I – Policy Statement
The
Ateneo de Zamboanga University recognizes the importance of safeguarding
and ensuring the integrity of the data it collects, processes or handles about
its clients, stakeholders, and personnel. Thus, this policy sets the
protocol on data protection in conformity with Republic Act No. 10173, or the
Philippine Data Privacy Act of 2012. It is established to provide guidance and
direction on the management of digital information and records of the University
and to clarify the responsibilities of the personnel who have direct and
indirect access to them.
A. PURPOSES
1. Provision
of safeguards for ADZU’s IT facilities, programs, data, network equipment
against loss, misuse or abuse
2. Warranty
for proper management and safekeeping of digital and paper records and
for secure and appropriate disposal of such
3. Establishment
of users’ responsibilities for protecting the confidentiality and integrity of
the data they handle or access
B. SCOPE
This
policy covers all information and records in digital or non-digital form about
the University or any of its members or affiliates. This includes any
expression of opinion about a person, group or organization in evaluation,
feedback, meetings and other University processes. It also applies to
recorded data such as photographs or video clips (including those from CCTV) or
audio recordings.
This
policy applies to all faculty and staff who have access to our digital records
and information that are located on the different servers of the University.
This, however, does not cover information that are located in the clouds (i.e.
Google drive), workstations, and personal digital storage devices.
II – Definition of Terms
A. PERSONAL INFORMATION are
those information that can identify an individual. It includes, but is not
limited to, the following:
1. Home
address or home telephone number
2.
Health insurance information
3.
Medical records related to an individual
4. Psychological
counseling records
B. PROTECTED DATA are
those information and records in digital and non-digital form that about the
University, its members and stakeholders. They also include audio recordings
and other information held visually in photographs or videos.
C. Republic Act No. 10173, or the
Philippine Data Privacy Act of 2012 (see annex)
III – Guidelines
A.
Information Systems and Digital Information Records
The
University’s internal and external processes involve massive amount of
information generation, collection or storage. Digital information and records
are collected and processed by the university’s numerous school systems
(enrollment, HR, RFID, clinic, etc).
A school
system is developed for an office, department, or unit to facilitate or enhance
their day-to-day operations and services. They, in turn, are designated owners
of the system.
Key
users of these systems, not necessarily the designated owners, are given
various access rights on the management, maintenance and updating of the
digital information or data in a school system. Responsibility comes with the
access rights. Thus, a user and/or an employees that have access to a school
system should not share his access rights and login information. Moreover, he
should not share digital information and records (that he has access to)
without proper clearance from the owner of the school system.
Nevertheless,
it is still the CITS that is responsible for the overall management of both the
digital information and records and the servers where they are saved.
B. Digital fingerprint
The AdZU
school systems keep logs of all activities of users that access them. This
allows the CITS team to determine the who, the what, the when, and oftentimes
the where that pertains to the changes made on a particular digital record.
C. Backup, retention, and deletion
The CITS
follows two (2) backup schedules for the university’s digital data – daily and
monthly. The backup activities are automated and they normally happen during
the night time when there is (assumed to be) no user of any of the various
school systems.
All data
collected since the 90’s have been retained and backed up. In an absence of any
policy on digital data deletion, the CITS have continued to retain preexisting
data and manage them accordingly.
D. Roles and responsibilities
1.
Designated owner of school system
The
designated owner screens and selects key users for the school system under his
care. In addition, he is responsible in informing the CITS about the access
rights to be given to the key users.
Lastly,
the designated system owner has the sole right to divulge digital information
and data derived from the system he is assigned to. A special arrangement can
be made to allow key users to dispense digital information and records (ie
department chairs using registrar system, HR personnel using finance system,
etc).
2. Key
users
Various
access rights are given to key users who handle tasks that require the
utilization of school systems. These rights ranges from simple viewing to
creating and updating of digital information and records.
Key
users are responsible for the accuracy and integrity of information they input
into the systems. Most school systems do not have the capability of detecting
wrong input of information. Thus, it is the responsibility of a user of the
system to ensure that whatever data he is feeding the system is correct and
appropriate.
3. CITS
staff
A number
of CITS personnel have high access clearance on the digital information and
records of the University. This is because of the nature of their jobs.
However, they are not allowed to divulge digital information or records to AdZU
clients. Clients directly requesting these information from the CITS should be
referred to the designated owner of the particular school system.
Specific Responsibilities
a.
Director
He is
ultimately responsible for the protection management of the digital information
and records of the University. He promotes compliance and delegates
responsibility to the CITS staff.
b.
Assistant for school systems
He is
the overall custodian of the digital information and records of the University.
He assists the director on the management of these digital data. He is also
responsible in assigning special access rights to the System Developers.
c.
Server administrator
He makes
sure that digital information and records are backed up regularly. He also
secures the digital data from inside and outside intrusions.
d.
System developer
He
develops systems and then coordinates with the unit, office, or department
heads in assigning access rights to key users.
E.
Confidentiality and penalty
Unauthorized
sharing of digital information and records shall be penalized and sanctioned
based on the provisions in the University Confidentiality Policy.
F.
Review and monitoring
This
policy shall be subjected to a review every year to ensure that the demands of
the changing times are addressed. Any new policy created will supersede this
policy
Compliance
with this policy will be monitored by the director of the CITS.
