---

PART 2 -
MANAGEMENT AND CONTROL OF THE CURRENT SIN SYSTEM

The core of current problems with respect to the Social Insurance Number remains a lack of precision and clarity about its purpose. Originally developed as a file number for a few selected government programs, the SIN was never intended to become, or to be thought of as, a national personal identification system for residents of Canada. Yet, that is precisely how the SIN has come to be used. Canada now has a SIN system that is treated akin to a national identifier but contains none of the built-in safeguards that would, or should, govern such a system. Privacy experts all told us that Canada now lives in the worst of all worlds - it possesses a de facto national identifier system with no privacy protection.

A formal legislative mechanism should be put in place to regulate the use of the SIN. Well-proven evidence that this legislative control can work was provided to us by Ontario's Information and Privacy Commissioner who outlined the effectiveness of the 1991 Ontario Health Cards and Numbers Control Act in preventing abuse of the Ontario health cards. This Act was implemented and accompanied the release of the new health number in Ontario. Quite simply, the Act states that the health numbers may only be used for certain prescribed medical purposes and it creates an offence accompanied by stiff penalties for use of the card number beyond the bounds of those identified in the Act.1 In that regard we recommend that:

2. After appropriate consultations, the Government of Canada should prepare a Social Insurance Number Cards and Numbers Control Act that would set out the legal uses of the existing SIN in both public and private sectors and provide for penalties and fines for the misuse and abuse of the SIN. A draft bill should be tabled with this Committee no later than 31 December 1999.

Despite claims about the widespread and inappropriate use of the SIN in the private sector, no study substantiates the extent of this inappropriate - or appropriate - use. Before effective solutions can be developed, we concur with the Privacy Commissioner for British Columbia in his conclusion that more attention needs to be directed to the extent of use and abuse of the SIN especially by the private sector. Therefore, we recommend that:

3. All relevant federal government departments and agencies and the Privacy Commissioner of Canada should work with Statistics Canada to conduct and complete by 31 December 1999, an assessment of the impact and extent of use of the SIN in the public and private sectors. The findings of this study should be used in the development of a public education campaign regarding the use and abuse of the SIN. (See Recommendation 5)

The Auditor General's report indicates that valid SINs are held by many persons who have no legal status in Canada. In part, this situation arises from the practice of issuing temporary SIN cards (a series of cards that begin with 900) with no expiry date on the card itself or in the file of such numbers in the Social Insurance Register. These cards are issued to seasonal workers, foreign students and non-permanent residents such as refugee claimants. They are also issued to non-Canadian residents who invest in Canada or do their banking in Canada, in order to facilitate the filing of income tax returns. As the report indicates, more than 680,000 temporary cards remain active after a five-year period and the number of temporary SINs issued is more than double the number of non-permanent residents reported by Statistics Canada in 1997.2 Clearly, this situation requires immediate attention because the proliferation of such cards increases the potential for fraud and abuse. While we do not wish to penalize any holder of an existing temporary SIN card, we recommend that:

4. HRDC should ensure that by 1 January 2000, all newly issued, temporary SIN cards have a clearly indicated expiry date on them. HRDC should also put in place a mechanism to review all existing temporary cards. While this review is taking place, holders should retain their existing temporary SIN cards. After consultations with the affected groups, but no later than 31 December 1999, a report indicating the results of this review and a plan and timetable for replacing outstanding temporary cards should be tabled with this Committee.

Our hearings revealed a common conclusion: most Canadians are unaware of the problems linked to the SIN and they are also unaware of the scope and potential for abuse of the SIN. They do not have a clear understanding about the instances where they must provide their SIN, nor are they fully aware about the situations when they can refuse to divulge their number without suffering any consequences. The same situation of operating in ignorance applies to businesses and services in the private sector - both large and small. They often use the SIN as a cheap and convenient bookkeeping tool and business owners and employees may request or require clients and customers to provide their SIN in completely inappropriate situations. Some go so far as to deny a good or service if individuals refuse to divulge their SIN. The Privacy Commissioner for Canada told us that improper use of the SIN by the private sector generates the largest number of complaints received by his office. Individual Canadians, as well as all elements of the private sector, need to understand their rights and responsibilities with respect to the SIN. We therefore recommend that:

5. Immediately following the passage of the Social Insurance Number Cards and Numbers Control Act, all relevant federal departments and agencies and the Privacy Commissioner of Canada should develop and embark upon a public education campaign regarding SIN in Canada. Such a campaign should:

• Be directed to both the public and businesses, services and organizations that operate in the private sector;
• Inform citizens of the legitimate use of their SIN in both the public and the private sectors;
• Inform citizens of their legal right to refuse to release their SIN;
• Inform businesses, services and organizations of the legal limits of their use of the SIN;
• Be made available and accessible to Canadians through a range of media including print, radio and television.

Steps that will restore the integrity of the Social Insurance Register (SIR) remain central to efforts to straighten out SIN administrative problems. The SIR contains information provided by all applicants for a SIN: basic personal data such as dates and places of birth and death and mother's and father's names. The SIR is managed by National Services, a branch of HRDC that operates out of Bathurst, New Brunswick. The Auditor General found that although the register is generally "well protected and physically secure," the integrity of the data in the register is compromised. For example, between 1965 and 1990 only 1 million deaths were recorded in the SIR compared to 4.4 million deaths in the Canadian population. Moreover, the 1998 database of the SIR recorded 771,000 persons over 90 years of age and 311,000 over 100 years of age, as compared to Statistics Canada's count of 127,000 and 3,000 respectively. For the entire population of Canadians over 20 years of age, the SIR contains more than 26 million entries as compared to Statistics Canada's population estimates of slightly over 22 million for the same age range. This represents a huge difference of about 4 million people. In the face of an inability to reconcile the gap, there is an increased risk of fraud and abuse of the SIN that could represent a significant cost to Canadians in illegal and inappropriate access to federal and provincial programs.3

HRDC officials told us that the Department has intensified efforts to address the gap in recorded deaths in the SIR. We also recognize that the provinces and territories have an essential role to play in providing vital statistics information to the SIR. Therefore, we recommend that:

6. For the strict purpose of maintaining an accurate and up-to-date Social Insurance Register, HRDC should complete consultations with provincial/ territorial governments regarding the controlled and prescribed release of vital statistics (birth, death and name change) between provincial and territorial governments and the federal government by 31 December 1999.

7. All exchanges of vital statistics data subsequent to these consultations should be approved by the privacy commissioners of the various jurisdictions involved and the results of the consultations and exchanges reported in HRDC's annual performance report.

An additional concern with respect to the excess of cards in circulation and the procedures for the issuing of new cards arises from the proof-of-identity process for SIN applicants. Until 1976 there was no proof-of-identity procedure at all; anyone who wanted a SIN simply filled in and returned a form. A card with the number was sent by mail. In consequence, as of March 1998, the SIR contained more than 16 million SIN card entries that were unsupported by any secondary identification documents.4

We agree with the Auditor General that the managers of the SIR should pay more attention to the proof-of-identity procedures that are currently in place. As his report also found, there are often problems in verifying information contained on documents accepted for SIN applications.

We also take heed of the Privacy Commissioner of Canada's advice that procedures based on efficiency carry potential privacy costs. A recent pilot project of HRDC in New Brunswick provides for online verification of birth, death and name-change information provided by SIN applicants (to avoid fraudulent issuance of a number). But we add a note of caution. We agree that extending this type of identification system to other regions could go some distance in ensuring the accuracy of the SIR and eliminating the issuance of fraudulent new SINs. Nonetheless, we are also aware that the very province where the pilot was conducted does not have a privacy act. After reviewing "Working Group 2: Proof of Identity,"5 one of HRDC's Working Groups, we recommend that:

8. HRDC should move immediately to ensure that privacy concerns are given a high priority and submit reports from the Proof-of-Identity Working Group and all working groups identified in the Draft Work Plan for Improving the Administration of the SIN, to the Privacy Commissioner for comments.

9. HRDC should issue an evaluation report on the New Brunswick Pilot Project and table the report with the Privacy Commissioner of Canada by 30 September 1999. The Privacy Commissioner of Canada should table his comments on the evaluation report with this Committee no less than 30 days thereafter.

10. HRDC should restrict any new procedures or programs to guarantee the validity of proof-of-identity documents to information that is clearly required to verify the documents' validity.

During our meetings on the SIN system, we heard testimony - sometimes astounding - about the extent and impact of fraud and abuse. Because the SIN is the gateway to a number of federal and provincial programs, the potential cost to taxpayers in over-payments or fraudulent payments is profound. The Auditor General's report identifies several instances where individuals applied for, and received, false SINs in order to file bogus Employment Insurance claims; lease vehicles for fictitiously created companies and then ship the vehicles out of the country for sale overseas; and to apply for, and receive, false GST and income tax refunds. We therefore recommend that:

11. HRDC should put in place a plan that demonstrates its commitment to effective and timely investigations of fraud and abuse of the current SIN system. This plan should be tabled with this Committee by 31 December 1999.

In light of the costs that result from the fraudulent use of the SIN, the federal government, and HRDC in particular, need to pay greater attention to the investigation of possible fraud. We concur with the Auditor General that such investigations are an extremely low priority item within HRDC. This situation should be rectified. One way to address this is to implement a better measure of performance. We believe that the existing performance measurement system at HRDC is inadequate. For example, it emphasizes savings generated from investigations of fraud and abuse to the Employment Insurance account. Any measure must take into account the fact that fraudulent use of the SIN card affects the full range of government programs that use the SIN as a file number (see Appendix B). We therefore recommend that:

12. HRDC should create a new performance measure that demonstrates the accrued savings to the full range of government programs which result from pursuing the fraudulent use of a SIN. The business case for this new measure should be made to Treasury Board during the next round of submissions.

13. HRDC should, based on the outcome of the newly designed measure, assign the appropriate level of human resources to investigate the fraudulent use of a SIN.

14. HRDC should include in its next, and subsequent, Annual Performance Reports to Parliament, a specific section on the management of the Social Insurance Number and the Social Insurance Registry.

Our recommendations thus far reflect those of both the Auditor General and the Public Accounts Committee, particularly with respect to the short-term and immediate problems that deal with the administration of the SIN system. We want responses to our recommendations to reflect the degree of consensus that has been expressed on these issues by all three parliamentary bodies. Actions should be taken swiftly to make the necessary corrections.

15. HRDC should report to Parliament before 30 September 1999 on progress in implementing the 1998-1999 Workplan for Improving the Administration of the SIN (Appendix C of this report).

---

1 Evidence, Meeting No. 47, 3 February 1999, p. 6.

2 Auditor General's Report, Chapter 16, p. 16-15.

3 Auditor General's Report, Chapter 16, p. 16-12.

4 Auditor General's Report, Chapter 16, p. 16-13 & 16-14.

5 Human Resources Development Canada, 1998-1999 Workplan for Improving the Administration of the SIN, pp. 4-5.