As a website owner, what's my legal requirement to ask for SIN number

Question

We have a job recruitment system that we installed which includes a public website where people can apply for jobs directly on the internet. One of the fields is SIN number that displays by default. The vendor is not willing to mark it as optional. Their explanation is since all required fields are marked "required" under the text boxes, it implies the rest of the fields are optional and they don't have to mark SIN field exclusively as optional which would confuse the applicants. They have a point but I am concerned.

Is the vendor's explanation correct?

Answer 1

Here's the government's advice on it, from the Office of the Privacy Commissioner of Canada:

[T]here is no law prohibiting an organization from asking for a customer’s SIN, or a customer from supplying the SIN, for purposes other than income reporting. Although we do not recommend the practice, we recognize that an organization may ask for the SIN, and a customer may choose to supply it, for reasonable purposes of identification, provided that the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA) are duly observed.

A SIN is the personal information of the individual to which it is assigned. As such, its collection, use, or disclosure is subject to all relevant provisions of PIPEDA. Notably, the following principles of Schedule 1 to PIPEDA apply.

• Principle 4.2 (Identifying purposes): An organization must inform the individual of its purposes for collecting the SIN and should do so at the time of collection, either orally or in writing (e.g., on an application form).
  • The organization should clearly specify whether it is requesting the SIN for purposes of income-reporting or for purposes of identification. ...
  • If requesting the SIN only for purposes of identification, the organization should clearly indicate that the collection is optional. ...
  • Where the SIN is to be used for purposes of identification, an organization must provide a convenient mechanism whereby the individual may withdraw consent to such purposes any time after providing the SIN. The mechanism should be inexpensive, easy to execute, and immediately effective. A toll-free telephone number is recommended.

Note that the laws are slightly different in BC, Alberta, and Quebec, as those provinces have passed equivalent legislation at the provincial level that supercedes the federal law. The review article below goes through the various legal restrictions on the collection of SINs for non-required purposes.

Eloïse Gratton & Raphaël Girard, Using Social Insurance numbers for identification purposes: Canadian perspective on legal and privacy risks. Trusts & Trustees, Volume 23, Issue 4, May 2017, Pages 431–452.