Property management company alters its rental application form to make clear that Social Insurance Number is optional
Early resolved case summary #2013-01
April 25, 2013
Lessons Learned
- No private sector organization should request the Social Insurance Number (SIN) from a customer and no customer should give their SIN to a private-sector organization unless the organization is required by law to collect it. For further information, consult our guidance document "Best Practices for the use of Social Insurance Numbers in the private sector".
- If an organization makes use of a third party to conduct its business operations, the organization is responsible for ensuring that the third party's practices are in compliance with PIPEDA.
Complaint summary
An individual alleged that a property management company was over-collecting personal information on rental application forms. Specifically, it was alleged that the organization was requesting the applicant's SIN, driver's licence information and banking information as a condition of accepting an application form. Our Office further looked into this complaint, as the company's website did not have a privacy policy; given that PIPEDA requires businesses to make readily available to individuals specific information about their policies and practices related to the management of personal information.
Outcome
Our Office contacted the property management company, who informed us that its website was currently under construction and that it would include a privacy policy once completed.
Regarding the alleged over-collection, the company informed us that the rental application forms it used were generated by a third-party organization, which the company believed to be in compliance with PIPEDA. The company stated that it was aware that providing a SIN was optional, but explained that there was no way to obtain a credit report for a prospective applicant without it. We disagreed on this point and suggested that the word "optional" be added on the form beside the request for a SIN.
As well, while our Office did agree with the company that it needed to confirm the identity of an applicant, via, for example, a government-issued identity card such as a driver's licence, we did not believe that it needed to collect the unique number appearing on the applicant's card.
The property management company committed to: (i) contacting the third party to ensure that the application form made clear that the request for a SIN, driver's licence and banking information was optional, and; (ii) providing a privacy policy on its website.
As the complainant was satisfied with the changes the company would make, we considered the matter resolved. Our Office later confirmed that the organization had made the appropriate changes to its application form and website.
- Date modified: