a head shall refuse to disclose personal information to any person other than the individual to whom
the information relates except the fallowing below.

(a) upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access

(b) in compelling circumstances affecting the health or safety of an individual, if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates

(c) personal information collected and maintained specifically for the purpose of creating a record available to the general public

(d) under an Act of Ontario or Canada that expressly authorizes the disclosure

(e) for a research purpose if below

(i) the disclosure is consistent with the conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained

(ii) the research purpose for which the disclosure is to be made cannot be reasonably accomplished unless the information is provided in individually identifiable form

(iii) the person who is to receive the record has agreed to comply with the conditions relating to security and confidentiality prescribed by the regulations

(f) if the disclosure does not constitute an unjustified invasion of personal privacy.
R.S.O. 1990, c. F.31, s. 21 (1).

Refusal to confirm or deny existence of record

A head may refuse to confirm or deny the existence of a record if disclosure of the record
would constitute an unjustified invasion of personal privacy. R.S.O. 1990, c. F.31, s. 21