INVESTIGATION REPORT

INVESTIGATION I94-098P

THE MINISTRY OF FINANCE

May 2, 1995

INTRODUCTION

Background of the Complaint

This investigation was initiated as a result of a complaint about the Ministry of Finance (the Ministry). The complainant, an employee of the Ministry, was concerned that the Ministry's collection of employees' Social Insurance Number (SIN) on three internal forms, entitled "Statement of Travelling Expenses", "Request for Leave of Absence", and "Request for Advance", was in contravention of the Freedom of Information and Protection of Privacy Act (the Act.) The complainant stated that if the SIN was not provided, the forms were returned to the employee, unprocessed.

The complainant was also concerned about the lack of confidentiality during the processing of these forms. The complainant stated that the forms passed through several hands, and were often left unattended on staff desks, where unauthorized individuals could have access to the SIN. The complainant stated that it was possible for someone to obtain personal, financial and medical information from Revenue Canada, or from the insurance company providing employee benefits by providing a name, address and the SIN.

Issues Arising from the Investigation

The following issues were identified as arising from the investigation:

(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,

(B) Was the personal information collected in compliance with section 38(2) of the Act?

RESULTS OF THE INVESTIGATION

Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?

Section 2(1) of the Act defines "personal information" as recorded information about an identifiable individual, including,

(c) any identifying number, symbol or other particular assigned to the individual,

Each of the three forms required the SIN to be provided. It is our view that the SIN is a unique identifying number assigned to an individual, and, therefore, meets the requirements of paragraph (c) of the definition of "personal information" in section 2(1) of the Act.

Conclusion: The information was personal information, as defined in section 2(1) of the Act.

Issue B: Was the personal information collected in compliance with section 38(2) of the Act?

Section 38(2) of the Act sets out the conditions for which personal information can be collected on behalf of an institution. This section states:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. [Emphasis added]

In our view, the Ministry's collection of the SIN on the three forms was not expressly authorized by statute nor was the collection for the purposes of law enforcement. We, therefore, examined whether the Ministry's collection met the third condition, i.e., necessary to the proper administration of a lawfully authorized activity.

The Ministry advised that the SIN was required on all three forms "to facilitate the administrative and accounting process." The Ministry also stated that the SIN was used "as a cross reference to the payroll system when T4's and T4A's are issued for tuition reimbursement and payment of professional contract staff." We noted, however, that none of the forms were specifically related to tuition reimbursement or to payment for contract staff.

In our view, the facilitation of an administrative and accounting process was a lawfully authorized activity. We, therefore, considered if the Ministry's collection of the SIN was necessary to the proper administration of this lawfully authorized activity.

"CORPAY" is the payroll system for all government employees. The SIN is used as an employee identifier to access CORPAY.

The "Request for Leave of Absence" form has to be completed when an employee applies for leave for various reasons, with or without pay, including maternity leave, bereavement leave, and jury duty.

In order for an employee to receive their correct salary and benefits, the information on this form is cross-referenced to CORPAY, which is accessed via the employee's SIN. It is, therefore, our view that the Ministry's collection of SIN on this form was necessary for the proper administration of a lawfully authorized activity, i.e., to facilitate the Ministry's payroll administration process. The Ministry's collection of the SIN on this form was, thus, in compliance with section 38(2) of the Act.

The purpose of the "Request for Advance" form and the "Statement of Travelling Expenses" form is to reimburse employees for out-of-pocket expenses incurred while travelling on Ministry business.

In our view, however, the Ministry's collection of the SIN on these forms was not necessary to facilitate the administrative and accounting process involved, as employees could be reimbursed without accessing CORPAY. Cross-referencing for income tax purpose was not required for these two forms. For comparison purposes, we reviewed our office's "Statement of Travelling Expenses" and "Request for Advance" forms. The SIN is not required on either of these two forms.

The Ministry stated that it was the Ministry's intention in future to facilitate direct deposits of reimbursements through the payroll system which would require the SIN. However, this was not the Ministry's present process for reimbursements and was not the purpose for which the SIN was collected on these two forms.

In our view, the Ministry's collection of employees' SIN on the "Statement of Travelling Expenses" and the "Request for Advance" forms was not necessary to the proper administration of a lawfully authorized activity and was, thus, not in compliance with section 38(2) of the Act.

Conclusion: The Ministry's collection of employees' SIN on the "Request for Leave of Absence" form was in compliance with section 38(2) of the Act.

The Ministry's collection of employees' SIN on the "Statement of Travelling Expenses" and the "Request for Advance" forms was not in compliance with section 38(2) of the Act.

Other Matters

The complainant was concerned about the confidentiality of employees' SIN since the complainant believed that the forms were often left unattended on staff desks. The complainant explained that it was the number of staff having unnecessary access to an employee's SIN, rather than the actual administrative process, that was the cause for concern. The complainant advised that the procedure for filing the forms was as follows:

The completed form was given to a manager for approval, then mailed by the manager's secretary to a second location in the program area, and a copy put on file. The secretary at the second location opened the mail, delivered it to the administrative clerk, who then entered the information on the on-line financial information system, and forwarded the form to Finance and Administration. Here, one or two staff members processed the employee's cheque.

In our view, the complainant's concerns would be reduced if the SIN was omitted from the two forms that do not require the SIN, i.e., the "Statement of Travelling Expenses" form and the "Request for Advance" form.

However, we would like to remind the Ministry of the requirements of sections 4(1) and 4(2) of Regulation 460 under the Act, which state respectively that "Every head shall ensure that reasonable measures to prevent unauthorized access to records in his or her institution are defined, documented and put in place..." and "Every head shall ensure that only those who need a record for the performance of their duties shall have access to it."

SUMMARY OF CONCLUSIONS

• The information in question was personal information, as defined in section 2(1) of the Act.

• The Ministry's collection of employees' SIN on the "Request for Leave of Absence" form was in compliance with section 38(2) of the Act.

• The Ministry's collection of employees' SIN on the "Statement of Travelling Expenses" and the "Request for Advance" forms was not in compliance with section 38(2) of the Act.

RECOMMENDATION

In our draft report, we recommended that the Ministry cease the collection of employees' SIN on its "Statement of Travelling Expenses" and "Request for Advance" forms.

In its response, the Ministry informed us that it was currently analyzing the systems changes necessary to accommodate the elimination of the employee's SIN as a reference on its "Statement of Travelling Expenses" and "Request for Advance" forms and its travel expenditure records. The Ministry stated, however, that a six month period for compliance with our recommendation was "administratively awkward in relation to the use of two different employee references during an annual cycle for recording travel expenditure data."

We, therefore, ask that within six months of receiving this report, the Ministry provide us with either proof of compliance with our recommendation or an update on its implementation.

Original Signed by: May 2, 1995

Susan Anthistle Date

Compliance Review Officer