Privacy Notice for Faculty and Staff

Employee Privacy Notice:

PRIVACY NOTICE FOR UNIVERSITY PERSONNEL

I. INTRODUCTION

L-NU is committed to complying with the Data Privacy Act of 2012 (DPA) http://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/ in order to protect the right to data privacy of L-NU personnel (the data subject).

This notice explains in general terms the purposes, and legal bases, for the processing of the typical examples of personal and sensitive personal information that L-NU collects from its personnel, the measures in place to protect data privacy, and the right to access and correct the same. Please note that this document does not contain an exhaustive list of all of L-NU’s processing systems, as well as the purposes and legal bases for processing. L-NU websites, as well as other L-NU offices or units, may provide other privacy notices pertaining to specific processing systems. Under the DPA, personal information may be processed (e.g., collected, used, stored, disclosed): (1)with the consent of the data subject; (2) pursuant to a contract with the data subject; (3)when it is necessary in order for L-NU to comply with a legal obligation; (4) to protect vitally important interests including life and health; (5) in order to respond to a national emergency; (6) to comply with the requirements of public order and safety; (7) to fulfill the functions of public authority; or (8) pursuant to the legitimate interests of L-NU or a third party, except where such interests are overridden by the data subject’s fundamental rights.Sensitive personal information (e.g., confidential educational records, age, birthdate, civil status, health, religious affiliation) on the other hand may be processed: (1) with the consent of the data subject; (2) when such is allowed by laws and regulations, and such regulatory enactments provide for the protection of such information, and the consent of the data subject is not required. Processing may also be done when needed to protect the life and health of the data subject, or another person, and the data subject is unable to legally or physically express consent, in the case of medical treatment; or needed for the protection of lawful rights and interests of natural or legal persons in court proceedings, and for the establishment, exercise or defense of legal claims, or where provided to government or public authority.

Section 4 of the DPA also provides that among others such Act does not apply to the following:

(a) Information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including:

(1) The fact that the individual is or was an officer or employee of the government institution;

(2) The title, business address and office telephone number of the individual;

(3) The classification, salary range and responsibilities of the position held by the individual; and

(4) The name of the individual on a document prepared by the individual in the course of employment with the government;

(b) Information about an individual who is or was performing service under contract for a government institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services;

(c) Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

(d) Personal information processed for journalistic, artistic, literary or research purposes;

(e) Information necessary in order to carry out the functions of an educational organization.

In most cases L-NU processes your personal data in order to carry out its functions as a private University and its right to academic freedom under the 1987 Constitution, comply with legal obligations, lawful issuance or orders of other public authorities, as well as contractual obligations to you, and to pursue its legitimate interests. Personal data refers to personal and sensitive personal information as defined under the DPA. The term L-NU/University/us refers to the relevant Lyceum-Northwestern University and other campuses. For the sole purpose of this notice the term you/your/University personnel refers to applicants for L-NU posts, including those covered by contract of services, past and present L-NU employees, as well as non-employees engaged by L-NU to perform personnel services pursuant to contract including, for example, lecturers, visiting professors. Please note that certain purposes for the processing of personal and sensitive personal information may apply only to certain personnel (e.g., employees or academic staff).

II. SOURCES AND CATEGORIES OF PERSONAL DATA

You provided L-NU with various personal data when you applied for a post. You may have attached documents, as well as references or recommendations. When you submitted your application and provided such references or recommendation letters, you granted consent, or authorized L-NU, to verify such information by securing relevant documents from third parties (e.g., academic institutions), and obtained the prior consent of third parties providing you with a reference or recommendation letter for L-NU to process their personal information in connection with your application. In the course of your employment or engagement with L-NU, you accomplish or sign forms required by law or lawful issuances of public authorities (e.g., Personal Data Sheet and, Social Security  System [SSS], PhilHealth, Home Development Mutual Fund [HDMF or Pag-IBIG]) or file applications in connection with your employment or engagement (application for renewal of appointment or tenure for academic staff, leaves, benefits and the like).

During your employment or engagement with L-NU, you (and in some instances in collaboration with others) produce as part of your functions documents, records, publications, research, minutes, records of proceedings and the like containing your personal data. Some forms require you to provide a photograph. In some instances, your image is captured when L-NU documents, records, publishes, broadcasts, transmits, uploads or streams University activities or events. L-NU operates closed circuit television (CCTV) systems for the safety and security of members of the L-NU community including personnel, students, alumni and guests, as well as its buildings, surrounding premises and assets. In the course of operating such CCTV systems, L-NU may capture your images. In the case of some offices, biometric information may be also be used to check attendance and secure such offices. L-NU may also collect publicly available information about you. The categories of personal information that L-NU processes, usually through paper based or electronic means, include:

• Personal Details: Name, past or present addresses, provincial address, contact details, birthdate, birthplace, age, gender, civil status, religion, citizenship, signature and such other information found in Personal Data Sheet; name of father, mother, spouse, children and other family members as required by, for example,SSS forms or for providing benefits to dependents.

• Educational Background: Official Transcript of Records or True Copy of Grades, Diplomas, Educational Attainment, etc.;

• Government-Issued Identification: SSS Number (Common Reference Number), taxpayer identification number (TIN), PhilHealth Number, Pag-IBIG Fund (HDMF) Number, L-NU employee number, etc.;

• Health information: height, weight, relevant medical details, etc.

• References: Names, contact details, employment details;

• Information Related to your Employment or Engagement: Service record,

recruitment and performance ratings, comments, feedback, succession planning, skills and competencies, and other work-related qualifications (other relevant training, publications, research, extension work, awards and the like) security data, disciplinary records, and background check reports, your personal information contained in reports, documents or records you produce during your employment or engagement and other similar information;

• Emergency Contacts: Names, addresses, other contact details;

• Photographs/Images/Biometric information as discussed above.

III. PURPOSES FOR THE PROCESSING OF PERSONAL DATA L-NU

processes your personal data for the following purposes:

a. For those applying for posts:

1) To process submitted forms and documents bearing personal information for the purpose of determining the fitness of the applicant for the position applied for;

2) To facilitate the conduct of mandatory pre-employment examinations;

3) To facilitate planning and staffing;

4) To verify the applicant’s identity, prevent identity fraud and conduct reference or background checks;

5) To communicate with you regarding your application;

6) In the event you are not selected for a post, L-NU may, at its sole discretion and with your consent, retain your application and supporting documents in order for L-NU to consider you for other posts for which you appear to be qualified.

b. For those employed or engaged by L-NU (note that as stated above, some purposes apply only to employees and to certain categories of employees):

1) To enable L-NU to perform its mandate pursuant to exercise its right to academic freedom under the 1987 Constitution;

2) To verify your identity and prevent identity fraud;

3) To facilitate your employment or engagement, which includes processing your pre-appointment requirements, including medical clearance;

4) To perform personnel actions such as the issuance or renewal of your appointment or contract, to act on your tenure application where applicable, process promotions, process your applications for leaves, retirement and the like.

5) To facilitate entry into contracts involving L-NU and third parties, such as with a private depositary, where L-NU will directly deposit compensation of employees, the Provident Fund and its benefits, and the like;

6) To communicate with you regarding matters related to your employment or engagement and other legitimate concerns;

7) To create/issue, modify and cancel/delete vehicle stickers or passes, clearances or access to L-NU’s information and communications technology (ICT) based data processing systems, including email;

8) To maintain employee records or records of your contract(s), as required by law;

9) To assess your performance and competencies;

10) To provide you with available training and development opportunities beneficial to you and L-NU;

11) To process your applications for grants, scholarships, fellowships, travel authorities, attendance in seminars, conferences and the like as well as other similar applications in the case of qualified personnel;

12) To process your payroll, allowances, and other benefits, and make direct deposit of payments to your bank account;

14) To provide, facilitate or manage health and other welfare-related services, when available, to qualified personnel and their dependents, subject to L-NU’s rules;

15) To comply with internal processes and legal requirements in the administration of disciplinary proceedings;

16) To investigate and resolve work-related incidents;

17) To provide a safe workplace, and secure L-NU premises from threats, theft, robbery, fraud, legal liability, and similar incidents;

18) To manage the assets and documents that may have been released to you in the course of your employment with L-NU;

19) To process the disbursement of expenses that may have been incurred by you in the performance of your functions;

20) To process any certifications, or any other documents that you may request from L-NU in relation to your employment or engagement;

21) To establish a contact point in the event of an emergency involving you, your colleagues, or third parties;

22) To comply with the obligations stipulated in your employment or engagement contract;

23) To conduct audits, or investigate a complaint or security threat;

24) When so required, to process the termination of your employment or engagement;

25) When so required, to settle accountabilities upon termination of your employment or engagement;

26) To compile statistics and conduct research, subject to the provisions of the DPA, and applicable research ethics guidelines, in order to carry out its internationalization goals;

27) To enable you to participate, where applicable, in selection processes, such as for the selection of the Faculty or Staff, and the like;

28) To comply with other applicable statutory and regulatory requirements, including directives, issuances by, or obligations of LNU to any competent authority, regulator, enforcement agency, court, or quasi-judicial body;

c. To establish, exercise, or defend legal claims;

d. To fulfill other purposes directly related to the above-stated purposes; and

e. For such other purposes as allowed by the DPA and other applicable laws.

IV. DISCLOSURES

Examples when L-NU discloses information as allowed by the DPA or other applicable laws, or with your consent, include:

a. disclosing your name, position or function, office address, and other relevant information that are exempt from the coverage of the DPA in the relevant L-NU site, office rosters, or directories and the like, for public information purposes, or as required in order to comply with the requirements of issuances, such as requirements by statutory and regulatory bodies;

b. disclosing that you are the recipient of a grant, or any other discretionary benefit of a financial nature, given by L-NU or the Philippine government, as allowed by Section 4 (c) of the DPA;

c. disclosures for your benefit or in support of your interests (such as those intended to enable you to participate in exchange programs, conferences, training, academic and other similar competitions or events), or to apply for, receive and comply with terms and conditions of scholarships, grants and other forms of assistance, or to be considered for and to receive awards with your consent;

d. disclosures in order to enable L-NU to participate in university ranking exercises and other similar internationalization activities;

e. news or feature articles (or other similar disclosures) about your achievements, awards received, research and public service activities, and the like in L-NU public spaces, publications, websites or social media posts, or disclosures that L-NU may make in the exercise of its sound discretion in response to inquiries from the press, or press releases and other similar disclosures for journalistic purposes, as allowed by the DPA, or with your consent;

f. disclosure of relevant personal data in relation to selection processes for certain posts, when such personal data is made available online, pursuant to the principle of democratic participation, and in the interest of transparency;

g. publishing, broadcasting, transmitting, uploading or streaming of L-NU activities or events pursuant to the legitimate interests of L-NU or third parties, or for journalistic purposes as allowed by the DPA;

h. disclosures needed in order to enable L-NU to deposit salaries and other compensation directly to an employee’s bank account;

i. information that we share with third parties who process your information in order to provide products or services to you or L-NU (e.g. to enable the printing of your L-NU ID card, cloud service providers for data processing systems, email and software providers, third party health providers and medical laboratories that process your medical clearance, and annual physical examinations). Unless your consent is given, it will not be possible for such products or services to be provided to you;

j. disclosures needed in order to enable you to receive medical treatment from third party health providers in the event you are physically or legally unable to give consent;

k. disclosures made pursuant to law and lawful issuances or orders of public authorities, such as the PRC Professional Regulatory Commission, Social Security System, PhilHealth, Home Development Mutual Fund, Commission on Higher Education, Maritime Industry Authority, law enforcement agencies, courts, and quasi-judicial bodies;

l. disclosures made in order for L-NU to respond to an emergency and comply with its duty to exercise due diligence to prevent harm or injury to you or others;

m. disclosures to establish, exercise, or defend legal claims; and

n. such other disclosures that may be made pursuant to the DPA and other applicable laws. Where applicable, L-NU will take reasonable steps to require third parties who receive your personal data to uphold your right to data privacy.

V. RETENTION OF YOUR PERSONAL DATA

L-NU shall retain and provide measures for the secure storage of your personal data for as long as the above purposes for processing such data subsist, in order to establish or defend legal claims, or as otherwise allowed or required by the DPA and other applicable laws and issuance. L-NU will archive and provide for the secure disposal of your personal data pursuant to the requirements of, among other laws and issuances, the DPA, National Privacy Commission issuances, National Archives Act, Commission on Audit issuances and Civil Service Commission Memorandum Circulars No. 8, Series of 2007, and No. 1, Series of 2011.

VI. HOW L-NU PROTECTS YOUR PERSONAL DATA

L-NU has put in place physical, organizational and technical measures to protect your right to privacy and is committed to reviewing and improving the same. From time to time L-NU posts information on relevant sites and sends emails that explain how you can secure and maintain the confidentiality of your personal data. L-NU offices are permitted by the DPA and other laws to share information with each other for the purpose of carrying out the mandate of L-NU pursuant to L-NU’s bylaws, policies  and other applicable laws. For example, appointments of certain personnel require that their personal data be transmitted by the recommending unit to other offices (HRD, Accounting Office), and by the L-NU Board of trsutees, through channels. Rest assured that L-NU officials and personnel in such offices are allowed to process your personal information only when such processing is part of their official duties.

VII. ACCESS TO AND CORRECTION OF YOUR PERSONAL DATA AND YOUR RIGHTS UNDER THE DPA

You have the right to access personal data being processed by L-NU about you. You may access your personal information, for instance, where applicable through the Human Resources Information System (HRIS) or request documents from relevant offices manually (e.g., the relevant Human Resources Development Office, Accounting Office). In order for L-NU to see to it that your personal data is disclosed only to you, these offices will require the presentation of your L-NU ID, or other valid government-issued IDs (GIID), and documents that will enable such offices to verify your identity. In case you process or request documents through a representative, in order to protect your privacy, we require you to provide a letter of authorization specifying the purpose for the request of documents or the processing of information, and your L-NU ID or other valid GIIDs, as well as the valid GIID of your representative. In the event that your information needs to be corrected please follow the instructions found in the relevant website or kindly get in touch with the proper L-NU office(s).

Aside from the right to access and correct your personal data, you have the following rights subject to the conditions and limitations provided under the DPA and other applicable laws and regulations:

a. The right to be informed about the processing of your personal data through, for example, this and other applicable privacy notices.

b. The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. Please note however that (as mentioned above) there are various instances when the processing of personal data you have provided to us is necessary for us to comply with L-NU’s mandate, statutory and regulatory requirements, or is processed using a lawful basis other than consent. In the case of your L-NU RFID card it is your duty to immediately report the loss of such card to the proper HRDO and the L-NU ITTSG so that L-NU can prevent the unauthorized use of the same.

c. The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, considering any violation of your rights and freedoms as a data subject; and

d. The right to lodge a complaint before the National Privacy Commission provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the proper Data Protection Officer (DPO) through the email address indicated below regarding the processing of your information or the handling of your requests for access, correction, blocking of the processing of your personal data, and the like.

VIII. HOW WE OBTAIN YOUR CONSENT AND HOW YOU CAN WITHDRAW CONSENT

L-NU obtains your consent for the processing of your personal data pursuant to this privacy notice by asking you to sign the relevant form or, in some instances, to give your consent through electronic means. If you wish to withdraw consent, please write or send an email to the relevant L-NU office that processes your information and identify the processing activity for which you are withdrawing consent. Please provide a copy of your L-NU ID or other GIID so that the relevant office will be able to verify your identity. Note that consent may be withdrawn only for a processing activity for which consent is the only applicable lawful ground for such processing. Please await the responsible office’s action regarding your request. Rest assured that once such office confirms that you have validly withdrawn consent for a processing activity the same shall be effective unless you thereafter send a letter or email to said office with a copy of your ID that you are consenting to such processing activity.

IX. REVISIONS TO THIS PRIVACY NOTICE AND QUERIES REGARDING DATA PRIVACY

HRD - POLICY

L-NU needs to process your personal and sensitive personal information - that is, information that identifies you as an individual in order to carry out its obligation as an academic institution and in compliance with other applicable laws.

L-NU is committed to comply with the Philippine Data Privacy Act of 2012 (DPA) in order to protect your right to data privacy.

Under the DPA, personal information may be processed e.g. collected, used, stored, disclosed, etc. with the consent of the data subject, pursuant to a contract with the data subject; when it is necessary in order for L-NU to comply with a legal obligation; to protect your vitally important interests including life and health; respond to a national emergency, public order, and safety; fulfill the functions of public authority or pursuant to the legitimate interests of the University or a third party, except where such interests are overridden by your fundamental rights.

Sensitive personal information (e.g, age/birthdate, civil status, confidential educational records etc.) on the other hand may be processed with the consent of the data subject, when such is allowed by laws and regulations, such regulatory enactments provide for the protection of such information and the consent of the data subject is not required for such law or regulation. Processing may also be done when needed to protect the life and health of the data subject or another person and the data subject is unable to legally or physically express consent, in the case of medical treatment, or needed for the protection of lawful rights and interests of natural or legal persons in court proceedings, and for the establishment, exercise or defense of legal claims or where provided to government or public authority.

The term L-NU/University/us refers to the Lyceum-Northwestern University and offices.

The term you/your refers to all University faculty and staff who are required to submit their CVs to the Office of the Vice President for Academic Affairs and the HRD.

PERSONAL AND SENSITIVE PERSONAL INFORMATION COLLECTED, THE PURPOSE/S AND LEGAL BASIS FOR PROCESSING SUCH INFORMATION

You provided us through the submission of your CV your current affiliation in L-NU (faculty rank, whether or not your appointment is permanent or temporary, administrative position if any), educational background (starting with your undergraduate degree and other subsequent degrees earned as well as any honors received), list of publications, creative works, projects, engagements in civil society and all other similar academic or scholarly activities (HRD MEMO on updating of faculty qualifications).

We required you through the above memo to submit your CV without any prescribed form through email and google drive using MS Word in order for the HRD through the OVPAA to capture the breadth and diversity of the outputs that you have produced and extension service you have provided and to conduct research on the same. We are aware that other data collection systems and the like may need to be revised in order to properly reflect and provide valuation for your accomplishments. We will also use such information for other similar purposes as allowed by the DPA.

Note that L-NU and college offices are permitted by the DPA and other laws to share information with each other for the purpose of carrying out the mandate of L-NU pursuant to the Constitution, and other applicable laws.

L-NU is aware that it must process information in line with the data processing principles which includes proportionality which means that personal information processed must not be excessive in relation to the purpose/s stated for the processing of such information.

We therefore request you and your respective units to delete or redact personal information contained in your CV that we do not need in relation to the above stated processes. These include the following and other analogous information your civil status, age or birthdate, home and office addresses, contact information,

L-NU does not process your personal information to carry out any wholly automated decision making that affects you.

INSTANCES WHEN YOUR RELEVANT PERSONAL AND/OR SENSITIVE PERSONAL INFORMATION MAY BE DISCLOSED BY L-NU TO THIRD PARTIES AND THE PURPOSE/S AND LEGAL BASIS FOR SUCH DISCLOSURES

The University will disclose or share your relevant personal and/or sensitive personal information to third parties in order to carry out its mandate as an academic institution, comply with legal obligations, perform its contractual obligations to you, promote and protect your interests and in order to pursue its legitimate interests and/or that of a third party. L-NU discloses such information when required or allowed by law or with your consent. Examples or instances of these include:

1. disclosure of your personal and/or sensitive personal information in compliance with University policies, rules and processes adopted pursuant to the Constitution, and other applicable laws, rules and regulations in order to uphold or promote your interest subject to the limitations provided by existing laws and jurisprudence, promote the legitimate interests of the University or third parties or with your consent

2. disclosures to enable L-NU to participate in university ranking exercises and other similar internationalization activities.

3. news or feature articles about your achievements, awards received, research and public service activities and the like in University publications, websites or social media posts, disclosures that the University may make in the exercise of its sound discretion in response to inquiries from the press or press releases and other similar disclosures for journalistic purposes as allowed by the DPA or with your consent

4. other disclosures analogous to the foregoing as allowed by the DPA

HOW L-NU PROTECTS YOUR PERSONAL AND SENSITIVE PERSONAL INFORMATION

Even prior to the effectivity of the DPA, L-NU put in place physical, organizational and technical measures to protect your right to privacy and is committed to reviewing and improving the same.

Rest assured that data you submit through this portal is encrypted at rest and during transmission and that only authorized personnel are allowed to process your information.

ACCESS TO AND CORRECTION OF YOUR PERSONAL AND SENSITIVE PERSONAL INFORMATION

We require you to provide us with truthful, accurate and complete information.

In order to uphold your right to access personal information contained in our processing system about you HRD will transmit a printout of your information.

In the event that your information needs to be corrected or updated please email the hrd@L-NU.edu.ph

HOW WE OBTAIN YOUR CONSENT AND HOW YOU CAN WITHDRAW CONSENT

L-NU obtains your consent for the processing of your personal and sensitive personal information pursuant to this privacy notice by asking you to electronically consent to the same. Note that consent may be withdrawn only for a processing activity/ies for which consent is the sole applicable lawful ground for such processing. If you wish to withdraw consent please email hrd@L-NU.edu.ph. Kindly await HRD action regarding your request. Rest assured that once HRD confirms that you have validly withdrawn consent for a processing activity/ies the same shall be effective unless you thereafter send a letter or email to the HRD with a copy of your ID that you are consenting to such processing activity/ies.

AMENDMENTS TO THIS NOTICE AND PRIVACY QUERIES

We encourage you to visit the portal to see any revisions or updates to this notice. We shall also endeavor to alert you via email of these changes.

If you have any Data Privacy queries or concerns as it relates to your CV submission please contact the HRD.

For queries, comments or suggestions regarding this System-wide privacy notice, please contact the University Data Protection Officer through the following:

Name of DPO - Zachary G. Javelona, MBA, CISA

Email: dpo@lyceum.edu.ph, qao@lyceum.edu.ph  

Tel.: 075-615-1701

Postal:

Quality Assurance Office, 2nd Floor, Admn. Building

Lyceum-Northwestern University

Tapuac Road, Tapuac District

Dagupan City, Pangasinan, 2400

PRELIMINARY PROVISIONS

A. Scope

The members of the faculty perform a vital role in the fulfillment of the University’s Vision and Mission. In the course of the latter’s discharge of its authority as an autonomous University, it must protect the personal information of its faculty members.

This Derivative Policy aims to outline and discuss how the University handles the processing of the faculty’s personal information in accordance with the Data Privacy Act of 2012.

B. Definition of Terms

For the purposes of this Policy, the following definitions shall apply:

1. Data Privacy Act (DPA) refers to Republic Act No. 10173 or the Data Privacy Act of 2012;

2. Data Processing System refers to either computerized system or physical records which stores, processes or transmits personal information or sensitive personal information owned or managed by your L-NU Registrar or office;

3. Data Subject refers to an individual whose personal information is processed. For the purposes of this Policy, the term Data Subject shall refer to the members of the faculty;

4. Faculty refers to the teaching staff of each academic unit, comprising of both regular and non-regular faculties;

5. IRR refers to the Implementing Rules and Regulations of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012;

6. NPC refers to the National Privacy Commission of the Philippines as created by the Data Privacy Act of 2012;

7. Personal Data refers to personal information, sensitive personal information, and privileged information as defined by the Data Privacy Act of 2012;

8. Privacy Risk refers to the potential loss of control over personal information when a threat exploits vulnerability;

9. Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data; and

10. Units and Offices refers to L-NU academic units and administrative offices;

CARDINAL PRINCIPLES OF DATA PRIVACY IN RELATION TO THE PROCESSING OF THE FACULTY’S PERSONAL DATA

A. Transparency

The University shall process the personal information of its faculty only after ensuring that the latter are apprised of the identification of the office or unit collecting their personal data; and the nature, purpose, and extent of its processing.

B. Proportionality

The University shall constantly abide by the principle of data minimization wherein it shall only process personal data that are accurate, relevant, and necessary for the declared purpose(s).

Furthermore, it will not process personal data if the purposes of the processing could be reasonably fulfilled by other means.

C. Storage, Retention, Disposal, and Destruction of Personal Data

The University shall ensure that all the personal data it collects and uses are stored in secured storage facilities in order to avoid any unauthorized access or use to the same. Moreover, it shall employ the necessary physical, organizational, and technical security measures to ensure that the stored personal data shall remain confidential, available, and unaltered.

It shall retain the faculty’s personal data only for as long as necessary and required by the pertinent laws, rules, and regulations within its Management System.

Personal data shall be disposed of and destroyed in such a way that no part of the data will be exposed and its reconstitution rendered impossible.

D. Access

The University shall ensure that only the authorized personnel shall have access to the personal data of its faculty. Moreover, their access to the same shall be strictly limited to the fulfillment of their respective duties in relation to the personal data involved. The access to personal data shall likewise be in line with the Data Security Data Classification Policy..

CONSENT

Generally, a data subject’s consent is a prerequisite to the lawful processing of their personal data. However, the same is not absolute, as under the following conditions, the University may process a faculty’s personal data without the latter’s consent:

1. The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;

2. The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

3. The processing is necessary to protect vitally important interests of the data subject, including life and health;

4. The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

5. The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

RIGHTS OF THE DATA SUBJECT

A. Right to be Informed

Every faculty member has the right to be informed of the purpose of the collection, use, disclosure, and other operations involving the processing of their personal data. This includes how the data will be processed, and the offices or units that will process or handle the same.

B. Right to Access

Every faculty member has the right, subject to pertinent laws and University rules and regulations, to the reasonable access to their personal data processed by the University.

C. Right to Object, and Right to Correct or Rectify

Every faculty member has the right to dispute the accuracy in their personal data and have the same rectified or corrected.

D. Right to Erasure or Blocking

These rights of erasure and blocking do not apply to Personal Data, documents, records and accounts which are part of L-NU's records. It may be exercised if there is a substantial proof that the processing of Personal Data is unlawful.

E. Right to Data Portability

Every faculty member has the right, subject to pertinent laws and University rules and regulations to request for a copy of their personal data in a format that is commonly used and allows further use.

F. Right to File a Complaint and Right to Damages

Every faculty member has the right to file a complaint in the event that their personal information has been misused, maliciously or improperly disclosed, or any of the aforementioned rights have been violated. Moreover, they have the right to be indemnified for any damage they have suffered by reason of the said violation(s).