Actually, there's an exemption right now under the Access to Information Act, where personal information is redacted unless you have consent or the information is public. It's probably the most used exemption through access requests that we see.
It's rarely questionable. Our institutions understand what privacy and protection of information is. We have a few cases where we don't agree with the institution, but that's really rare and we take that very seriously. We do have a good report from the Privacy Commissioner on those types of cases.