MANILA, Philippines — The Data Privacy Council Education Sector, a private sector initiative backed by the National Privacy Commission (NPC), reminded schoolteachers and administrators to use learning management systems (LMS) that have adequate data protection features and seek the consent of students and parents or guardians of minors before recording online classes.
Under the council’s Advisory No. 2020-1, educational institutions are accountable for all personal data it collects and processes, even if they properly obtained the consent of students.
Higher education institutions on Wednesday issued recommendations on online learning, following security breaches earlier this year of schools’ data systems where sensitive personal information of students were leaked online.
It also recommended that downloading of personal data stored in the LMS or online productivity platforms be kept to a minimum or be limited to what is necessary for online learning.
“It is also important that any downloaded data be retained only until there is a legitimate need for such offline copy,” the council said.
The use of webcams during synchronous online classes should be optional, while legitimate purposes such as for later viewing of students who were not able to attend class must be considered when recording.
Drafted by schools
However, the council, composed of private universities in Manila, Cebu, Legazpi, Mindanao, Laguna and Iloilo, reminded teachers to get the consent of students or the parents or guardians of minors before recording online classes.
“Posting the recorded classes or sessions or making them available on public platforms must also adhere to the principles of legitimate purpose and proportionality. Individuals who may be affected thereby must have been informed beforehand of the school’s intention to make the recording public,” it said.
Any announcement that involves personal data such as grades and results of submitted assignments must only be viewable on an individual basis regardless of whether the students are part of the same class.
The group also warned teachers to refrain from requiring their students to submit their assignments and projects through social media, “since these platforms were never designed for such purpose.”
It pointed out that all personal data posted on social media were considered “public by nature,” unless teachers or students used the available privacy settings in the different platforms.
If the posting of a student’s personal data is necessary and allowed, only the official social media accounts of the schools must be authorized to do so, the council said, as using personal accounts could be a violation of the school’s social media policy and may merit disciplinary action.
It added that previously collected personal data of students must also be “disposed of securely” when the purpose for collection and processing is no longer valid, such as when the student is no longer enrolled in the subject or course, “unless some other lawful basis for their continued retention exists.”
“Each educational institution retains the prerogative to decide on the measures it shall deem appropriate for its context. It may define, adopt and implement its own data protection policies that seek to protect personal data under its control or custody,” it explained.