The Social Insurance Number (SIN) Code of Practice

On this page

• List of abbreviations
• Section 1 – Introduction
• Section 2 – Information for SIN holders
• Section 3 – Information for employers
• Section 4 – Information for private sector organizations
• Section 5 – Information for Service Canada and Service Canada’s partners
• Section 6 – Service Canada employees’ duties
• Annex 1: Authorized federal uses of the SIN
• Annex 2: SIN holder dos and don’ts: protecting your SIN
• Annex 3: What to do if you suspect your SIN is compromised
• Annex 4: What to do if your organization is handling privacy breaches involving SINs
• Annex 5: Employers’ dos and don’ts: requesting, collecting, using and storing the SIN
• Annex 6: Private sector dos and don’ts: requesting, collecting, using and storing the SIN

Section 1 – Introduction

In this section

• Overview
• 1.1 Background
• 1.2 Service Canada’s message about data breaches and SIN fraud

Overview

The SIN Code of Practice states the roles and duties of SIN users. SIN users include:

• individuals
• employers
• private sector and not-for-profit organizations
• Service Canada and its federal and provincial government partners
• Service Canada employees

The purpose of the Code of Practice is to:

• establish a set of principles (addressing privacy, security and integrity) for the management and use of the SIN
• increase awareness about the shared duty to protect the SIN from inappropriate use and fraud
• provide standards, which follow legislation, policy and directives, to help all SIN users understand and fulfil their duties

The Code of Practice respects and explains relevant laws, policies and directives. Some examples are:

• Department of Employment and Social Development Act (DESDA)
• Employment Insurance Act
• Privacy Act
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• Policy on Privacy Protection
• Directive of Social Insurance Number

These documents govern the use of the SIN. More than 150 provincial and territorial acts mention SIN use in their texts. Consult your provincial or territorial government for more information about SIN requirements in your jurisdiction. Those using SINs must uphold these laws and policies based on their jurisdiction. Jurisdictions include the federal or provincial level and the private sector.

1.1 Background

The SIN program began in 1964 to register people for Unemployment Insurance. Unemployment Insurance later became Employment Insurance (EI). In 1965, the Canada Pension Plan (CPP) and the Quebec Pension Plan (QPP) began to use the SIN as a file number. In 1967, the SIN also became a file number for income tax.

DESDA defines the SIN as a 9-digit number for use as a file number, account number or data processing purposes. No one should use it as an identity document or a piece of identification. People use the SIN to be able to work in insurable or pensionable employment and to file income tax returns. The SIN also plays a role in managing government SIN-enabled programs and services.

Many people need a SIN to work in Canada. Many also need a SIN to receive benefits and services from government programs.

At Service Canada, we issue a SIN to a person for life. No one may use another person’s SIN as if it is their own. Safeguarding the privacy, security and integrity of the SIN is very important to help protect people, organizations, and the government against fraud and misuse.

The Government of Canada stopped producing physical SIN cards after March 31, 2014. Instead, the Government of Canada now produces a letter that confirms a client’s SIN. Clients receive this letter either in person or by mail.

1.2 Service Canada’s message about data breaches and SIN fraud

The SIN Code of Practice outlines the shared duty to maintain the security and integrity of the SIN. It also describes how to prevent fraud and protect against potential data breaches.

At Service Canada, we commit to helping fraud victims. This Code of Practice is one of Service Canada’s supports available to fraud victims as well as other important information for all SIN users.

DESDA prohibits creating, using, buying and selling, and making available personal data that isn’t your own. This includes the SIN. The SIN program does not proactively issue new SINs. Subsection 28.2(8) of DESDA limits issuing new SIN to specific cases. These include cases where there is proof of misuse of the SIN (for example, to get credit or services). It also includes cases where the person requests a new SIN.

Getting a new SIN won’t protect a person from fraud or theft. The previous SIN would continue to exist and be linked to the person in the private sector. To update their files, the owner of a new SIN must contact:

• their financial institutions
• creditors
• pension providers
• other government entities
• employers (past and current)

A client who gets a new SIN needs to track their accounts and credit reports for both SINs on a regular basis. Government of Canada programs, departments and agencies may still have the client’s old SIN on file. It is the client’s duty to contact those government programs, departments and agencies to update their file. This way, these programs, departments, and agencies can link the client’s new SIN to their benefit(s) account(s).

Section 2 – Information for SIN holders

In this section

• Overview
• 2.1 Key duties of SIN holders
• 2.2 The SIN and you
• 2.3 Service Canada’s pledge to SIN holders

Overview

Department of Employment and Social Development Act (DESDA) and the Employment Insurance Act specify who needs a Social Insurance Number (SIN) to work in Canada. This list includes:

• Canadian citizens
• permanent residents
• temporary residents

These individuals also need a SIN to receive benefits and services from government programs.  

The Employment Insurance Regulations require an individual to apply for a SIN as soon as possible. You must provide your SIN to your employer no later than 3 days after your employment start date. This does not prevent you from working before receiving your SIN.

If you don't already have a SIN, you must apply for one within 3 days after you start your employment. You must also provide proof to your employer that you have applied.

Under the Income Tax Act, you need a SIN:

• to complete your income tax return
• when applying for Employment Insurance (EI)
• when applying for Canada Pension Plan and applying for Quebec Pension Plan (CPP/QPP) benefits

Certain private sector entities must ask for your SIN. They do this for any accounts and investments that pay income (such as interest and dividends). This includes:

• banks
• credit unions
• trust companies

Your SIN is confidential. Your SIN card or confirmation letter isn’t an identity document. It is not a piece of identification. DESDA defines the SIN as a 9-digit number for use as a file number, account number or data processing purposes.

Except for specific government programs, you have a choice about the collection and use of your SIN. You should provide it only when the law requires it. This helps to prevent fraud and to ensure that your personal information remains private. If you share it outside of the uses prescribed by law, you must accept the risk of doing so.

It is not against the law to ask for an individual’s SIN. Many private sector organizations do ask for your SIN. This is part of their policies and procedures. But, at Service Canada, we discourage such practices.

Some private sector organizations will ask for your SIN when checking your credit rating. This is to increase the probability that they’re checking or updating the right credit records. When asked for your SIN for a credit check, you should instead provide the requestor with a copy of your credit report. This credit report should not include your SIN.

Remember: The law does not allow private sector businesses to require clients’ SIN for purposes other than income reporting. No one can deny you a product or service for refusing to provide your SIN when the law does not require it.

To inform yourself further on this subject, please refer to: Protecting your Social Insurance Number.

2.1 Key duties of SIN holders

As a SIN holder, you have 4 key duties to protect your SIN.

1. Never give out your SIN unless you're sure the law requires it or unless you're satisfied it’s necessary and you understand the risks

You must provide your SIN to take part in some government programs and services. To inform yourself about federal legislation and the use of SINs, refer to Annex 1, Authorized federal uses of the SIN.  

In the private sector, you must provide your SIN to your employer for income tax and benefit purposes. In some cases, you must give your SIN to certain private sector entities. Except when required by law, it is your decision when to share your SIN information and with whom.

You can share your SIN outside of legally prescribed uses. However, in doing so, you may expose yourself to a heightened risk of fraud or identity theft. You should only do so if you are willing to assume that risk.

Someone may ask you to provide your SIN for the following purposes, but you're not required by law to provide it when:

• proving your identity
• completing an employment application (before you get a job offer)
• applying to rent a property
• applying for credit products (such as a credit card, loan or mortgage) with a financial institution to allow for a credit rating check
• cashing a cheque or transferring money
• applying for a membership
• completing some banking transactions (mortgages, lines of credit, loans)
• completing medical questionnaires
• renting a motorized-vehicle or equipment
• subscribing to cellular telephone, internet or television services
• writing a will
• negotiating a lease with a landlord
• applying to a university or college
• registering for supplemental health offered by your employer
• communicating electronically, particularly online

No one can deny you a product or service for refusing to provide your SIN when it’s not required by law. If the organization refuses to give you the product or service unless you give your SIN, you may file a complaint (Section 2.1.2 explains how to do so).

2. Take steps to protect your SIN from theft and misuse

The Privacy Act defines the SIN as personal information and as such, all SIN users should work to protect it. If someone steals your SIN, they could use it to gain access to a wide range of personal information. They could also use it to gain access to benefits and services in your name. As a SIN holder, you have key duties about the protection of your SIN. Follow Annex 2, SIN holder: dos and don’ts to protect yourself and your SIN.

Act if you think that a private organization isn’t safeguarding your personal information or your SIN properly. Speak to the person in charge if an organization refuses to provide the product or service that you requested unless you disclose your SIN. You may also use the organization’s complaint process. Many organizations aren’t aware of the appropriate uses of the SIN.

If you're not satisfied with the organization’s response or suspect that the organization isn’t a good steward of your personal information:

• contact the organization’s industry association, ombudsman or complaint office, or
• call 1-800-282-1376 to make a formal complaint against the organization to the Office of the Privacy Commissioner of Canada

As examples, the Canadian Marketing Association and the Ombudsman for Banking Services and Investments handle client complaints about their member companies.

3. Inform Service Canada and other appropriate authorities if you believe any actor is using your SIN in a fraudulent way

Criminals may use stolen or lost SINs to defraud governments, organizations, and individuals. If someone else uses your SIN to work illegally or to get credit, governments may tax you for income you didn’t earn. You may also have difficulty when you apply for credit. Even if you take steps to safeguard your personal information, you could still be a victim of identity theft. Thieves are becoming more creative in their attempts to steal personal information. If you suspect that someone is using your SIN fraudulently, it is important to act fast. Annex 3, What to do if you suspect your SIN is compromised, instructs you on steps to take and relevant contact information.

4. Contact Service Canada

You should contact Service Canada when:

• you legally change your name
• your citizenship status changes
• your temporary SIN expires
• you'd like to update your gender designation
• you have proof that someone is using your SIN in a fraudulent way
• you discover that information on your SIN record is incorrect or incomplete

You can update your Social Insurance Register (SIR) record.

Apply online to update your SIR record. You can also find a Service Canada office and apply in person or by mail.

For more information on what you need to apply, visit the apply to update your SIR record page.

2.2 The SIN and you

The SIN is personal information under the Privacy Act. You can protect your own privacy by keeping control of your personal information and treating the SIN as confidential. The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal privacy law for private sector organizations. PIPEDA protects your right to privacy.

PIPEDA requires private sector organizations to follow rules for the collection, use and disclosure of personal data. These rules include putting safeguards in place to protect your personal data. They protect your personal data against loss, theft or unauthorized disclosure.

According to PIPEDA, you have the right to:

• know why an organization collects, uses or discloses your personal information
• expect an organization to collect, use or disclose your personal information appropriately
• expect an organization to only use information for purposes that you agreed to
• know who in the organization is in charge of protecting your personal information
• expect an organization to protect your personal information by taking the proper security measures
• expect the personal information an organization holds about you to be accurate, complete and up-to-date
• access your personal information and request changes
• complain about how an organization handles your personal information

For more information on how PIPEDA applies to the use of the SIN, please visit the Office of the Privacy Commissioner’s website.

If you have forgotten your SIN, you can find your SIN on your income tax return or your record of employment. You may also request a confirmation of your SIN online or by mail. You may also find a Service Canada office and request one in person. For more information on how to request a confirmation of your SIN, visit the how to apply for a SIN website.

This applies to temporary residents on maintained status as well (previously called implied status). For more information, visit IRCC's website for maintained status. Visit our website Social Insurance Number Required documents or contact us to obtain more information on the documents required to apply for a confirmation of your SIN. Your employer can also contact Service Canada's Social Insurance Number program to verify your number.

Your employer also uses your SIN to inform the government. This includes information about your income and the amount of income tax deducted. It also includes the amounts withheld for government benefit programs and services (such as EI, CPP/QPP, Records of Employment and T4).

Providing your SIN to your employer helps to ensure that your taxable income and pension contributions are accurate. For example, an employer will collect an employee’s SIN. This is to provide the employee with various year-end reporting slips.

At Service Canada, we'll never call or email you and ask for your SIN and/or credit card number. Someone may reach you by telephone, text, mail or email who claims to be from the Government of Canada (Service Canada). They may request your SIN, or credit card, bank account and passport numbers. These communications may even say that they need this information so that you can receive a refund or payment. These are fraudulent communications.

Another common fraud tactic is to refer clients to a website that looks like the Service Canada website. The website may ask you to verify your identity by entering personal information. You should not respond to such communications.

If you receive a communication that appears to come from or be like a Service Canada program, we encourage you to check our website. You can also contact our Social Insurance Number program. If you responded to what may resemble a misleading or fraudulent communication, please contact the Royal Canadian Mounted Police's Canadian Anti-Fraud Centre. You can do so by email at info@antifraudcentre.ca or by calling 1-888-495-8501. You may also contact the Competition Bureau for help. You can reach them through their website or by calling 1-800-348-5358.

For more information, visit Service Canada’s Unauthorized/Misleading Communications website.

2.3 Service Canada’s commitment to SIN holders

At Service Canada, we have the duty to protect a person’s SIN from inappropriate use, fraud and theft within federal government benefits and programs. We take this duty very seriously and have many ways of safeguarding SINs. We also ensure the accuracy of information in the SIR. This includes well-defined and functioning practices that detect and protect against improper access to personal information.

At Service Canada, we:

• monitor and restrict access to your SIN and personal information
• allow access only to authorized individuals and organizations with a “need to know”
• carefully check that the identity of SIN holders and applicants is correct to maintain the accuracy and completeness of personal information
• inform SIN holders about the proper protection, use and disclosure of the SIN
• assist all clients wanting information about the SIN or government services related to it

Section 5, Service Canada and its Partners’ Responsibilities describes Service Canada and our partners’ roles and duties related to the SIN.

Section 3 – Information for employers

In this section

• Overview
• 3.1 Key duties of employers
• 3.2 Information about the use of the SIN and employers
• 3.3 Service Canada’s commitment to employers

Overview

As an employer, you must request the Social Insurance Number (SIN) of each employee you hire. This is to provide the employees with Records of Employment. This is also to provide them with various year-end reporting slips. Such slips include, for example, the T4 for income tax purposes. You also use SINs to record and forward employee payroll deductions for:

• income tax
• Employment Insurance (EI) program
• Canada Pension Plan (CPP) or Québec Pension Plan (QPP), and
• Quebec Parental Insurance Plan (QPIP)

3.1 Key duties of employers

As an employer, you play a vital role in protecting the SIN from misuse, fraud, and theft. You must ensure that you identify employees correctly. You must request other pieces of identification before finalizing their employment documents. A SIN card or SIN confirmation letter is not an identity document or a piece of identification. Employees cannot use these documents for this purpose.

Private sector employers may also have specific roles and duties for the SIN and for personal information. Inform yourself further about private sector duties in Section 4, Information for Private Sector Organizations.

Key duties for employers are:

• by law, you must request each new employee’s SIN no more than 3 days after the day employment begins
• you must ensure that employees with a SIN beginning with the number "9" have authorization to work in Canada. They must have valid immigration documents
• employers must protect their employees’ personal information, including SINs, from theft and misuse
• employers must inform Service Canada if they suspect a SIN is being misused

1. By law, you must request each new employee’s SIN no more than 3 days after the day employment begins

If your employee does not already have a SIN, you should tell them to apply for one. They can do so online, by mail or by visiting the Service Canada Centre closest to them. The employee must apply for a SIN and provide proof to you that they have applied. You must request this information soon after the employment start date. They must also inform you of their SIN within 3 days of getting the SIN confirmation letter.

To confirm the SIN of a current or former employee, contact our Social Insurance Number program. We’ll need your Canada Revenue Agency (CRA) issued business number. You must also provide correct information to authenticate the company and the SIN holder. This may include:

• name
• date of birth

Every person working in insurable employment in Canada must have a SIN. This is according to the Income Tax Act, the Canada Pension Plan and the Employment Insurance Act.

2. You must ensure that employees with a SIN beginning with the number "9" have authorization to work in Canada

Immigration, Refugees and Citizenship Canada (IRCC) approves temporary residents to work in Canada. These residents are neither Canadian citizens nor permanent residents and receive SINs that begin with the number "9."

These SINs are valid based on IRCC’s work permits. They correspond to the date the foreign worker may work in Canada. The SIN alone does not allow them to work. You must verify all terms and conditions on the work permit before hiring them. This includes authorized dates and work locations.

If the immigration document of a foreign worker expires, you must ask the employee to get a valid document before hiring them. You must ask the employee to contact IRCC to do so. You must also inform the employee to apply with the new immigration document to us at Service Canada. This is to update the SIN record with the new expiry date.

A temporary resident is able to work while the decision on their work or study permit renewal is pending. They can work even if their permit expires before they receive the decision. In these situations, temporary residents can continue working, studying or using their SIN under the same conditions as long as they remain in Canada. This is according to paragraph 186(u) and section 189 of the Immigration and Refugee Protection Regulations.

These conditions remain valid until IRCC decides about renewing their work or study permit. The temporary resident then has "maintained status" (previously called implied status). For more information, visit IRCC's website for maintained status or our website Receiving your SIN and updating your SIN Record. You, as the employer, must verify the new immigration document once you get it. You must verify that IRCC’s decision allows the employee to continue working in Canada. You must also verify the new expiry date. You must inform the employee to apply with the new immigration document. This is to update their SIN record with the new expiry date.

For more information, visit the IRCC website. You may also call the IRCC Call Centre at 1-888-242-2100 or TTY: 1-888-576-8502.

3. Employers must protect their employees’ personal information, including SINs, from theft and misuse

Employers like you, should store and dispose of employees’ personal information safely and securely. Only authorized persons may access this information. Employers like you, who have to withhold or deduct CPP contributions, EI premiums and taxes, must keep records. You must keep these records for at least 6 years from the end of the last year that you employed the person. This is according to the Employment Insurance Act, the Canada Pension Plan Act and the Income Tax Act.

The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal privacy law for private sector organizations. This includes private sector employers. PIPEDA requires private organizations to follow policies when collecting, using, or disclosing personal data in their commercial work. Personal data may include the SIN.

These policies include putting in place security safeguards. You should follow Annex 5, Employers dos and don’ts: Requesting, collecting, using and storing the SIN.

If someone steals, uses, or discloses employees’ SINs in a fraudulent way, you must act quickly. See Annex 4, What to do if your organization is handling privacy breaches involving SINs.

4. Employers must inform Service Canada if they suspect a SIN is being misused

You play a leading role in detecting and preventing fraud relating to SINs. Illegal employment and income tax evasion are 2 of the main motives for SIN fraud. Every year, criminals and other actors use stolen, lost, borrowed, and fake SIN cards or confirmation letters. Fraudsters use them to defraud individuals, private sector organizations and governments.

If you suspect a SIN is compromised or being used for fraud, you must immediately report the issue. You must provide us at Service Canada with your CRA-issued business number. You must also provide information to authenticate the company and the SIN holder.

3.2 Information about the use of the SIN and employers

Your employees don't need to show you physical proof of their SIN. They don't need to provide their SIN card or confirmation letter to you.

Only employers may verify an employee’s SIN from the Social Insurance Number program. Payroll service providers cannot contact us to verify a SIN as they are not the employer. Still, payroll service providers must receive the employees’ SINs. This is to fulfil their roles and duties to their client or the employer.

There should be a contractual agreement between the payroll service provider and the employer to explain this need. These agencies must adhere to this Code of Practice.

Many people use a nickname, middle name or another name. You must ensure that you identify your employees correctly. You should record your employee’s legal name. You may remind employees that their SIN record should reflect their current legal name.

If someone’s name changes and this person has a SIN, they must get their SIN updated. This is regardless of the reason for name change (because of marriage or otherwise). The person must apply to update their SIN record under the new name within 60 days.

You should not use the SIN as an employee identifier. Serious problems could arise if the employee’s personal information is at risk. We strongly encourage you to use another method of employee identification. This is to protect your employees’ privacy and maintain the integrity of the SIN.

3.3 Service Canada’s commitment to employers

Identity fraud, including stolen, lost, and borrowed SINs, can lead to increased costs. These costs can harm individuals, private sector organizations and governments. Safeguarding the SIN is key to the management and delivery of many government services and benefit programs. You can help prevent SIN fraud and misuse.

Keep unauthorized persons from accessing employee files containing the SIN. You can also report suspected SIN misuse. Everyone should do their part to ensure their personal information is accurate and complete. Here at Service Canada we take this duty very seriously. We’ve many ways of keeping SINs and the accuracy of personal information secure.

To fulfil this duty to employers, we commit to:

• confirming and/or providing the SIN of their employees
• offering guidance, information and tools to help employers fulfill their SIN duties
• assisting employers when SIN information in their care is put at risk
• working with employers to detect, report and inquire into suspected misuse of a SIN

For a full description of our roles and duties related to the SIN, refer to Section 5, Service Canada and its Partners’ Responsibilities.

Section 4 – Information for private sector organizations

In this section

• Overview
• 4.1 Key duties of private sector organizations
• 4.2 Information about the use of the SIN in the private sector
• 4.3 Service Canada’s commitment to private sector organizations

Overview

In certain cases, private sector organizations may collect the Social Insurance Number (SIN). These include employment and income tax purposes. These also include for government benefit payments, and other government programs.

Organizations like yours may choose to use the SIN for other reasons as well, like credit rating and identification. Here at Service Canada, we discourage using the SIN for these purposes. This Auditor General’s report on the SIN suggests that these practices endanger the integrity of the SIN. This has increased the risk of SIN fraud and abuse.

The Office of the Privacy Commissioner of Canada recommends that organizations refrain from requesting their clients’ SIN when the law does not require it. Clients should not provide their SIN unless the law requires it. For more information, please visit the Office of the Privacy Commissioner's website.

Remember: Your private sector organization does not have the legal authority to request clients’ SINs for any reason, except to report income. You cannot deny a client a product or service if they refuse to provide their SIN when the law does not require it.

4.1 Key duties of private sector organizations

The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal privacy law for private sector organizations. The law balances a person's right to privacy with an organization's need to collect, use or disclose personal information. SINs are considered personal information as per PIPEDA.

PIPEDA requires private sector organizations to follow rules for the collection, use and disclosure of personal data (including SINs) during business ventures.

These rules include putting in place security safeguards to protect personal data against loss, theft or unauthorized disclosures. Innovation, Science and Economic Development Canada has overall policy management for PIPEDA. This includes recent amendments introduced in 2018.

A private sector organization like yours has 4 key duties to protect the SIN, which respect the principles of PIPEDA.

1. A private sector organization should never use the SIN as a piece of identification or as a client identification number

The SIN is not an identity document or a piece of identification and no one should use it for that purpose. As such, no one should view it as official government identification. Instead, to verify a client’s identity, request an appropriate piece of identification that includes specific data elements. Specific data elements may include:

• a name
• a date of birth
• a place of residence

You should never ask for a client’s SIN unless there is a legal need to collect it. The law does not allow private sector businesses to require clients' SIN for purposes other than income reporting. If your private sector organization collects the client’s SIN, you must follow PIPEDA, or applicable provincial legislation. This includes disclosing the purpose for using the SIN and getting consent. You must only use the SIN for the disclosed purposes.

If your private organization needs to assign a client identification number to its clients, you should create one of your own.

2. If you request a client’s SIN, you must then tell them why you’re requesting it and you must only use it for that purpose

There is only 1 reason a private sector organization legally needs the SIN from clients. Banks, credit unions and trust companies need your SIN for accounts and investments that pay income (such as interest and dividends). For example, financial institutions need the SIN to report the interest earned in a person’s bank account. If an account does not produce income, the law does not require your organization to ask for the client’s SIN.

The law, in turn, doesn’t require the client to provide their SIN. You should tell your client that in these cases, the SIN is optional. You should state that the law requires the SIN when your organization uses it to report the interest earned in a person’s bank account.

3. A private sector organization cannot make clients provide their SIN without a legal need

You should inform your clients about this. You must receive a client’s consent to collect and use their SIN. If the law does not require providing a SIN, you should offer the client a way to withdraw consent. This option should be available at any time after the client provides their SIN to you. The ability to withdraw consent should be clear, easy to execute, secure and effective.

4. Private sector organizations must protect their clients’ personal information (including the SIN) from theft and inappropriate use or disclosure

If you receive your clients’ personal information, you must protect it. You must ensure the information is safe and secure from theft, inappropriate use or disclosure. Your organization should keep SINs under lock and key when they’re stored in hard-copy format. You should encrypt or password protect SINs stored in a digital format. You should also keep SINs stored away from other personal information.

Private sector organizations should follow Annex 6, Private sector dos and don’ts: Requesting, collecting, using and storing the SIN.

If someone steals or inappropriately uses your clients’ SINs, you must act. If your organization is subject to PIPEDA, mandatory reporting may be required. If the breach of personal information poses a real risk of significant harm to an individual, reporting is mandatory. There may be equivalent reporting requirements at the provincial level as well. For more information, see Annex 4, What to do if your organization is handling privacy breaches involving SINs.

4.2 Information about the use of the SIN in the private sector

At Service Canada, we strongly advise against private organizations requesting the SIN as identification. This is because:

• the SIN has no security features to identify the person
• the private sector is unable to verify the information in the SIR
• there is an increased risk for private sector entities that solely use the SIN for identification
• this practice may also increase the chances that identity thieves will target the organization

If your organization still wishes to request SINs for identification purposes only, you must not suggest in any way that you require SINs. You cannot require a SIN to establish a business relationship. You must make it clear that the SIN is optional and provide the client with other options.

Before providing their SIN, clients have the right to ask what the legal requirements are for the SIN. More information is available about the SIN on the SIN overview page.

There is no longer a legal need to provide physical proof of the SIN (card or confirmation letter). Private sector organizations do not need to request a proof of a client’s SIN.

You should pursue a policy of openness with your clients. You should readily disclose personal records to the client to whom they belong. Clients have the right to know what is in these records. For more information on PIPEDA’s Openness Principle, please visit the website of the Office of the Privacy Commissioner.

Before PIPEDA, private sector organizations collected clients’ SINs when the law didn’t require that you needed consent to do so. The provisions of PIPEDA apply to all personal information held by an organization. This is the case regardless of when the organization collected the information. In some cases, destroying or erasing older files may be the best way to deal with this information. Still, organizations like yours don’t always need to seek consent to continue holding and using SINs on file.

To decide if you should keep a client’s SIN, ask the following question: Is there a legal or contractual need to keep the information? If the answer is yes, then consider the following questions.

• Is the information still serving (or has it ever served) a useful or necessary purpose?
• Is it likely the client would expect the organization to keep the SIN on file?

If the answer to these questions is ‘no’, it is best to dispose of these SINs in a safe and secure manner.

4.3 Service Canada’s commitment to private sector organizations

At Service Canada, we commit to offering guidance, information, education and tools to organizations. This is to help organizations like yours to fulfil their duties of safeguarding the SIN.

For a full description of Service Canada’s roles and duties related to the SIN, refer to Section 5, Service Canada and its Partners’ Responsibilities.