Data Privacy

Pursuant to Republic Act No. 10173 (Data Privacy Act of 2012) and the Implementing Rules and Regulations promulgated by the National Privacy Commission, complying with initiatives of the Commission on Higher Education to implement the law in all SUCs, the following rules are hereby laid down for observance by all offices of the Cagayan State University:

1. The University shall abide by the principles of transparency, legitimate purpose and proportionality in relation to the collection, processing and retention of data of all employees and students of the university. Persons from whom data is obtained will be told of the purpose for which data is obtained, processed and retained. The purpose must be legitimate: sanctioned by law or the approved policies and rules of the university. Only such data as may be adequate, relevant and necessary for specific legal purposes shall be obtained, processed and retained.

2. When employees and students are required to furnish information through standard university forms, the purpose for which the information is obtained and the officers or offices that will process the information must be clearly identified on the forms themselves, or in appropriate announcements on posters or information sheets, or orally communicated to the data-subjects provided that the oral communication thus made shall be evidenced either by a recording or by written acknowledgement of the data subject.

3. Every office that obtains or receives information from employees and students of the Cagayan State University must classify the information received into:

   Data classifications, access restrictions, and color codes

   Classification	Restrictions	Color code
   General	Publicly available	Green
   Sensitive	Available only to the office that has need of the information and made be shared with another office only with the consent of the head of the university department (academic affairs, administration and finance, research and development, linkages and resource mobilization).	Yellow
   Highly confidential	Available only to the head of the office and may not be passed on to any other office without the consent of the data-subject in writing.	Red

4. Data and information publicly available by operation of law such as the Statement of Assets, Liabilities and Net Worth of officials and employees of the university shall remain as such. Even when such information, however, is publicly available, it may not be disseminated, publicized, posted or otherwise made public unless there is a legitimate request for such information.

5. To assure the accuracy of data, the following rules shall be observed:

   1. 5.1No data shall be obtained, processed and retained from hearsay and from unverifiable sources.
   2. 5.2Every year, the offices of the university that retain and process data of employees and students must give such employees and students the chance to view their own data or to be informed of the contents of the databases of the university about them and to enter or to cause the entry of the necessary corrections.
   3. 5.3When an employee or a student is apprised of erroneous data pertaining to such employee or student in any of the offices of the university, he may request the University President or the Vice-President heading the particular department of the university to direct that the necessary changes or corrections be made.

6. Data or information that may compromise the safety and security of the data-subject such as residence, contact numbers, bank accounts, identity of children and schools or institutions attended by such children and the like shall always be considered “Highly Confidential.”

7. All information and documents relating to pending administrative or disciplinary investigations or actions are classified as “Sensitive” and shall be available only to the extent needed for the adequate prosecution of the investigation or action, or the preparation of an adequate defense.

8. Where the health services of the university discover, either from routine examinations or from particular attention given a specific member of the university community, any highly infectious and contagious condition such as HIV, Hepatitis, or the like, the data-subject will be required to disclose such a condition himself or herself to the local unit of the Department of Health, as well as to the Director of Auxiliary Services of the university, so that the latter two offices may do what is necessary for the protection of the larger community, in the case of the Department of Health, and of the university community, in the case of the Director of Auxiliary Services. The data-subject will also be warned that should he or she fail to make the requisite disclosure, it will be presumed by the medical services units of the university that authority is given them to make the needed disclosures.

9. “Fishing expeditions” - or the request for, retrieval or request for data for the manifest purposes of finding fault against university officials, employees and students is never a legitimate purpose. Where requests or demands for information are clearly part of “fishing expeditions”, the request or demand shall be denied.

10. The recordings of surveillance cameras or CCTV cameras, when these are installed, are publicly available. No such surveillance cameras or CCTV cameras however may be installed where privacy is reasonably expected such as in comfort rooms, dressing rooms or lockers.

11. When the records of any particular employee or student are covered by a sub poena duces tecum directed at any university official, the data-subject shall be duly informed by the head of the office to which the court order was addressed, but in all cases, the court order shall be complied with.