INVESTIGATION REPORT
INVESTIGATION I93-075P
MINISTRY OF FINANCE
January 12, 1994
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning the Ministry of Finance (the Ministry).
The complainant, a self-employed individual, had objected to the Ministry's collection of his Social Insurance Number (SIN) on its "Registration Form for Self-employed Individuals" (Registration Form). He had stated that the collection was contrary to the Freedom of Information and Protection of Privacy Act (the Act).
Effective January 1, 1993, self-employed individuals who earned Ontario self-employment net income of more than $40,000 were required to pay the Employer Health Tax (EHT). Prior to 1993, self-employed individuals were only required to pay this tax on behalf of their employees, if they had employees. The EHT replaced Ontario Health Insurance Plan (OHIP) premium payments, beginning in January 1990.
Self-employed individuals were required to complete the Registration Form in order to register for this tax.
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the complainant's SIN "personal information", as defined in section 2(1) of the Act? If yes,
(B) Was the Ministry's collection of the complainant's SIN in accordance with section 38(2) of the Act?
(C) Did the Ministry provide notice of its collection, in accordance with section 39(2) of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the complainant's SIN "personal information", as defined in section 2(1) of the Act?
Section 2(1) of the Act defines "personal information", in part, as:
recorded information about an identifiable individual, including,
(c) any identifying number, symbol or other particular assigned to the individual,
We obtained a copy of the Ministry's Registration Form. It required self-employed individuals to provide their SIN.
It is our view that the information in question -- the SIN, met the requirements of paragraph (c) of the definition of "personal information", in section 2(1) of the Act.
Conclusion: The complainant's SIN was personal information, as defined in section 2(1) of the Act.
Issue B: Was the Ministry's collection of the complainant's SIN in accordance with section 38(2) of the Act?
Section 38(2) of the Act states:
No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity [emphasis added].
The Ministry provided us with a document entitled "EHT'S REVIEW OF FOI's [Freedom of Information's] RECOMMENDED PROCEDURES ON THE COLLECTION AND USE OF THE SOCIAL INSURANCE NUMBER". In this document, the Ministry stated, in part, that its collection of the SIN was "necessary to the proper administration of a lawfully authorized activity".
The Ministry also provided us with a copy of "Bill 27 [subsection 16(2)]" which, it stated, "authorizes the Ministry to collect the Social Insurance Number". Since a bill is only draft legislation, we did not regard Bill 27 as providing the basis for statutory authority. We did, however, look at section 15(1)(a) of the Employer Health Tax Act, (the EHTA) which states:
The Minister may, for the purpose of the administration or enforcement of this Act, by a written notice, require from an employer or from a director, employee or agent of an employer, or from any other person [emphasis added],
(a) any information or additional information or any required or prescribed form;
Based on the above, it is our view that the administration and enforcement of the employer health tax was a "lawfully authorized activity".
The Ministry submitted that it is necessary for self-employed individuals to submit their SIN for the purposes of ensuring the confidentiality of taxpayer information, and for auditing purposes.
Confidentiality of Taxpayer Information
The Employer Health Tax Branch is responsible for collecting and keeping confidential taxpayer information. When self-employed individuals make account-related enquiries, they are required to identify themselves by providing their SIN, along with other information. EHT staff are also required to use the SIN to verify the client's identity when they respond to questions regarding interpretation.
Auditing
Regional Office managers and audit staff also require the SIN for auditing and other verification functions. To verify the information they receive from self-employed individuals, the EHT Branch requires the SIN. This is necessary to facilitate the exchange of tax information with Revenue Canada, under existing exchange of information agreements.
It is our view that the steps taken by Ministry to ensure the confidentiality of taxpayer information as well as the Ministry's auditing function form part of the overall administration and enforcement of the employer health tax. Since the collection of the SIN is necessary for the purposes of auditing and ensuring the confidentiality of taxpayer information, it is our view that the Ministry's collection of the SIN was for a lawfully authorized activity, and therefore, was in accordance with section 38(2) of the Act.
Conclusion: The Ministry's collection of the complainant's SIN was in accordance with section 38(2) of the Act.
Issue C: Did the Ministry provide notice of its collection, in accordance with section 39(2) of the Act?
Section 39(2) of the Act requires an institution to notify the individual to whom the personal information relates of whatever information the institution is collecting and why. It states:
Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,
(a) the legal authority for the collection;
(b) the principal purposes for which the personal information is intended to be used; and
(c) the title, business address and business telephone number of a public official who can answer the individual's questions about the collection.
We have examined the Registration Form in question, which provided the following notice:
Personal information contained on this form is collected under the authority of the Employer Health Tax Act, RSO 1990, ch. 11, s. 15, and will be used for tax purposes. Questions about this information collection should be directed to: Freedom of Information Liaison Officer, Employer Health Tax Branch, 33 King Street West, Oshawa, Ontario L1H 8H5. (416) 436-4489.
Based on the above, it is our view that the Ministry provided proper notice in accordance with section 39(2) of the Act.
Conclusion: The Ministry provided notice of its collection, in accordance with section 39(2) of the Act.
OTHER MATTERS
The Ministry provided us with a copy of "EHT'S REVIEW OF FOI's RECOMMENDED PROCEDURES ON THE COLLECTION AND USE OF THE SOCIAL INSURANCE NUMBER". In this document, it states:
Although TDC [Taxation Data Centre] staff do not require access to the SIN to do their job, it is within the institutions functions and therefore reasonable that they have access to it. [emphasis added]
Section 4(2) of Regulation 460 under the Act, as amended by Regulation 532/93, states:
Every head shall ensure that only those individuals who need a record for the performance of their duties shall have access to it.
In our draft report, we had stated that it was our view that TDC staff should not have access to the SIN since it appeared that they did not require the SIN to perform their duties. Accordingly, we concluded that the Ministry had not complied with this Regulation, and recommended that the Ministry ensure that only staff who needed the SIN in the performance of their duties be permitted access to it.
However, in its submissions to the draft report, the Ministry provided further clarification on this matter. We have now determined that TDC staff do in fact require access to the SIN in the performance of their duties -- in order to enter taxation data into the computer system supporting the EHT program. It is thus our view that the Ministry was in compliance with the above Regulation.
SUMMARY OF CONCLUSIONS
The complainant's SIN was "personal information", as defined in section 2(1) of the Act.
The Ministry's collection of the complainant's SIN was in accordance with section 38(2) of the Act.
The Ministry provided notice of its collection, in accordance with section 39(2) of the Act.
Original signed by: January 12, 1994
Ann Cavoukian, Ph.D. Date
Assistant Commissioner