UPCAT

PART I. POLICY

The University of the Philippines ("UP") is required by law to process your personal information and sensitive personal information (personal data) in order to safeguard academic freedom, uphold your right to quality education, and protect your right to data privacy in conformity with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its implementing rules and regulations and the applicable issuances of the National Privacy Commission (NPC), the body tasked with implementing such law. The said law can be viewed via https://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/.

This privacy notice explains:

(1) the nature, purpose/(s) and extent of the processing of your personal data;

(2) the legal basis/(es) for such processing;

(3) the risks associated with such processing and the measures that UP has put in place to protect your data privacy; and

(4) your data privacy rights and how you may exercise the same.

Republic Act No. 10173 and its implementing rules and regulations may be referred to as RA 10173, the Data Privacy Act of 2012, or simply the DPA, where applicable. For purposes of this privacy notice, references to the DPA may also include the issuances of the National Privacy Commission ("NPC"), or the rules UP may issue (or may have already issued) in order to comply with the said law.

The term personal data includes personal information and sensitive personal information (as these terms are defined in the DPA). In essence, these are information that identify individuals or information which when put together with other information can be used to identify individuals.

The terms process or processing refer to any operation, or any set of operations, performed on personal data including the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

The terms UP/University/we/us refer to the University of the Philippines System, its Constituent Universities ("CU"), any of its offices, or any of its officials or authorized personnel.

The terms you/your refers to applicants for undergraduate first year admission via the UP College Admission Test (UPCAT) and, in the case of applicants below eighteen (18) years of age, where the context so indicates, their respective parent or guardian who also sign the certification and data privacy consent form for their UPCAT Form 1.

PART II. PERSONAL DATA THAT WILL BE PROCESSED, NATURE OF PROCESSING, PURPOSES FOR PROCESSING AND LAWFUL BASIS/ES FOR PROCESSING

The UP System Office of Admissions processes your personal data through information and communications technology ("ICT") based (i.e. UPCAT portal at https://upcat2025online.up.edu.ph), and paper-based, processing systems. The filing of paper-based applications is allowed only in highly exceptional instances as indicated in the General Information Bulletin.

When you apply for admission to UP, you provide us, through the forms and documents you certify through the submission of your application containing your signature, and, in the case of applicants below eighteen (18) years of age, forms or documents that your parent or guardian also sign and certify and which you voluntarily submit through the UPCAT portal or to a person duly authorized by UP to accept your paper-based application in case you are permitted by UP to make such paper-based submission, the following personal data:

(1) your full name as indicated in your Philippine Statistics Authority birth certificate (first name, middle name if any, and your last name);

(2) your sex assigned at birth (male/female);

(3) your date and place of birth;

(4) your citizenship;

(5) your learner reference number (if any);

(6) your 2x2 in or 51x51 mm or 192x192 pixels in size colored photograph (with plain light colored background) full face view (directly facing the camera without glasses, contact lenses or any other accessory that may cover facial features) picture must be taken while holding a name tag (signature over printed name in the format last name, first name, middle name or a digital name and signature in the same format) photo must have been taken within the last six months in JPEG (.jpg) file format not exceeding 1MB in file size;

(7) your signature;

(8) information about your family (names of your parents, their citizenship, civil status, etc.);

(9) information about your education and educational records;

(10) socio-economic and geographic information about your household, including your answers to questions regarding whether you think you may need financial and other assistance in the event you are deemed eligible to enroll in UP, estimated gross annual income of your household as well as relevant documents as discussed below; and

(11) your choice of UP campuses and degree programs.

These information are required to verify your identity, prevent fraud, and to determine whether you are legally authorized to enter into a contract and grant consent for the processing of personal data and to document such consent in the course of determining your eligibility to enroll in UP. If you are below eighteen years of age, your parent or guardian must grant such consent for and in your behalf in order for us to process your application. If you are a minor and your parents are not married, you must see to it that it is your mother or your legally authorized guardian who signs the certification and data privacy consent form for and in your behalf.

UP processes your registered email address and access credentials in order to verify your identity, prevent fraud, enable you to securely accomplish online forms, and to confidentially view the results of your application through the UPCAT online portal (https://upcat2025online.up.edu.ph) and to file appeals via the linked DIWA portal.

Please see to it that you keep your access credentials secure. We encourage you to use a strong password https://itdc.up.edu.ph/about/advisories/2023%2012%2004%20REMINDER%20-%20Use%20Strong%20Passwords%20for%20UP%20Mail%20Accounts.pdf. When possible, please activate two-factor authentication for the email account (see for example instructions for Google accounts Turn on 2-Step Verification - Computer - Google Account Help) that you will use for the UPCAT portal and double check that such account has not been compromised by using haveibeenpwned.

We advise you to refrain from using public unsecured networks when you are submitting your personal data through the UPCAT portal. If such is not feasible, we recommend that you use a VPN in order to protect your personal data. You may wish to refer to What is a VPN and Why Do You Need One in 2024? (vpnoverview.com).

UP also processes information regarding your citizenship (including relevant passport information i.e. the identification page, or Bureau of Immigration identification certificate if you are a Filipino born abroad) to determine whether you are required to pay an application fee.

You also provide information regarding the citizenship, civil status, highest educational attainment, occupation, employment information, and annual income or pension of your parents or legal guardian; the number of other persons (whether household members or not) who contribute to your household's upkeep (including your education), and the total amount of their contributions. UP processes such socio-economic data, along with your permanent address, and other information (e. g., grades; whether you are a child of a UP faculty or employee; your choice of UP campuses and degree programs; UP College Admission Test ["UPCAT"] scores) because the selection of campus qualifiers also considers socio-economic and geographic factors as explained in the General Information Bulletin (GIB).

We also ask if you are a member of an indigenous people's group (i.e., indigenous cultural community) in the application form, and require you to submit the proper certification from the National Commission on Indigenous Peoples, or the National Commission on Muslim Filipinos, when you take the UPCAT. We likewise ask all applicants to indicate their preferred UPCAT Test Center. UP also asks if you have any physical disability or medical condition that will make it difficult for you to take a regular test, and to submit the proper medical certificate in order for the Office of Admissions to make the necessary arrangements to enable you to take the UPCAT. Such processing is done pursuant to Section 9 of Republic Act No. 9500 (or the University of the Philippines Charter of 2008) which requires UP to observe the principle of democratic access in its admissions process; and take affirmative steps to enhance access of disadvantaged students to University programs and services. The UP Charter can be viewed via http://www.officialgazette.gov.ph/2008/04/19/republic-act-no-9500/.

Contact information is processed by UP in order to be able to communicate effectively with you.

When you provide UP with the personal data of third parties you certify that you obtained their consent for UP to process their personal data and agree to hold UP harmless from all liabilities for the processing of such personal data.

We require you to present the UPCAT test permit that you downloaded and printed from the UPCAT portal, your school ID, or a government-issued ID, to our personnel before you are allowed to take the UPCAT so that we will be able to verify your identity and prevent fraud.

If you were authorized to submit a paper-based application, UP, through the Ugnayan ng Pahinungod unit that collected your paper-based application or an authorized UPCAT examiner will provide you with the print out of your UPCAT test permit after you show such unit personnel or the UPCAT examiner your valid school ID or GIID. UP personnel as well as any Pahinungod volunteer who processes personal data are required to execute the proper non-disclosure undertaking in order to uphold your right to data privacy. By submitting such paper-based application, you are also deemed to grant UP, through its duly authorized personnel authority to encode and double check your personal data for the purpose of enabling the University to process your application through fully automated decision-making means.

We require you to certify through your signature, as well as your act of submitting your application, that the information you provide in support of your application is correct and complete, as we also use the said information in order to prevent the commission of fraud. Such processing is necessary for compliance with our legal obligations as a publicly funded university, and to uphold our legitimate interest as an educational institution, as well as the legitimate interest of taxpayers. Note that giving false information, or withholding information, will disqualify you from admission, or will be a basis for dismissal if you are admitted.

In the event you are not admitted to the degree program or UP campus of your choice, the UPCAT portal will provide you with access to the linked DIWA portal which indicates degree programs with available slots or UP campuses for which you are eligible to apply. This portal, which is also managed by the Office of Admissions, makes use of the same email address and password that you used for submitting your UPCAT application. We will require you to indicate two (2) degree programs and/or a UP campus through such portal. In case your appeal is successful, you will be required via the said portal to state whether you are accepting or declining the slot within a specified deadline and, if applicable to you, your assigned learner reference number.

In order for UP to exercise its right to academic freedom, and to uphold academic standards under its Charter, it must necessarily process information about your education, including your school's profile, and the educational records you provide, along with other information (including socio-economic, and geographic factors, and your UPCAT scores as mentioned above and in the GIB), using fully automated decision-making means in order to determine whether you are qualified to enroll as a first year student for an undergraduate course in the University.

Section 18 (c) of the Memo Circular 2023-04 of the National Privacy Commission states:

  A PIC shall obtain the consent of the data subject when automated processing is the sole basis for a decision that produces legal effects on or may significantly affect the data subject.

We are therefore constrained to require you to grant us consent for the processing of your abovementioned personal data for the purpose of determining whether you are qualified to enroll as a first year student for an undergraduate course in the University. If you do not grant us consent, or withdraw such consent, we regret that we will not be able to process your application and or your appeal as consent is the only lawful basis for using fully automated decision-making means for processing personal data under the above cited section of NPC MC 2023-04.

As stated, however, in the certification and consent form that we require you to sign, and if you are below eighteen (18) years of age, your parent or guardian to also sign, while we obtain your consent for such automated decision making means, please note that our processing of the UPCAT application as well as any appeal thereon is ultimately based on UPs right to exercise academic freedom under the 1987 Constitution, our Charter R.A. 9500, other applicable laws such as the Education Act of 1982 and Philippine jurisprudence. The right to academic freedom includes the right of UP to determine who may be admitted to study in UP.

You may wish to refer to the case of Garcia vs. Faculty Admissions Committee Loyola School of Theology G.R. No. L-40779 November 28, 1975 68 SCRA 277 (1975) cited in University of the Philippines vs. Arokiaswamy G.R. No. 134625. August 31, 1999 https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/3688 which states that:

Wide indeed is the sphere of autonomy granted to institutions of higher learning, for the constitutional grant of academic freedom, to quote again from Garcia v. Faculty Admission Committee, Loyola School of Theology, "is not to be construed in a niggardly manner or in a grudging fashion."
Academic freedom: is a freedom granted to "institutions of higher learning" which is thus given "a wide sphere of authority certainly extending to the choice of students."

Your information that is processed for determining your eligibility for admission to UP that is in paper-based form is retained for a maximum of two (2) years and is thereafter securely disposed of. Such disposal is conducted in conformity with Republic Act No. 9470 (or the National Archives Act of 2007), the related issuances of the National Archives of the Philippines, the DPA and NPC issuances. Republic Act No. 9470 may be viewed via http://www.officialgazette.gov.ph/2007/05/21/republic-act-no-9470/.

We securely store and further process the same for several key reasons: to comply with legal obligations such as providing information required by public authorities like the Commission on Audit; to establish or defend legal claims; and to carry out other activities allowed or required by the Philippine Data Privacy Act as well as other applicable laws and issuances.

UP likewise stores your personal data pursuant to Sec. 11 (f) of the Philippine Data Privacy Act which states Provided, That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods: Provided, further, That adequate safeguards are guaranteed by said laws authorizing their processing.

UP conducts research on stored, previously processed, de-identified UPCAT data in order to comply with its legal obligations including its right and responsibility to exercise academic freedom under the 1987 Constitution and the UP Charter. UP as a research university must conduct scientific research in order to produce general demographic information and statistics regarding UPCAT applicants across various time periods. Such research enables the University to assess whether its policies, programs, as well as procedures and revisions to the same in different years, enable the University, among others, to enhance the access of disadvantaged students to UPs programs and services (Sec. 9 of RA 9500 or the UP Charter), comply with the spirit of other applicable laws such as RA 10687 or the Unified Student Financial Assistance System for Tertiary Education (UniFAST) Act, and RA 10931 or the Universal Access to Quality Tertiary Education Act and to allow us to provide advice and technical assistance to public authorities such as Congress, the Commission on Higher Education, the UniFAST Board, etc. in accordance with Sec. 7 of the UP Charter.

For this UPCAT we included the following research questions:

(1) your interest in pursuing a master's degree, in the event you are admitted into UP;
(2) your interest in pursuing a doctoral degree, assuming you obtain a master's degree;
(3) whether your household is a 4Ps recipient;
(4) the language(s) you speak at home;
(5) whether you will be the first person in your immediate family (parents and siblings) to enter college;
(6) in the event you are admitted to UP, whether you will be the first person in your immediate family to enter UP;
(7) if there are members of your family (up to the third degree of consanguinity) who earned a college degree;
(8) if there are members of your family (up to the third degree of consanguinity) who obtained a university degree (e. g., bachelor's, master's, doctoral, medicine and/or law degree) from UP;
(9) if you have any sports talent that may qualify you for varsity athlete admission;
(10) if you would be interested in pursuing a straight PhD program; and
(11) where you obtained information about the UPCAT

Rest assured that before any research is conducted by UP, so that we will be able to comply with our ethical obligations and uphold your right to privacy, duly authorised UP personnel will remove identifiers from the UPCAT dataset such that UP's researcher or research teams who will perform operations on such dataset will not be able to associate your data with you. The research results will only include statistical data and general demographic information that does not identify you and any other data subjects.

Kindly note that Sec. 16.C.2 of Memorandum Circular 2023-4 issued by the National Privacy Commission provides that:

  The conduct of research where the end results will be anonymized and will only disclose the general demographic of the research subjects does not require the consent of the data subject.

PART III. DISCLOSURES

The University will disclose or share your personal data only when required or allowed by applicable laws, or with your consent.

Examples of applicable laws that may require UP to process and disclose your information include the Implementing Rules and Regulations and Implementing Guidelines for Republic Act No. 10931 (or the Universal Access to Quality Tertiary Education Act of 2017) and Republic Act No. 10687 (the Unified Student Financial Assistance System for Tertiary Education Act, or simply the UNIFAST Act). These can be viewed via http://www.officialgazette.gov.ph/2017/08/03/republic-act-no-10931/ and http://www.officialgazette.gov.ph/2015/10/15/republic-act-no-10687/ respectively.

Please note that under the UNIFAST Act – among other duties – the UNIFAST Board is authorized under Section 15 to:

"xxx

(e) Promulgate the minimum guidelines, rules and regulations for determining qualified Beneficiaries of student financial assistance for Tertiary Education;

(f) Provide general guidelines for the drawing up of contracts with the student Beneficiaries specifying the rights and obligations of the parties that may include a service clause or such other stipulations of cost recovery the Board may deem in the best interest of the public and consistent with, or responsive to, national, social, economic, and human resources development plans, subject to Section 12;

(g) Monitor, assess and make impact evaluation of StuFAPs and projects, with the end in view of determining whether these programs shall be adopted, continued, or terminated;

xxx"

Please note that the following are examples of information that are not covered by the DPA as stated in Section 4 of the said law:

"xxx

c. Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

d. Personal information processed for journalistic, artistic, literary or research purposes;

e. Information necessary in order to carry out the functions of public authority;

xxx"

PART IV. RISKS INVOLVED AND MEASURES IMPLEMENTED BY UP TO ADDRESS SUCH RISKS

The processing of personal data for your UPCAT application and any appeal thereon carries risks that may involve the confidentiality, integrity, and availability of personal data or the risk that processing will violate the privacy principles and rights of data subjects. UP has put in place reasonable physical (e.g. access control measures such as locks, security personnel, etc.) organizational (e.g. only authorised personnel who have signed the required non-disclosure undertaking and need such personal data to perform their functions are allowed to process such personal data, periodic privacy impact assessments etc.) and technical measures (e.g. use of CDN, encryption, multi factor authentication for the UPCAT portal, the conduct of vulnerability and penetration testing and other similar measures) to prevent or mitigate such risks. Kindly note that these measures do not guarantee absolute protection against such risks as when systems are subject to targeted cyberattacks, malware, ransomware, computer viruses, etc. However, UP has also adopted measures in order to deal with security incidents or personal data breaches in compliance with the PDPA and National Privacy Commission (NPC) issuances. See the Board of Regents approved UP Data Privacy Manual which includes security incident and breach response procedures (Part 7, page ) and the following forms:

Form 1 Security Incident or Data Breach Report Form

Form 2 Preliminary Assessment Form

Form 3 Mandatory Personal Data Breach Notification to the National Privacy Commission

Form 4 Mandatory Personal Data Breach Notification for Data Subjects

Form 5 Security Incident or Personal Data Breach Report Form

PART V. ACCESS, CORRECTION AND RIGHTS

You have the right to access personal data concerning you that is being processed by UP.

You may access and correct your information per the instructions and within the period mentioned in the portal.

Note that all applicants are required to provide true, complete and accurate information. In the event you need to correct your information please follow the instructions in the proper UP website.

Withholding information or giving false information will disqualify you from admission, or will be a basis for dismissal if you are admitted.

Applicants can confidentially view the results of their application through the online portal. Please check this UP website (https://upcat.up.edu.ph) for announcements on the availability of results.

Kindly address any request for the exercise of your data privacy rights (e. g., access to your UP predicted grade if you filed paper-based forms, as you have no internet access and are unable to appeal through the DIWA portal) to the Office of Admissions through this postal address:

(1) UP Office of Admissions, Kalaw Street corner Quirino Avenue, UP Diliman, Quezon City 1101 Philippines; or

(2) if possible or able, send an email to [email protected]

Aside from the right to access and correct your personal data, you have the following rights, subject to the conditions and limitations provided under the DPA, and other applicable laws and regulations:

(1) The right to be informed about the processing of your personal data through this and other applicable privacy notices.

(2) The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. Please note however that, as mentioned above, there are various instances when the processing of personal data is necessary for us to comply with UP’s mandate; with statutory and regulatory requirements; or is processed using a lawful basis other than consent.

(3) The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject; and

(4) The right to lodge a complaint before the National Privacy Commission ("NPC"), provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the proper DPO through the email address indicated below regarding the processing of your information, or the handling of your requests for access, correction, blocking of the processing of your personal data, and the like.

You shall be required to present a valid school identification card, or government issued identification card ("GIID"), when you submit a request to exercise your above-mentioned data privacy rights, in order for UP to see to it that we protect your privacy, and prevent identity fraud.

In case you make such a request through a representative, UP requires you to provide a letter of authorization stating the name of your authorized representative, the purpose(s) for which the requested document(s) will be used, your valid school identification card or government issued ID ("GIID"); as well as the valid GIID of your authorized representative.

PART VI. CONSENT AND WITHDRAWAL OF CONSENT

UP obtains your consent for the processing of your personal data pursuant to this privacy notice by asking you to electronically submit your certification and data privacy consent form through the UPCAT portal, and, if you are below eighteen years of age, the certification and data privacy consent form of the parent or authorized guardian exercising parental authority over you. In the case of paper-based applications, we require you to sign the UPCAT certification and data privacy consent form.

For those who submitted applications online, you may withdraw consent using the UPCAT portal. Log in and click the drop-down box for your account (upper right-hand corner in between general information and log out). Click on withdraw consent. This will automatically direct you to a page which will require you to provide your reason for withdrawal. You must check all the boxes containing the following statements:

I understand that this withdrawal will terminate my application as an incoming first-year student of the University of the Philippines for UPCAT 2025;

I understand that my access to the application portal of the University of the Philippines for UPCAT 2025 will be revoked;

I am aware that I will not be permitted to create a new application account for UPCAT 2025;

I understand that my University Predicted Grade (UPG) for UPCAT 2025 will not be computed; and

I acknowledge that this action cannot be reversed and is considered final.

so that we can be assured that you fully understand all the consequences for withdrawal then click withdraw.

For those who were allowed to submit a paper-based application you must write a letter addressed to the UP Office of Admissions, Kalaw cor. Quirino Ave., UP Diliman, Quezon City 1101 Philippines or send an email to the following official email address: [email protected] stating that you are withdrawing your application and or appeal and indicate that you understand that withdrawal will terminate your application (and or appeal) as an incoming first-year student of the University of the Philippines for UPCAT 2025; you will not be allowed to file a new application for UPCAT 2025; your University Predicted Grade (UPG) for UPCAT 2025 will not be computed; and withdrawal cannot be reversed and is considered final as mentioned above.

An applicant who is a minor who accomplishes such withdrawal online certifies that he or she is withdrawing such consent with the express permission of his or her parent or guardian who granted consent for the processing of his or her personal data for the UPCAT application.

PART VII. QUERIES

If you have any data privacy queries (such as data privacy concerns regarding your application, or suggestions regarding this privacy notice) you may contact the UP System Data Protection Officer through the following:

(1) via post

2^nd Floor North Wing, Quezon Hall (Administration Building), University Avenue, UP Campus, Diliman, Quezon City 1101 Philippines

(2) via landlines

(632) 89280110; or (632) 89818500 loc. 2521

(3) via email

[email protected]