PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-040005-1

 

 

Ministry of Training, Colleges & Universities

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

PRIVACY COMPLAINT NO.                   PC-040005-1

 

INVESTIGATOR:                                       Leslie McIntyre

 

INSTITUTION:                                            Ministry of Training, Colleges and Universities

 

 

SUMMARY OF COMPLAINT:

 

The Office of the Information and Privacy Commissioner/Ontario received a complaint under the Freedom of Information and Protection of Privacy Act (the Act) involving the Ministry of Training, Colleges and Universities (the Ministry).

 

The complainant is the parent of a student who has applied for financial assistance through the Ministry’s Ontario Student Assistance Program (OSAP or the program).  The complainant has a number of concerns about the Ministry’s collection, use and disclosure of personal information under the program, which are primarily focussed on specific aspects of the OSAP application form.  The complainant also raised a concern relating to the security of personal information held by OSAP offices located at colleges and universities.  In light of the complainant’s concerns, the IPC initiated a privacy complaint under the Act.

 

BACKGROUND:

 

Before proceeding to address the issues in this complaint I feel it would be helpful to outline some background information concerning OSAP, as provided by the Ministry.

 

OSAP is a “needs-based” program designed to provide financial assistance to post secondary students, supplementing but not replacing the financial contribution expected of a student and his or her parents, sponsor, spouse or same-sex partner (referred to collectively as “expected contributors”). 

 

OSAP is actually an umbrella program that includes a number of financial assistance sub-programs funded by the Ontario and federal governments, including the Ontario Student Loan program (OSL) and the Canada Student Loan program (CSL), the latter administered by Ontario on behalf of the federal government.

 

Eligibility for OSAP is dependent on a number of factors, including residency, citizenship or permanent residency status, enrolment in an approved course of study at an approved institution, maintenance of the minimum required course load and maintenance of any previous loans in good standing.  A student is eligible for OSAP assistance if his or her allowable educational costs, subject to certain fixed limits, are greater than the resources available to the student and his or her expected contributors.

 

The Ministry explains that to properly administer the program, it collects a wide range of personal information from students and their expected contributors.

 

In recent years, the Ministry has employed a single OSAP application form to allow students simultaneously to make application for CSL, OSL and other financial assistance programs.

 

The Ministry operates OSAP under the authority of the Ontario  Ministry of Training, Colleges and Universities Act  [MTCUA ] and the federal  Canada Student Financial Assistance Act  [CSFAA ].  In addition, Management Board Secretariat collects OSAP debts under the Financial Administration Act [FAA] and the Management Board of Cabinet Act [MBCA].

 

DISCUSSION:

 

Introduction

 

The complainant’s concerns are focussed on the 2003-2004 OSAP application form.  In the course of this investigation the Ministry advised that it is now using a revised form for the 2004-2005 period.  In the circumstances, I have decided to consider the issues raised by the complainant in the context of the revised form.

 

I sought and received the submissions of the Ministry on the issues raised by the complaint.

 

I will address each of these issues below.

 

Is the information in question “personal information” as defined in section 2(1) of the Act?

 

Discussion

 

The provisions concerning collection, use and disclosure of personal information in Part III of the Act apply only to “personal information”.  Therefore, I must first determine whether the information in question meets this definition, which states (in part):

 

“personal information” means recorded information about an identifiable individual, including

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(c)          any identifying number, symbol, or other particular assigned to the individual,

 

(h)        the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

[my emphasis]

 

The OSAP application form (2004-2005 version) is broken down into 20 sections:

 

A.        Personal Information

B.        Current Status Information

C.        Residency Information

D.        Information on Next of Kin Living in Canada

E.         Applicant’s Consent to Release Personal Information

F.         Information on Previous Postsecondary Studies

G.        Information on 2004-2005 Study Period

H.        Applicant’s Assets

I.          Applicant’s Income

J.          Information on Applicant’s Children

K.        Temporary Password

L.         Information from Parents

M.        Information from Partner

N.        Ontario Student Opportunity Grant

O.        Queen Elizabeth II Aiming for the Top Scholarship

P.         Canada Millennium Bursary

Q.        Consents, Declarations and Signatures of Parents

R.        Consents, Declarations and Signatures of Partner

S.         Consents, Declarations and Signature of Applicant

T.         Application Fee

 

The form clearly collects a broad range of personal information about identifiable individuals, including the applicant, the applicant’s parents and/or partner and/or children.  The Ministry does not dispute this finding.

 

Conclusion

 

The information in question is “personal information” as defined in section 2(1) of the Act.

 

Does the Ministry indirectly collect personal information in accordance with section 39(1) of the Act?

 

Introduction

 

Section 39(1) generally prohibits an institution from collecting personal information from sources other than the individual in question, but sets out a number of exceptions to this rule.  The Ministry relies on the exception in paragraph (a) for its indirect collection in this case.  That section reads:

 

Personal information shall only be collected by an institution directly from the individual to whom the information relates unless

           

the individual authorizes another manner of collection

 

The complainant appears to accept that in collecting personal information directly from the applicant and expected contributors, the Ministry complies with its authority to do so under the section that governs direct collection, section 38(2).  Therefore, I will not consider this issue.

 

However, the complainant is concerned about the Ministry’s indirect collection of personal information about the applicant and expected contributors from other individuals or organizations.

 

Applicant’s information

 

Discussion

 

The OSAP form (section S) describes the basis for the Ministry’s collection of personal information about the applicant as follows:

 

Collection and Use of Personal Information

 

Your personal information provided on this application form and in all other communications related to your application and award of financial assistance, including your [SIN], is used by the [Ministry] to administer and finance [OSAP] and by Human Resources Development Canada (HRDC) to administer and finance the [CSL].  The ministry and HRDC also use your personal information in respect of this and previous applications and awards of assistance to conduct policy analysis, evaluation and research related to all aspects of the program, including developing key performance indicators about your postsecondary institution such as the aggregated [OSL] default rates of its students.  The ministry and HRDC may use contractors or auditors for any of these activities.  Under agreement with the ministry and HRDC, the National Student Loans Service Centre [NSLSC] uses your personal information to administer OSAP and the [CSL].  Under agreement with the ministry, your postsecondary institution and, where authorized by the ministry, its agents who administer OSAP and its auditors use your personal information to administer OSAP and the [CSL].

 

Administration includes:  determining your eligibility for and award of financial assistance; verifying your application; verifying any award of financial assistance and any relief granted from any payment you are required to make; considering any applications for review or appeals of determinations relating to your financial assistance or eligibility for relief from any payment; maintaining and auditing your file; collecting loans, overpayments, and repayments; enforcing the legislation set out below and your agreements with the ministry, the Ontario Student Loan Trust [OSLT], and HRDC; and monitoring and auditing the NSLSC and your postsecondary institution or its authorized agents to ensure that they are administering the programs appropriately.  Financing includes:  funding or arranging funding of the programs.

 

The personal information provided in connection with this application, including your [SIN], is necessary for the proper administration of [OSAP].  This information is being collected and will be used by the ministry to administer and enforce OSAP, including:  determining eligibility; verifying the application, any loans approved, grants, bursaries, or scholarships issued, and loans forgiven; maintaining and auditing your file; collecting loans, overpayments, and repayments; and auditing the administration of OSAP by or on behalf of your educational institution and the [NSLSC].  The ministry administers OSAP under the authority of the [MTCUA and regulations]; the [FAA]; the [CSFAA and regulations]; the [Budget Implementation Act, 1998].  If you have any questions about the collection or use of this information, contact the Director, Student Support Branch [of the Ministry] . . .

 

The form then requires the applicant to consent to the indirect collection of his or her personal information in the following statement:

 

Applicant’s Consent to the Indirect Collection and Disclosure of Personal Information

 

I agree that until my loans, overpayments and repayments are repaid, the ministry can, without limitation, collect and exchange personal information about me that is relevant to the administration and financing of OSAP and the [CSLP] and that is needed for policy analysis, evaluation and research into all aspects of OSAP with:  HRDC, NSLSC, my postsecondary institution and its authorized financial administration agents, other agencies identified on this application form, the ministry ’s contractors and auditors, HRDC’s contractors and auditors, collection agencies operated or retained by the federal or provincial governments and consumer reporting agencies.

 

If I am selected for a Canada Millennium Bursary, I agree that the ministry and the Canada Millennium Scholarship Foundation may collect and exchange personal information about me to administer and finance the bursary, including conducting policy analysis, evaluation and research activities related to all aspects of the bursary.  I also agree that the ministry, the Foundation and their auditors may collect and exchange personal information about me for the sole purpose of auditing the administration of the bursary.

 

If I indicated on the application that I wish to be considered for a Queen Elizabeth II Aiming for the Top Scholarship, I agree that: (a) the Ontario Universities’ Application Centre or OCAS Application Services Inc. (formerly known as the Ontario College Application Services [OCAS]) may disclose my high school marks or grades to the ministry for the sole purpose of determining my eligibility for this scholarship; and (b) the fact that I have won a Queen Elizabeth II Aiming for the Top Scholarship along with my name, city, and high school will be disclosed to my school board and may be published in newspapers or otherwise publicized in recognition of outstanding achievement.

 

The complainant states that although the applicant, in filling out the form, consents to the indirect collection of his or her personal information, the consents are unreasonably vague and broad to be considered valid under section 39(1)(a):

 

In the consent for indirect collection . . . of personal information, the [Ministry] alludes to its right to collect . . . “personal information about me”.  The Privacy Commissioner of Canada, in a number of complaints filed by this writer, has clearly stated that this scope of collection is too vague and all encompassing.

 

Clearly, [the Ministry] elects to collect . . . information and it would appear that such a collection . . . may be totally indiscriminate.  In the correct circumstances, it may amount to institutional blackmail.

 

If health information is collected, the limitation should be clearly stated . . . The collection of personal information for the purposes of sharing should be restricted to fiscal information and enrolment status.  It is imperative this clause be redrafted.

 

The Ministry states:

 

. . . [T]he consent is not vague and . . . it provides adequate notice of the range of persons and organizations that [the Ministry] may need to [collect] personal information [from] “for the sole purpose” of administering OSAP and auditing the administration of OSAP by the student’s educational institution and the NSLSC.  The main stages of the administration and enforcement of OSAP are noted in the section 39(2) notice.  In addition, the consent comprehensively sets out the main partners involved in the administration and enforcement of OSAP.

 

With over 200,000 applicants per year, each with a different set of circumstances, it is impossible to specifically identify every person or organization that [the Ministry] may need to contact in every case . . . [T]he consent is clear, specific and understandable within the context of personal circumstances of a student and his or her expected contributors.  For example, the consent does not note that [the Ministry] may collect personal information indirectly from the Ministry of Transportation but it does say that it may collect personal information indirectly from “other agencies identified on this application”.  Those students and partners who identified that they owned or leased a vehicle will understand that this information will be verified with the Ministry of Transportation.  In addition, those students and partners who did not identify that they owned or leased a vehicle but who actually own or lease a vehicle will also understand that this information can be verified with the Ministry of Transportation.

 

The notices and consents are buttressed by the detailed program information contained in the Instructions, Information Guide on the OSAP web-site.

 

I agree with the complainant’s general view that if a consent is unreasonably broad or vague in the circumstances, this office may determine that an institution may not rely on the consent exception in section 39(1)(a).  However, in these circumstances, I am satisfied that the consents to indirectly collect personal information are reasonably specific to meet the requirements of section 39(1)(a).

 

I accept the Ministry’s submission that it is not reasonably possible for it to provide a concise and complete list of the persons from whom it will indirectly collect information, and what information it will collect.  In my view, the Ministry has made reasonable efforts in its consent statements and elsewhere to inform applicants about the types of information it may collect, the reasons why it would collect information indirectly, and the sources of that information.  Given the nature of the program and the broad spectrum of information that is collected directly from the applicant, it stands to reason that in order to verify information and monitor the program, the Ministry may need to collect a broad range of information indirectly from a variety of sources.  It is simply not reasonable to expect the Ministry to set out every possible scenario, and I accept that the Ministry has made reasonable efforts to be transparent about the circumstances in which indirect collection will occur.  I also note that the consent contains specific language limiting the purpose of the collection of personal information to the administration of OSAP and the CSL. In my view, given the information available to applicants both within and outside the form, the consents in this case amount to more than mere statements that the Ministry may indirectly collect any information from any person for any reason, as the complainant appears to suggest.

 

Conclusion

 

The consents in the OSAP form to indirectly collect personal information of applicants are sufficient for the application of section 39(1)(a) of the Act.

 

Parents’ and Partner’s Information

 

Discussion

 

General issues

 

The OSAP form (sections Q and R) descriptions of the Ministry’s basis for collecting personal information about the applicant’s parents and partner are very similar to the statement regarding collection of the applicant’s personal information.

 

The form (section Q) requires the parents to consent to the indirect collection of their personal information in the following statement:

 

Consent of Parent(s) to the Indirect Collection and Disclosure of Personal Information

 

I understand that the information on this form is a necessary part of the calculation of any award of financial assistance to the applicant.  The information I have given is complete and true, and I will notify the applicant’s financial aid office or the ministry in writing if there are any changes.  I also understand that if I have more than one dependent child who makes application for OSAP, my personal information will be used in the administration of the OSAP of all such dependent children.

 

I agree that until the applicant’s loans, overpayments, and repayments are repaid, the ministry can, without limitation, collect and exchange personal information about me that is relevant to the administration of OSAP and the [CSL] with: HRDC, Canada Customs and Revenue Agency, NSLSC, the applicant’s postsecondary institution and its authorized auditors and financial administration agents, other agencies identified on this application form, the ministry’s contractors and auditors, HRDC’s contractors and auditors, collection agencies operated or retained by the federal or provincial governments, and consumer reporting agencies.

 

I understand that the personal information I provide in connection with this application can be accessed by the applicant.  Other personal information relevant to a reassessment or appeal will be disclosed to the applicant and any person(s) authorized by the applicant to have access to all information in the applicant’s 2004–2005 OSAP file.

 

Section R of the form contains the same consent statement, with the exception of the portion relating to dependent children.

 

The complainant states that the Ministry’s indirect collection of information about the applicant’s parents is too broad:

 

As a parent who is about to disclose some of my most personal information, I find it appalling that the Programme would declare the right to “collect and share information about me with any government, or branch of government, or any person.”

 

Such collection breaks all rules of contemporary data sharing since it does not state a limit on the collection and it seeks the right to share information well beyond the test of “reasonable person”.

 

I believe this section of the protocol is the most dangerous from a privacy standpoint since the parent is not even applying for assistance.

 

It is also unclear from whom information will be collected.  Indirect collection should be clearly disclosed in terms of the source of collection and the extent of collection.  As well, there is no clear time limit on the collection.  Conceivably, collection could continue after awards are made and paid.

 

The complainant goes on to state that he has the same concerns with respect to the Ministry’s indirect collection of information about partners.

 

The Ministry responds as follows:

 

With respect to students who are eligible for OSAP, the consent to the indirect collection and disclosure of personal information signed by their parents or partner is limited to verification and audit of the personal information provided by their parents on Section L of the . . . application or the personal information provided by their partners on Section M of the . . . application.  Obviously the range of personal information that [the Ministry] may need to collect indirectly will be dependent on the facts of a particular application.  For example, [the Ministry] may need to verify that the parent is actually supporting the dependent children identified on the application form or that the dependent children identified to be in postsecondary studies are actually in full-time attendance.  The consent also provides that personal information relevant to a reassessment or appeal by the student will be disclosed to the student or anyone the student has authorized in Section E to have access to his or her . . . OSAP file.

 

Both the . . . Application and Instructions and the Information Guide provide detailed and explicit information about the indirect collection of personal information that takes place in the usual course of verification.

 

[The Ministry] only relies on the s. 39(2) notice and the consent of the parents, spouses and same-sex partners from the time the student applies for OSAP to and including the date that the student repays his or her OSAP indebtedness in full or until the last audit of the administration of OSAP by the student’s educational institution or the [NSLSC].  This period is different for every student and cannot be determined at the time the student makes application for OSAP.  However, the notice clearly describes the major stages of the life cycle of OSAP and . . . this limitation is implicit in both the notice and the consent.

 

. . . [The Ministry] . . . has authority to indirectly collect personal information about parents and partner that is necessary to the administration and enforcement of OSAP under . . . s. 39(1)(a).

 

Similar to my finding above, I am satisfied that the consents to indirectly collect personal information about parents and partner are reasonably specific to meet the requirements of section 39(1)(a).  Again, for similar reasons to those above, the Ministry has made reasonable efforts in its consent statements and elsewhere to inform parents and partner about the types of information it may collect, the reasons why it would collect information indirectly, and the sources of that information. 

 

With respect to the time frame for collection, I find the Ministry’s explanation to be reasonable.  I accept the Ministry ’s statement that given the loan life cycle and need to perform audits, it is not reasonably possible to provide a time limit that is more specific than the one that the Ministry provides.

 

Income information

 

The complainant states that when verifying the parents’ and partner’s income, the Ministry should not require consent to indirect collection from the federal government of any information beyond income information.

 

Section 13 of Ontario Regulation 268/01 under the MTCUA  speaks to the issue of determining income for the purpose of OSAP:

 

(1)        For the purposes of a student loan, the amount of an individual’s financial resources for a particular period of study in an approved course of study at an approved institution is the amount of money that the Minister expects the individual and his or her expected contributors, if any, to contribute toward the individual’s education costs for the period.

 

(2)               The Minister shall determine the individual’s financial resources having regard to the following matters:

 

1.         The individual’s total income from all sources, including earnings from summer and other part-time or full-time employment, investment income and other income including gifts.

 

2.                  Any academic awards and government assistance that the individual is receiving or is entitled to receive.

 

3.         The assets of the individual and, if the individual has a spouse, the assets of the spouse.

 

4.         If the individual has expected contributors, their total income from all sources.

 

5.         If the individual has expected contributors, their personal income tax payments and employment insurance and pension plan contributions.

 

6.         The number of other individuals that, in the opinion of the Minister, are dependants of the individual or his or her expected contributors, if any.

 

7.         Any other resources, assets or deductions of the individual and his or her expected contributors, if any, that the Minister considers to be relevant in the circumstances.

 

The form (section Q) contains the following consent statement regarding indirect collection of income information about parents:

 

Consent of Parent(s) to the Indirect Collection and Disclosure of Information from Income Tax Returns

 

I authorize the Canada Customs and Revenue Agency to release to the ministry information from my income tax returns and, if applicable, other required taxpayer information about me (“the information”), whether supplied by me or by a third party.  The information will be relevant to, and used solely for the purpose of, the administration and enforcement of [OSAP].  The ministry will not disclose the information to any person or organization except to the applicant or where authorized by or where required by law . . . This consent applies to the 2003 and 2004 taxation years.

 

Section R of the form contains a similar consent relating to partner information.

 

The Ministry states:

 

As noted previously, OSAP is a needs-based program which is income-tested.  In one form or another, verification of the income of students and their parents and spouses has always been an integral part of the administration of OSAP.  On March 1, 2000 same-sex partners became subject to contribute to education costs for the purposes of OSL and subsequently also became subject to income verification.

.  .  .  .  .

 

Once CRA has received the request from [the Ministry], it discloses the following identification and taxpayer information to [the Ministry]:

 

Identification:

 

•           Income verification record identifier

•           Program area code

•           SIN

•           Taxation year

•           Client’s surname

•           Client’s first name

•           Street Address

•           City/province

•           Postal code

•           Birth date

•           Marital status

•           Province of residence as at December 31st

•           Tax services office code

•           Income verification mismatch code

•           Disability transfer code

•           Reassessment flag

•           Reassessment count

•           Match status codes

 

Taxpayer Information:

 

•           Total Income (line 150 on General Income Tax Return for Ontario)

•           Spouse or common-law partner amount (line 303)

•           CPP/QPP contributions (line 308)

•           Employment insurance premiums (line 310)

•           Net federal tax (line 420)

•           Net provincial tax (line 428)

 

Section 13 of O. Reg. 268/01 [under the MTCUA ] requires the Minister to consider a very broad range of factors in determining a student’s financial resources, including the total income from all sources of the student and his or her expected contributors; their personal tax payments and employment insurance and pension plan contributions; the number of individuals that, in the opinion of the Minister, are dependents of the expected contributors; and any other resources, assets or deductions of the individual and his or her expected contributors, if any, that the Minister considers to be relevant in the circumstances.

.  .  .  .  .

 

The complainant has expressed concern that this consent would authorize the disclosure of income tax returns in their entirety to the administrators of OSAP. However, the consent is clearly limited to “information from tax returns and, if applicable, other required taxpayer information about me” that “will be relevant to, and used solely for the purpose of the administration and enforcement of OSAP.  In the overwhelming majority of cases, the only taxpayer information exchanged between [the Ministry] and CRA is the information listed above that comprises the standard income verification transaction.  However, the eligibility for and amount of OSAP to which each individual is entitled is determined having regard to his or her particular circumstances.  The consent is designed to reflect the fact that [the Ministry] may, in rare circumstances, need to ask for other taxpayer information, but only if relevant to the administration and enforcement of OSAP.  For example, if [the Ministry] is conducting an inquiry into a serious misrepresentation of income, [the Ministry] may need to obtain information from CRA.

 

I accept that it is reasonable for the Ministry to require consent of parents and partner to indirectly collect income information beyond a simple income “bottom line” statement.  This is supported, for example, by the regulation under the MTCUA  that indicates that an applicant’s financial resources may be determined on the basis of the applicant’s parents’ or partner’s “personal income tax payments and employment insurance and pension plan contributions” (paragraph 5).

 

Collection after Determination of Ineligibility

 

The complainant states:

 

If an applicant does not qualify for assistance because of deemed “parental responsibility ” or parental income, there should be no further collection of information since the application is immediately disqualified.

 

In response, the Ministry states:

 

The complainant states that if a student is not eligible for OSAP because of the expected parental contribution, there should be no further collection of information, including verification of parental income.  [The Ministry] agrees that if a student is not eligible for OSAP and does not make an appeal, then there is no reason for [it] to collect, use or disclose any personal information of the student and his or her parents or partner.  In the course of its regular review of OSAP operations, [the Ministry] has identified that income verification should not take place where a student is not eligible for OSAP and has not appealed and that a system change is necessary to ensure that income verification cannot be initiated for either ineligible students or their parents or partner.  [The Ministry] is currently developing the necessary system changes.

 

I agree with the position of both the complainant and the Ministry that the Ministry should not continue to collect personal information in these circumstances.  I will address this issue below in my recommendations.

 

Conclusion

 

I agree with the Ministry’s position on the indirect collection of personal information about parents and partner, and I find that section 39(1)(a) applies in this regard, with the exception of indirect collection where OSAP has determined that an applicant is ineligible for assistance.

 

Does the Ministry use personal information in accordance with section 41 of the Act?

 

Discussion

 

Section 41 prohibits an institution from using personal information except in certain circumstances.  Section 41(b) reads:

 

An institution shall not use personal information in its custody or under its control except,

 

for the purpose for which it was obtained or compiled or for a consistent purpose;

 

The complainant is concerned about the Ministry’s use of the applicant’s Social Insurance Number (SIN).  While he accepts that the Ministry should be able to use the SIN for establishing the applicant’s identity and confirming other information provided by the applicant, he believes the Ministry should not use the SIN as a  “universal identifier”:

 

The first field of information captured is the Social Insurance Number.  The reason for collection appears on page 10 and outlines reasons for collection that include:  determination of eligibility, verifying the application, collection and audit.

 

These reasons for collection of the SIN are more or less reasonable given the need to verify the veracity of declared income . . .

 

Because the SIN has a field for completion on each of the twenty pages of the application, it is clear that OSAP uses this as a universal identifier within the program.  In the past, the Privacy Commissioner of Canada ruled that such use of this identifier by banks was a misuse of the SIN.  I would submit that the use of the SIN should be restricted to those on a “need to know” basis and should not appear within the body of the application.

.  .  .  .  .

 

The use of the SIN for all parties should be restricted to the administrative confines for the sole purposes of establishing identity and confirming the veracity of the applicant’s disclosures.

.  .  .  .  .

 

[The] SIN [should] be used only to establish identity and veracity of information. Once collected, the SIN [should] not be available as an identifier within the Program and [should] not be shared to an outside agency unless specifically directed by the individual to whom it pertains.

 

The Ministry states:

 

The use of the SIN is clearly a privacy issue of concern that has been debated for many years.  In 1980, the federal Privacy Commissioner published a “Report of The Privacy Commissioner on the Use of the Social Insurance Number”.  In this report, it was noted that the Secretary of State Department had reported that it used the SIN in three areas, including as a main identifier on computer files for the Canada Student Loans Program.  This use was identified to include extensive data linkage with provincial governments, banks, other local institutions and Revenue Canada in the administration of the program.

 

Because of the importance of the SIN in the operations of the program, the detailed submission of the Secretary of State Department on the use of SIN in the program was quoted in the report.  The submission noted that provincial authorities, eligible educational institutions, lending institutions, federal administration, collection agency offices and the Department of Justice were all players in the administration of the program.  The submission also noted that unique identification of each borrower is essential not only to the administration of the program but for the benefit of the borrowers.  Before 1968 the Secretary of State Department stated that “it had become apparent that the necessary controls could no longer be achieved by using names, birthdates and other traditional identifiers given the volume of loans issued”.  As well, since each province had also established its own student assistance program linked to the Canada Student Loans Program and a unique identifier was needed to ensure proper linkage of the federal and provincial programs, it was decided that the most efficient and effective mechanism for identification was the SIN for both provincial and federal use.  As early as 1970, the mandatory use of SIN for purposes of the Canada Student Loans Program was incorporated into regulation.  At the time of the Privacy Commissioner’s review, the Secretary of State Department argued strongly to retain the authority to use the SIN in the federal and provincial student assistance programs.

 

In 1988, after a review of the increasingly common use of SIN for purposes not originally intended, the federal Treasury Board took steps to restrict the use of SIN.  Permitted uses were only those authorized by statute and those related to the administration of tax, pension and social benefits programs.  Use of the SIN for purposes of the administration of the Canada Student Loan Act (now CSFAA ) was included in the permitted uses of the SIN.

 

Since 1988 there have continued to be concerns about the use of the SIN by the public sector and by the unregulated private sector, but to date use of the SIN in connection with CSFAA  continues to be a permissible use.  Indeed, the fact sheet on Social Insurance Numbers issued by the federal Privacy Commissioner indicates that the CSFAA  is one of the legislated uses of the SIN.

 

In June 2001 HRDC entered into an agreement with MTCU, as an appropriate authority, to verify the SIN of CSL applicants.  The preamble set out that the exchange of personal information between them was “to ensure that information on student borrowers in the Canada Student Loans database is accurate, and for preventing the improper use of SIN in obtaining financial assistance under the Canada Student Loans Program, through the accurate identification of Applicants and Borrowers under the Canada Student Loans Program.”  This verification process, which occurs at the initial stages of an OSAP application, addresses some of the concerns identified in the 1998 Report of the Auditor General about the completeness and accuracy of the SIN database. ()

 

[The Ministry] is authorized to collect the SIN in the administration of OSAP by express statutory authority, in accordance with s. 38(2) of [the Act].  The express legal authority for [the Ministry] (as an appropriate authority under the CSFAA ) to collect the SIN is found in s. 12(3)  of the CSFAA  which requires a certificate of eligibility issued by an appropriate authority to set out “the social insurance number of the qualifying student”.  In addition, the CSFAA Regulations require the inclusion of the SIN on various forms.

 

In addition, [the Ministry] collects the SIN of students . . . because it is necessary to the proper administration of OSAP, which is a lawfully authorized activity in accordance with s. 38(2) of [the Act].

 

The complainant also takes issue with the use of the SIN on each page of the paper application.  As noted earlier, the vast majority of students apply on-line and only provide their SIN once.  Approximately 8% of students filed a paper application in 2003-04.  In administering OSAP, [the Ministry] scans each paper application onto its system so that it can be accessed electronically.  To conduct this scan, the application form is taken from the booklet and the pages are separated.  To ensure that each application form is fully scanned for the appropriate individual, the SIN is noted at the top of each page.  [The Ministry] submits that this use of the SIN is necessary to the proper administration of OSAP as set out in the s. 39(2) notice provided to students and as authorized under s. 41(b) of [the Act].

.  .  .  .  .

 

The use of the SIN in the administration of CSL is required by statute and regulation.  As CSL and OSL are harmonized programs, the use of the SIN in the administration of OSAP is not only required but of benefit to the students who receive OSAP.  As the administration of OSAP includes more than the establishing of a student's identity and the verification of their income, [the Ministry] does not agree that the use of the SIN should be limited as the complainant suggests.

 

[emphasis added]

 

The Ministry collects the applicant’s SIN for the general purpose of administering the provincial OSL program, as well as the federal CSL program on behalf of the federal government.  More specifically, the Ministry collects the SIN (among other things) to verify the identity of applicants and ensure the accuracy of their information.  These purposes are made clear in the Ministry’s notices of collection and use in the OSAP form.

 

In addition, the Ministry collects the applicant’s SIN to use it as a general identifier in administering OSAP, but does not make this clear in its OSAP form notices.

 

The CSFAA  states that where the Ministry decides that a student qualifies for assistance, it will issue a certificate of eligibility that must include the student’s name together with his or her SIN (section 12).

 

In addition, the Canada Student Financial Assistance Regulations (SOR/95-329) under the CSFAA  require that various student loan documents must include both the student’s name as well as his or her SIN (student loan agreement, confirmation of enrolment, consolidated direct loan agreement, consolidated risk-shared loan agreement, direct student loan agreement, full-time direct student loan agreement, and full-time risk shared loan agreement).

 

In my view, through legislation and regulation, Parliament has entrenched the use of the SIN as an identifier for the purpose of administering student loan programs.  The Ministry has been designated by the federal government to administer federal student loan programs on its behalf.  Therefore, the Ministry clearly needs to collect the SIN for the purpose of using it as an identifier in the context of administering student loans on the federal government’s behalf.  Also, I accept the Ministry’s submission that it is necessary to collect and use the SIN as an identifier in the context of the provincial program, to ensure accuracy and efficiency in administering both levels of programs.  In my view, requiring the Ministry to adopt another method of identification would unduly hamper the administration of the program.

 

As I indicated above, the Ministry does not explicitly state in its OSAP form notices that it collects the applicant’s SIN for the purpose of using it as a general identifier in the program, but should do so.  I will address this issue in my recommendations below.

 

Conclusion

 

Based on the above, I conclude that in using the SIN as an identifier for OSAP, the Ministry is using that information for the purpose for which it was obtained or compiled under section 41(b) of the Act.

 

Does the Ministry disclose personal information in accordance with section 42 of the Act?

 

Introduction

 

Section 42 prohibits an institution from disclosing personal information except in certain circumstances.  Sections 42(b), (c) and (e) read:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(b)        where the person to whom the personal information relates has identified that information in particular and consented to its disclosure;

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(e)        for the purpose of complying with an Act of the Legislature or an Act of Parliament or a treaty, agreement or arrangement thereunder;

 

The complainant is concerned about the degree of the Ministry’s disclosure of personal information about the applicant, parents and partner.

 

Applicant’s information

 

Discussion

 

The complainant submits:

 

In addition to the risk of identity theft, I believe the forced disclosure [of the SIN] to banks creates a use for the identifier that is inconsistent with the purposes of the Program.  It is entirely possible to deal with Canadian banks and never disclose one’s SIN as I have personally done over almost thirty years of professional practice.

.  .  .  .  .

 

Specific questions are asked regarding the health of the applicant.  The fields include disclosure of permanent disability and hearing impairment.  Although this scope of collection may have a valid purpose that can be defended by the goals of the Programme, disclosure to an outside agency - especially a bank may prejudice the ability of the applicant to secure loans in the future.  There is no reason for this information to be shared.

 

If OSAP insists on collecting information relating to health and disability, its sharing should be curtailed.

 

The complainant also states that the consents to disclosure of the applicant’s personal information contained in the OSAP form is unreasonably vague and broad to be considered valid under section 42(b).

 

The Ministry responds to the complainant’s concerns about disclosure of the SIN as follows:

 

The complainant also has concerns that disclosure of SINs to banks creates a use that is inconsistent with the purposes of OSAP.  Banks have not been involved in direct lending for either CSL since August 1, 2000 or OSL since August 1, 2001. However, prior to that time they were principal partners in the delivery of these programs and they continue to administer older loans.  Their use of the SIN was permissible for . . . them to fulfil their role in the administration of OSAP which was to advance the loan, collect interest payments from HRDC and [the Ministry], manage the loan during any period of interruption by the student, consolidate the loans, manage the repayment of the loans, administer any interest relief requested, participate in any bankruptcy proceedings related to the loan and, where necessary, call on the government guarantee where the student defaulted on repayment.  These activities are authorized under Regulation 774 made under the MTCUA .  For the reasons more fully documented by the Secretary of State Department, the banks need the SIN to properly administer OSAP.  [The Ministry] submits that this disclosure of the SIN is necessary to the proper administration of OSAP as set out in the s. 39(2) notices provided to students and is authorized under s. 42(c) of [the Act].  [The Ministry] also submits that this disclosure is also permitted by the consent on the OSAP application form and is authorized under s. 42(b) of [the Act].

 

The Ministry also states, with respect to health information of applicants:

 

The complainant expressed concern that the information collected in questions 165 and 166 of the 2003-04 OSAP application form may be shared more widely than necessary and, in particular, may be shared with banks.

 

Question 165 asks if the student has a permanent disability and refers the student to page 5 of the instructions for an explanation of the question.  The instructions provide the definition of permanent disability and explain that a disabled student is entitled to be considered a full-time student if he or she takes 40-59% of a full course load.  Students who do not have a permanent disability are required to take 60% of a full course load to be eligible for OSAP.  These requirements are set out in s. 9 of O. Reg. 268/01 [under the MTCUA ].  The Instructions and the Information Guide provide additional information, including an explanation that [the Ministry] requires documentation of the disability.

 

Question 166 asks if the student is deaf, deafened, or hard-of-hearing and planning to attend a post-secondary institution outside Canada and refers the student to page 8 of the instructions for an explanation of the question.  The instructions advise the student that they can obtain further information on assistance available to deaf students by accessing an OSAP Application Guide for Deaf Students, accessing the OSAP web-site or contacting [the Ministry]. Although OSL is not generally available to Ontario students studying outside Canada, an exception is made for deaf, deafened, or hard-of-hearing students who study at Gallaudet University or National Technical Institute for the Deaf in the United States, both of which offer postsecondary education services for such students that are not available in Canada.

 

[The Ministry] collects the personal information from both of these questions because it is necessary to the proper administration of a lawfully authorized activity, in accordance with s. 38(2) of [the Act].  In accordance with the s. 39(2) notice provided and the consent, [the Ministry] uses this information when necessary to administer OSAP.  This includes verifying and auditing the student’s entitlement to and amount of OSAP and also auditing the administration of OSAP by or on behalf of the student’s educational institution and the [NSLSC].  [The Ministry] uses this personal information in accordance with ss. 41(a) and (b) of [the Act].

 

In the ordinary course of administering OSAP, only HRDC and the student’s financial aid office would have access to the questions about disability on the OSAP application form.  HRDC has access to this information as the funder of CSL and other OSAP programs designed to benefit students with disabilities.  In addition, Annex 6 of the Harmonization Agreement between [the Ministry] and HRDC provides for the exchange of personal information about disability and the amount of Canada Study Grant - Students with Disabilities on a per borrower basis.  The financial aid office has responsibility for direct dealing with the student about OSAP and needs the information to be able to explain the assistance available and the obligations regarding documentation of the disability and maintaining full-time student status in order to maintain eligibility for OSAP. [The Ministry] . . . is authorized to disclose this personal information to HRDC and the financial aid offices in accordance with ss. 42(c) and (e) and also in accordance with s. 42(b) of [the Act].

 

In the ordinary course of administering OSAP, information about a student’s disability is not disclosed to any of the other partners involved in the administration of OSAP, including banks.  The chartered banks that made guaranteed loans to students until July 31, 2001 did not receive copies of students’ OSAP applications.  In 2003-04, Canada made direct loans under CSL and the Ontario Student Loan Trust made guaranteed loans under OSL.  The Deed of Trust dated July 9, 2001 expressly provides that the Trust does not have any right to any personal information of OSAP applicants and that the Trust shall make loans without a right to any such information.

 

In some cases, [the Ministry] may have to conduct a more detailed investigation or audit into the circumstances of a student’s application for and receipt of OSAP. In cases involving assistance provided to a disabled student, [the Ministry] may have to disclose the fact that the student had declared himself or herself to be disabled and to indirectly collect information from any of the partners involved in the administration of OSAP, e.g. the student’s financial aid office.  [The Ministry] will only disclose this personal information if it is necessary to the proper administration of OSAP and is authorized to do so under ss. 42(b) and (c) of [the Act].  [The Ministry] is authorized to collect personal information in the course of such investigations or audits in accordance with s. 39(1)(a) and (b) of [the Act].

 

Also, to ensure proper stewardship of public money and proper administration of a public program, [the Ministry] audits the administration of OSAP by the financial aid offices and HRDC audits the administration of OSAP by the [NSLSC].  Such audits, which can be conducted by ministry or HRDC staff or by auditors retained by [the Ministry], HRDC or the financial aid offices, necessarily involve a review of student OSAP files.  Auditors retained by or on behalf of [the Ministry] are required to sign confidentiality agreements based on the on the research agreement set out in Regulation 460 made under [the Act].  [The Ministry] is authorized to disclose personal information in these circumstances under ss. 42(b) and (c) of [the Act] and to collect personal information in accordance with s. 39(1)(a) and (b) of [the Act].

 

For essentially the same reasons as set out above under the indirect collection issue, I find that the consent in the OSAP form to disclose personal information is reasonably specific to permit disclosure of the SIN under section 42(b) of the Act.

 

With regard to health information of applicants, I accept the Ministry’s explanation that in the ordinary course of administering OSAP, the Ministry discloses this information only to HRDC and the financial aid office of the student’s educational institution, and not banks as suggested by the complainant.  I also accept the Ministry’s submission that the consent on the OSAP form to disclosure of personal information is sufficient to permit routine disclosure of health information to HRDC and financial aid offices for the purpose of administering loans.  I also accept the Ministry’s position that in the context of an audit, the Ministry may disclose health information to an auditor and that the consent to disclosure on the OSAP form is sufficient to allow this disclosure under section 42(b).

 

The complainant maintains that, in the consent, the Ministry should describe in detail the limitations it places on its disclosure of particular types of information, including health and relationship information.  As I stated above, I do not find it reasonable to expect the Ministry to set out in detail a concise and complete list of what specific information may be disclosed, under what circumstances disclosure may take place, and to whom.  Again, I find the Ministry’s description of the purposes for which information may be disclosed in the consent to be reasonably specific.

 

Conclusion

 

I conclude that the Ministry discloses the applicant’s SIN and health information in accordance with section 42(b) of the Act.

 

Parents’ and Partner’s Information

 

Discussion

 

The complainant submits:

 

Item 210 invites the applicant to declare any common law or same sex conjugal relationship whereby co-habitation is included.  Again, the consent to share information of this nature is entirely inappropriate.  If the program can make a case for such a collection, then it should be clearly protected.

 

Disclosures of this nature may harm future employment or social potential of an applicant.  Sharing with financial institutions or “any person” is entirely inappropriate.

.  .  .  .  .

 

. . . [S]haring of information about the parents creates problems for me as a parent.

 

. . . As a parent who is about to disclose some of my most personal information, I find it appalling that the Programme would declare the right to “collect and share information about me with any government, or branch of government, or any person.”

.  .  .  .  .

 

The sharing of identifiers such as the SIN has no right in this program.  If my son were to accept assistance, I see no reason why my SIN would be shared to any government agency or any person.

.  .  .  .  .

 

[Page 17] outlines similar obligations on the part of the partner.  Again, the mandate being sought for collection and sharing is incompatible with contemporary standards.

 

The complainant points out that while it may be reasonable for the Ministry to disclose parent information for purposes of determining applicant eligibility, there should be no need for the Ministry to disclose this information for other purposes, particularly to collection agencies and credit reporting agencies.

 

The Ministry explains why it collects information relating to whether the applicant is in a common law or same sex relationship:

 

The complainant expressed concern about the collection and disclosure of information collected under question 210 on the 2003-04 OSAP application form about whether a student is in a common-law or same-sex relationship.

 

As noted in the section dealing with income tax verification, this question is relevant to the determination of an individual’s financial resources as required under O. Reg. 268/01.  In addition to the sections previously cited, paragraph 3 of s. 13(2) of O. Reg. 268/01 requires the Minister to have regard to the assets of the student and his or her same-sex partner in determining the student’s financial resources.  Question 210 advises the student that his or her partner must complete sections M and R of the application and that they are required to provide an affidavit confirming their same-sex relationship in accordance with the definition set out in s. 2 of O. Reg. 268/01.  [The Ministry] has the authority to collect the information under s. 38(2) of [the Act].

 

The Ministry’s submissions with regard to the subsequent disclosure of this personal information are very similar in nature to its submissions regarding the applicant’s health information.  The Ministry states that in the ordinary course of administering OSAP, the Ministry discloses this information only to HRDC and the financial aid office of the student’s educational institution, and not banks, for the purpose of administering loans.  In addition, in the context of an audit, the Ministry may disclose this information to an auditor.  I accept the Ministry’s position that its disclosure of this information about the applicant and the partner is permitted under section 42(b), for essentially the same reasons as set out above regarding the applicant’s health information.

 

The complainant submits that he is concerned that the Ministry states that it may “collect and share information about [parents and partner] with any government, or branch of government, or any person.”  The current OSAP application form does not contain this language, and the revised collection and disclosure statements are more restrictive, referring specifically to the agencies and organizations to which parent information may be disclosed.  Therefore, I am satisfied that the consent to disclosure of parent information is sufficient for the application of section 42(b).

 

In addition, I am persuaded that the Ministry may rely on the consent of the parent to disclose the parent’s SIN under section 42(b), since the consent is not unreasonably broad.

 

With respect to disclosure of parents’ information to collection agencies, the Ministry submits:

 

The complainant expressed particular concern about the prospect that personal information about parents may be disclosed to collection agencies.  Under the Service Level Agreement, [the Ministry] does not disclose any personal information to the private sector collection service providers in the standard information provided on setting up a new account.  If the basic information is sufficient to permit a private sector collection service provider to contact the debtor, then no further personal information is provided by [the Ministry].  In individual cases where the debtor cannot be located, [the Ministry] may provide the address of the parent because that information might be relevant to the collection of the debt.  [The Ministry] does not provide any other information about parents as it would not be relevant to the collection of the debt.

 

I am satisfied that the Ministry has a valid purpose in disclosing this limited parent information to collection agencies and consumer reporting agencies and, therefore the Ministry may rely on the consent of the parent under section 42(b).

 

The Ministry has advised that it does not, in fact, disclose parents’ information to consumer reporting agencies.  The Ministry has also advised that it intends to omit the reference to these agencies from the parents’ consent to the indirect collection and disclosure portion of the application form (section Q).

 

Conclusion

 

The Ministry’s disclosure of information about parents and partner is permitted under section 42(b) of the Act.

 

Other matters

 

As indicated above, the complainant raised a general concern relating to the security of personal information held by OSAP offices located at colleges and universities.  The complainant states that the OSAP offices’ security practices “may be worthy of a privacy and confidentiality audit”.

 

In the absence of more specific concerns relating to security, I am not satisfied that there is a reasonable basis for this office to conduct an investigation into this matter.

 

CONCLUSIONS:

 

1.         The information in question is “personal information” as defined in section 2(1) of the Act.

 

2.         The Ministry’s indirect collection of personal information of applicants is permitted under section 39(1)(a) of the Act.

 

3.         The Ministry’s indirect collection of personal information about parents and partner is permitted under section 39(1)(a) of the Act, with the exception of indirect collection where OSAP has determined that an applicant is ineligible for assistance.

 

4.         The Ministry’s use of the SIN as an identifier for OSAP is permitted under section 41(b) of the Act.

 

5.         The Ministry’s disclosure of the applicant’s SIN and health information is permitted under section 42(b) of the Act.

 

6.         The Ministry’s disclosure of information about parents and partner is permitted under section 42(b) of the Act.

 

RECOMMENDATIONS:

 

1.         As outlined above, the Ministry agrees that if a student is not eligible for OSAP and does not make an appeal, then there is no reason for it to collect, use or disclose any personal information of the student and his or her parents or partner.  Also, the Ministry has advised that a system change is necessary to ensure that income verification cannot be initiated for either ineligible students or their parents or partner, and that it is currently developing the necessary system changes. 

 

In view of this and my findings above, I recommend that the Ministry complete the necessary system changes to ensure that it does not collect, use or disclose personal information once it determines that a student is not eligible for OSAP and any appeal is resolved.

2.         As I indicated above, the Ministry does not explicitly state in its OSAP form notices that it collects the applicant’s SIN for the purpose of using it as a general identifier in administering OSAP.   I recommend that the Ministry amend its notices to include this use.

 

3.         As indicated above, the Ministry has advised that it intends to omit the reference to consumer reporting agencies from the parents’ consent to the indirect collection and disclosure portion of the OSAP application form (section Q), and I recommend that the Ministry do so.

 

By June 24, 2005, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

Original signed by:                                                                              March 24, 2005

Leslie McIntyre Investigator