
739 P.2d 874 (1987)
The DENVER POST CORPORATION, and Neil Westergaard, Plaintiffs-Appellees and Cross-Appellants,
v.
The UNIVERSITY OF COLORADO, the Regents of the University of Colorado, C. William Fischer and H.H. Arnold, Defendants-Appellants and Cross-Appellees.
No. 86CA0331.
Colorado Court of Appeals, Div. II.
March 5, 1987.
Rehearing Denied March 26, 1987.
Certiorari Denied July 27, 1987.
*876 Gibson, Dunn & Crutcher, George B. Curtis, David Schieferstein, Denver, for plaintiffs-appellees, cross-appellants.
Office of the University Counsel, University of Colorado, Ted D. Ayres, Ben A. Rich, Kathleen Mills, Rosemary Augustine, Boulder, for defendants-appellants and cross-appellees.
Certiorari Denied (University) July 27, 1987.
STERNBERG, Judge.
The University of Colorado appeals an order of the district court allowing the Denver Post to inspect certain University documents. The Post cross-appeals, asserting that the court erred by sustaining the University's refusal to allow inspection of other documents on the basis of the attorney-client privilege and the work product doctrine, and in denying its request for attorney fees and court costs. We affirm in part, and reverse in part.
Pursuant to the Colorado Open Records Act, § 24-72-201 et seq., C.R.S., a reporter *877 for the Post submitted a written request to the University of Colorado seeking access to certain documents. These documents related to an internal investigation conducted by a special review committee appointed by the president of the University. The committee had investigated allegations raised by the state auditor that certain regents and certain administrators, faculty, and employees of the University's Health Sciences Center had received, in connection with University contracts to establish a hospital and medical school in Saudi Arabia, payments from that government which may have been unauthorized and improperly reported.
The University released some documents to the Post, but withheld others, claiming they were exempt from disclosure under the Open Records Act. The Post then filed an application in the district court under § 24-72-204(5), C.R.S., for an order directing the University to show cause why inspection of this information was denied, and to pay the Post's attorney fees and costs if the court found the denial arbitrary or capricious. Thereafter, the trial court entered the order here at issue.
The Colorado Open Records Act contains a broad legislative declaration that all public records shall be open for inspection unless specifically excepted by law. Section 24-72-201, C.R.S. Consonant with that policy mandate, it was held in Denver Publishing Co. v. Dreyfus, 184 Colo. 288, 520 P.2d 104 (1974) that a public official has no authority to deny any person access to public records unless there is a specific statute permitting the withholding of the information requested.
The University denied access to the documents on the basis of several provisions of § 24-72-204, C.R.S. This section provides in pertinent part:
"(1) The custodian of any public records shall allow any person the right of inspection of such records ... except on one or more of the following grounds or as provided in subsection (2) or (3) of this section:
(a) Such inspection would be contrary to any state statute.
 ....
(c) Such inspection is prohibited by rules promulgated by the supreme court or by the order of any court.
....
(3)(a) The custodian shall deny the right of inspection of the following records, unless otherwise provided by law....
....
(II) Personnel files, except applications and performance ratings....
....
(IV) ... privileged information ...
....
(6) If, in the opinion of the official custodian of any public record, disclosure of the contents of said record would do substantial injury to the public interest, notwithstanding the fact that said record might otherwise be available to public inspection, he may apply to the district court ... for an order permitting him to restrict such disclosure...." (emphasis added)
For each of the documents, the University asserted the applicability of one or more of these exceptions, arguing specifically that the documents were in the nature of personnel files, were protected by the attorney-client privilege and its associated work product doctrine, and that disclosure would do substantial injury to the public interest.
The trial court ordered the University to release sixty-one of the seventy-seven documents in question, finding that, of the statutory exemptions relied upon by the University in denying inspection of the documents, only the attorney-client privilege and work product doctrine were properly applied, and that they protected only sixteen of the documents. The court denied the Post's request for attorney fees and costs, concluding that the University's denial of inspection, though incorrect, was not arbitrary or capricious.
*878 In its appeal, the University contends that all the documents are protected from disclosure under the Act. In its cross-appeal, the Post seeks access to all the documents and a reversal of the finding which led to the denial of attorney fees and court costs. All documents were ordered sealed by the trial court and remain so pending final resolution of the case.

I. Exception for Personnel Files
The trial court held that the statutory exception for personnel files, § 24-72-204(3)(a)(II), C.R.S., applies only to documents which actually are present in an employee's personnel file. Consequently, since no documents at issue here came from such a file, it ruled the University had no right to deny inspection on that basis.
The legislative history of the Colorado Open Records Act indicates a concern for protecting the individual's constitutionally based right to privacy while providing for access to public records. Colorado Legislative Council, Research Publ. # 126, Open Public Records for Colorado at xvii, 3 (1967). This concern is the basis of the statutory exception for personnel files.
We conclude that the statutory scheme and language of the Open Records Act require the interpretation that § 24-72-204(3)(a)(II) applies only to documents which actually are present in an employee's personnel file. Section 24-72-204(2) lists types of records as to which a custodian of public records may deny inspection on the ground that disclosure would be contrary to the public interest. Section 24-72-204(3), however, provides for mandatory denial of the types of records specified therein, unless otherwise provided by law. Thus, while subsection (2) allows for the exercise of some discretion by the custodian, subsection (3) does not.
A comparison with the analogous section of the federal Freedom of Information Act, 5 U.S.C. § 552(b)(6), emphasizes the point. The drafters of Colorado's Open Records Act studied the federal act and quoted this section in their report to the General Assembly. Exemption 6 of the federal act exempts from mandatory disclosure "personnel and medical and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." In Department of the Air Force v. Rose, 425 U.S. 352, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976), the phrase "a clearly unwarranted invasion of personal privacy" was held to modify not only "similar files," but also personnel and medical files. We hold that by omitting any such modifying language in subsection § 24-72-204(3)(a)(II), the General Assembly intended a blanket protection for all personnel files (except applications and performance ratings, for which the Assembly presumably found an overriding public interest in disclosure) and did not grant the custodian discretion to balance the interest in disclosure with the individual's right of privacy.
Although § 24-72-204(3)(a)(II) does not authorize any balancing of the public interest and the right of privacy by the custodian, the protection for personnel files is based on a concern for the individual's right of privacy, and it remains the duty of the courts to ensure that documents as to which this protection is claimed actually do in fact implicate this right. As we read the statute, where documents are sought from an employee's personnel file, §§ 24-72-204(3)(a)(11) and 24-72-204(5) require the applicant to bear the burden of proving that the custodian's denial of inspection was arbitrary and capricious.
As to documents which are not present in an employee's personnel file but which involve privacy rights, we agree with the trial court's finding that the custodian of the documents bears the burden of proving, under § 24-72-204(6), that disclosure would do substantial injury to the public interest by invading the constitutional right to privacy of the individuals involved. We review the court's findings under § 24-72-204(6) in the following section.

II. The Public Interest
The University contends that, in considering the University's allegations of substantial injury to the public interest under § 24-72-204(6), C.R.S., the trial court failed to give proper weight to the public interest *879 in protecting the privacy rights of individuals named in the documents and the public interest in encouraging internal review, investigation, and correction by government without undue interference.

A. Privacy Rights
In Martinelli v. District Court, 199 Colo. 163, 612 P.2d 1083 (1980), the supreme court applied a tripartite balancing inquiry to the issue of privacy rights in the context of the civil discovery rules. In the public records context, this inquiry requires consideration of (1) whether the individual has a legitimate expectation of nondisclosure; (2) whether there is a compelling public interest in access to the information; and (3), where the public interest compels disclosure of otherwise protected information, how disclosure may occur in a manner least intrusive with respect to the individual's right of privacy.
The federal courts have recognized that an individual has at least a minimal privacy interest in his or her employment history and job performance evaluations, and a strong interest in not being associated unwarrantedly with alleged criminal activity. See Stern v. F.B.I., 737 F.2d 84 (D.C.Cir.1984) and cases cited therein. However, it also has been recognized that public employees have a narrower right and expectation of privacy than other citizens. Stern v. F.B.I., supra; Journal Publishing Co. v. Office of the Special Prosecutor, 131 Misc.2d 417, 500 N.Y.S.2d 919 (Sup.1986); Pottle v. School Committee of Braintree, 395 Mass. 861, 482 N.E.2d 813 (1985). See also Open Records for Colorado, supra at 4 (1967).
The documents sought by the Post contain information concerning payments individuals received from the Saudi government, how those payments were reported, the tax treatment of those payments, and the results of an internal investigation into the propriety of these activities. In the scheme of the "descending order of sensitivity and constitutional interest" described in Martinelli, supra, we cannot say this information is so intimate, personal, or sensitive as to rank near the top of that order. Moreover, the privacy expectations of the top ranking officials named in these documents must be considered to be somewhat diminished in light of the fact that they already have been specifically named in newspaper articles about the Saudi contract payments, based on information already available to the media.
Against the privacy interests at stake must be weighed the Act's general presumption in favor of public access. See Denver Publishing Co. v. Dreyfus, supra; Open Records for Colorado, supra at xi. We conclude that the trial court correctly found that the important public interest in disclosing circumstances under which public employees of the University received payments from a foreign government clearly overrides the privacy interest the individuals might have in the disclosure of a portion of their income.

B. Encouragement of Internal Review
The University argues that disclosure of the documents in question will have a chilling effect on the process of internal review, investigation, and correction. However, we agree with the trial court's finding that any possible danger of discouraging internal review is outweighed by the public's interest in whether the internal review was adequate, whether the actions taken pursuant to that review were sufficient, and whether those who held public office or were employed by the University should be held further accountable.
In sum, we affirm the trial court's finding that the University failed to show there will be a substantial injury to the public interest by disclosure of the information sought. The University therefore may not assert § 24-72-204(6) as grounds for denying inspection.

III. The Attorney-Client Privilege
The University cites several statutes and rules as authority for withholding the documents on the basis of the attorney-client privilege. These include § 13-90-107(1)(b), C.R.S. (1986 Cum.Supp.) (examination of attorney as a witness), C.R.C.P. 26(b)(1) (discovery of privileged documents by a party), and Code of Professional Responsibility, *880 DR4-101. C.R.C.P. 26(b)(3) (discovery of work product by a party) is cited as authority for withholding documents on the basis of the work product doctrine.
Given the broad legislative declaration in the Open Records Act that all public records shall be open for inspection unless specifically provided by law, the codifications and rules concerning attorney-client and work product privilege cited above cannot be grafted onto the Open Records Act as a matter of course. While the supreme court held in Martinelli, supra, that the open records laws were limited by the rules of civil procedure in the context of that case, the Post here is not seeking the documents under the rules of civil discovery, but under the terms of the open records laws themselves.
However, because the General Assembly has specifically authorized denial of inspection of "privileged information" in § 24-72-204(3)(a)(IV), C.R.S., we conclude that the privileges for attorney-client communication and attorney work product established by common law have been incorporated into the Open Records Act. See Hickman v. Taylor, 329 U.S. 495, 67 S.Ct. 385, 91 L.Ed.2d 451 (1947); A v. District Court, 191 Colo. 10, 550 P.2d 315 (1976), cert. denied, 429 U.S. 1040, 97 S.Ct. 737, 50 L.Ed.2d 751 (1977); Losavio v. District Court, 188 Colo. 127, 533 P.2d 32 (1975). Whether the privilege exists in this case must be determined by examination of the facts.
Here, the "client" and "attorney" are, respectively, the University, by way of the President's Special Review Committee appointed to investigate the Saudi payments, and the university counsel, who participated in the investigation, according to affidavits of members of the committee, to provide legal advice "with reference to the University's legal obligation to its employees" and "with regard to potential or expected litigation both by and against the University as a result of the investigation."
The University contends that, because it has a legal obligation to provide a defense for its employees under the Government Immunity Act, § 24-10-110(1)(a), C.R.S., the employees who received the Saudi payments also are "clients" of the university counsel and documents containing their communications with the counsel are protected by the attorney-client privilege. We find § 24-10-110(1)(a) wholly inapplicable to the facts of this case. That section refers to a public entity's liability for "injuries," which are specifically defined in § 24-10-103(2) to include injuries to a person and property damage which would be actionable in tort if inflicted by a private person. Neither is involved here.
However, we do hold that communications between the university counsel and university officials and employees who received the Saudi payments may be protected under the rationale presented in Upjohn v. United States, 449 U.S. 383, 101 S.Ct. 677, 66 L.Ed.2d 584 (1981). There the United States Supreme Court rejected use of the "control group test" to identify a corporate "client," reasoning that the attorney-client privilege exists not only to protect the giving of professional advice to those who can act on it, but also the giving of information to the lawyer by lower level employees to enable the lawyer to give sound and informed advice. See also National Farmers Union Property & Casualty Co. v. District Court, 718 P.2d 1044 (Colo.1986). We apply the supreme court's rationale in Upjohn to cover communications between counsel and former employees of the client which concern activities during their period of employment.
In the course of its internal investigation, the University (the "client") directed full disclosure to the state auditor of all facts related to the Saudi contracts and all findings of the internal review, and directed its administrative staff to cooperate fully with the Office of the State Auditor. The record shows that the University's investigative findings also were disclosed to the Denver District Attorney, who reviewed the documents to determine whether any criminal statutes had been violated. (He concluded that no criminal conduct could be found). The Post argues that these disclosures constitute a waiver of any attorney-client *881 or work product protection which may exist.
The burden of proving a communication is privileged rests with the person asserting the privilege. United States v. Bump, 605 F.2d 548 (10th Cir.1979). The attorney-client privilege exists to protect confidential communications, and it is waived by any voluntary disclosure by the privilege holder to a third person. See Permian Corp. v. United States, 665 F.2d 1214 (D.C.Cir.1981).
The work product privilege exists not to protect a confidential relationship, but to promote fairness in the adversary system by safeguarding the fruits of an attorney's trial preparations, which have been paid for by his client, from being usedwithout cost by his opponent. See PermianCorp v. United States,supra. Where a privilege is asserted for attorney work product, a more liberal standard of waiver is applied. A voluntary disclosure effects a work product waiver if it is made to a party having no common interests so as to establish a basis for expectations of confidentiality. See In re Subpoenas Duces Tecum, 738 F.2d 1367 (D.C.Cir.1984).
The record demonstrates that the University anticipated possible involvement in litigation with the employees who received the payments. To protect its interests, the University conducted an internal investigation during which it voluntarily submitted the documents in question to the auditor and district attorney for review. We hold that by disclosing privileged information to a potential adversary of its employees, the University waived its right to later claim a privilege to protect the same information on behalf of those employees. Moreover, it is conceivable that the auditor or district attorney could be litigation opponents of the University itself in regard to the matter of the Saudi payments.
We therefore hold that the University did waive its privileges, both for attorney-client communications and for university counsel's work product, by disclosing the documents to the state auditor and district attorney. Thus, the trial court erred in sustaining the University's refusal to allow inspection of documents on this basis.

IV. Attorney Fees and Costs.
We agree with the trial court's conclusion that the University's refusal to allow inspection of documents was neither arbitrary nor capricious, and that the Post was not entitled to an award of attorney fees and costs under § 24-72-204(5). The General Assembly recognized that balancing the public interest in disclosure with other societal interests would be difficult, and that the courts would be the logical place for decision when balancing is required in situations which the legislature was unable to identify in advance. See Open Public Records for Colorado, supra at 5.
The order is affirmed as to the documents ordered released by the trial court and as to the denial of attorney fees and costs. The order is reversed as to documents ordered withheld on the basis of attorney-client or work product privilege, and the cause is remanded with directions to release those documents.
SMITH and TURSI, JJ., concur.
