Text
25 March 2022
Re: RECORDING AND UPLOADING OF ONLINE CLASSES
Dear [Redacted],
We write in response to your email received by the Presidential Complaint Center, which was forwarded to the National Privacy Commission (NPC) seeking clarification on whether the recording of online classes and uploading the same to Google Classroom are a violation of privacy law.
From your inquiry, we understand that you teach in college, and it is your school’s policy to require the recording of online classes and uploading the same to Google Classroom. We further understand that for not recording and uploading your online class, you are now facing a hearing in your school.
You now ask for the NPC’s guidance on whether the requirement of recording online classes and uploading them is a violation of the law.
Discussion
Lawful Criteria for Processing of Online Class Recordings; Educational Framework as the Contract Between the School and the Student
Republic No. 10173 or the Data Privacy Act of 20121 (DPA) is the law that governs the processing of all types of personal information and provides for the rights of the data subjects. Recording of online classes and any kind of activity pertaining to the recording, be it uploading or storage, are considered as processing of personal data, considering the content of the recording involves the names, images, videos, audio or other personal data of the individuals in the online class. Thus, any activity done in relation to the online class must be in accordance with the provisions of the DPA.
For the lawful criteria of processing of personal information, Section 12 of the law provides the instances when personal information may be processed, while Section 13 enumerates the allowable grounds of processing of sensitive personal information.2 Should any of the grounds be present in the given scenario, there is lawful basis for the requirement of recording and uploading of online class sessions by the school.
In Non vs. Danes II,3 the Supreme Court clarified the relationship between the school and the students in this wise:
But it must be repeatedly emphasized that the contract between the school and the student is not an ordinary contract. It is imbued with public interest, considering the high priority given by the Constitution to education and the grant to the State of supervisory and regulatory powers over all educational institutions [See Art. XIV, secs. 1-2, 4(1)].
The above doctrine was emphasized in Isabelo, Jr. vs. Perpetual Help College of Rizal where the Supreme Court declared: “We have also stressed that the contract between the school and the student, imbued, as it is, with public interest, is not an ordinary contract.”4
Reiterating the doctrine in the Alcuaz and Non cases, the Supreme Court characterized the school-student relationship as contractual in nature.5
The NPC considered this characterization by the Supreme Court of the contractual relationship between the school and the student in its interpretation of the application of the DPA in a school setting. The NPC refers to this contract between the school and the student as the “educational framework,” which encompasses all activities and operations the school may perform in line with the student’s education. Any processing of personal information to fulfill the obligations of parties within the educational framework is permissible, as provided in Section 12 (b) of the DPA which states:
SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;6
On the other hand, in the case of processing of sensitive personal information within the educational framework, which includes an individual’s information of his or her education such as grades, performance or awards, etc., such processing is still permitted under Section 13 (a) of the DPA, to wit:
SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, xxx.
Although the “fulfillment of a contract” requirement is not included in the enumeration in Section 13, the NPC anchors the processing of sensitive personal information within the school’s educational framework upon consent based on jurisprudence defining the contractual nature of the relationship between the school and the student. Hence, upon enrollment, the student and the school are deemed to have executed a contract imbued with public interest that necessarily carries with it the consent of both parties. A different interpretation would otherwise create an absurd situation where schools may not process or use their student’s educational information for his or her own education and benefit.
Processing of Personal Data Within the Educational Framework in Relation to Academic Freedom
At this juncture, the NPC would like to clarify that educational institutions may process personal data to achieve the purposes within its educational framework without the need for consent of the data subject. The data subject in an educational setting includes students7, faculty and staff. It is then of utmost importance that the school delineates all processing operations, carefully identifying those that are core to the educational framework and those outside of it (e.g. marketing or public relations purposes).
In the given facts, the NPC deems the recording of online classes, and any use, storage or any kind of processing related thereto) as permissible processing within the educational framework. The NPC, through our separate discussions with the Department of Education (DepEd) and Department of Interior and Local Government (DILG), have been informed of the necessity for these online class recordings.
Connected to this, the Supreme Court reiterated in the Isabelo, Jr. case,8 the doctrine in Ateneo de Manila University vs. Capulong9 that : “…this Court cited with approval the formulation made by Justice Felix Frankfurter of the essential freedoms subsumed in the term ‘academic freedom’ encompassing not only ‘the freedom to determine … on academic grounds who may teach, what may be taught (and) how it shall be taught’ but likewise ‘who may be admitted to study.’”10
In the same vein, the NPC respects the same doctrine of Academic Freedom for the processing of personal data within the educational framework, if it is in accordance with the provisions of the DPA and other existing laws, rules and regulations. The NPC will remain neutral on the chosen methods and technology by the educational institution as long as it is within the bounds of the law.
Given the foregoing, the complained requirement of recording online classes and uploading of the same to Google Classroom is not violative of one’s data privacy. However, we take this opportunity to remind the school to uphold the principle of transparency and the data subject’s right to information, such that all data subjects within its responsibility are apprised of the school’s privacy policies.
In view of this, we take this opportunity to remind schools to create and implement policies covering the processing of online class recordings, including the specific purposes for and acceptable use of such recordings. This can be made through privacy policies that are properly disseminated to all data subjects, including school faculty and staff, the students, and their parents or guardian, if necessary. Having clear policies will not only protect the data privacy of students but the teachers’ as well.
We also advise you to check on our website Public Health Emergency Bulletin No. 17 (Bulletin), which is an Update on the Data Privacy Best Practices in Online Learning. In this Bulletin, recommendations from government agencies, teachers, learners and parents were gathered to help assess and adequately address concerns relative to online learning. This Bulletin may be helpful and applicable regarding the concern raised in your email. You may find our Bulletin at this link: NPC PHE BULLETIN No. 17: Update on the Data Privacy Best Practices in Online Learning » National Privacy Commission.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Non v. Danes II, 264 PHIL 98-131 (1990). ↩
-
Isabelo, Jr. v. Perpetual Help College of Rizal, Inc., 298 PHIL 382-389 (1993). ↩
-
Parents-Teachers Association of St. Mathew Christian Academy v. Metropolitan Bank and Trust Co., 627 PHIL 669-690 (2010). ↩
-
Emphasis supplied. ↩
-
In the case of minor students, their parents or guardians. ↩
-
Note 5, supra. ↩
-
G.R. No. 99327, May 27, 1993. ↩
-
Isabelo Jr., 298 PHIL 382-389. ↩