Privacy Protection Policies for Personnel

Introduction

Sacred Heart College of Lucena City, Inc. is committed to transparency and to complying with its duties and responsibilities under data privacy and data protection laws. This Data Privacy Protection Policy for School Personnel informs employees about the school’s policy regarding the information that we collect, use or process with respect to their personal data. This privacy policy relates to individuals in the categories of employee, worker, staff, assignee, consultant, and collaborator either on a full-time or part-time basis, regular or probationary status.

Sacred Heart College of Lucena City, Inc., as an educational institution with a mission to offer quality education, respect employees’ right to data privacy. In compliance with the requirements of relevant data privacy and data protection laws, in particular RA 10173, otherwise known as the Data Privacy Act of 2012, we strive to achieve a balance between your personal privacy and the need for free flow of information, particularly when pursuing our legitimate interests and carrying out our responsibilities as an academic institution.

In this Policy, the terms “data” and “information” will be used interchangeably. Thus, when we speak of “personal data”, the term includes the concepts of personal information, sensitive information and privileged information. Personal information and sensitive information pertain to information that are commonly used to distinctively identify you. For their exact definitions, you may refer to the text of the Data Privacy Act of 2012. While this Policy uses examples in simple and clear language, they do not form a comprehensive list of all the data that we process.

Data Privacy Protection Policy

The purpose of this data privacy protection policy is twofold: first, it aims to explain how we, as an academic institution and personal information controller (PIC), will use your personal data, and second, to explain your rights under relevant data protection laws.

It is important that you read this policy prior to providing your personal information.

Who will process your personal information?

Under data privacy and data protection laws, Sacred Heart College of Lucena City, Inc. is the “personal information controller” (PIC). This means that SHC is responsible for how it uses and processes your personal data and for complying with requests from you in relation to your personal data, where appropriate under the laws.

If you have any questions regarding the use of your personal data or data privacy rights, please contact the school’s Data Protection Officer at shcdpo@shc.edu.ph.

How will we use your information?

We have set out below where we obtain your information, the main purposes for which we will use your information, who it is shared with, if it is transferred internationally, and any information relating to retention.

For each type of processing, we have identified our “legal basis for processing”. This is set out in Appendix A.

Is my data secure?

Your personal data will be managed securely. Access will be restricted to only those staff or units/offices that require it and on a “need to know” basis. SHC will employ any technical and institutional measures necessary to protect your data.

Keeping information updated

SHC strives to ensure that your personal data is accurate and up-to-date. School personnel also have a responsibility to update changes to their contact information via the relevant offices such as the Human Resources Development Office (HRDO) and/or the MIS/IT Dept. In addition, you should advise the school of any inaccuracies in the personal data held about you.

Retention of Personal Data

The school will retain your personal data only for as long as is necessary for the purposes described. Details of how long the school retains personnel information is set out in the relevant retention schedule available on the HR manual. Please note that after you cease to work with SHC, we will still require to hold your personal data for a period of time to satisfy statutory/legal obligations and/or to meet administrative requirements. Limited, anonymized information will also be retained to allow the school to perform statistical analyses.

Your Rights

You have the right to:

  1. find out what personal data we process about you and obtain a copy of the data, free of charge within one month of your request. We may make a charge for additional copies of the same information;
  2. ask us to correct inaccurate or incomplete data; and
  3. withdraw consent to process your personal data at any time, if you were asked for and provided consent.

If you think we are acting unfairly or unlawfully you can:

  1. object to the way we are using your data; or
  2. complain to the National Privacy Commission.

Under certain conditions you also have the right to ask us to:

  1. restrict the use of your data, ex. if you have raised issues about the accuracy or use of your personal data, until we have investigated and responded to your concerns;
  2. erase your information or tell us to stop using it to make decisions about you;
  3. comply with your wishes where you have previously agreed to us processing your data for a particular purpose and have withdrawn your consent to further processing; and
  4. provide you with an electronic copy of data you have given us.

Please contact us if you wish to exercise/inquire about any of these rights.

Contact Details

Data Protection Office

Sacred Heart College of Lucena City, Inc.

1 Merchan Street

Lucena City, Quezon 4301

e-mail: shcdpo@shc.edu.ph

More Information

To find out more about data protection and your rights please see:

Where do we obtain information from?

The school obtains personal data about you from a variety of sources:

  1. directly from you in your application (this includes references from individuals you have listed on your application); and/or
  2. throughout your time as an employee or during your engagement with the school, ex. Annual Evaluations/Reviews and any updates you make to your personal details and records with the HRDO; and/or
  3. as a result of any school policies and procedures ex. disciplinary action(s)/complaints; and/or
  4. from agencies from which we may be legally obliged to seek information (such as previous employers, in relation to data required for submissions to the Department of Education (DepEd), the Commission on Higher Education (CHED) and the Philippine Statistics Authority (PSA)).

What information about you do we collect and use?

When you become a member of staff, we will create a central “personal file” for you. This consists of the information provided in your application and other additional information added during the course of your employment. Other information may be held in different locations, depending on your engagement with other units/offices of the school. Personal information may be held in digital or hard copy format on various school systems relating to:

– personal and contact information (including emergency contacts);
– education records (including qualifications, skills and personal statements);
– evidence of your right to work in the Philippines (for non-residents and foreign nationals);
– provision of, access to and use of IT systems and information;
– employment and training details;
– references;
– banking details;
– casework and attendance records;
– goods or services provided;
– visual images; audiovisual recordings
– occupational health, safety and wellbeing.

“Special category” and criminal conviction data are also processed where it is necessary and lawful for us to do so. In most cases for special category data, you have the option whether or not to provide this information (or the option to choose “prefer not to say”). Special category data is subject to additional protections and refers to data revealing:

– racial or ethnic origin;
– political opinions;
– trade union membership;
– physical or mental health;
– sexual orientation.

NB. Data relating to criminal convictions and offences is subject to strict processing requirements and is only processed when appropriate in accordance with the law.

Why do we collect and use your personal data?

The school collects, holds and uses a wide range of information about you for various reasons including:

§  administrative and financial management purposes;
§  academic and research purposes;
§  performance management;
§  to meet our duty of care to you;
§  to meet our legal obligations;
§  public safety and the prevention and detection of crime;
§  archiving and research purposes;
promotion of the school;

§  ensuring health and safety (including monitoring);
§  ensuring equality of opportunity;
§  providing occupational health services;
§  attendance/absence management (includes leave of any kind and medical information submitted, where appropriate);
§  management and security of the campus/premises and facilities (including CCTV and access management);
equal opportunities monitoring.

The school also has a legal duty of care to its staff, students and others affected by its undertaking. It is therefore necessary for the school to maintain a list of key staff or third-party key contacts who the school can contact in the event of (or in order to prevent) an emergency or significant loss or disruption affecting the safety or continued operation of the school.

Detailed information regarding the purposes for which we process your personal data and our legal basis for processing can be found in Appendix A.

Who do we share your data with?

In some situations, the school will share your personal data with external organizations. Often, this is where we have a contractual agreement with an organization to provide services to us, or we have a legal obligation to provide information ex. pension providers; insurers; auditors; researchers; other organizations in the course of funding, accrediting or reviewing the quality of school activities. In other cases, we may share data where it is in our legitimate interests to do so, in which case we will undertake an appropriate assessment to evaluate and reconcile the interests of the school with those of the data subjects.

Who has access to data?

Your information will be shared internally, including with members of the HRD and recruitment teams (including payroll), your immediate supervisor, and administrative staff in the unit/office in which you work and MIS/IT staff and other professional services, if access to the data is necessary for the performance of their roles.

The school shares your data with third parties in order to obtain pre-employment references from other employers and to obtain employment background checks from third-party providers.

The school also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits and the provision of occupational health services.

In addition to those listed above we also may share your data when requested by the following bodies:

  • partner organizations involved in joint/collaborative course provision or where staff participate in teaching/administrative staff mobility or exchanges;
  • Department of Education (DepEd), Technical Education and Skills Development Authority (TESDA) and the Commission on Higher Education (CHED);
  • law enforcement agencies;
  • relevant authorities dealing with emergency situations at the school;
  • research funding bodies or bodies managing financial administration/monitoring of research funds;
  • professional, statutory and regulatory bodies ex. Philippine Regulations Commission (PRC);
  • potential employers;
  • accreditation bodies, ex. PAASCU;
  • Collective organizations of which the school is a member, such as the Daughters of Charity-St. Louise de Marillac Educational System (DC-SLMES), and other agencies with which the sector collaborates for employer benchmarking purposes;
  • any other authorized third party to whom the school has a legal/contractual obligation to share data with.

Is my data made available to the public?

The school makes some information publicly available via its website to enable stakeholders, including students, potential students and research partners to identify individuals they wish to communicate with.

Your name, department, school designation, e-mail address and telephone number will normally appear in the school’s staff and telephone directory. Staff may choose to provide an image of themselves to accompany their entry in the staff directory. If you submit a personal statement and a photograph within the school online system, these will become publicly available via the pages of the school website.

It is expected that school personnel, particularly those involved in learning, teaching and research, will provide information to be published on the school website for academic/promotional purposes including academic qualifications and professional recognition(s), brief biography, professional/research interests, activities and outputs. Research outputs are held in the school’s research repository and will identify academic/research staff involved.

Certain activities, such as lectures, may be recorded or audio recorded to support online learning, or to implement recommended reasonable adjustments for staff or students with disabilities or additional requirements.

If the school wishes to use images of school personnel in its publicity/promotional material (where the individual is the focus of the image), consent will be obtained from the personnel concerned.

Is my data transferred internationally?

Some personal data may be transferred internationally for example:

  • where the school is involved in collaborations/course provision with or for organizations and educational institutions overseas;
  • where the school is involved in staff and student exchanges and academic partnerships;
  • where the school works with overseas student recruitment agencies and partner institutions with limited staff;
  • information published on the school website is accessible internationally;
  • the school may engage third parties to provide systems/services which are hosted outside the Philippines;
  • in emergency situations for non-residents and foreign personnel, we may transfer data internationally where it is necessary to ensure your vital interests, ex. contacting next of kin in medical emergencies.

Whenever we transfer data internationally, we will make sure that appropriate safeguards are in place to protect your information and your rights to data privacy.

What if you do not provide personal data?

Certain information, such as contact details, your right to work in the Philippines (for non-residents and foreign personnel), bank payroll and other pertinent details (such as TIN, SSS and PhilHealth, among others), have to be provided to enable the school to enter a contract of employment with you. If you do not provide the required information, this will hinder the school’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

How long do we retain your data?

Retention periods for school personnel records held and managed by HRDO are as set out in the school’s HR retention schedule. Personnel data held in other units/offices may be subject to different retention periods.

Reference

  1. University of Strathclyde Glasgow, “Data protection Privacy notices”. Retrieved from https://www.strath.ac.uk/whystrathclyde/universitygovernance/accesstoinformation/dataprotection/privacynotices/ on Oct 22, 2020.