Monday, February 24, 2014


Canada's Just Retired Privacy Commissioner, Jennifer Stoddart.
Photo Credit: Office of the Privacy Commissioner of Canada. 
Social Insurance Numbers (SINs) used to be tossed around like middle names. Everyone had one, and although you had to ask people in order to find out what their number was, no one really thought much about sharing them. In fact, in a lot of places they were even used an an identification number. When I was in the Canadian Forces, we had to write our SINs on the top right corner of all of our tests - it seems the military had thrown out the "serial number" and replaced it with what something it thought was more efficient. How times have now changed.

Every Canadian's SIN is part of his or her core biographical data. Someone who already has your name, date of birth and address might only need your SIN to get up to all sorts of mischief on the identity theft front. The Office of the Privacy Commissioner of Canada goes to so as to suggest that you never provide your SIN to a private sector organization, unless it is required by law to collect it. And there's only one reason it legally needs it: income reporting, such as when you open an interest bearing bank account.

It's actually contrary to Canadian law for a private business to demand your SIN as a condition of providing you service, unless it is collecting the number for income reporting purposes. Certainly some parts of the private sector like collecting SINs as part of personal identification and to increase credit score searching accuracy, but they CANNOT demand your SIN, unless it is for income reporting.

So the next time someone demands your SIN, ask: why? If the answer isn't income reporting, then just politely decline. If you are then told you won't be provided with the service unless your provide your SIN, call their bluff. Tell them they will be violating Canadian law (the Personal Information Protection and Electronic Documents Act - PIPEDA) if that is the sole reason you won't be provided service.

I know it isn't easy to hang tough on an issue like this. I had to recently call the bluff of a large company on this very issue. First, they claimed I had to provide my SIN to get service. I said "no" and told them that they would be violating Canadian law to refuse. They then came back, and demanded two years of audited financial statements (something even more personal, and costing big bucks) as an alternative to providing my SIN. I again said "no" and insisted that such a demand was likewise contrary to Canadian law, because it was effectively a denial of service. Two weeks later they caved: no SIN, no audited financial statements, just my signature at the bottom of a form agreeing to a credit check. But hey, even me, the privacy lawyer, felt the pressure. So you'll need especially steely resolve to resist simply caving on the SIN front.

Service Canada has put together a useful FAQ on the topic at the following page: