QMS Data Privacy Notice

Privacy Notice for QMS

L-NU ADMINISTRATION PRIVACY NOTICE FOR THE QUALITY MANAGEMENT SYSTEM (QMS) TRAINING SESSIONS AND CERTIFICATION ACTIVITIES

L-NU is committed to comply with the Philippine Data Privacy Act of 2012 (DPA) https://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/ in order to protect your right to data privacy.

This privacy notice explains in general terms:
(1) the nature, purpose/(s) and extent of the processing (collection, use, disclosure, destruction and other operations) of your personal data (personal and sensitive personal information) as defined in the DPA;
(2) the legal basis/(es) for such processing;
(3) the risks associated with such processing and the measures that
L-NU has put in place to protect your data privacy; and
(4) your data privacy rights and how you may exercise the same.

The term L-NU/University/us refers to Lyceum-Northwestern University and any of its offices, or any of its officials or authorized personnel. The term you/your refers to the participants of the L-NU’s Quality Management System training sessions and certification activities Personal data (personal and sensitive personal information) refers to information that identifies you as an individual or information which when put together with other information will identify you as an individual (pseudonymised data).

PERSONAL DATA COLLECTED, PURPOSE(S) AND LEGAL BASIS FOR SUCH PROCESSING

The QMS Office, processes the following personal data of QMS
participants in paper based and electronic forms:
1. Name
2. Designation
3. L-NU office
4. L-NU mail email and access credentials
5. Cell phone number
6. Responses to Google form questions that includes whether or not you are able to attend sessions, if such participation has been authorised by your immediate superior, your choice of QMS committee(s), meal preferences, skills or talents you may wish to contribute for the QMS activities
7. Photograph(s) and or video images taken strictly for documentation
purposes
8. Signature (in the attendance sheets) for the purpose of organising, managing and documenting the QMS activities. L-NU processes your personal information in order to exercise its right and responsibility of academic freedom, and other laws, comply with its contractual and legal obligations to you as well as to third parties including, but not limited to the Government of the Republic of the Philippines, the and other public authorities.

Note that National Privacy Commission (NPC) the body tasked with implementing the DPA, issued Advisory Opinion 2022-14 https://privacy.gov.ph/wp-content/uploads/2022/08/Advisory-Opinion-No.2022-014_Redacted.pdf which states:

Processing of personal data within the educational framework in relation to academic freedom. At this juncture, the NPC would like to clarify that educational institutions may process personal data to achieve the purposes within its educational framework without the need for consent of the data subject. The data subject in an educational setting includes students, faculty and staff. It is then of utmost importance that the school delineates all processing operations, carefully identifying those that are core to the educational framework and those outside of it (e.g. marketing or public relations purposes)
x x x

In the same vein, the NPC respects the same doctrine of Academic Freedom for the processing of personal data within the educational framework, if it is in accordance with the provisions of the DPA and other existing laws, rules and regulations. The NPC will remain neutral on the chosen methods and technology by the educational institution as long as it is within the bounds of the law (footnotes omitted, underscoring supplied). You may wish to refer to the case of Garcia vs. Faculty Admissions Committee Loyola School of Theology G.R. No. L-40779 November 28, 1975 68 SCRA 277 (1975) cited in University of the Philippines vs. Arokiaswamy G.R. No. 134625. August 31, 1999 https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/3688 which states that: Wide indeed is the sphere of autonomy granted to institutions of higher learning, for the constitutional grant of academic freedom, to quote again from Garcia v. Faculty Admission Committee, Loyola School of Theology, "is not to be construed in a niggardly manner or in a grudging fashion (footnotes omitted, underscoring supplied)."

L-NU stores your personal data pursuant to Sec. 11 (f) of the DPA which states Provided, That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods: Provided, further, That adequate safeguards are guaranteed by said laws authorizing their processing.

L-NU conducts research on stored, previously processed, de-identified data
in order to comply with its legal obligations including its right and responsibility to exercise academic freedom under the 1987 Constitution. L-NU as private university must conduct scientific research in order to produce general demographic information and statistics regarding the University’s personnel across various time periods. Such research enables the University to assess whether its policies, programs, as well as procedures and revisions to the same in different years, enable the University to comply with other applicable
laws, rules and regulations. Before any research is conducted by UP, so that we will be able to comply with our ethical obligations and uphold your right to privacy, duly authorized L-NU personnel will remove identifiers from the applicable dataset such that L-NU’s researcher or research teams who will perform operations on such dataset will not be able to associate your data with you. The research results will only include aggregate or statistical data and general demographic information that does not identify you and any other data subjects.

Kindly note that Sec. 16.C.2 of Memorandum Circular 2023-4 issued by the National Privacy Commission provides that: The conduct of research where the end results will be anonymized and will only disclose the general demographic of the research subjects does not require the consent of the data subject. On the other hand, if research will make use of identifiable personal data, when so required by applicable laws, rules and or ethical guidelines such as the guidelines issued by the Philippine Health Research Ethics Board pursuant to the Philippine National Health Research System Act, we will first obtain the proper ethics clearance as well as your informed consent prior to the conduct of such research.

INSTANCES WHEN YOUR RELEVANT PERSONAL DATA MAY BE DISCLOSED BY L-NU TO THIRD PARTIES AND THE PURPOSE/S AND LEGAL BASIS FOR SUCH DISCLOSURES

Since the QMS training activities are made possible through a grants as well as resources provided by the L-NU which receives public funds, your personal data may be disclosed to the grantor, and other public authorities in order to comply with the requirements of such grant, applicable laws, rules and regulations of such entities as well as other public authorities.

As also stated in the L-NU Privacy Notice for Personnel, under the Philippine
Data Privacy Act the following are exempt from the coverage of such law:

(a) Information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including:

(b) (1) The fact that the individual is or was an officer or employee of the government institution;
(2) The title, business address and office telephone number of the individual;
(3) The classification, salary range and responsibilities of the position held by the individual; and

(4) The name of the individual on a document prepared by the individual in the course of employment with L-NU;
(b) Information about an individual who is or was performing service under contract for the institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services;

(5) (c) Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

(6) (d) Personal information processed for journalistic, artistic, literary or research purposes;

(7) (e) Information necessary in order to carry out the functions of public authority...

DATA PRIVACY RISKS AND HOW L-NU PROTECTS YOUR PERSONAL DATA

The processing by L-NU of your personal data in order to carry out its contractual obligations to you, to comply with its legal obligations and to exercise its academic freedom carries risks that may involve the confidentiality, integrity, and availability of personal data or the risk that processing will violate the privacy principles and rights of data subjects. L-NU has put in place reasonable physical (e.g. access control measures such as locks, security personnel, etc.) organizational (e.g. only authorised personnel who have signed the required non-disclosure undertaking and need such personal data to perform their functions are allowed to process such personal data, periodic privacy impact assessments etc.) and technical measures (e.g. use of encryption, multi factor authentication for L-NU mail and portals, the conduct of vulnerability and penetration testing and other similar measures) to prevent or mitigate such risks. Kindly note that these measures do not guarantee absolute protection against such risks as when systems are subject to targeted cyberattacks, malware, ransomware, computer viruses, etc. However, L-NU has also adopted measures in order to deal with security incidents or personal data breaches in compliance with the DPA and National Privacy Commission (NPC) issuances.

We remind you in our various portals and privacy notices to keep your personal data secure by double checking that the L-NU mail account you are using for L-NU portals has not been compromised, using a strong password for such account, using only your email account for L-NU portals and communications with L-NU as required, Reminder that faculty and students must use L-NU Mail for official correspondence and data privacy and security measures required for sending attachments and sharing .pdf not using public, unsecured networks for submitting personal data or at least using VPN if use of such unsecured networks is unavoidable and keeping all your L-NU account credentials confidential.

ACCESS TO AND CORRECTION OF YOUR PERSONAL DATA AND
YOUR RIGHTS UNDER THE DPA

You have the right to access personal data being processed by L-NU about you. In order for L-NU to see to it that your personal data are disclosed only to you, these offices will require the presentation of your L-NU ID or other documents that will enable L-NU to verify your identity. In case you process or request documents through a representative, in order to protect your privacy, L-NU requires you to provide a letter of authorization specifying the purpose for the request of documents or the processing of information, and your L-NU  ID or other valid government-issued ID (GIID), as well as the valid GIID of your representative.

As mentioned above, L-NU requires you to provide correct information. In the
event that your information needs to be updated, kindly get in touch with the  QMS Team at qao@lyceum.edu.ph. Aside from the right to access and correct your personal data, you have the following rights subject to the conditions and limitations provided under the DPA and other applicable laws and regulations:

1. The right to be informed about the processing of your personal data
through this and other applicable privacy notices.

2. The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. Kindly note however that, as mentioned above, there are various instances when the processing of personal data you have provided is necessary for us to comply with L-NU's mandate, statutory and regulatory requirements, or is processed using a lawful basis other than consent.

3. 3. The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject and

4. 4. The right to lodge a complaint before the National Privacy Commission provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the DPO through the email address indicated below regarding the processing of your information, or the handling of your requests for access, correction, blocking of the processing of your personal data and the like.

REVISIONS TO THE PRIVACY NOTICE AND QUERIES REGARDING
DATA PRIVACY

We encourage you to visit the L-NU Privacy site PRIVACY POLICIES - HOMEPAGE and (insert QAO Website) from time to time to see any further updates regarding this and other privacy notices that may apply to you. Changes to QAO System privacy notices can be seen through the DPO Privacy site. For queries, comments or suggestions regarding this privacy notice, please contact the University Data Protection Officer through the following

Name of DPO - Zachary G. Javelona, MBA, CISA

Email: dpo@lyceum.edu.ph, qao@lyceum.edu.ph  

Tel.: 075-615-1701

Postal:

Quality Assurance Office, 2nd Floor, Admn. Building

Lyceum-Northwestern University

Tapuac Road, Tapuac District

Dagupan City, Pangasinan, 2400