骗不了你哈。崩溃不?
The SIN is considered to be personal information under thePersonal Information Protection and Electronic Documents Act(PIPEDA); therefore, it's collection, use, disclosure and protection are covered by this legislation. PIPEDA balances an individual's right to privacy with an organization's need to collect, use or disclose personal information for legitimate business purposes.
To respect the principles of this legislation, private sector organizations should fulfill four responsibilities.
A private sector organization should never use theSIN as a piece of identification or as a customer identity number.The SIN is not an identity document and should not be used for that purpose. If a client's identity needs to be verified, request other pieces of identification.Private sector organizations should never ask for a customer's SIN unless they are legally required to collect it (for example, for income reporting purposes). If private sector organizations collect the customer's SIN, they have to fully comply with PIPEDA in disclosing the purpose and obtaining consent. They must then only use the SIN for the disclosed purposes.If an organization needs to assign a customer identity number to its clients, the number should be created and used only by that organization. Using the SIN, which was created for another purpose, as an identity number puts clients' personal information at risk and jeopardizes the integrity of the SIN. This practice also increases the chances that identity thieves will target the organization because of the valuable information linked to that number.
A private sector organization must inform its clients why it is requesting the SIN at the time of the request, and must only use the SIN for that purpose.There is only one reason a private sector organization is required to collect the SINfrom its customers – income reporting (for example, financial institutions that must report interest earned in a person's bank account). If the organization is asking for the SIN for that reason, it should clearly state that the request is required by law.If a private sector organization decides to request the SIN for other purposes, such as identification, the organization must state clearly at the time of the request why the SIN is being requested and how it will be used. The organization must also tell the person that they do not have to provide their SIN if they do not want to.An organization must not use the SIN for any unidentified purpose without the customer's consent.
A private sector organization cannot make clients provide their SIN as a condition for receiving a product or service, unless there is a legal requirement for the SIN.An organization should ensure that its customers are sufficiently informed and that they consent to the collection and use of their SIN.If asking for a customer's SIN for any purpose other than a legal requirement, the organization must not, in any way, suggest to this person that their SIN is required as a condition of receiving a product or service.If providing a SIN is not legally required, an organization should offer the customer a convenient mechanism for them to withdraw consent at any time after providing the SIN, if there is to be ongoing use of SIN. The mechanism should be clear, inexpensive, easy to execute, secure and effective.
Private sector organizations must protect their clients' personal information, including Social Insurance Numbers, from theft and inappropriate use or disclosure.If private sector organizations are entrusted with their customers' personal information, including SINs, they must ensure that this information is safe and secure from theft or inappropriate use or disclosure.Customers' personal information should be stored and disposed of safely and securely. Access should be restricted to authorized persons.Private sector organizations should follow Annex 7, Private Sector Dos and Don'ts: Requesting, Collecting, Using and Storing the SIN.If customers' SINs are stolen or inappropriately used or disclosed, the organization must take immediate steps to minimize the potential damage. See Annex 4, SIN at Risk: Action Plan for Organizations.