Essentially, an injury-based exemption would require the institution to provide specific evidence of the reasonable eventuality of an injury caused by the release of that particular information, as opposed to a mandatory exemption, where it would be sufficient to qualify the information, such as personal information. It would be sufficient to qualify the information as personal information to exempt it from the application of the act.
On October 25th, 2011. See this statement in context.