The Social Insurance Number Code of Practice
Section 5 - Service Canada and its partners' responsibilities
Under the Department of Employment and Social Development Act, the Canada Employment Insurance Commission (the Commission) has the authority to assign SINs, maintain the Social Insurance Register (the Register), to disclose SIN information to identify individuals, and to use the SIN effectively.
Service Canada, working closely with Employment and Social Development Canada (ESDC), manages the use of the SIN on behalf of the Commission. Service Canada is responsible for:
- developing SIN operational policies and directives
- administering the registration of SIN applicants and maintaining the Register
- handling requests for access to SIN information
- developing and implementing investigation and control measures to detect and deter abuse of the SIN
- working on communication strategies with the business community and the general public
- reviewing legislation related to the SIN to ensure proper provisions to administer the SIN.
Treasury Board Secretariat and Service Canada, on behalf of the Commission, both have responsibility for policy on uses of the SIN.
Service Canada collaborates with a wide array of organizations to deliver the SIN program. In this section, Service Canada's SIN partners are defined as federal and provincial governments that have formal agreements, which give them access to share information held in the Register.
5.1 Key responsibilities of Service Canada and its partners
To have access to information in the Register, Service Canada and its partners must protect the SIN from inappropriate use, fraud and theft, and ensure that the information in the Register is accurate, complete and secure. To accomplish that, Service Canada and its partners have the following key responsibilities:
1. Service Canada and its partners must restrict access and the disclosure of the Register and other personal information to only those who are authorized and those who have a legitimate “need to know”.
- Program access to information contained in the Register is strictly governed by formal agreements that specify:
- what information can be accessed or disclosed
- the purpose for which and to whom the information can be accessed
- the policies and procedures that specify the terms and conditions of this information sharing
- the program's authority to use the SIN.
- Without a formal agreement, access to information in the Register is not allowed.
- Under the terms of the agreement, Service Canada and its partner employees can only access or disclose information from the Register if they:
- are authorized to do so
- need to know the information to carry out their duties
- follow procedures.
- Adherence to the terms of the agreement is monitored and subject to audit.
- All information shared among Service Canada and its partners must be transmitted by a secure method, specified by Service Canada.
2. Service Canada and its partners must make all reasonable efforts to secure personal information in their care from theft, inappropriate access or disclosure.
- Service Canada and its partners must adhere to all Government of Canada privacy and security legislation and policies including the Privacy Act, Treasury Board policies on the Information Management and the Use of Electronic Networks.
- Service Canada and its partners must also adhere to all SIN-related privacy and security policies, procedures and practices, as specified in agreements providing access to SIN information and identity-management policies.
- Service Canada and its partners should ensure that employees are fully informed of all policies and procedures, have completed required training and have security screening to the appropriate level.
For further direction and information, see Annex 8, Dos and Don'ts for Employees: Protecting the Privacy and Security of the SIN.
3. Service Canada and its partners must accurately confirm the identity of individuals.
- The accurate and secure identification of individuals is key to ensuring that the right client receives the right benefit or service and is also essential to prevent fraudulent use
- Service Canada and its partners must follow Service Canada identity-management policies to confirm a client's identity. These policies include:
- Accepting only proof-of-identity documents that are approved for use by Service Canada.
- Fully reviewing a client's SIN record and taking required action if the record has an annotation or condition. (For more details, see Question 6, in Section 5.2, Questions and Answers about the SIN, Service Canada and its Partners.)
4. Service Canada and its partners must maintain the accuracy and completeness of personal information held in the Register.
- The accuracy and completeness of the information in the Register is crucial to ensuring that the right client receives the right benefit, and to protect all programs that use the SIN from fraud.
- Service Canada and its partners must follow Service Canada’s identity management policies to maintain the accuracy and completeness of the information found in the Register, including:
- fully comparing the information from the Register with the client's identity and program information to ensure there are no discrepancies
- correcting information on an individual's SIN record if a discrepancy or error is identified
- taking required action, such as referral to National Investigative Services or to the Social Insurance Registration Office, when a client's SIN record has an annotation or condition that requires particular attention. (For more details, see Question 6, in Section 5.2, Questions and Answers about the SIN, Service Canada and its Partners).
5. Service Canada and its partners must establish risk-management and monitoring practices to assess compliance to privacy, security and program integrity policies and principles.
- Service Canada and its partners must systematically identify high-risk areas to detect and prevent fraud and unauthorized access or disclosure of information from the Register.
- Whenever personal information is accessed, it should be documented to monitor compliance to privacy, security and program integrity policies and principles.
- Service Canada and its partners must regularly use audit trails to track use and detect unauthorized access to, or modification of, personal information.
- Breaches of these policies and principles must be reported to Service Canada authorities.
For more information on employees' responsibilities, see Section 6: Service Canada Employees' Responsibilities.
5.2 Questions and answers about the SIN, Service Canada and its partners
1. What legislation and authorities permit disclosure to partners of data from the Social Insurance Register?
The Department of Employment and Social Development Act governs disclosure of information from the Register. Under subsection 28.2(5) of the Department of Employment and Social Development Act, the Canada Employment Insurance Commission or its delegated authority can grant approval to disclose Register information to partners.
Only authorized departments and agencies can obtain information from the Register. Sharing this information is based on the program’s legislation such as the Department of Employment and Social Development Act legislation, Treasury Board policy and/or a formal agreement.
2. Can an authorized partner provide information from the Register to another authorized partner?
Information from the Register cannot be shared with another organization, even if that organization is an authorized user. These users should contact the Social Insurance Registration Office directly to obtain the information they require. This Office has verification requirements to ensure that the requesting party is authorized and that the request meets the terms of the agreement with regard to the type of information that is allowed to be disclosed, and the reason for requiring the information.
3. How can a partner organization obtain information from the Register?
Employees of Service Canada partners that are authorized to obtain SIN information, but who do not have direct access, must contact the Social Insurance Registration Office to obtain information from the Register. Their organization must have an agreement allowing them access to information from the Register. As well, the employee's name must appear on the employee list kept at the Social Insurance Registration Office. Specific information will be validated for two purposes: to ensure the requesting party is an authorized employee and to ensure the reason for the request is valid and meets the terms of the agreement.
4. What should a Service Canada partner do if issues arise related to the adherence to this Code or other related policies?
The partner should immediately contact the appropriate official listed in their agreement (if unknown, call toll-free at 1-800-206-7218 and select option “3” or, 1-506-548-7961 from outside Canada (long-distance charges apply) to determine the appropriate action).
5. What should be done when information in the Register is inaccurate?
When a Service Canada partner is made aware of an error on a client's SIN record, they must contact Service Canada at 1-800-206-7218 and select option “3” (or 1-506-548-7961, if calling from outside Canada). Data-capture errors will be corrected immediately without contacting the client. If the inaccuracy is not a data-capture error, the Social Insurance Registration Office will work with the partner to inform the client about how to correct the data, including the documentation he or she needs and the service options that are available.
6. What should be done when a client's SIN record has an annotation or a condition?
Service Canada partners should follow specific directives when a client's SIN record contains an annotation or a condition. All partners are responsible for ensuring appropriate action is taken. Partners should consult their agreement and related procedures to find out what action to take.
5.3 Service Canada's commitment to its partners
Service Canada is committed to enhancing and maintaining the integrity of the SIN and the Register, and working with its partners to achieve these goals.
Given the importance of this relationship with its partners, Service Canada is committed to:
- working with all Social Insurance Register partners to enhance the integrity and reliability of the Register's data and to ensure the Register's long-term sustainability
- establishing and maintaining a clear governance and accountability structure, described in agreements and addressing funding models, service requirements and information-sharing protocols
- maintaining open and transparent communication
- offering guidance, information and tools to help partners fulfill their SIN responsibilities.
- Date modified: