It says, “Subject to subsection (2), the head of a government institution shall refuse to disclose any record requested under this Act that contains personal information as defined in section 3 of the Privacy Act.” And there's a long list of information in section 3 that identifies what personal information is.
Section 20 of the Access to Information Act deals with third party information. Was it paragraphs 20(1)(b) and (c)?