Under the Privacy Act, personal information about an individual may not be provided to a third party without that individual’s written consent or unless it is in accordance with other disclosure provisions of the Act. For example, CIC cannot give specific reasons for a refusal to a member of the person’s family, a friend, a consultant or the media, unless that person has authorized, in writing, the disclosure of personal information to the third party.