Privacy Questions

Frequently Asked Questions on Data Privacy Rights

A Guide for Lyceum-Northwestern University Students and Learners

1. What is the Data Privacy Act of 2012 (DPA)?

The Data Privacy Act of 2012 (Republic Act No. 10173) is a landmark law in the Philippines that protects your fundamental right to privacy by regulating the collection, processing, and use of your personal data. It applies to all individuals and organizations—including Lyceum-Northwestern University—that process personal information, whether in the government or private sector.

2. Who is a "Data Subject" and what is "Personal Information"?

You are a Data Subject! 👤 A Data Subject is an individual to whom personal information relates. In short, it's you. Your Personal Information is any data that can be used to identify you, such as your name, student ID number, address, email, and phone number. The law also defines Sensitive Personal Information, which includes more private details like your religious beliefs, political affiliations, health records, and government-issued IDs.

3. What are my fundamental data privacy rights as a student?

As a Data Subject, you have several key rights under the DPA:

• The Right to be Informed: You have the right to know when your data is being collected and why.

• The Right to Access: You can request a copy of the personal data an organization has about you.

• The Right to Object: You can object to the processing of your data, especially if it's for marketing or other purposes not related to your initial transaction.

• The Right to Rectification: If your data is incomplete or inaccurate, you have the right to have it corrected.

• The Right to Erasure or Blocking: You can demand the removal or destruction of your data if it is no longer necessary or was processed unlawfully.

• The Right to Data Portability: You have the right to receive a copy of your personal data in an electronic format to easily transfer it to another organization.

• The Right to File a Complaint: If you believe your rights have been violated, you can file a complaint with the National Privacy Commission (NPC).

4. What are some common examples of data privacy violations?

A data privacy violation occurs when an organization processes your data without a valid legal basis, such as your consent. Common examples include:

• Data Breaches: When a university's database containing student information is hacked, exposing personal details.

• Unauthorized Use: A company selling your email address to third-party advertisers without your permission.

• Negligent Handling: A professor leaving a class list with student grades in an unsecured public area.

• Unsolicited Marketing: Receiving text messages or emails for products you never signed up for, using a contact number you only provided for a specific purpose.

5. Who is responsible for enforcing the Data Privacy Act?

The National Privacy Commission (NPC) is the primary government agency responsible for implementing and enforcing the DPA. It investigates complaints, imposes fines on violators, and creates the rules and guidelines that organizations must follow to protect personal data. Think of them as the national watchdog for your data privacy rights.

6. What should I do if I suspect my data privacy rights have been violated?

If you believe your data has been mishandled by Lyceum-Northwestern University or any other organization, here are the steps you can take:

1. Inform the Data Protection Officer (DPO): First, contact the organization's designated DPO or privacy officer to report the incident. Many issues can be resolved at this level.

2. Document Everything: Keep a record of all relevant information, including the date of the incident, communications with the organization, and any evidence of the violation.

3. File a Complaint with the NPC: If the organization does not respond adequately or if the violation is severe, you can formally file a complaint with the National Privacy Commission. You can find the necessary forms and procedures on the official NPC website.

Question:

If the University informs my parents that I'm failing my classes, is this a violation of my data privacy?

This is an excellent question that highlights the importance of understanding your rights as a data subject. The answer depends entirely on your age.

Under the Data Privacy Act of 2012, your academic records, including grades and academic standing, are considered sensitive personal information. This means they are subject to a higher level of protection.

• If you are a minor (below 18 years old): It is not a violation of the DPA for the university to inform your parents or legal guardian about your academic performance. As a minor, your legal rights are exercised by your parents or guardian, who have the legal authority to be informed about your education and well-being.

• If you are 18 years old or older: Yes, this is a clear violation of your data privacy rights. Once you reach the age of 18, you are a legal adult and the sole owner of your personal and sensitive personal information. The university must obtain your explicit, specific, and informed consent before releasing your grades or academic status to anyone, including your parents. Without your consent, the university cannot legally disclose this information.