Disclosure of Personal Information

When the university provides personal information it holds to a third party outside of the university, or permits that third party to have access to personal information it holds, then this is a disclosure of personal information.

The Freedom of Information and Protection of Privacy Act ("FOIP Act") lists the only circumstances under which public bodies may disclose personal information.

Primary examples - these are the primary examples where section 40 provides for disclosure of personal information:

1. for the purposes for which it was collected; or

2. with the express informed consent of the individual the information is about.

To obtain the informed consent of an individual, please use the Informed Consent for Disclosure or Personal Information form. (Word 52 KB)

Otherwise, disclosure of personal information may occur only as outlined in section 40, together with section 17 of the Act, which includes consideration as to whether the disclosure is an unreasonable invasion of a third party's personal privacy.

Remember: The FOIP Act requires that you only disclose the least amount of personal information necessary in any situation.


Additional examples - some additional examples in which section 40 permits the disclosure of personal information are:

1. To an employee of the university if that information is necessary for the performance of their duties. This allows the university to disclose information to a service provider or volunteer, because the definition of "employee" in the FOIP Act includes service providers and volunteers;

2. "Business card information" in a business or professional context if it does not reveal other personal information about the individual;

3. Managing a common program or service with another public body (e.g. student placement);

4. Complying with subpoena or court order from an Alberta court (not from a foreign court);

5. To law enforcement agencies (e.g. police) if needed for an active investigation. If a unit other than UAPS is asked to disclose information, please ask the law enforcement agency to fill out this form first;

6. If the Provost believes, on reasonable grounds, that the disclosure will avert or minimize

- a risk of harm to the health or safety of a minor, or

- an imminent danger to the health or safety of any person,

7. For Research or Statistical Purposes. - See Access to Personal Information for Research/Studies Procedure in UAPPOL;

8. If the disclosure would not be an unreasonable invasion of an individual's privacy.

Here are some examples of a disclosure that would not be an unreasonable invasion:

A. For confirming enrolment in a program offered by the university* [note: section 40 does not permit disclosure of attendance, schedules, full or part time status, class locations, or ID photographs. Confirmations of enrolment are best performed by offices that are delegated that authority, e.g. Office of the Registrar or Faculty of Graduate Studies.]

B. Attendance or participation in a public event or activity related to the university*

C. Receipt of an honour or award granted by or through the university*

* In all of these cases, the university may not disclose the personal information if the individual has formally requested that the university not disclose this information. Students may make this request to the Office of the Registrar.

This is not an exhaustive list. The complete list can be found in sections 40 - 42 of the FOIP Act, located here.

For more information on guidance, university employees can also contact the Information and Privacy Office.

May 2017