Text
04 September 2025
Re: UNAUTHORIZED HANDLING OF STUDENT TRANSCRIPT OF RECORDS (TORS)
Dear [Redacted],
Greetings from the National Privacy Commission!
We respond to your request for an Advisory Opinion seeking guidance on whether the unauthorized removal of student Transcript of Records (TORs) by university personnel violates the provisions of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA).
In your letter-request, you mention that your university follows an established protocol whereby TORs from external campuses are delivered to the OUR for verification and thereafter handed to the University Registrar for signing within the OUR premises. However, from October 2024 to 6 February 2025, a Registrar II retained verified TORs and brought them to a Registrar IV for signing in another office outside the OUR premises. Further, on at least two occasions, the Registrar II also handed several TORs to the Registrar IV’s spouse—an employee of the Supplies Office—for further transmission, without the knowledge or approval of the University Registrar or the University President.
Thus, you now raise the following issues:
- Whether the unauthorized removal and handling of TORs for signature by another employee to be signed in any other place than the OUR violates the Data Privacy Act of 2012.
- Whether the acts of the concerned personnel amount to unauthorized processing, improper disposal, or unlawful disclosure of sensitive personal information under the DPA.
- Whether the liability may extend to both the Registrar II and Registrar IV, considering their roles in handling sensitive data.
Discussion
Sensitive Personal Information; Processing; Security Measures
Section 3(g) of the DPA defines personal information as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”1 Section 3(l) then defines sensitive personal information to include, among others, information “specifically established by an executive order or an act of Congress to be kept classified, as well as those issued by government agencies peculiar to an individual such as… educational, financial, or employment records.”2 Student TORs contain academic records, grades, and other educational information that directly identify students, thus making TORs sensitive personal information.
Processing, under Section 3(j) of the DPA3 and Rule II, Section 3(k) of the IRR, includes any operation performed on personal data such as use, storage, retrieval, consultation, transfer, or destruction.4 Unauthorized processing occurs when personal data is handled without proper authority, even if done by someone who otherwise has access within their official capacity.5
Section 20 of the DPA requires personal information controllers (PICs) to implement reasonable and appropriate organizational, physical, and technical security measures to protect personal data against unauthorized access or processing. They must ensure that anyone acting under their authority processes personal data only on their instructions or as required by law.6 Rule VI, Section 26 of the Implementing Rules and Regulations further elaborates on these security requirements.7
Organizational Security Measures; Non-compliance with established protocols
The university’s established procedure for processing and signing TORs functions as an organizational security measure designed to ensure confidentiality and proper handling of sensitive educational records. Any deviation from this protocol, such as removing TORs from the OUR without authority and handling them in unsecured locations outside the designated office— represents a failure to comply with these organizational safeguards.
Based on the limited facts available, there is no conclusive basis to determine whether the acts described constitute punishable acts under the DPA, such as unauthorized processing (Sec. 25), unauthorized access (Sec. 26), or unauthorized disclosure (Sec. 29). The personnel involved were authorized to process student records by virtue of their positions, and no actual proof of unauthorized disclosure has been presented based on your query.
Section 26 of the DPA penalizes providing access to personal or sensitive personal information to individuals not authorized by law, or its release to a person without authority, whether intentional or through negligence.8 Here, there is no showing that the TOR contents were actually disclosed to unauthorized persons, nor that the personnel acted wholly outside their authority as employees tasked with processing student records. However, the removal of the TORs from the OUR and their handling outside the established chain of custody indicate a deviation from organizational security measures required under Section 20 of the DPA. Such lapses, while not conclusive of a punishable act under Section 26, may still amount to a major infraction under NPC Circular No. 2022-01 (Guidelines on Administrative Fines),9 which allows for the imposition of penalties for violations committed in the course of processing, subject to proper fact-finding.
Extent of potential liability of the involved personnel; University policy and internal administrative and disciplinary mechanisms
Based on the facts provided, the acts described may not be considered outright a punishable violation under the DPA. The personnel involved were authorized to process student records by virtue of their positions, and no proof of unauthorized disclosure has been presented. Nonetheless, whether a violation of the DPA may be established will ultimately depend on the results of the University’s internal investigation or other fact-finding, which may bring to light circumstances not reflected in the present request.
Accordingly, their accountability may more appropriately be pursued through the University’s policies and internal administrative and disciplinary mechanisms, consistent with due process. Should further facts establish willful or negligent violations of the DPA itself, the personnel may fall within the scope of administrative sanctions under NPC Circular No. 2022-0110 as natural persons processing personal data or under the DPA itself.
It is worth noting that one of the employees previously served as the university’s Data Protection Officer, which may be relevant in assessing the gravity of the infraction.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 3, ¶ g (2012). ↩
-
Id. § 3, ¶ l(2). ↩
-
Id. § 3, ¶ j. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 3(k). ↩
-
Data Privacy Act of 2012, § 25. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, Rule IV, § 20 (2016). ↩
-
Id. § 26. ↩
-
Id. § 26. ↩
-
National Privacy Commission, Guidelines on Administrative Fines, NPC Circular No. 2022-01 (August 08, 2022). ↩
-
Id. ↩