Grasslands Public Schools Policy Handbook Grasslands Public Schools
Sign in
Home
live
Administrative Procedure

AP-325 — Disclosure of Personal Information Without Consent

Section Three: General School Administration
Effective Date: June 8, 2026 Last Reviewed: June 8, 2026

Background

Grasslands Public Schools holds personal information that, under the Protection of Privacy Act, is not disclosed without the individual's consent unless a statutory ground authorizes the disclosure. In defined circumstances, POPA section 13 authorizes disclosure without consent to parties outside the Division, or internally to other employees.

This Administrative Procedure establishes the authority and decision framework for disclosing personal information to third parties or internally to other employees. It identifies who may authorize a disclosure, the statutory ground each disclosure relies on, and the duty to limit every disclosure to the minimum necessary. It also establishes the Division's legal hold authority: the decision to suspend normal records disposition when information must be preserved for a legal matter.

Scope

This procedure applies to all employees, contractors, and volunteers of Grasslands Public Schools who may receive a request to disclose personal information, or who may authorize a disclosure. It applies to all personal information in any format that is in the custody or under the control of the Division.

This procedure governs the disclosure of personal information without the individual's consent, on the statutory grounds set out in POPA section 13. Disclosure of a student's personal information for the student's benefit or safety, including disclosure under the Children First Act, under POPA s.13(1)(cc) to avert or minimize harm to the student, or under POPA s.13(1)(ee) in the student's best interests, is governed by A.P. 920 – Sharing Information for Student Benefit and Safety. Where a disclosure concerns a student in any of these circumstances, consult A.P. 920 first; this procedure governs disclosure where the subject may or may not be a student, or where no student-benefit ground applies. Disclosure made with the individual's consent (under POPA section 13(1)(a)) is outside the scope of this procedure.

This procedure does not apply to routine access to information requests processed under A.P. 324 – Access to Information.

Definitions

Terms not defined in this procedure have the meanings assigned in Policy 310 – Information Security Charter and Policy 311 – Privacy and Access to Information.

Compelled disclosure: A disclosure the Division is legally required to make, such as production under a subpoena, warrant, or court order issued by a body with jurisdiction in Alberta (POPA s.13(1)(f)).

Control: The Division's authority to obtain, manage, direct the use of, and dispose of personal information, regardless of which party has physical custody of it.

Custodian: An individual who has possession of or responsibility for records or information that may be subject to a legal hold.

Custody: Physical possession of personal information by a party on the Division's behalf, distinct from control.

Disclosure: Making personal information available to a person or body outside the Division, or to an individual within the Division who would not otherwise have access to it.

Legal Hold: A directive requiring the preservation of records and information that may be relevant to a pending or reasonably anticipated legal proceeding, investigation, or regulatory action, suspending normal retention and destruction schedules for the affected records.

Service Provider: A party that collects, uses, stores, or has access to personal information on behalf of the Division under a contract or agency relationship. Under POPA s.1(1)(h), a service provider is an employee of the Division for the purposes of that Act.

Voluntary disclosure: A disclosure the Division is permitted but not required to make, where the Division exercises discretion to disclose under a POPA s.13(1) ground (for example, assisting a law enforcement investigation under s.13(1)(p)).

Responsibilities

Superintendent (Head of the Public Body)

Access and Privacy Coordinator (Associate Superintendent Business Services)

Director of Technology

Site Coordinators (School Principals)

All Staff

Procedures

1. Disclosure of personal information to service providers

Provision of personal information to a service provider engaged under contract is an authorized internal use under POPA s.13(1)(g) and POPA s.1(1)(h) (a service provider is an employee of the Division for the purposes of that Act), not a disclosure to a third party. Vendor arrangements are governed by A.P. 322 – Third-Party and Vendor Risk Management, not this section.

a. Receipt and routing

  1. All law enforcement, court, and legal requests for the disclosure of personal information shall be directed to the Access and Privacy Coordinator except in circumstances where there is imminent risk of harm to an individual. No employee shall disclose personal information in response to such a request without first routing it through the Access and Privacy Coordinator.
  2. The Access and Privacy Coordinator shall maintain a record of all law enforcement, court, and legal requests, recording the date of receipt, the requesting party, the nature of the request, the records requested, the statutory ground relied on, the authorization decision, the records disclosed, and the date of disclosure.

b. The minimum-necessary limit

  1. Every disclosure under this procedure is subject to POPA s.13(4): the Division may disclose personal information only to the extent necessary to carry out the purpose of the disclosure in a reasonable manner. The Access and Privacy Coordinator shall limit each disclosure to the specific information required for the stated purpose and shall not disclose a complete record where a single fact will answer the request.

c. Compelled disclosure: subpoenas, warrants, and court orders

  1. The Division shall comply with a subpoena, warrant, or order issued by a court, person, or body having jurisdiction in Alberta to compel the production of information, as authorized under POPA s.13(1)(f). A valid warrant or order compels production regardless of Division consent.
  2. Upon receiving a subpoena, warrant, or court order, the Access and Privacy Coordinator shall:
    1. Verify the authenticity of the document and confirm it was issued by a body with jurisdiction.
    2. Review the scope of the demand to determine exactly which records are required.
    3. Consult legal counsel before producing records where the scope is broad, the demand is unusual, or privileged information may be involved.
    4. Produce only the records the demand specifies, and no more.
    5. Where the document type permits, redact information that falls outside the scope of the demand, in consultation with legal counsel.
  3. A valid warrant issued under the Criminal Code compels production and shall be complied with promptly. Where a warrant is executed in person and immediate production is required, verification of authenticity and scope review shall occur as quickly as practicable, but shall not unreasonably delay execution of a valid warrant.
  4. Records that may be subject to solicitor-client privilege shall not be voluntarily produced. Where privileged records fall within the scope of a warrant or order, the appropriateness of producing them shall be assessed by legal counsel.
  5. Where the Government of Alberta or the Division is a party to a proceeding before a court or quasi-judicial body, personal information may be disclosed for use in that proceeding under POPA s.13(1)(u), as directed by legal counsel.

d. Voluntary disclosure to law enforcement and in urgent circumstances

  1. The Division may disclose personal information without the individual's consent and without a warrant or court order only where a POPA s.13(1) ground authorizes the disclosure. The grounds most relevant to law enforcement and urgent circumstances are:
    1. Assisting a law enforcement investigation (POPA s.13(1)(p)). The Division may disclose personal information to a public body or a law enforcement agency in Canada to assist in an investigation undertaken with a view to, or likely to result in, a law enforcement proceeding. This is permissive, not mandatory: the Access and Privacy Coordinator weighs each request and decides what assistance is appropriate.
    2. Averting or minimizing harm (POPA s.13(1)(cc)). Where the head of the public body believes on reasonable grounds that disclosure will avert or minimize a risk of harm to the health or safety of a minor, or an imminent danger to the health or safety of any person, disclosure is authorized. Where the person at risk is a student, the disclosure is handled under A.P. 920 – Sharing Information for Student Benefit and Safety; this ground is applied under this procedure where the person at risk is not a student (for example, a staff member, parent, contractor, or member of the public).
    3. Contacting family in tragic circumstances (POPA s.13(1)(r), s.13(1)(s)). Where an individual is injured, ill, or deceased, contact information may be disclosed so that family may be reached, subject to the limits in those paragraphs.
    4. Best interests of a minor (POPA s.13(1)(ee)). Where the minor is a Division student, this disclosure is governed by A.P. 920 – Sharing Information for Student Benefit and Safety; proceed under that procedure. Where the disclosure concerns a minor who is not a Division student, or a parent or guardian of a minor, and the head believes on reasonable grounds that disclosure is in the best interests of that minor, disclosure may be authorized under this procedure by the Access and Privacy Coordinator.
  2. The decision to make a voluntary disclosure shall be authorized by the Access and Privacy Coordinator, or by the Superintendent where the ground requires the head of the public body. The Access and Privacy Coordinator shall document the statutory ground relied on, the specific information disclosed, the agency and individual receiving the information, and the circumstances supporting the decision.
  3. When the Division makes a voluntary disclosure to a law enforcement agency, the Access and Privacy Coordinator shall consider whether to notify the affected individual, and shall not notify where doing so would compromise an investigation or endanger any person. A decision not to notify shall be documented with reasons.

2. Investigative access to staff personnel information

  1. Access to staff personnel information for the purpose of a workplace investigation is a disclosure authorized under POPA s.13(1)(w) (managing or administering personnel, including conducting workplace investigations). This section establishes who may authorize that access.
  2. Before a matter becomes a formal investigation, a principal or the Superintendent may conduct a preliminary assessment with limited initial steps to determine whether a concern warrants escalation accessing only the minimum staff personal information necessary under POPA s.13(1)(w) and s.13(4).
  3. A request to the Technology Department for access to a specific employee's information is actioned only where the access is authorized. Routine, operationally necessary access for example, retrieving Division records needed to keep a school or department operating may be actioned on confirmation of operational need. A request driven by a concern about the employee's conduct is a preliminary assessment or investigation, and shall not be actioned until authorized by the Superintendent or the Access and Privacy Coordinator. The Technology Department shall not provide targeted access to an employee's information on the basis of an individual supervisor's concern alone.
  4. Where a system owner or Technology Department staff member, in the course of legitimate system administration, security, maintenance, or support work, incidentally discovers information suggesting possible staff misconduct, they shall not act on it or disclose it on their own initiative. They shall report it to the Director of Technology, who assesses the matter and escalate to the Superintendent or the Access and Privacy Coordinator, who determines the appropriate channel a preliminary assessment, a referral to the employee's supervisor under POPA s.13(1)(g), a formal process under A.P. 725 – Respect in the Workplace, a child-safety report under A.P. 920 – Sharing Information for Student Benefit and Safety, or preservation and escalation where the matter may be criminal. Technology Department staff do not independently decide what to disclose, or to whom, and do not monitor or search a specific employee's information without authorization under this section.
  5. Requests for staff personnel information shall be classified as either routine human resources inquiries or investigative requests:
    1. Routine human resources inquiries (verification of qualifications, emergency contact retrieval, benefit administration, scheduling) are authorized by the Associate Superintendent Business Services or designate, on confirmation of a legitimate operational need.
    2. Investigative requests (information related to a workplace investigation, disciplinary proceeding, or harassment or violence complaint) require Superintendent authorization, who shall confirm that the investigation has a lawful basis and that the scope of the information requested is proportionate to the matter.
    3. Investigative requests involving Senior Administration are authorized by the Board Chair or the Board's legal counsel, to ensure independence from the subject of the investigation.
  6. No employee shall access personnel information about another employee outside the authorization process established in this section. Unauthorized access to personnel information shall be treated as a privacy incident under A.P. 321 – Information Security Incident Response.
  7. Where an investigative request may lead to litigation, the Access and Privacy Coordinator shall assess whether a legal hold is warranted at the time the request is authorized.
  1. A legal hold suspends the normal retention and disposition of records so that information relevant to a legal matter is preserved. This section establishes the authority to issue a hold.
  2. The Access and Privacy Coordinator shall issue a legal hold when any of the following conditions exist:
    1. The Division has been served with a statement of claim, notice of action, or other originating legal document.
    2. The Division has received notice of a pending or threatened legal proceeding, regulatory investigation, or formal complaint to the Office of the Information and Privacy Commissioner.
    3. The Superintendent has authorized an internal investigation that may result in disciplinary action or litigation.
    4. The Division has received a law enforcement request or warrant that identifies records that must be preserved.
    5. The Division reasonably anticipates litigation, even if no formal proceeding has been commenced.
  3. When in doubt about whether a legal hold is required, the Access and Privacy Coordinator shall consult legal counsel. The default position shall be to issue the hold; failure to preserve relevant evidence can result in adverse inferences or sanctions in a legal proceeding.
  4. A legal hold shall be released only when the Access and Privacy Coordinator determines, in consultation with legal counsel, that the matter giving rise to the hold has been resolved and that preservation is no longer required. On release, normal retention schedules resume, and the Access and Privacy Coordinator shall confirm that no other active hold applies before any affected records are disposed of.

Review

This procedure shall be reviewed every three years by the Access and Privacy Coordinator or earlier if triggered by:

Cross reference

Legal references

Document history

Version Date Author Changes
1.0 2026-06-04 Director of Technology Initial release.