PART I. POLICY

The University of the Philippines (“UP”) is required by law to process your personal information and sensitive personal information (personal data) in order to safeguard academic freedom, uphold your right to quality education, and protect your right to data privacy in conformity with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its implementing rules and regulations and the applicable issuances of the National Privacy Commission (NPC), the body tasked with implementing such law. The said law can be viewed via https://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/.

This privacy notice explains:

(1) the nature, purpose/(s) and extent of the processing of your personal data;

(2) the legal basis/(es) for such processing;

(3) the risks associated with such processing and the measures that UP has put in place to protect your data privacy; and

(4) your data privacy rights and how you may exercise the same.

The term personal data includes personal information and sensitive personal information (as these terms are defined in the DPA). In essence, these are information that identify individuals or information which when put together with other information can be used to identify individuals.

The terms process or processing refer to any operation, or any set of operations, performed on personal data including the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

The terms UP/University/we/us refer to the University of the Philippines System, its Constituent Universities ("CU"), any of its offices, or any of its officials or authorized personnel.

The terms you/your refers to applicants for undergraduate first year admission via the UP College Admission Test (UPCAT) applying for the Iskolar ng Bayan program INB through the UPCAT DPWAS, Iskolar ng Bayan, Waitlist and Appeals (DIWA) portal and, in the case of applicants below eighteen (18) years of age, where the context so indicates, their respective parent or guardian who also sign the certification and data privacy consent form for their UPCAT Form 1.

PART II. PERSONAL DATA THAT WILL BE PROCESSED, NATURE OF PROCESSING, PURPOSES FOR PROCESSING AND LAWFUL BASIS/ES FOR PROCESSING

The UP System Office of Admissions processes your personal data through information and communications technology ("ICT") based (i.e. DIWA), and paper-based, processing systems. The filing of UPCAT and DIWA paper-based applications is allowed only in highly exceptional instances as indicated in the General Information Bulletin.

When you apply for admission to UP, you provide us, through the forms and documents you certify through the submission of your application containing your signature, and, in the case of applicants below eighteen (18) years of age, forms or documents that your parent or guardian also sign and certify and which you voluntarily submit through the UPCAT portal or to a person duly authorized by UP to accept your paper-based application in case you are permitted by UP to make such paper-based submission, the following personal data:

(1) your name (first, middle if any and last name as indicated in your Philippine Statistics Authority birth certificate);

(2) address;

(3) telephone number;

(4) mobile number;

(5) the name of your father, mother and legal guardian if any;

(6) date and place of birth;

(7) citizenship;

(8) high school where you completed your high school education, address, telephone number and email address and name of your high school principal;

(9) date of your graduation from such high school, any honors you received in your last year from the above high school, the number of students in the graduating class of your high school and your rank in such class, if available;

(10) three (3) preferred degree programs in the Constituent University for which you are eligible to apply (you must have received the minimum UP Predicted Grade for the preferred degree programs for such Constituent University that is in the same region as the high school from which you graduated as indicated in the UPCAT General Information Bulletin and the DIWA portal);

(11) certification signed by your principal that you belong to the top ten of your graduating class (in pdf format with a file size not exceeding 1 MB);

(12) your UPCAT online access credentials; and

(13) signature as well as the signature of your parent or legal guardian if you are below eighteen (18) years old.

These information are required to verify your identity, prevent fraud, and to determine whether you are legally authorized to enter into a contract and grant consent for the processing of personal data and to document such consent in the course of determining your eligibility to enroll in UP as Iskolar ng Bayan pursuant to RA 10648. If you are below eighteen years of age your parent or guardian must grant such consent for and in your behalf in order for us to process your application. If you are a minor and your parents are not married, you must see to it that it is your mother or your legally authorized guardian who signs the certification and data privacy consent form for and in your behalf.

UP processes your registered email address and access credentials in order to verify your identity, prevent fraud, enable you to securely accomplish online forms, and to confidentially view the results of your application through the DIWA portal.

Please see to it that you keep your access credentials secure. We encourage you to use a strong password https://itdc.up.edu.ph/about/advisories/2023%2012%2004%20REMINDER%20-%20Use%20Strong%20Passwords%20for%20UP%20Mail%20Accounts.pdf. When possible, please activate two-factor authentication for the email account (see for example instructions for Google accounts Turn on 2-Step Verification - Computer - Google Account Help) that you will use for the DIWA portal and double check that such account has not been compromised by using haveibeenpwned.

We advise you to refrain from using public unsecured networks when you are submitting your personal data through the UPCAT portal. If such is not feasible, we recommend that you use a VPN in order to protect your personal data. You may wish to refer to What is a VPN and Why Do You Need One in 2024? (vpnoverview.com).

UP also processes information regarding your citizenship and the information in (8) to (11) above to determine your eligibility to receive the Iskolar ng Bayan scholarship.

Contact information is processed by UP in order to be able to communicate effectively with you regarding your application.

When you provide UP with the personal data of third parties you certify that you obtained their consent for UP to process their personal data and agree to hold UP harmless from all liabilities for the processing of such personal data.

If you were authorized to submit a paper based application, UP, through the Ugnayan ng Pahinungod unit that collected your paper based application is authorized to receive your paper based application for the INB.

UP personnel as well as any Pahinungod volunteer who processes personal data are required to execute the proper non disclosure undertaking in order to uphold your right to data privacy. By submitting such paper based application, you are also deemed to grant UP, through its duly authorized personnel authority to encode and double check your personal data for the purpose of enabling the University to process your application through fully automated decision making means.

We require you to certify through your signature, as well as your act of submitting your application, that the information you provide in support of your application is correct and complete, as we also use the said information in order to prevent the commission of fraud. Such processing is necessary for compliance with our legal obligations as a publicly funded university, and to uphold our legitimate interest as an educational institution, as well as the legitimate interest of taxpayers as the INB program is a publicly funded program. Note that giving false information, or withholding information, will disqualify you from admission, or will be a basis for dismissal if you are admitted.

In order for UP to exercise its right to academic freedom, and to uphold academic standards under its Charter, it must necessarily process information about your education, including your school’s profile, and the educational records you provide, along with other information (including socio-economic, and geographic factors, and your UPCAT scores as mentioned above and in the GIB), using fully automated decision making means in order to determine whether you are qualified to enroll as a first year student for an undergraduate course in the University as INB scholar.

Section 18 (c) of the Memo Circular 2023-04 of the National Privacy Commission states:

  A PIC shall obtain the consent of the data subject when automated processing is the sole basis for a decision that produces legal effects on or may significantly affect the data subject.

We are therefore constrained to require you to grant us consent for the processing of your abovementioned personal data for the purpose of determining whether you are qualified to enroll as a first year student for an undergraduate course in the University. If you do not grant us consent, or withdraw such consent, we regret that we will not be able to process your application and or your appeal as consent is the only lawful basis for using fully automated decision-making means for processing personal data under the above cited section of NPC MC 2023-04.

As stated, however, in the certification and consent form that we require you to sign, and if you are below eighteen (18) years of age, your parent or guardian to also sign, while we obtain your consent for such automated decision making means, please note that our processing of the UPCAT and INB application as well as any appeals thereon is ultimately based on UPs right to exercise academic freedom under the 1987 Constitution, our Charter R.A. 9500, other applicable laws such as the Education Act of 1982 and Philippine jurisprudence. The right to academic freedom includes the right of UP to determine who may be admitted to study in UP.

You may wish to refer to the case of Garcia vs. Faculty Admissions Committee Loyola School of Theology G.R. No. L-40779 November 28, 1975 68 SCRA 277 (1975) cited in University of the Philippines vs. Arokiaswamy G.R. No. 134625. August 31, 1999 https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/3688 which states that:

Wide indeed is the sphere of autonomy granted to institutions of higher learning, for the constitutional grant of academic freedom, to quote again from Garcia v. Faculty Admission Committee, Loyola School of Theology, "is not to be construed in a niggardly manner or in a grudging fashion."
Academic freedom: is a freedom granted to "institutions of higher learning" which is thus given "a wide sphere of authority certainly extending to the choice of students."

Your information that is processed for determining your eligibility for admission to UP as INB scholar that is in paper-based form is retained for a maximum of two (2) years and is thereafter securely disposed of. Such disposal is conducted in conformity with Republic Act No. 9470 (or the National Archives Act of 2007), the related issuances of the National Archives of the Philippines, the DPA and NPC issuances. Republic Act No. 9470 may be viewed via http://www.officialgazette.gov.ph/2007/05/21/republic-act-no-9470/.

We securely store and further process the same for several key reasons: to comply with legal obligations such as providing information required by public authorities like the Commission on Audit; to establish or defend legal claims; and to carry out other activities allowed or required by the Philippine Data Privacy Act as well as other applicable laws and issuances.

UP likewise stores your personal data pursuant to Sec. 11 (f) of the Philippine Data Privacy Act which states Provided, That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods: Provided, further, That adequate safeguards are guaranteed by said laws authorizing their processing.

UP conducts research on stored, previously processed, de-identified UPCAT data in order to comply with its legal obligations including its right and responsibility to exercise academic freedom under the 1987 Constitution and the UP Charter. UP as a research university must conduct scientific research in order to produce general demographic information and statistics regarding UPCAT and INB applicants across various time periods. Such research enables the University to assess whether its policies, programs, as well as procedures and revisions to the same in different years, enable the University, among others, to enhance the access of disadvantaged students to UPs programs and services (Sec. 9 of RA 9500 or the UP Charter), comply with the spirit of other applicable laws such as RA 10687 or the Unified Student Financial Assistance System for Tertiary Education (UniFAST) Act, and RA 10931 or the Universal Access to Quality Tertiary Education Act and to allow us to provide advice and technical assistance to public authorities such as Congress, the Commission on Higher Education, the UniFAST Board, etc. in accordance with Sec. 7 of the UP Charter.

Rest assured that before any research is conducted by UP, so that we will be able to comply with our ethical obligations and uphold your right to privacy, duly authorised UP personnel will remove identifiers from the UPCAT and INB dataset such that UP's researcher or research teams who will perform operations on such dataset will not be able to associate your data with you. The research results will only include statistical data and general demographic information that does not identify you and any other data subjects.

Kindly note that Sec. 16.C.2 of Memorandum Circular 2023-4 issued by the National Privacy Commission provides that:

  The conduct of research where the end results will be anonymized and will only disclose the general demographic of the research subjects does not require the consent of the data subject.

PART III. DISCLOSURES

The University will disclose or share your personal data only when required or allowed by applicable laws, or with your consent.

Examples of applicable laws that may require UP to process and disclose your information include the Implementing Rules and Regulations and Implementing Guidelines for Republic Act No. 10931 (or the Universal Access to Quality Tertiary Education Act of 2017) and Republic Act No. 10687 (the Unified Student Financial Assistance System for Tertiary Education Act, or simply the UNIFAST Act). These can be viewed via http://www.officialgazette.gov.ph/2017/08/03/republic-act-no-10931/ and http://www.officialgazette.gov.ph/2015/10/15/republic-act-no-10687/ respectively.

Please note that under the UNIFAST Act – among other duties – the UNIFAST Board is authorized under Section 15 to:

"xxx

(e) Promulgate the minimum guidelines, rules and regulations for determining qualified Beneficiaries of student financial assistance for Tertiary Education;

(f) Provide general guidelines for the drawing up of contracts with the student Beneficiaries specifying the rights and obligations of the parties that may include a service clause or such other stipulations of cost recovery the Board may deem in the best interest of the public and consistent with, or responsive to, national, social, economic, and human resources development plans, subject to Section 12;

(g) Monitor, assess and make impact evaluation of StuFAPs and projects, with the end in view of determining whether these programs shall be adopted, continued, or terminated;

xxx"

Please note that the following are examples of information that are not covered by the DPA as stated in Section 4 of the said law:

"xxx

c. Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

d. Personal information processed for journalistic, artistic, literary or research purposes;

e. Information necessary in order to carry out the functions of public authority;

xxx"

PART IV. RISKS INVOLVED AND MEASURES IMPLEMENTED BY UP TO ADDRESS SUCH RISKS

The processing of personal data for your INB application and any appeal thereon carries risks that may involve the confidentiality, integrity, and availability of personal data or the risk that processing will violate the privacy principles and rights of data subjects. UP has put in place reasonable physical (e.g. access control measures such as locks, security personnel, etc.) organizational (e.g. only authorised personnel who have signed the required non-disclosure undertaking and need such personal data to perform their functions are allowed to process such personal data, periodic privacy impact assessments etc.) and technical measures (e.g. use of CDN, encryption, multi factor authentication for the UPCAT portal, the conduct of vulnerability and penetration testing and other similar measures) to prevent or mitigate such risks. Kindly note that these measures do not guarantee absolute protection against such risks as when systems are subject to targeted cyberattacks, malware, ransomware, computer viruses, etc. However, UP has also adopted measures in order to deal with security incidents or personal data breaches in compliance with the PDPA and National Privacy Commission (NPC) issuances. See the Board of Regents approved UP Data Privacy Manual which includes security incident and breach response procedures (Part 7, page ) and the following forms:

Form 1 Security Incident or Data Breach Report Form

Form 2 Preliminary Assessment Form

Form 3 Mandatory Personal Data Breach Notification to the National Privacy Commission

Form 4 Mandatory Personal Data Breach Notification for Data Subjects

Form 5 Security Incident or Personal Data Breach Report Form

PART V. ACCESS, CORRECTION AND RIGHTS

You have the right to access personal data concerning you that is being processed by UP.

You may access and correct your information per the instructions and within the period mentioned in the portal.

Note that all applicants are required to provide true, complete and accurate information. In the event you need to correct your information please follow the instructions in the proper UP website.

Withholding information or giving false information will disqualify you from admission, or will be a basis for dismissal if you are admitted.

Applicants can confidentially view the results of their application through the DIWA online portal. Please check this portal for announcements on the availability of results.

Kindly address any request for the exercise of your data privacy rights (e. g., access to your UP predicted grade if you filed paper-based forms, as you have no internet access and are unable to appeal through the DIWA portal) to the Office of Admissions through this postal address:

(1) UP Office of Admissions, Kalaw Street corner Quirino Avenue, UP Diliman, Quezon City 1101 Philippines; or

(2) if possible or able, send an email to [email protected]

Aside from the right to access and correct your personal data, you have the following rights, subject to the conditions and limitations provided under the DPA, and other applicable laws and regulations:

(1) The right to be informed about the processing of your personal data through this and other applicable privacy notices.

(2) The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. Please note however that, as mentioned above, there are various instances when the processing of personal data is necessary for us to comply with UP’s mandate; with statutory and regulatory requirements; or is processed using a lawful basis other than consent.

(3) The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject; and

(4) The right to lodge a complaint before the National Privacy Commission ("NPC"), provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the proper DPO through the email address indicated below regarding the processing of your information, or the handling of your requests for access, correction, blocking of the processing of your personal data, and the like.

You shall be required to present a valid school identification card, or government issued identification card ("GIID"), when you submit a request to exercise your above-mentioned data privacy rights, in order for UP to see to it that we protect your privacy, and prevent identity fraud.

In case you make such a request through a representative, UP requires you to provide a letter of authorization stating the name of your authorized representative, the purpose(s) for which the requested document(s) will be used, your valid school identification card or government issued ID ("GIID"); as well as the valid GIID of your authorized representative.

PART VI. CONSENT AND WITHDRAWAL OF CONSENT

UP obtains your consent for the processing of your personal data pursuant to this privacy notice by asking you to electronically submit your certification and data privacy consent form through the DIWA portal, and, if you are below eighteen years of age, the certification and data privacy consent form of the parent or authorized guardian exercising parental authority over you. In the case of paper-based applications, we require you to sign the INB certification and data privacy consent form.

If you wish to withdraw your consent as you are withdrawing your INB application or any appeal thereon you must write a letter addressed to the UP Office of Admissions Kalaw cor. Quirino Ave., UP Diliman, Quezon City 1101 Philippines and if feasible immediately email the same the following official email address: [email protected] stating that you are withdrawing your application and or appeal and indicate that you understand that withdrawal will terminate your application (and or appeal) for the INB. Please note that such withdrawal cannot be reversed and is considered final.

PART VII. QUERIES

If you have any data privacy queries (such as data privacy concerns regarding your application, or suggestions regarding this privacy notice) you may contact the UP System Data Protection Officer through the following:

(1) via post

2^nd Floor North Wing, Quezon Hall (Administration Building), University Avenue, UP Campus, Diliman, Quezon City 1101 Philippines

(2) via landlines

(632) 89280110; or (632) 89818500 loc. 2521

(3) via email

[email protected]