INTRODUCTION  

Over the past five years, the Auditor General and this Committee have examined and reported on problems associated with the management of the Social Insurance Number (SIN) and the Social Insurance Register (SIR). On 28 November 2002, the Committee held a meeting to review the findings of the Auditor General of Canada’s 2002 audit of the SIN. On 13 February 2003, we held another meeting to examine Human Resources Development Canada’s (HRDC) Action Plan to address the problems identified in the Auditor General’s latest audit of the SIN.  

Although we do not know the exact size of the gap between the number of SINs issued and the potential number of SIN users, we recognize that it will take some time to restore integrity to the SIR. Members of the Committee are pleased that HRDC has increased its fraud investigation activities, has developed a fraud-screening program and has begun to develop a comprehensive risk management strategy for conducting SIN investigations. We are also pleased that HRDC has begun to de-activate dormant SINs and intends to introduce an expiry date on SINs used by temporary residents.  

While these measures will undoubtedly serve to improve the quality of the data in the SIR, the Committee has serious concerns with some of the other elements of HRDC’s Action Plan to improve the SIN system. In particular, we do not know if the Plan is fully funded and we doubt that the recent modifications to the documents that may be used in applying for a SIN respect the requirements of the Employment Insurance Act and Regulations. In addition, Members of the Committee believe that more needs to be done to insure that SINs are used for their intended purpose, and that HRDC establish deadlines for all initiatives in the Action Plan and report regularly on progress implementing the Plan.  

AN OVERVIEW OF THE PROBLEM 

The Social Insurance Number (SIN) was created in 1964 as a file identifier for the Canada Pension Plan, the Quebec Pension Plan and the Unemployment Insurance Program (now Employment Insurance). However, the use of the SIN has grown considerably since then, and has become a personal identifier in both the public and private sectors.  The Canada Employment Insurance Commission is responsible for the administration of the SIN. Human Resources Development Canada (HRDC) issues SINs on behalf of the Commission and maintains the Social Insurance Register, which contains relevant information on individuals who apply for a SIN.  

It is important to note that HRDC does not have sole responsibility for the SIN. The Treasury Board Secretariat is responsible for developing policy and issuing guidelines that govern the use of the SIN at the federal level. The Department of Justice provides legal advice on SIN-related questions pertaining to the Privacy Act and responds to public inquiries regarding inappropriate use of the SIN in the private sector. The Privacy Commissioner investigates SIN-related complaints and monitors compliance with the Privacy Act in his reports to Parliament. 

Despite the ongoing vigilance of the Auditor General of Canada, this Committee and others, the administration of the SIN has been problematic for too many years. In 1998, the Auditor General conducted an audit of the SIN and identified many problems with respect to the way in which this activity is managed. This Committee also initiated a study of the SIN system in the same year and tabled its unanimous report, entitled Beyond the Numbers, on 4 May 1999. That report contained 21 recommendations chief among which were: immediate action to correct abuses of the management and control of the SIN system (with a draft bill — The Social Insurance Numbers Control Act — to be presented by 31 December 1999); a government study of the longer term solutions with special attention to data-matching and privacy, based on more complete information about the impact and use of the SIN in the public and private sectors; regulatory reforms to deal with abuse of temporary cards and an action plan with regard to timely investigations of fraud, including progress reports to Parliament; a public information campaign on the legitimate use of the SIN; and appropriate and regulated exchange of vital statistics with the provincial and territorial  governments in order to maintain the integrity of the information contained in the SIR. 

The government tabled two responses in the House of Commons to the Committee’s report. The first response, released on 16 November 1999, dealt with administrative issues. In this response, the government rejected the Committee’s recommendation for a new act to protect SINs, since it believed that these would be protected through Bill C-6 — since proclaimed as the Personal Information Protection and Electronic Documents Act — among other government actions and plans. The government also rejected the idea of issuing new SIN cards with biometric identification, because the government estimated the cost of issuing a “smart” SIN card as somewhere between $1.2 billion and $3.6 billion (excluding the additional costs to be incurred in the periodic re-registration of SIN cardholders). As for the privacy concerns that the Committee put forward, the government response maintained that the body of case law based on the Charter, the Criminal Code and the Privacy Act, responded to the Committee's concerns in terms of privacy protection in the federally regulated sector.  The government agreed in full with the remaining recommendations and also agreed to provide additional details on the administration of the SIN in HRDC’s annual Performance Reports. The government also undertook to implement a communication strategy to inform Canadians of the proper use of the SIN and to take steps to ensure that only information clearly relevant to the verification of an applicant's identity would be requested. It agreed to an expiry date for temporary cards and indicated that existing temporary cards had been reviewed and that those that were inactive (i.e., not used for 5 years) had been identified.  

The government's second response, tabled on 31 December 1999, dealt with the Committee’s policy-related recommendations. In this regard, the government rejected the idea of new legislated restrictions on the use of the SIN and cited the increased costs that this would entail for private businesses (whose use of the SIN for their own purposes was unauthorized). The government also rejected the suggestion to establish a national identity system, an issue that has resurfaced following the horrific events of 11 September 2001. Finally, the government reaffirmed that the existing SIN system was still appropriate (given its announced intentions to improve the administration and control of the SIN). 

During a meeting to discuss the government responses, HRDC officials assured the Committee that SIN issues (including privacy) were being appropriately dealt with by HRDC and that the Department was following Treasury Board guidelines and the advice of the Privacy Commissioner with regard to the administration of the SIN system. They also told the Committee that HRDC would not be able to provide additional information regarding improvements to the administration of the SIN system until various administrative issues (e.g., reports from 5 internal taskforces in the Spring of 2000, funding and passage of the Personal Information Protection and Electronic Documents Act) had run their course. 

HRDC officials also repeated the arguments in the response that Bill C-6 (enacted since as the Personal Information Protection and Electronic Documents Act) would address SIN-related issues and that the government wanted to avoid a debate that might prove inconsistent with the proposed law.  The Committee was told that the SIN was only one element of a broad and ongoing debate related to electronic commerce and the protection of personal information that was being led by the Treasury Board. 

In 2000, the Auditor General conducted a follow-up audit to the 1998 audit and reported that some improvements had been made in SIN records and that the number of SIN-related fraud investigations had increased.  Given these findings and the expectation that HRDC was well on its way to enhancing the integrity of the SIN, Members of this Committee were disappointed with HRDC’s activities as reported in the Auditor General’s subsequent 2002 audit, that identified significant and continuing inadequacies regarding SIN administration and the integrity of the Social Insurance Register. 

The September 2002 Report of the Auditor General found that:

• the Social Insurance Register (SIR) still contains significant variances from population estimates. If dormant SINs (i.e., 2.6 million) are removed from the SIR, there would still be 2.4 million SINs more than the Canadian population over 20 years old;
• HRDC is using the SIN for some of its own programs without obtaining the required approval from the Treasury Board;
• although the Employment Insurance Regulations specifically require HRDC to determine both the identity and citizenship status of SIN applicants, HRDC does not respect the intent of the Employment Insurance Act or Regulations in this regard; 
• HRDC staff focus more on satisfying the SIN applicant than on safeguarding the integrity of the SIN application process;
• job responsibilities, training tools and information for issuing SINs vary greatly among local HRDC offices;
• since the 1998 audit, HRDC has made no changes in the way it controls the 900-series SINs (i.e. temporary SINs  held by non-citizens and non-residents);
• HRDC’s staff do not systematically require applicants of a 900-series SIN to demonstrate why they need a SIN, even though this is specified in the Employment Insurance Act and Regulations;
• HRDC has not determined the extent and nature of SIN-related fraud and it has not analysed the link between the results of its fraud investigations and the risks associated with the way the Department issues SIN cards; and
• there is still no formal training program for SIN investigators.

THE ACTION PLAN 

When the Associate Deputy Minister of HRDC, Ms. Maryantonett Flumian, appeared before the Committee on 28 November 2002, she promised to table HRDC’s Social Insurance Number Action Plan with both the Auditor General and this Committee. Distributed to Members of the Committee on 10 December 2002, this Plan consists of 14 initiatives, the successful completion of which is contingent on suitable funding and the involvement of other federal departments and agencies. The 14 initiatives that comprise the current Action Plan are:

• to use the SIN only where authorized by the Treasury Board;
• to ensure that the reporting on improvements to quality of the information in the Social Insurance Register (SIR) is clear;
• to ensure that policies and practices for determining identity and citizenship status of SIN applicants respect the intent of the Employment Insurance Act and Regulations;
• to re-consider goals for 900-series SINs and revise policies and practices accordingly;
• to assess the reliability of all identity and citizenship documents accepted for SIN applications;
• to strengthen the Proof of Identification program for SIN applications;
• to set goals for the completeness and accuracy of the SIR and take the necessary steps to meet them;
• to place an expiry date on 900-series SINs;
• to reduce the number of usable SINs in the SIR;
• to adopt a risk-based approach to investigating SIN-related fraud;
• to assess the effectiveness of SIN public awareness activities;
• to develop a means of checking the validity of identity and citizenship documents with the authorities that issued them;
• to ensure that staff has the proper training and tools; and
• to develop agreements with partners to improve the integrity of the SIR.

As noted in the Action Plan, HRDC initiated a number of measures on 8 October 2002. These measures include accepting only original identity documents for SIN applications, deactivating SINs that have not been used in the previous five years and obtaining authority to introduce expiry dates on 900-series SINs (i.e., those belonging to individuals who are neither Canadian Citizens nor permanent residents). HRDC has also initiated discussions with Citizenship and Immigration Canada for access to immigration data to establish proof of identity and need for a SIN regarding applicants who are not permanent residents and to validate the identity of foreign-born citizens. HRDC has also initiated discussions with some provinces to validate SIN application information against vital statistics information.  In terms of staff training, HRDC has updated its computer-based training course and provided staff with an Identification Document Guide to help them recognize false documents. New tools, such as ultraviolet lights, have also been provided to help staff detect false documents.

While the Committee is heartened by HRDC’s recent efforts to manage the SIN better, many Members of the Committee are frustrated by the slow progress that this Department has demonstrated in the past five years to address this very important problem. We are also not convinced that HRDC’s current Action Plan is sufficient to do the job.  

I. Funding 

The Action Plan states that the completion of each of the initiatives outlined above is contingent on the availability of suitable funding. While this is understandable, we are mindful of the fact that a lack of funding was cited as a key reason for not fully implementing HRDC’s previous action plan to fix the SIN. Many of us are concerned that HRDC has not yet demonstrated a strong enough commitment to secure the necessary funding to implement its Action Plan. During our meeting on 13 February 2003, the Assistant Auditor General, Ms. Maria Barrados, said that “we expected that the Department would have a clear idea of what the cost would be and would secure appropriate resources before providing an action plan to the Committee.”¹ We share this expectation.