Section 19: Questions
Archived [2008-11] – Investigator's Guide to Interpreting the Act
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived.
The Investigator’s Guide was removed from the website in April 2021 and is currently available solely for the above-mentioned activities.
We invite you to consult the Information Commissioner’s Guidance section where you will find up-to-date information on how we approach investigations and interpret the Access to Information Act.
In addition, the Information Commissioner posts final reports on her investigations on the website to provide guidance to both institutions and complainants. Using the database, you can sort through the decisions with the relevant sections of the Act.
Subsection -- 19(1) & (2)
Exemption: PERSONAL INFORMATION
19(1) Subject to subsection (2), the head of a government institution shall refuse to disclose any record requested under this Act that contains personal information as defined in section 3 of the Privacy Act.
19(2) The head of a government institution may disclose any record requested under this Act that contains personal information if
- the individual to whom it relates consents to the disclosure;
- the information is publicly available; or
- the disclosure is in accordance with section 8 of the Privacy Act.
Statement of Test to be Met
Inquiry Path
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Is the information 'personal information' under paragraphs 3(a) to (i) of the Privacy Act?
If so, is the information also described in paragraphs 3(j) - (m) of the Privacy Act?
Does section 19(2) apply? Is the information publicly available (paragraph 19(2)(b)); or does the individual consent to disclosure (paragraph 19(2)(a)); or does section 8 of the Privacy Act apply?
|
Subsection 19(1)
Exemption: PERSONAL INFORMATION
19(1) Subject to subsection (2), the head of a government institution shall refuse to disclose any record requested under this Act that contains personal information as defined in section 3 of the Privacy Act.
3. In this Act, 'personal information' means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing,
Statement of Test to be Met
Information about an identifiable individual
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information relate to a person other than the requestor? |
Statement of Test to be Met
Must be able to identify the individuals
Relevant Questions | Departmental Response | Assessment |
---|---|---|
To whom does the information relate? Does the access request describe this person? |
Statement of Test to be Met
Linkage of information to identifiable individuals must be clear and direct
Relevant Questions | Departmental Response | Assessment |
---|---|---|
If the information does not relate to a named individual, is it possible to identify the individual from the information in the record?
Does the information describe or relate to inclusion of individuals in a group?
|
Statement of Test to be Met
- Look for specific characteristics of members of group.
- Must be small and specific enough to identify individuals in the group.
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Are members of the group identified by personal characteristics?
Is it possible to identify individuals as members of this group?
Is there other information in the record that links an identifiable individual with the group
|
Statement of Test to be Met
Information must be 'about' the identifiable individual
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Is the individual described in a way that is personal? |
Statement of Test to be Met
Information must be specific to the individual
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information relate directly to the individual?
If not, how does the information relate to the individual? |
Statement of Test to be Met
Must be personal in nature
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Is there a meaningful connection between the information and the individual? |
Statement of Test to be Met
Cannot be so general as to not relate in a meaningful way to the individual
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Would another person reasonably ascribe to the individual the qualities, characteristics or financial information described in the record? [questions above about inclusion of individuals in a group are also relevant here] |
Section - 19
- Information relating to the race, national or ethnic origin, colour, religion, age or marital status of the individual.
- Information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved.
- Any identifying number, symbol or other particular assigned to the individual.
- The address, fingerprints or blood type of the individual.
- The personal opinions or views of the individual except where they are about another individual or about a proposal for a grant, an award or a prize to be made to another individual by a government institution or a part of a government institution specified in the regulations.
- Correspondence sent to a government institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to such correspondence that would reveal the contents of the original correspondence.
- The views or opinions of another individual about the individual.
- The views or opinions of another individual about a proposal for a grant, an award or a prize to be made to the individual by an institution or a part of an institution referred to in paragraph (e), but excluding the name of the other individual where it appears with the views or opinions of the other individual.
- The name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual.
Statement of Test to be Met
Paragraphs 3(a), (b) and(d)
Information must identify an individual
- physical characteristics
- personal activities
- personal status
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Statement of Test to be Met
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information describe general characteristics of a group? If so, how is the information related to the individual? Is the individual connected to the information?
Are the sources publicly available? Is it easy to connect the individual with the information using these sources, financial transactions or financial position? |
Statement of Test to be Met
Must be specific in relation to the individual
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information ascribe personal characteristics to an individual?
Does the information record the voice of an identifiable individual? Does the information attribute physical characteristics to an individual?
Does the information describe activities that are personal to an individual?
Does the information describe the status of the individual?
Does the request identify such personal characteristics or circumstances? |
Statement of Test to be Met
- Contractual relationships.
- Watch for connections with 3(j), (k) and (l).
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information describe average income, expenditure, net worth of members of a group? Are these average amounts meaningful indicators of the financial status of the individual? Does the information confirm the participation of a specific individual in a financial transaction? If not, does the information provide a meaningful indication of the participation of the individual in a financial transaction?
Is the financial transaction personal in nature? Does the transaction relate to the job of the individual? Did the individual have responsibility for the transaction as a function of his or her position or job? Is this a government job? Does the information describe a contract in which the individual is involved? Is this a contract for personal services?
If so, is the contract with the government?
Is it a contract by the individual for services from someone else?
Is the contract for services related to the job or position of the individual?
|
Statement of Test to be Met
Paragraph 3(b) -- Employment history
- watch for section 3(j), (k) and (l)
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the record reveal an individual's employment or employment history?
|
Statement of Test to be Met
Paragraph 3(c) -- Personal Identification
Identifying number, symbol or other particular assigned by the individual
Must relate to the individual in their personal capacity
Other particulars assigned to the individual
- Must identify the individual
Relevant Questions | Departmental Response | Assessment |
---|---|---|
If the information reveals an address, is it the address of an identifiable individual? Is it a home or other residential address?
Is it a business address or address of a group?
|
Statement of Test to be Met
Paragraph 3(d)
- Address, fingerprints, blood type.
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information assign a number, symbol or other identifier to an individual? Does this identifier relate to the individual alone or does it identify a group of individuals?
Is the identifier connected with other personal information identifying the individual?
Does the identifier relate to the individual in their personal capacity?
|
Statement of Test to be Met
Paragraphs 3(e), (g) and (h)
Views and Opinions.
Watch for section 3(j)(v), 3(k).
- Must be view/opinion of an individual.
- Were they are about another individual?
- Can only be disclosed to the other individual.
Proposals for grants award and prizes by a government institution.
- Can disclose views to the person about whom the views or opinions are expressed, without the name.
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information set out the views and opinions of an identifiable individual? Does paragraph 3(j)(v) apply?
If it is the opinion or view of the individual, is it a personal opinion or conveyed in an official capacity? Does the opinion or view represent the opinion or views of a group? Does the information convey an opinion or view?
Does the information recite or analyze facts as opposed to expressing an opinion or view? What does the opinion or view consist of? Is the opinion or view about another individual?
Is the opinion or view about a proposal for a grant, award or prize to be given to someone else?
Is there other information in the record which would identify the individuals? Is the nature of the grant, award or prize such that potential recipients can be easily identified?
Is the information about the grant, award or prize such that individuals judging or awarding grants can be easily identified?
Is the grant, award or prize being awarded by a government institution specified in the regulations to the Privacy Act
|
Paragraph 3(f)Privacy Act
Private and confidential correspondence
- content must be personal and private in nature
- does not apply to official correspondence
Watch for section 3(j)
- does not apply to correspondence on a public issue
- can be implicit
- based on content of information
- reply must reveal content of information
Watch for section 3(l)
Severance important
Statement of Test to be Met
Paragraph 3(i) --Names
names of individuals
- must appear with other personal information; or
- where name itself reveals information about the individual
Watch for section 3(j), (k) Severance must be considered
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information include names of individuals? What other personal information appears with the name? Is the information that appears with the name personal in nature?
Does the name appear in the context of an individual dealing with the government as a representative of an organization or for a business purpose?
Would the name itself reveal information about an identifiable individual?
Is there other information in the record which connects the name with personal information? Does the person involve have a high public profile?
Does the title or heading in the document create personal information about the individuals named in the document?
Would severance of the name leave information in the record which still identifies the individual?
|
Statement of Test to be Met
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the record consist of correspondence by an individual with a government institution or government official? Is the correspondence private or confidential in nature? What does the correspondence relate to? Is the correspondence sent by the individual in their personal capacity? Is the information sent by an individual representing a group or organization?
Does the correspondence relate to the position or functions of a government employee?
Is the correspondence sent by another government employee? Is the correspondence sent by the government employee in their capacity as a government employee, or in their capacity as an individual? Is the content of the correspondence routine? Is the content of the correspondence administrative in nature? Does the correspondence relate to a public issue or to public policy?
Does this correspondence provide recommendations or analysis of a public issue by the author? Was the correspondence explicitly sent on a private or confidential basis? Does the person sending the correspondence request confidentiality? Is the correspondence implicitly confidential or private?
Does the reply reveal the content of the original correspondence? Is the reply confined to matters dealing with public policy? Does the reply apply government criteria for assistance or such matter to the individual? Does the correspondence deal with the conferring of a benefit?
Would severance of the name of the individual sending the correspondence eliminate the likelihood of the correspondence relating to an identifiable individual?
Could the individual be identified from the correspondence through public, accessible sources? |
Subsection - 19(3)
3. In this Act,'personal information' means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing… but, for the purposes of sections 7, 8 and 26 and section 19 of the Access to Information Act, does not includeinformation about an individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual including,
- the fact that the individual is or was an officer or employee of the government institution;
- the title, business address and telephone number of the individual;
- the classification, salary range and responsibilities of the position held by the individual;
- the name of the individual on a document prepared by the individual in the course of employment; and
- the personal opinions or views of the individual given in the course of employment.
Statement of Test to be Met
Officers and employees of government institution
- must relate to position or function of individual
- performance in the function is not included
- personnel evaluations not included
Includes:
- Employment history with the government
- When employment with government ceased
- Period of time employed by government
- Position, title, location
- General information about the duties and functions performed by the individual
- Classification and salary range of position
- Per diems, specific salaries not included
Identification of individual in course of employment
- Documents by individual
- Views and opinions of individual
Watch for paragraph 3(l)
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Section - 19
'Personal information' means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing,
(k) information about an individual who is or was performing services under contract for a government institution that relates to the services performed, including the terms of the contract, the name of the individual and the opinions or views of the individual given in the course of the performance of those services
Statement of Test to be Met
- Must be a contract for services
- Relates to paragraph 21(2)(b)
- Does not include evaluation of performance under the contract
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information relate to a contract for services between an individual and the government? Is the individual employed pursuant to such a contract? Does the individual perform services under the contract for the government institution? Does the information relate to the terms of the contract? Does the information relate to conclusions or views of the individual given in the course of the contract? Does the information relate to an evaluation of the individual's performance under the contract? |
Section - 19
'Personal information' means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing,
(l) information relating to any discretionary benefit of a financial nature, including the granting of a licence or permit, conferred on an individual, including the name of the individual and the exact nature of the benefit,
Statement of Test to be Met
Discretionary benefit of a financial nature
- benefit must be discretionary
- must confer a financial benefit
- licence or permit must confer a financial benefit
- discounts, lower than market rates, subsidies are included
- does not apply to salarial compensation
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Is the benefit conferred by a government institution? Is the benefit discretionary?
Is a financial benefit conferred
Does the benefit relate to salarial compensation?
|
Statement of Test to be Met
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information relate to an individual who is an officer or employee of a government institution? Is the government institution listed in the Schedule of the Access to Information Act/Privacy Act? Is the employee currently employed by a government institution? If not, was the person ever employed by a government institution?
Is the information described in subparagraphs (I)-(v)?
Generally, does the information relate to the general duties or activities connected with or required by the position, i.e.,
Information not covered by 3(j) Is the information related to the individual's performance?
Does the information describe the effectiveness of the individual in performing the function? Does the information describe the effectiveness of the individual in dealing with an issue for which the individual has responsibility? Does the information relate to the employment history of the individual with the government?
Is it related to information contained in subpararagraphs (I) through (v)? Does the information describe personal accomplishments or failures of the individual? Does the information relate to how an individual is affected by government reorganization? Does the information relate to changes in the responsibilities assigned to an individual?
With respect to documents prepared by the individual:
Does the information relate to compensation given to a government employee?
Does the information describe a settlement of employment conditions between the individual and the government institution? Does the information describe a severance package?
|
Section - 19
'Personal information' means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing,
(m) information about an individual who has been dead for more than twenty years;
Statement of Test to be Met
Individual has been dead for more than twenty years
- government institution must have reasonable basis for concluding section 3(m) does not apply
- government institution must undertake some examination
- assess against the period of time described in the information
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Does the information relate to an individual who could be dead for more than twenty years? Has the government institution investigated this possibility?
What period of time does the information relate to? Is there a possibility the individual could have been dead? Would this fact be known using available public sources?
|
Subsection - 19(2)
The head of a government institution may disclose any record requested under this Act that contains personal information if
- the individual to whom it relates consents to the disclosure;
- the information is publicly available; or
- the disclosure is in accordance with section 8 of the Privacy Act.
Statement of Test to be Met
Consent of individual to whom information relates
- implicit or explicit
- look at consent provided under the Privacy Act
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Has the individual consented to disclosure of the information? Has the government institution sought consent of the individual?
Has the individual provided an explicit direction to the government not to disclose the information? Has the individual provided consent to disclosure under the provisions of the Privacy Act? Has the individual implicitly consented to disclosure of the information? See questions on whether information is publicly available. Has the individual consented in the past to disclosure of the record? Has the individual consented to disclose parts of the information? Has the individual consented to disclose a version of the information which eliminates highly sensitive matters?
|
Subsection - 19(2)
The head of a government institution may disclose any record requested under this Act that contains personal information if
- the individual to whom it relates consents to the disclosure;
- the information is publicly available; or
- the disclosure is in accordance with section 8 of the Privacy Act.
Statement of Test to be Met
Consent of individual to whom information relates
- implicit or explicit
- look at consent provided under the Privacy Act
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Has the individual consented to disclosure of the information? Has the government institution sought consent of the individual?
Has the individual provided an explicit direction to the government not to disclose the information? Has the individual provided consent to disclosure under the provisions of the Privacy Act? Has the individual implicitly consented to disclosure of the information? See questions on whether information is publicly available. Has the individual consented in the past to disclosure of the record? Has the individual consented to disclose parts of the information? Has the individual consented to disclose a version of the information which eliminates highly sensitive matters?
|
Exemption: Personal Information
Section 8 -- Privacy Act
8(1) Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.
(2) Subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed
- for the purpose for which the information was obtained or compiled by the institution for a use consistent with that purpose;
- for any purpose in accordance with any Act of Parliament or any regulation made thereunder that authorizes its disclosure;
- for the purpose of complying with a subpoena or warrant issued or order made by a court, person or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of information;
- to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada;
- to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed;
- under an agreement or arrangement between the Government of Canada or an institution thereof and the government of a province, the government of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, for the purpose of administering or enforcing any law or carrying out a lawful investigation;
- to a member of Parliament for the purpose of assisting the individual to whom the information relates in resolving a problem;
- to officers or employees of the institution for internal audit purposes, or to the office of the Comptroller General or any other person or body specified in the regulations for audit purposes;
- to the National Archives of Canada for archival purposes;
- to any person or body for research or statistical purposes if the head of the government institution
- is satisfied that the purpose for which the information is disclosed cannot reasonably be accomplished unless the information is provided in a form that would identify the individual to whom it relates, and
- obtains from the person or body a written undertaking that no subsequent disclosure of the information will be made in a form that could reasonably be expected to identify the individual to whom it relates;
- to any association of aboriginal people, Indian band, government institution or part thereof, or to any person acting on behalf of such association, band, institution or part thereof, for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada;
- to any government institution for the purpose of locating an individual in order to collect a debt owing to Her Majesty in right of Canada by that individual or make a payment owing to that individual by Her Majesty in right of Canada; and
- for any purpose where, in the opinion of the head of the institution,
- the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or
- disclosure would clearly benefit the individual to whom the information relates.
Statement of Test to be Met
Provisions requiring an Access to Information Request
- Paragraph 8(2)(a)
- Disclosure authorized for a use consistent with the purpose for collecting the information
Determine why information was collected Determine the likely use of information if disclosed
- Are these consistent with one another?
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Statement of Test to be Met
Paragraph 8(2)(b)
- For any purpose where a statute or regulation authorizes disclosure
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Was the information generated pursuant to a statutory provision or regulation?
Does the statute or regulation require individuals outside the government to provide the information? Does the statute or regulation allow disclosure of the information?
Is disclosure controlled? How is disclosure controlled? In what circumstances does the statute or regulation authorize disclosure?
Is the requestor a person to whom disclosure would be authorized? |
Statement of Test to be Met
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Would disclosure of the information be for a use consistent with the original purpose behind collecting the information? To determine if this is the case: Why was the information originally collected? How is the information likely to be used if it is disclosed? What is the reason that the information has been requested? Is there a meaningful connection between the requestor and the information requested?
Is the likely use of the information consistent with the original purpose for collecting it? Does the personal information concern individuals who are parties to a proceeding?
Was the information collected in connection with this proceeding? Is a party to the proceeding requesting the information? Would disclosure of the information otherwise be given to the party in the course of the proceedings? Would disclosure of the information to the requestor ordinarily take place? Does the requestor want the information for a government purpose?
Does the requestor want the information for personal use?
Is use of the information outside of the government consistent with the reason the government obtained or generated the information? |
Statement of Test to be Met
Paragraph 8(2)(j) Research or statistical purposes
- Determine if it is possible to disclose without identifying the individual
- Ensure undertaking is provided not to identify individual in subsequent disclosure
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Is the information requested for researchers' statistical purposes? Are there measures that can be taken to disclose the information without identifying the individual?
Would the government institution be able to create a record which would avoid disclosing the identity of the individual? Has the requestor provided an undertaking not to identify any individuals in subsequent disclosure? What does this undertaking consist of? Is the undertaking enforceable? Has the requestor established that the information is required for a research or a statistical purpose? What is being researched? Why are the statistics being generated? What will the statistics show? How will the research or statistics be used? |
Statement of Test to be Met
Public Interest Override
Paragraph 8(2)(m)
For any purpose where, in the opinion of the head of the government institution
- the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure
Opinion of the head of institution
- discretionary power
- assess on basis of relevant considerations
Standard of proof is high
- clearly outweighs any invasion of privacy
Standard of proof quantifying privacy interest is low
- any invasion of privacy that could occur
Public interest in disclosure
- characterize the public interest in disclosure
- quantify its importance
Relevant Questions | Departmental Response | Assessment |
---|---|---|
What are the reasons favouring disclosure of this information? Does the information relate to a private interest only, or does it relate to a matter of public concern? Do these reasons relate to a public concern for interest? Is there general public interest in knowing the information? Is the information of use to the requestor only, or to a broader public group? Would disclosure of the information subject the activities of the government to public scrutiny? Would disclosure of the information reassure the public about government activity? Would disclosure of the information promote public health and safety? Would disclosure of the information assist the requestor in obtaining a fair determination of his or her rights? Would disclosure of the information inform the public about the consumer issues? Does the information concern an investigation into activity which is likely to generate significant public interest? Why are the reasons in favour of disclosure compelling? |
Statement of Test to be Met
Any invasion of privacy?
- characterize/quantify the invasion of privacy
- assess the likelihood of an invasion of privacy
- identify any mitigating measures that would reduce the invasion of privacy
Relevant Questions | Departmental Response | Assessment |
---|---|---|
What is the invasion of privacy that will result if the information is disclosed? How serious is the invasion of privacy? Is the personal information involved of a highly sensitive nature? Would the individual to whom the personal information relates be unfairly exposed to financial harm?
Is the personal information involved accurate or reliable?
Was the personal information supplied in confidence to the government institution?
What is the likelihood of harm from disclosure? What is the likelihood of the above invasions of privacy? Can the government institution sever the information in order to reduce the invasion of privacy? Can the government institution provide an explanatory note or take other measures to reduce the invasion of privacy |
Statement of Test to be Met
Balance the interests
- weigh the likelihood and degree of invasion of privacy against reasons in favour of disclosure
- assess which are more important
- note that courts have stated disclosure in and of itself is an important public interest
Standard of Proof
- do the reasons favouring disclosure to the public clearly outweigh the invasion of privacy
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Do the reasons in favour of disclosure outweigh the likelihood and degree of the invasion of privacy? Is the public interest compelling? Is the invasion of privacy minimal or serious in nature? What factors were taken into account by the head of the government institution? Are these consistent with the purpose of the Access to Information Act?
Are the factors consistent with the purpose of the Privacy Act?
Are the reasons for not disclosing the information proper?
Are the reasons for not disclosing relevant to the purpose of avoiding invasion of privacy of the individuals concerned? |
Statement of Test to be Met
Sub-paragraph 8(2)(m)(ii)
Clear benefit to the individual
- look at likely use of the information
- would the individual otherwise know about the benefit
- is the benefit significant
- mitigating measures to minimize invasion of privacy
- undertakings
Relevant Questions | Departmental Response | Assessment |
---|---|---|
Would disclosure clearly benefit the individual about whom the information relates? What is the likely use of the personal information? Would the individual otherwise know about the benefit?
What kind of benefit is involved?
How large is the benefit? Would disclosure of the information apprise the individual of a medical risk?
Has the individual about whom the information relates sought this information in the past? Are there mitigating measures the institution can take to minimize the invasion of privacy? Can the institution obtain an undertaking from the requestor not to use the information for purposes other than benefiting the individual? Is this undertaking enforceable? |