Protection of Privacy Act (POPA)

Disclosure of Personal Information

What is a Disclosure?

Disclosure of personal information means sharing, releasing, showing, providing or transmitting it to a third party outside the University. Under the Protection of Privacy Act (POPA), a disclosure of personal information is considered consistent with the purpose for which the personal information was collected or compiled, if it has a reasonable and direct link to the original purpose and is necessary to perform a legal duty or operate an authorized program.

Disclosure of Personal Information

The University may disclose personal information only in the prescribed circumstances under POPA. POPA disclosure authorities include, but are not limited to:

if the disclosure would not be an unreasonable invasion of personal privacy under section 20 of the Access to Information Act (ATIA);
for the purpose for which the information was collected or compiled;
with consent of the individual (to obtain the consent of an individual, please use the Consent for Use or Disclosure of Personal Information under POPA Form;
for the purpose of collecting a fine or debt owing by the individual;
to law enforcement agencies (e.g. police) to assist in an investigation (please ask the law enforcement agency to fill out this Law Enforcement Disclosure Form first);
if the Head of the University (Provost) believes, on reasonable grounds, that the disclosure will avert or minimize a risk of harm to the health or safety of a minor, or an imminent danger to the health or safety of any person; and
for a research purpose, including statistic research (for additional information, see the Access to Personal Information for Research and Studies Procedure

Note: Section 20(2) of the ATIA outlines specific circumstances where the disclosure of personal information is not considered an unreasonable invasion of personal privacy.

Some specific examples related to post-secondary institutions, like the University of Alberta, include:

enrollment in a school or in a program offered by a post-secondary educational institution;
attendance at or participation in a public event or activity, including a graduation ceremony or sporting event; and
receipt of an honour or award granted by or through a public body.

Note: The University will not disclose personal information listed in the examples above if an individual has formally requested that it remain confidential. Students may make this request to the Office of the Registrar by completing the Request for Non-Disclosure of Personal Information.

Facts and Frameworks

When the University provides personal information it holds to a third party outside of the University, or permits that third party to have access to personal information it holds, then this is a disclosure of personal information.
The University may disclose personal information only in specific circumstances and only to the extent necessary to enable it to carry out its purpose in a reasonable manner.

Definitions

Personal Information means recorded information about an identifiable individual, including but not limited to: name, home address, personal email address, age, and an identifying number assigned to the individual.
Examples of public bodies include post-secondary institutions, Government departments, municipalities, and health authorities.
A third party is a person, group of persons or organization other than the individual who is the subject of the information or a public body.

For questions regarding the disclosure of personal information, consult the Information, Privacy and Records Management Office at privacy@ualberta.ca.