Disclosure of Personal Information of Employees to Third Parties
It is incumbent on all University of Alberta staff to ensure that the personal information of employees of the university is not inappropriately disclosed. Personal information is defined in the Freedom of Information and Protection of Privacy Act as recorded information about an identifiable individual. It includes such information as an individual’s name; home or business address; home or business telephone number; race, national or ethnic origin; age; sex; marital or family status; identifying number; health and health care history; educational, financial, employment or criminal history; anyone else’s opinions about the individual; and the individual’s personal views or opinions (except if they are about someone else).
Section 40(1) of the Act lists the only circumstances under which the university may disclose personal information. It provides authority to respond to:
- a formal request for access under the Act
- a general request for personal information about an employee (routine disclosure)
- a request or an intent to publish personal information about employees (active dissemination)
The following guidelines will help staff to make appropriate disclosure decisions.
- You may disclose an employee’s personal information to a third party if the disclosure is not an unreasonable invasion of the employee’s personal privacy [section 40(1)(b)]. It does not constitute an unreasonable invasion of privacy to release information in the following categories:
- employment status
- business address, telephone number, e-mail address
- job title; job profile
- rank, job category
- salary range
- discretionary benefits
- relevant educational qualifications
- attendance at or participation in a public event or activity related to the institution (e.g. graduation, sporting or cultural event)
- personal information already in the public domain
- publications listed in an academic staff member's annual report
When individuals are hired by the University of Alberta, they must be informed that, although the above information is personal information and subject to consideration under the Act, it has been determined to be a matter of public record on this campus.
NOTE An individual’s employment status, contact information, or portions thereof, may be restricted in specific cases for security reasons. You can be sure that information is not restricted if it is included in the e-mail or telephone directory. If you are not sure whether the information can be disclosed, check the directory or call the employee yourself to confirm status before releasing information.
- You must refuse to disclose an employee’s personal information to a third party if the disclosure would be an unreasonable invasion of the employee’s privacy. It would be an unreasonable invasion of privacy to release the following kinds of information to a third party unless the disclosure is authorized under section 40 of the Act:
- exact salary or any information that might indicate an exact salary amount
- home address or telephone number
- information relating to an individual’s race, national or ethnic origin; age; birth date; marital or family status; health or health care history
- employment history
- ID number
- evaluative information
- You may disclose an employee’s personal information to a third party if the employee has identified the information and consented in writing to the disclosure [section 40(1)(d)]. Written consent must be obtained prior to disclosure in the following kinds of cases:
- credit card company or bank requests exact salary information
- potential employer requests an evaluation of a former or current employee
- potential employer requests details regarding the employment history of a former or current employee
- You may also disclose an employee’s personal information to a specific third party if the disclosure is authorized under the Act. Section 40(1) includes the following authorities:
- for the purpose for which the information was collected or compiled or for a use consistent with that purpose
- for the purpose of complying with a collective agreement
- for any purpose in accordance with an enactment of Alberta or Canada that authorizes or requires the disclosure (e.g. reports to Statistics Canada)
- to an officer of the University of Alberta if the information is necessary for the performance of his or her duties
- for the purpose of collecting a fine or debt owed by an individual to the University of Alberta
- for the purpose of determining or verifying an employee’s suitability or eligibility for a program or benefit
- to University Audit or any other prescribed body for audit purposes
- so that the spouse, relative or friend of an injured, ill or deceased individual may be contacted
- for the purpose of managing or administering personnel of the University of Alberta
Consult section 40 of the Act for a complete list of authorities.
NOTE that in all cases, the university should disclose personal information only to the extent necessary to enable the officer to carry out the purpose described.
It should be clear that staff may choose to disclose information in one circumstance but not in another. For example:
- It would be inappropriate to disclose exact salary information to an employee’s next door neighbour, the media or a colleague. However, a payroll or budget officer would clearly need the information for the purpose of managing personnel or to perform his or her regular duties.
Section 40 enables disclosure; it does not require disclosure. Staff should not assume that the person requesting the personal information of a third party is authorized to receive the information. Although university employees have a duty to assist any person who requests information, when the personal information of a third party is involved, the onus is on the applicant to provide evidence of authorization. At the same time, the onus is on the staff member of the university to ensure that information is not inappropriately disclosed.
- ensure that personal information is provided only to an individual who is entitled to the information. If you receive a request by phone and cannot confirm the identity of the caller, ask for some information that will allow you to identify the caller or verify the phone number and return the call yourself or respond by e-mail.
- ask a relative to provide identification and evidence that he or she has the authority to act on an employee’s behalf.
- request that the bank provide evidence of consent to release specific financial information.
- request that an employee provide written consent before you write a letter of reference or respond to a request for an oral evaluation.
See also the Guidance on Release of Personal Information in Emergency or Special Situations.
If you need assistance determining whether information should be disclosed, contact Human Resources, the unit FOIPP Liaison Officer, or the Information and Privacy Office.