In general, an employer can only release private information if it is compelled by law or if it serves a legitimate commercial purpose.