ARCHIVE: Rappler X will be closing down, and articles there will be transferred here.
Updated November 26th 2017, 2:48:42 pm
Students reportedly refused to sign the consent form due to lack of information on the data sharing agreement
MANILA, Philippines — Lyceum of the Philippines University (LPU) on Tuesday has distributed "personal information consent" forms throughout the campus, but some students were baffled as to what the contents of the document are.
In an interview with LPU's Data Protection Officer Rejan Tadeo, he admitted that the administration has not yet fully discussed the policy prior to distributing the consent forms.
"That's our target sa second semester... The first step is to meet all the student leaders. Then afterwards, to cascade them to their officers and members. Then the next step is to also [tap] those classes [in the College of International Tourism and Hospitality Management] having the [Events Management] class. They are also the main collectors of personal information in terms of registration," he said.
Refusing to sign the informed consent form has no effect, Tadeo explained, since it is "to signify that the letter was received by them." The purpose of the form is to inform the students that prior to the law, they are already processing personal information for a certain purpose.
"Yun lang yun. Walang mangyayari... It is signifying that [students] are aware of that. [Yung policy] magpu-push through na yun," he said.
(That's it. Nothing else will happen if they don't sign it. It signifies that students are aware of the policy. The policy will push through regardless if they sign or not.)
What the law says: Be transparent and ask for consent
In adherence to Republic Act 10173 or the "Data Privacy Act of 2012," institutions who are operating with at least 1000 individuals must register their personal data processing systems. Companies with less than 250 employees are not required to register their system of processing personal information.
Tadeo reaffirmed that since LPU has "more than 250 employees and even more than a thousand students," they have to comply with the law.
Some of the principles stated in the Act include:
The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.
The data subject must be provided specific information regarding the purpose and extent of processing, including, where applicable, the automated processing of his or her personal data for profiling, or processing for direct marketing, and data sharing
Processing shall uphold the rights of the data subject, including the right to refuse, withdraw consent, or object. It shall likewise be transparent, and allow the data subject sufficient information to know the nature and extent of processing
Students are also entitled to six rights:
(1) Right to be informed
(2) Right to object
(3) Right to access
(4) Right to rectification
(5) Right to erasure or blocking
(6) Right to damages
Cautious, wary
Tadeo assured that the implementation focuses on systematizing personal information collection.
"The main purpose is to protect the data subject [from any danger] kasi your personal information can be used for anything," he said.
Back in September, students were alerted after LPU posted on Twitter that the Student Affairs Office (SAO) is monitoring social media. This tweet came after the university received 1-star ratings from students due to its recurring late class suspension announcements and the issue of campus press repression. An unverified information from an insider alleged that LPU has plans to file cyber libel cases to counter unruly social media criticisms.
Tadeo explained that they are focusing on imposing limitations on sharing information with third party affiliates of LPU. Data subjects — in this case, the students — must be informed and be asked for consent every time if their personal information will be shared with another organization.
"You need to be informed what's the collection procedure, how we process your personal information, or what's the purpose of collecting this personal information, and how long it will retain to us," he said.
Tadeo added: "It should be beneficial to both the institutions and the data subject. Pero kung hindi siya beneficial, for sure hindi namin siya ishe-share."
(It should be beneficial to both the institutions and the data subject. But if it isn't beneficial to the students, for sure we won't share it.)
Read the document here:
