TABLE OF CONTENTS

BACKGROUND INFORMATION

REGULATING THE USE OF THE SIN

PRIVACY COMMISSIONER'S SPECIAL REPORT, 1981

PRIVACY ACT

PRIVATE MEMBERS’ BILLS

HOUSE OF COMMONS STANDING COMMITTEE REPORT

GOVERNMENT RESPONSE TO COMMITTEE REPORT

This paper discusses the placing of restrictions on the collection and use of the social insurance number (SIN), the most common unique personal identifier in Canada. The SIN was introduced by the Pearson Liberal government in 1964 in order to replace the national unemployment insurance number used by the Unemployment Insurance Commission, then under the Department of Labour. That system was running out of numerical combinations at the same time as a new registration system was required for the soon-to-be-implemented Quebec and Canada Pension Plans. It was felt that two systems of numbering would be entirely impractical since approximately four and a half million employees would come under both plans. However, the adoption of the SIN for use in pension disbursement under the Canada Pension Plan came about only after considerable debate. Some Members of Parliament expressed concern that extending the use of the SIN might ultimately lead to a national numbering system.

Although the SIN was introduced for purposes of federal unemployment insurance and pension plans, no controls were placed on other uses. This has resulted in the proliferation of such uses by organizations maintaining personal data banks in both federal and provincial government institutions and in the private sector.

Between 1965 and the late 1970s, the House of Commons paid little systematic attention to the rapidly increasing use of the SIN. When the Conservative government of Prime Minister Clark was elected in 1979, however, it promised legislation that would restrict such use. On 30 October 1979, the then Minister of State for the Treasury Board, the Hon. Perrin Beatty, announced that the government would shortly be proposing legislation:

to restrict the use of the Social Insurance Number within the federal government where provision of the SIN by individuals may be mandatory, along with some initial steps to limit the use of the Social Insurance Number outside the federal government... It is the government’s intention to reverse the trend towards the use of the Social Insurance Number as the single identifying number in departments and agencies of the federal government... The government is preparing legislation that will ensure greater legal protection against unauthorized disclosure of personal information and put constraints on the ability to link files using SINs, by limiting the number of uses for the SIN. This legislation will be introduced in this session of Parliament.(1)

However, the Conservative government fell in December 1979, before these new legislative initiatives could be introduced in the House of Commons. A definitive statement of the government’s intentions appeared in a letter from Mr. Beatty to the Globe and Mail, published during the election campaign, on 11 February 1980. He said that the SIN was being used for many unauthorized purposes in both the public and private sectors:

Individuals are asked to provide SIN for purposes unrelated to those initially envisaged by Parliament and in many cases may be denied service if they refuse to disclose their number or are simply not informed of the consequences of not providing the SIN.(2)

The major new privacy legislation planned by the Clark government was later introduced by Mr. Beatty as a Private Member’s Bill, C-535,(3) on 2 May 1980. The bill, which was essentially a revision of the original privacy legislation (Part IV of the Canadian Human Rights Act of 1977), also proposed a new section of the Act, which would have limited the federal government’s use of the SIN to the administration of an Act of Parliament or a number of basic programs: pensions, student loans, family allowances, old age security, income tax and unemployment insurance. Otherwise, "no right, benefit or privilege shall be withheld from and no penalty shall be imposed on any individual by reason of a refusal by the individual to disclose to a government institution the Social Insurance Number assigned to the individual..." Except for uses authorized by statute, individuals could have required that the SIN be deleted from federal files about them. Whenever federal government institutions requested a SIN, they would have been required to explain the consequences, if any, of failure to provide it. Another provision would have explicitly authorized the Privacy Commissioner to review complaints about SINs. The bill died on the Order Paper.

Governmental and non-governmental organizations increasingly came to use the federal SIN as a standard identifying number in record-keeping systems containing personal information. In part, the use of the number by institutions that provide pension or other income-related benefits to members of the public facilitates confirmation of income by the Department of National Revenue. More generally, however, the proliferating use of the SIN was due to its convenience and the need for record-keeping systems to have a method of identifying each individual on file; numbering systems are more efficient than other techniques of identification. Rather than establishing a different numbering system for each personal data bank, organizations found it easier and cheaper to use the SIN.(4)

The growing use of the SIN resulted in two different kinds of privacy-related concerns. First, there appeared to be considerable public resistance to the use of identifying numbers, and especially of one single identification number, on the grounds that it represented a dehumanizing influence in modern social life. Second, there were concerns that use of the SIN enhanced the possibility that information gathered for one purpose might be used for another.(5)

Restricting the use of the SIN, however, is not likely to result in an overall reduction in the use of identifying numbers, which organizations find necessary in running their record-keeping systems. The real concern is whether use of the SIN should be allowed to continue unregulated so that one numbering system comes to dominate personal record-keeping in both the public and private sectors.

In connection with concerns about data linkage, the following must be considered. Although use of the SIN does facilitate the integration of data bases, such integration is also possible even where data bases do not use similar or identical identifiers; in fact, as the technological capacity to integrate data bases becomes more sophisticated, it appears that in future the use of the same identifying numbers will have little or no impact on integration. The crucial question with regard to data linkage, therefore, would appear to be not whether it can be completely prohibited, but in what circumstances and under what conditions it should be allowed.(6)

In 1980, the Minister of Justice ordered a special study by the then Privacy Commissioner under Part IV of the Canadian Human Rights Act, Ms. Inger Hansen, to examine the extent of the use of the SIN and its implications for the privacy of individuals. The terms of reference required the Privacy Commissioner to examine the extent to which and the purposes for which the number was being collected and used, and whether it was serving as a data linkage device. The study was also required to examine what threats, if any, the use of the SIN represented to the privacy of individuals and the implications of possible regulation or prohibition of the collection and use of the number. As the time for completion of the study did not allow for public meetings, most submissions were in the form of comments and briefs. The report was released in January 1981.(7)

The Privacy Commissioner found widely differing attitudes to the SIN. Some individuals, for instance, opposed its use on the basis that to be identified primarily by a number was too impersonal. Others suspected that possession of a person’s number would provide access to all recorded information about that person. Yet others felt that the number facilitated inappropriate linkage of data. Some resisted using the number for religious reasons, while others had an aversion to any use of personal identification numbers because of experiences with such numbers during World War II. On the other hand, there were those who praised the efficiency and accuracy resulting from the use of the SIN in machine processing of data, and they advocated its universal application for identification purposes.(8)

When asked why they objected to the use of the SIN, most people answered that possession of it allowed access to personal records without the knowledge or permission of the individual concerned.

The study found that the SIN had become important in data processing and was being used extensively by the various levels of government and the private sector, both to identify individuals and as a tool for data linkage, particularly in the administration of government assistance programs. At the federal level, the greatest use of the SIN was in areas where there was a legal requirement to provide the number, such as under the Unemployment Insurance Act, the Canada Pension Plan and the Income Tax Act. Other programs had adopted the number to assist in the identification of clients.

The study found that many federal government programs required the exchange of voluminous amounts of information for which the SIN was often the identifying link. The SIN was also being used to link different sets of personal information, and was thus giving rise to the fear that improper use might endanger personal privacy, especially in view of the capacity of the computer to store, process and retrieve large amounts of data with minimum time and effort.

In spite of these findings, the Privacy Commissioner’s study found that data linkage was not as widespread as had been thought. In fact, the SIN was being primarily used to distinguish individuals with the same name. However, the study noted that there could be no doubt that the SIN had the potential both for use as a universal identifier and for data linkage. It was also apparent that prohibition of the collection and use of the SIN would not eliminate data-sharing, which could still take place using other identifiers. The report, therefore, made no recommendation to limit the use of the SIN, stressing that much more than such regulation would be necessary in order to prevent the perceived harms.(9)

The report made recommendations in four key areas. Finding that the privacy of individuals might be threatened by improper data linkage, it recommended that an offence be included in the Canadian Criminal Code to prohibit dishonest dealings with personal data that had been provided to obtain a benefit or service or under compulsion of law, or had been placed in the custody of another for storage and the exclusive use of the depositor. The report noted three advantages in creating such an offence:

It would protect against undisclosed use or modification of personal information provided by the individual concerned, it should generate awareness of the need to protect individual privacy and should result in the taking of new preventive measures to protect against the commission of the prohibited acts.(10)

The proposal for a new criminal offence did not address the problem of whether the use of the SIN should be limited or regulated for reasons not connected with data linkage; for example, because the use of the number was felt to be impersonal, evoked memories of prejudice or mass brutality, or violated religious beliefs. The report, therefore, went on to recommend that the federal government should make it possible for an individual, on application, to be exempted from being identified by a SIN or other number in federal information systems, with a reasonable fee being imposed when such individualized processing of personal information resulted in a significant increase in costs.(11)

The report also recommended that the federal government study the need for contingency plans to ensure that banks containing personal data were protected during periods of man-made or natural disasters.(12)

Finally, the study found that many individuals did not know that, in many instances, they had the right to refuse requests for their SIN, or for other personal data. The report, therefore, recommended that the federal government assume responsibility for informing members of the public of their rights to informational privacy and of the need for individuals to assume part of the responsibility for not releasing personal data arbitrarily.(13)

The federal government did not act on the report’s recommendations.

PRIVACY ACT

On 1 July 1983, Parliament proclaimed the Privacy Act,(14) which repealed and replaced Part IV of the Canadian Human Rights Act. The Privacy Act protects the privacy of Canadians with respect to personal information held by federal government institutions; the SIN is treated as personal information, as defined in that Act, and receives the same protection as any other identifier or item of personal information, neither more nor less.

PRIVATE MEMBERS’ BILLS

A number of Private Members’ bills have been introduced in the House of Commons respecting the use of SINs. For instance, between 1980 and 1986, three Conservative Members of the House of Commons introduced virtually identical bills on this subject, all of which died on the Order Paper.(15) The last of those bills, Bill C-236, An Act respecting the use of Social Insurance Numbers, was introduced in the House of Commons by Mr. Stackhouse on 21 October 1986.

Like the similar bills, Bill C-236, had it been enacted into law, would have stipulated that "except as provided in this or any other Act, no person, organization, group or body that is not a federal body shall request any person to disclose his Social Insurance Number."(16) The bill further stipulated that "except as provided in this or any other Act, no person is required to disclose his Social Insurance Number."(17) For purposes of the bill, "federal body" was defined to mean "any ministry, department, board, commission, person, regulatory agency, tribunal, advisory council, office or other body exercising or purporting to exercise jurisdiction or powers conferred by or under any Act of the Parliament of Canada."(18)

The bill would have provided that people would be required to disclose their SIN to a federal body in response to a written request that was accompanied by a statement setting out a) the particular purpose for which the SIN was requested, and b) the particular Act that authorized such disclosure.(19)

Written requests from an organization, group or body for a person to disclose his or her SIN would have had to be accompanied by a statement setting out the particular purpose for which the SIN was requested, and advising the person that he or she had the right to refuse to disclose the SIN. The person could subsequently have disclosed his or her SIN, or refused to do so.(20)

The bill would also have provided that the SIN was not to be used for a purpose other than that for which disclosure was required under the bill or any other federal Act.(21)

Under another provision, any 20 Members of the House of Commons who were of the opinion that it was in the public interest to disclose and use the SIN for a purpose not authorized by law, could have filed a motion with the Speaker for the consideration of the House. The motion would have been to the effect that a Special Committee of seven members be appointed to review and report upon whether the public interest would be best served by the disclosure and use of the SIN for the specific purpose.(22) The bill would have further required the House to consider the motion not later than five sitting days after it had been filed.(23) The motion would have been deemed to have been adopted by the House at the normal time of adjournment on the day the motion was taken up and considered, unless sooner adopted or negatived by the House.(24)

Individuals would have been permitted to make application to the Federal Court of Canada for a declaratory judgment, injunction, damages or other remedy if, as a result of lawfully refusing to disclose their SIN, they had been denied a benefit or had been threatened with the denial of a benefit to which they were entitled.(25) Also, people who had disclosed their SIN where such disclosure was not required by law would still have been eligible for any remedy referred to above.(26)

Finally, the bill would have made it an offence, punishable on summary conviction and by a fine not exceeding $1,000, for anyone to:

1. publish someone’s SIN disclosed pursuant to the bill without that person's consent;

2. compel or attempt to compel a person by threat, intimidation or force to disclose his or her SIN where disclosure was not required by law; or

3. make use of the SIN of a person in a manner unauthorized by law.(27)

Another Private Member's Bill, C-321, An Act to amend the Criminal Code (Social Insurance Number),(28) was introduced in the House of Commons by the Hon. Robert Kaplan on 14 September 1988, but did not go beyond first reading. In order to protect the privacy of Canadians, the bill would have limited the use of the SIN to federal government institutions. The bill would have expressly amended the Criminal Code to provide that "No person shall require the disclosure of a Social Insurance Number." However, the above provision would not have applied to a "government institution," which was defined in the bill to mean a government institution as defined in the Access to Information Act. A person who contravened the above provision would have been guilty of an offence and would have been liable on summary conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding six months, or both. Finally, in any prosecution for an offence under the provision, it would have been sufficient to establish that it had been committed by an employee or agent of the accused (whether or not that employee or agent had been identified or prosecuted) unless the accused established that the offence had been committed without his or her knowledge or consent and that he or she had exercised all due diligence to prevent its commission.

HOUSE OF COMMONS STANDING COMMITTEE REPORT

In March 1987, the report of the House of Commons Standing Committee on Justice and Solicitor General on the review of the Access to Information Act and the Privacy Act(29) was released. The Committee shared the concerns expressed in Mr. Stackhouse’s Private Member’s Bill C-236 and other similar bills and was of the view that the SIN should not be employed in ways never intended or authorized by Parliament. The Committee noted that the Canadian Bar Association, at its 1986 annual meeting, had passed a resolution on the SIN expressing "its deep concern over the philosophy of using a compulsory identification number as a means of tracing or locating persons for purposes other than income tax, social assistance and pensions, as initially instituted."(30)

The Committee accordingly recommended that a new section be added to the Privacy Act to limit the collection and use of SINs to those activities explicitly authorized by federal Act or regulations. In other cases, there should be a statutory prohibition against the federal government, the provinces or the private sector denying services or goods to an individual, because of a refusal to provide a SIN. The Committee also urged the creation of a statutory cause of action under the Privacy Act for individuals faced with such denials.(31)

Specifically, the Committee recommended that the Privacy Act be amended as follows:

It shall be unlawful for any federal, provincial or local government institution or the private sector to ask any person for his or her Social Insurance Number, unless such a request is authorized by law.

It shall be unlawful for any federal, provincial or local government institution or the private sector to deny to any individual any right, benefit, or privilege provided by law, because of such individual’s refusal to disclose his or her Social Insurance Number, unless such disclosure is required by federal statute.

Any federal government institution which requests an individual to disclose his or her Social Insurance Number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.(32)

GOVERNMENT RESPONSE TO COMMITTEE REPORT

In its 15 October 1987 response to the above report,(33) the federal government agreed with the Committee’s concerns over the growing use of the SIN. It noted that whereas initially the SIN had been required for the Canada Pension Plan and unemployment insurance, it was now being required for such other matters as income tax, old age security, family allowances, excise tax, student loans, and for federal elections. It was also being used extensively throughout Canada in the public and private sectors.

The government recognized that Canadians did not want the SIN to become a universal identification number, and indicated that it would act to prevent this from happening by very shortly issuing a policy to:

• require all federal departments and agencies to obtain Treasury Board   approval for any current use of SIN not authorized by statute or regulation;

• prohibit the collection and use of SIN by any federal department and agency for any new administrative purpose, unless authorized by law;

• inform Canadians of the uses of the SIN which are required by federal statute or regulation;

• require individuals to be informed why the SIN is being requested and   whether or not it is required by law;

• require that no right, benefit or privilege be withheld from and no penalty be  imposed on any individual for refusal to disclose his or her SIN number to a federal government institution, except where its provision is required by   law.(34)

The government indicated that, it would consider legislation to express these principles in law in the longer term.(35)

The government also stated that following action to regulate its own use of the SIN, it would pursue the application of similar controls throughout the rest of the public sector and the private sector. This would be part of the government’s negotiations to obtain compliance with guidelines issued by the Organisation for Economic Co-operation and Development (OECD) to protect privacy and individual liberties in respect of personal data. The government indicated that if satisfactory arrangements could not be made it would explore the legislative alternatives to regulate the collection and use of the SIN; if necessary, an amendment to the Criminal Code might prohibit a request for the number unless authorized by law.(36)

The President of the Treasury Board, the Hon. Pat Carney, on 8 June 1988 announced the government’s intention to restrict the use of the SIN by federal institutions to the administration of specified tax, pension, social and benefits programs, and certain federal statutes and regulations. A copy of the press release, along with attachments showing authorized statutes, regulations and programs, is included as an Appendix to this paper.

The government-wide review of the collection and use of the SIN identified the specific federal statutes, regulations and programs for which such collection and use were permissible. Existing uses for administrative purposes without statutory authority were examined by departments and by Treasury Board. As a result of this review process, many federal uses of the SIN were to be phased out over a five-year period. Some of the major changes were the discontinuation of the request for SINs on application forms for citizenship, for credit checks required for federal programs, and as the principal federal employee identifier. A list of some of the discontinued uses of the SIN is attached to the Minister's news release in the Appendix to this paper.

Prior to the federal government’s policy announcement on 8 June 1988, though an individual was not obliged to meet a request for a SIN for a purpose not authorized by law, he or she could be deprived of a desired service or benefit for withholding the number. The Privacy Commissioner had expressed his concern over this matter in his annual report for 1986-87:

It is small comfort to tell Canadians that, except in those limited situations authorized by law, they are not required to provide their SIN, when refusal may deprive them of a service or benefit. No organization should be able to deny goods, services, benefits or entitlements for failure to provide a SIN unless its collection is specifically required by statute. This principle should apply to both government and the private sector; it should be enshrined in law.(37)

Since the policy announcement, however, in the case of federal government institutions at least, no right, benefit or privilege can be withheld from, and no penalty can be imposed on any individual for refusal to provide his/her SIN, except where the SIN is required by statute or, where specified federal government programs are authorized by Treasury Board under the above policy to continue to use the SIN. Federal government institutions are also prohibited from collecting and using the SIN for any new administrative purpose, unless so authorized by law.

In the absence of federal legislation on the subject, the above policy continues to apply to the use of the SIN by federal government institutions.

(1) Canada, House of Commons, Debates, 1979, p. 749.

(2) Globe and Mail (Toronto), 11 February 1980, p. 7.

(3) Bill C-535, An Act to extend the present laws of Canada that protect the privacy of individuals with a right of access to government files containing personal information relating to themselves, 1st Session, 32nd Parliament, 1980. The same bill was introduced in the Senate by Senator Jacques Flynn.

(4) Ontario Commission on Freedom of Information and Individual Privacy, Public Government for Private People, Report, 1980, Vol. 3, p. 589- 590.

(5) Ibid., p. 771.

(6) Ibid., p. 773.

(7) Canadian Human Rights Commission, Report of the Privacy Commissioner on the Use of the Social Insurance Number, January 1981.

(8) Ibid., p. 2.

(9) Ibid., p. 3.

(10) Ibid., p. 215.

(11) Ibid., p. 223.

(12) Ibid., p. 224.

(13) Ibid., p. 230.

(14) R.S.C. 1985, c. P-21.

(15) Bill C-537, An Act respecting the use of Social Insurance Numbers, 1st Session, 32nd Parliament, 2 May 1980 (the Hon. Ramon Hnatyshyn); Bill C-586, An Act respecting the use of Social Insurance Numbers, 1st Session, 32nd Parliament, 2 May 1980 (Mr. J. Gamble); Bill C-245, An Act respecting the use of Social Insurance Numbers, 1st Session, 33rd Parliament, 27 June 1985 (Mr. R. Stackhouse); Bill C-236, An Act respecting the use of Social Insurance Numbers, 2nd Session, 33rd Parliament, 21 October 1986 (Mr. R. Stackhouse).
A subsequent but similar Private Member’s bill, C-355, An Act respecting the use of Social Insurance Numbers, 1st Session, 35th Parliament, was introduced in the House of Commons by Mr. John Finlay on 20 June 1995, but later died on the Order Paper.

(16) Bill C-236 (2nd Session, 33rd Parliament), s. 3(1).

(17) Ibid., s. 3(2).

(18) Ibid., s. 2.

(19) Ibid., 3. 4.

(20) Ibid., s. 5.

(21) Ibid., s. 6.

(22) Ibid., s. 7(1).

(23) Ibid., s. 7(2).

(24) Ibid., s. 7(3).

(25) Ibid., s. 8(1).

(26) Ibid., s. 8(2).

(27) Ibid., s. 9.

(28) Bill C-321, An Act to amend the Criminal Code (Social Insurance Number), 2nd Session, 33rd Parliament, 14 September 1988 (the Hon. Robert Kaplan).

(29) Canada, House of Commons, Standing Committee on Justice and Legal Affairs, Report, "Open and Shut: Enhancing the Right to Know and the Right to Privacy," March 1987.

(30) Canadian Bar Association, National (September 1986), 1986 Annual Meeting, Resolution No. 2.

(31) Ibid., p. 46.

(32) Ibid.

(33) Government of Canada, Access and Privacy: The Steps Ahead, Response to the Parliamentary Committee Report on Access to Information and Privacy, 1987.

(34) Ibid., p. 6.

(35) Ibid.

(36) Ibid., p. 7.

(37) Privacy Commissioner, Annual Report, 1986-87, p. 20.