DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

Name of Project/System:

Library Management System

I. Project/System Description
a. Description

Ø A library management system is an ERP software that is designed & developed to

manage all the in-house functions of a library. A librarian requires maintaining a
database of new books and the books that are borrowed by users along with their due
dates. This system completely automates all your library's activities.

b. Scope of PIA
The Library Management System is an application for assisting a librarian in managing
a book library in a school. The system would provide basic set of features to add/update
members, add/update books, and manage check in specifications for the systems
based on the client’s statement of need. This system is exclusively used of Pandan Bay
Institute, Inc.

The main objective of the Library Management System is to manage the details of
Address, Member, Issues, Books, Student. It manages all the information about
Students, Faculty and Staff of the school. The project is totally built at administrative
end and thus only the administrator is guaranteed the access.

II. Threshold Analysis

The following questions are intended to help you decide whether a PIA is necessary. Answering
‘yes’ to any of these questions is an indication that a PIA would be a useful exercise. You can
expand on your answers as the project develops if you need to.

a. Will the project or system involve the collection of new information about individuals?

[ ] No [/] Yes
b. Is the information about individuals sensitive in nature and likely to raise privacy concerns or
expectations e.g. health records, criminal records, or other information people would consider
particularly private?

[/] No [ ] Yes
c. Are you using information about individuals for a purpose it is not currently used for, or in a way
it is not currently used?

[ ] No [/] Yes
 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

d. Will the initiative require you to contact individuals in ways which they may find intrusive?

[/] No [ ] Yes

e. Will information about individuals be disclosed to organizations or people who have not
previously had routine access to the information?

[ ] No [/] Yes

f. Does the initiative involve you using new technology which might be perceived as being
privacy-intrusive (e.g. biometrics or facial recognition)?

[] No [/] Yes

g. Will the initiative result in you making decisions or taking action against individuals in ways
which can have a significant impact on them?

[ ] No [/] Yes
h. Are the personal data collected prior to August 2016?
[ ] No [/] Yes

III. Stakeholder(s) Engagement

State all project stakeholders, consulted in conducting PIA. Identify which part they were
involved. (Describe how stakeholders were engaged in the PIA process)

Name Role Involvement Inputs/Recommendatio

ns

IV. Personal Data Flow

Collection: The data will be collected from the students through filling up the hard copy
form.

Storage: The data will be stored in the system database (MySQL)

Retention: The data will be save on the desktop computer and with back up data.

Disclosure/Sharing: The data are exclusively used by the library management system.

Disposal/Destruction: No disposal of data.

 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

V. Privacy Impact Analysis

Transparency Yes No Not

Applicable

1. Are data subjects aware of the nature, purpose, and extent /

of the processing of his or her personal data?

2. Are data subjects aware of the risks and safeguards /

involved in the processing of his or her personal data?

3. Are data subjects aware of his or her rights as a data

subject and how these can be exercised?
Below are the rights of the data subjects:
- Right to be informed /
- Right to object /
- Right to access /
- Right to correct /
- Right for erasure or blocking /
- Right to file a complaint /
- Right to damages /
- Right to data portability /

4. Is there a document available for public review that sets out /

the policies for the management of personal data?

Please identify the document(s) and provide link where

available:

5. Are there steps in place to allow an individual to know what /

personal data it holds about them and its purpose of
collection, usage, and disclosure?

6. Are the data subjects aware of the identity of the personal /

information controller or the organization/entity processing
their personal data?

7. Are the data subjects provided information about how to /

contact the organization’s Data Protection Officer (DPO)?

Legitimate Purpose Yes No Not

Applicable

1. Is the processing of personal data compatible with a /

declared and specified purpose which are not contrary to
law, morals, or public policy?

2. Is the processing of personal data authorized by a specific /

law or regulation, or by the individual through express
consent?

Proportionality Yes No Not

Applicable
 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

1. Is the processing of personal data adequate, relevant, /

suitable, necessary, and not excessive in relation to a
declared and specified purpose?

2. Is the processing of personal data necessary to fulfill the /

purpose of the processing and no other means are
available?

Collection Yes No Not

Applicable

1. Is the collection of personal data for a declared, specified,, /

and legitimate purpose?

2. Is individual consent secured prior to the collection and /

processing of personal data?
If no, specify the reason

3. Is consent time-bound in relation to the declared, specified, /

and legitimate purpose?

4. Can consent be withdrawn? /

5. Are all the personal data collected necessary for the /

program?

6. Are the personal data anonymized or de-identified? /

7. Is the collection of personal data directly from the /

individual?

8. Is there authority for collecting personal data about the /

individual from other sources?

9. Is it necessary to assign or collect a unique identifier to /

individuals to enable your organization to carry out the
program?

10. Is it necessary to collect a unique identifier of another /

agency?
e.g. SSS number, PhilHealth, TIN, Pag-IBIG, etc.,

Use and Disclosure Yes No Not

Applicable

1. Will Personal data only be used or disclosed for the primary /

purpose?

2. Are the uses and disclosures of personal data for a /

secondary purpose authorized by law or the individual?

Data Quality Yes No Not

Applicable

1. . Please identify all steps taken to ensure that all data that is /
 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

collected, used or disclosed will be accurate, complete and

up to date:

1.1 *Please identify all steps taken to ensure that all data that /
is collected, used or disclosed will be accurate, complete
and up to date:

1.2 *The system is regularly tested for accuracy /

1.3 *Periodic reviews of the information /

1.4 *A disposal schedule in place that deletes information /

that is over the retention period

1.5 *Staff are trained in the use of the tools and receive /
periodic updates

1.6 *Reviews of audit trails are undertaken regularly /

1.7 *Independent oversight /

1.8 *Incidents are reviewed for lessons learnt and systems/ /

processes updated appropriately
1.9 *Others, please specify

Data Security Yes No Not

Applicable

1. Do you have appropriate and reasonable organizational, /

physical and technical security measures in place?
organizational measures - refer to the system’s
environment, particularly to the individuals carrying them
out. Implementing the organizational data protection policies
aim to maintain the availability, integrity, and confidentiality
of personal data against any accidental or unlawful
processing (i.e. access control policy, employee training,
surveillance, etc.,)
physical measures – refers to policies and procedures shall be
implemented to monitor and limit access to and activities in
the room, workstation or facility, including guidelines that
specify the proper use of and access to electronic media
(i.e. locks, backup protection, workstation protection, etc.,)
technical measures - involves the technological aspect of
security in protecting personal information (i.e. encryption,
data center policies, data transfer policies, etc.,)

*Have you appointed a data protection officer or /

compliance officer?
 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

*Are there any data protection and security measure /

policies in place?

*Do you have an inventory of processing systems? Will you /

include this project/system?

*Are the users/staffs that will process personal data /

through this project/system under strict confidentiality if
the personal data are not intended for public disclosure?

*If the processing is delegated to a Personal Information /

Processor, have you reviewed the contract with the
personal information processor?

Physical Security Yes No Not

Applicable

*Are there policies and procedures to monitor and limit /

the access to this project/system?

*Are the duties, responsibilities and schedule of the /

individuals that will handle the personal data processing
clearly defined?

*Do you have an inventory of processing systems? Will you /

include this project/system?

Technical Security Yes No Not

Applicable

*Is there a security policy with respect to the processing of /

personal data?

*Do you have policies and procedures to restore the /

availability and access to personal data when an incident
happens?

*Do/Will you regularly test, assess and evaluate the /

effectiveness of the security measures of this project/
system?

2. The program has taken reasonable steps to protect the /

personal data it holds from misuse and loss and from
unauthorized access, modification or disclosure?

3. If yes, which of the following has the program undertaken to

protect personal data across the information lifecycle:

3.1 * Identifying and understanding information types /

3.2 * Assessing and determining the value of the information /

3.3 * Identifying the security risks to the information /

3.4 * Applying security measures to protect the information /

 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

3.5 * Managing the information risks. /

Disposal Yes No Not

Applicable

1. The program will take reasonable steps to destroy or de- /

identify personal data if it is no longer needed for any
purpose.
If YES, please list the steps

Cross-border Data Flows (optional) Yes No Not

Applicable

1. The program will transfer personal data to an organization /

or person outside of the Philippines
If YES, please describe

2. Personal data will only be transferred to someone outside of

the Philippines if any of the following apply:
a. The individual consents to the transfer /
b. The organization reasonably believes that the recipient is /
subject to laws or a contract enforcing information handling
principles substantially similar to the DPA of 2012
c. The transfer is necessary for the performance of a contract /
between the individual and the organization
d. The transfer is necessary as part of a contract in the interest /
of the individual between the organization and a third party
e. The transfer is for the benefit of the individual; /

3. The organization has taken reasonable steps so that the

information transferred will be stored, used, disclosed and /
otherwise processed consistently with the DPA of 2012
If YES, please describe

VI. Privacy Risk Management

 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

Ref # Threats/Vulnerabilities Impact Probability Risk Rating

Unauthorized Use of 1 2 3 4 1 2 3 4 4 Low

Library Card Risk

1 2 3 4 1 2 3 4

1 2 3 4 1 2 3 4

1 2 3 4 1 2 3 4
 DATA PRIVACY PROTECTION TRAINING

LEARY JOHN H. TAMBAGAHAN, LPT

PANDAN BAY INSTITUTE, INC.

1 2 3 4 1 2 3 4
*add additional rows if needed

VII. Recommended Privacy Solutions

Recommended Solutions (Please provide justification)