hand as the situation contemplated in the advisory opinion was limited to the posting of the names of entrance exam passers. Names are classified as personal information, the processing of which may be anchored on the legitimate interest of the school, subject to the three-part test on purpose, necessity, and balance.

It is not the same case as the posting of more detailed information on a student’s education which is sensitive personal information, the processing of which cannot rely upon legitimate interest as this ground is absent in Section 13 of the DPA.

Likewise, the said Advisory Opinion concluded by still recommending that consent be obtained moving forward to ensure that the school adheres to the principles of transparency and legitimate purpose.

The school should carefully reexamine whether such practice of posting class lists is still necessary and proportional to the purpose which the school seeks to achieve. Consider also that posting in a physical bulletin board inside the school has a different context as posting in a social media platform or website that is publicly accessible.

  1. On posting of screenshots/photos of students

You asked if a teacher is allowed to post on his/her personal social media account (FB, Twitter, Instagram) screenshots of his/her class/students during their online class, where the posted screenshots would reveal the faces of the students and/or their real/nicknames.

Further, you asked if it is permissible if the posting is done officially by the school on the school’s official website and/or FB account for “legitimate school-related purposes” which may include educational, promotional, school community information regarding the status of school’s online classes, etc. If otherwise not allowed, can the same be remedied if such an act is clearly expressed in the Student Handbook?

Social media posting; photos of online classes; photos of children

Under the DPA, an individual’s name and photo are generally categorized as personal information, and the posting on social media of the same should be grounded upon a lawful basis under Section 12 of the DPA. In the case of the school, it may be possible to rely on the fulfilment of the school’s contract with its students as well as legitimate interest of the school pursuant to Section 12 (b) and (f) of the DPA, respectively.

However, in certain instances where a photo would reveal sensitive personal information, which includes educational information, the posting of the same should find basis under Section 13 of the DPA instead.

In this case, if the screenshots of online classes where students are identifiable by their names and images, would likewise reveal other education-related details, i.e. name of school, grade level, exam scores, etc., the same may be considered as processing of sensitive personal information.

We wish to emphasize that whether the posting was done by a teacher or the school, the same should always have a lawful basis for processing under the DPA.

In the given scenarios of posting screenshots of online classes in social media platforms, it would seem that consent is the most appropriate basis, given the context and the manner such photo was taken and will be disclosed. Hence, the teacher and the school should have obtained the consent of the students, or parents, in case of minor students.

The school should have policies in place, i.e. social media policy, netiquette guidelines, etc. to serve as a guide on how schools handle students’ photos, videos, and other personal data, the duties and responsibilities of teachers and other school personnel, as well as rules for students themselves.

Even stakeholders have identified the issues surrounding the use of social media in education. We quote herein the Data Privacy and Online Learning Advisory4 from the Data Privacy Council Education Sector, a stakeholders group working closely with the National Privacy Commission:

“C. On the use of social media

xxx xxx xxx

  1. Posting or sharing of personal data (e.g., photos, videos, etc.) on social media must always have a legitimate purpose. Such purpose, along with the type of personal data involved, often determines whether or not the consent of affected data subjects is necessary prior to such posting or sharing.

  2. Even when posting of personal data is determined to be allowed:

a. the numerous risks inherent in social media platforms should still be properly appreciated. Adherence to the principles of legitimate purpose and proportionality is encouraged at all times. b. it must be carried out using only authorized or official social media accounts of the educational institution (or any of its units or offices). There should be appropriate rules or protocols governing the use of these official accounts.”

The above are construed as recommendations. While not controlling as in the case of NPC issuances, we deem these to be best practices which are aligned with the provisions of the DPA.

We remind schools, and especially the teachers, that the processing of personal data for online classes is only for purposes related to online learning and teaching, and not for a teacher’s personal use.

We wish to emphasize that processing operations performed about vulnerable data subjects like minors or in any other case where an imbalance exists in the relationship between a data subject and a personal information controller or personal information processor,5 require

special protection.6 Note that “children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data.”7

  1. On posting of the list of students’ awards, recognition of students’ achievements/results during school-related competitions and representation, and scholarship grant qualifiers

You likewise ask if the posting of the above in the school’s official website and/or in the school’s official social media accounts is allowed under the DPA.

Honors, awards, achievements and results during any school-related competition and representation, including school or government scholarship grants, all fall under sensitive personal information since these are information on an individual’s education.

Similar to the discussion in Item No. 2 above, the processing of such sensitive personal information should be based on any of the criteria provided under Section 13 of the DPA. In this scenario, consent may be the most appropriate lawful basis for processing.

Expressly stating certain provisions on the subject in the student handbook is not a valid remedy nor will the same provide a lawful basis for processing. This may address the requirement for transparency but is not equivalent to obtaining consent.

  1. On school-related programs and activities

You also ask whether the posting/publication of students’ pictures and videos showing their participation/involvement in school-related or sponsored activities or programs in the school’s official website, in the school’s official social media accounts, and/or in the school’s promotional or publication materials (brochures, videos, school paper, etc.) is allowed.

Policies; other considerations; data subject rights

We note that the participation or involvement by a student in school-related or sponsored activities and programs may be shown through different ways. The evaluation on whether the pictures and videos may constitute personal or sensitive personal information may be made on a case-to-case basis, considering various factors and circumstances, i.e. whether the photos or videos involve a large crowd at a school event, etc.

As discussed in Item No. 2, names and photographs may be considered as personal information and may be shared or disclosed pursuant to Section 12 of the DPA. If otherwise considered as sensitive personal information, Section 13 would then apply.

The school would have to make the determination of the most appropriate lawful basis for processing, taking into account all relevant circumstances of the processing, adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality, as well as the students’ reasonable expectation of privacy and the impact on their rights and freedoms.

In all cases, schools must have mechanisms in place whereby the students, by himself/herself or through their parent or legal guardian, would be able to exercise his/her rights as a data subject, i.e. be able to provide consent and withdraw the same, object to the processing of personal data, request for erasure, etc., as may be appropriate and subject to the provisions of the DPA and its Implementing Rules and Regulations.

  1. On posting students’ account or balance

Finally, you ask whether the posting of the students’ account or balance or amount due for a given month (showing the student’s full name and the amount payable) on the school’s community bulletin board (usually near the Cashier/Treasurer’s Office) is allowed. If otherwise, can the same be remedied if such an act is clearly expressed in the Student Handbook?

Proportionality

The principle of proportionality dictates that the least privacy-intrusive means of processing should be chosen, if available. In this case, sending of notices by the school of the amounts payable directly to the student, or his or her parent or legal guardian, can be easily done and is more appropriate. In this scenario, there may be no need to post such names and amounts due in the community bulletin board.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 3 (l). ↩

  3. National Privacy Commission, NPC Advisory Opinion No. 2018-020 (Apr. 18, 2018). ↩

  4. Data Privacy Council Education Sector, Advisory No. 2020-1 - Data Privacy and Online Learning, available at https://www.privacy.gov.ph/wp-content/uploads/2020/10/DP-Council-Education-Sector-Advisory-No.-2020-1.pdf, p. 5-6 (last accessed 9 Nov 2020). ↩

  5. NPC Circular 17-01, §5(c)(3). ↩

  6. Article 29 Data Protection Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, Item III (B)(a)(7), 4 April 2017. ↩

  7. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119, Recital 38 (4 May 2016). ↩

Backlinks

  • No backlinks found