thestar.com
Bob Aaron

Bob Aaron bob@aaron.ca

September 6, 2003

It's not a sin to keep your SIN private

Just how private is your Social Insurance Number? If you're applying for a bank loan or a mortgage, do you have to supply your Social Insurance Number? Is it a sin to ask for a SIN?

Tom and his wife believe a Social Insurance Number (SIN) is personal. When they went to their bank recently to arrange a loan, they refused to provide their SINs. A week later, they were informed that the loan application would not be processed without them. When they finally provided the information, the loan was quickly approved.

Tom and his wife then filed a complaint about the bank's actions with the Privacy Commissioner of Canada. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) which came into force on Jan. 1, 2001, the privacy commissioner has authority over this type of complaint. The PIPEDA legislation applies to any federal "work, undertaking or business," including banks.

PIPEDA states that, as a condition of supply a product or service, an organization must not require an individual to consent to the collection, use or disclosure of more information than is required to fulfil the specific purpose.

By law, an organization like a bank may collect, use or disclose personal information, but only for purposes that a reasonable person would consider are appropriate in the circumstances.

In the case of Tom's complaint against the bank, the commissioner noted that the use of the SIN has become widespread since it was first introduced in 1964.

It was created to serve as a customer account number in the administration of the Canada Pension Plan and the country's various employment insurance programs.

In an effort to prevent the SIN from becoming used as a universal identifier, government policy restricts the collection and use of the SIN to specific statutes, regulations and programs, such as the Income Tax Act.

Nothing actually prevents an organization from asking for the SIN for other purposes such as identification. The privacy commissioner, however, has cautioned organizations subject to PIPEDA to indicate clearly to consumers that providing the SIN is optional and is not a condition for obtaining the service requested.

The privacy commissioner ruled that Tom's complaint was well-founded, and that the bank was not in compliance with PIPEDA since the SIN was not required for the loan application. The commissioner also ruled that it was unacceptable for the bank to require customers to provide a SIN in order to negotiate a loan.

The name of the bank involved has not been published since this case, after all, originated with the "privacy" commissioner. Tom's real name was not disclosed either. His bank, however, has since reminded its employees that customers are not required to provide their SINs when applying for a loan.

In his ruling, the commissioner stated, "In keeping with the federal government's position that the SIN should only be used for legislative purposes, I would urge Canadians to refrain from providing their SINs as identification. Otherwise, they would be to risk making the SIN a de facto national identifier, instead of simply an individual's account number for social benefit purposes."

A SIN is required to open a bank account, but not an account for a child under 18 whose income is less than $2,500. When one customer complained that her bank had refused to open an account in her 12-year old daughter's name without the child's Social Insurance Number, the commissioner ruled that the complaint was justified. The bank had improperly contravened one of the principles of PIPEDA.

Another complainant before the privacy commissioner stated that a telecommunications company improperly collected her Social Insurance Number. When she was signing up for an Internet connection, a company representative had told her, "No SIN, no connection." The commissioner ruled the complaint was justified and the communications company was wrong.

In two other complaints, individuals complained that they had to provide their SINs in order to activate their new credit cards by telephone. The complaints were upheld, and the bank involved has since changed its policy.

Banks are required to collect customer's SINs for income-reporting purposes in respect of interest-bearing accounts. But does this apply to real estate agents?

A typical clause in offers prepared by Ontario real estate agents requires the recipient of interest on deposit monies (usually the purchaser) to disclose a Social Insurance Number on the face of the offer. If that doesn't contravene PIPEDA now, it certainly will on Jan. 1, 2004 when the legislation will cover the collection and use of personal information within the provinces.

SINs are a private matter between the citizen and the government. Let's keep it that way.

Bob Aaron is a Toronto real estate lawyer. He can be reached by email at bob@aaron.ca, phone 416-364-9366 or fax 416-364-3818.
Visit the Toronto Star column archives at http://www.aaron.ca/columns for articles on this and other topics or his main webpage at www.aaron.ca.