privacy security ontario employer
Is it legal for an employer to ask for SIN number over email?
<p>I live in Ontario and recently my SIN Number changed. I notified my employer about the change and they asked me to email them the new sin number. I do not want to do so and I prefer to update my sin number through a secured website (https).</p>

<p>But, the employer does not have a secured system. They in-directly insists on sending it with email. Is it legal to do so? and what should I do?</p>

<p>It is generally legal for a business to ask, but it is not legal for a business to insist that you provide it as a condition of providing goods and services unless a law requires that the SIN be provided. As explained by the <a href="https://www.priv.gc.ca/en/privacy-topics/identity-and-privacy/social-insurance-numbers/protecting-your-social-insurance-number/" rel="nofollow noreferrer">relevant Canadian government website</a>:</p>

<blockquote>
  <p>While there is no law barring businesses from asking for the SIN where
  there is no legal requirement to do so, they do need to make people
  aware that collection of a SIN is optional and not a condition of
  service.</p>
  
  <p>The <a href="https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/" rel="nofollow noreferrer">Personal Information Protection and Electronic Documents Act
  (PIPEDA)</a> sets out ground rules for how private sector
  organizations may handle personal information — including the SIN — in
  the course of commercial activities.</p>
  
  <p>Under the law, organizations cannot require you to consent to the
  collection, use or disclosure of your personal information unless it
  is required for a specific and legitimate purpose.</p>
  
  <p>This means that, unless an organization can show that your SIN is
  required by law, you cannot be denied a product or service on the
  grounds of your refusal to provide your SIN.</p>
</blockquote>

<p>Of course, the rub is, that an employer is legally required to have your updated SIN for tax purposes, so the employer is allowed to demand, rather than merely request that you provide it. In particular:</p>

<blockquote>
  <p>7.3 In addition to the circumstances set out in section 7, for the purpose of clause 4.3 of Schedule 1, and despite the note that
  accompanies that clause, a federal work, undertaking or business may
  collect, use and disclose personal information without the consent of
  the individual if</p>
  
  <p>(a) the collection, use or disclosure is necessary to establish,
  manage or terminate an employment relationship between the federal
  work, undertaking or business and the individual; and</p>
  
  <p>(b) the federal work, undertaking or business has informed the
  individual that the personal information will be or may be collected,
  used or disclosed for those purposes.</p>
</blockquote>

<p>A business is required to do this consistent with Schedule 1 to the Act which provides in the most pertinent part:</p>

<blockquote>
  <p>4.7 <strong>Principle 7 — Safeguards</strong> Personal information shall be protected by security safeguards appropriate to the sensitivity of the
  information.</p>
  
  <p>4.7.1</p>
  
  <p>The security safeguards shall protect personal information against
  loss or theft, as well as unauthorized access, disclosure, copying,
  use, or modification. Organizations shall protect personal information
  regardless of the format in which it is held.</p>
  
  <p>4.7.2</p>
  
  <p>The nature of the safeguards will vary depending on the sensitivity of
  the information that has been collected, the amount, distribution, and
  format of the information, and the method of storage. More sensitive
  information should be safeguarded by a higher level of protection. The
  concept of sensitivity is discussed in Clause 4.3.4.</p>
  
  <p>4.7.3</p>
  
  <p>The methods of protection should include</p>
  
  <p>(a) physical measures, for example, locked filing cabinets and
  restricted access to offices;</p>
  
  <p>(b) organizational measures, for example, security clearances and
  limiting access on a “need-to-know” basis; and</p>
  
  <p>(c) technological measures, for example, the use of passwords and
  encryption.</p>
  
  <p>4.7.4</p>
  
  <p>Organizations shall make their employees aware of the importance of
  maintaining the confidentiality of personal information.</p>
  
  <p>4.7.5</p>
  
  <p>Care shall be used in the disposal or destruction of personal
  information, to prevent unauthorized parties from gaining access to
  the information (see Clause 4.5.3).</p>
</blockquote>

<p>There is really no specific provision allowing you to refuse to provide information via email, but the Safeguards provision does state that appropriate care does need to be taken to avoid disclosure, and you are disputing that their email collection is adequate. Also, while employers are required to collect SIN data from employees, there is nothing that expressly requires them to collect it via email.</p>

<p>If you wanted to compromise, one option would be to save the SIN in a password protected word processing document (usually available in the save as window in an obscure little corner), and then you could attach the password protected document to the email and communicate the password itself to the recipient orally via telephone with you calling their number to prevent any phishing scam. It's a bit clunky, but it gets the job done.</p>

<p>Also, please recognize that while a SIN number is important to keep confidential to the extent possible, it is hardly the most sensitive personal information in existence. Lots of people have a need to know it for legitimate purposes and it probably wouldn't be hard at all for someone to get it illegitimately by making a request for your credit record or a tax return transcript under false pretenses.</p>
