Office of the Saskatchewan Information and Privacy Commissioner. Guide to LA FOIP, Chapter3, Access to Records. Updated 5 May 2023. 9 Verifying Identity Local authorities should verify the identity of an applicant before giving the applicant access to the applicant’s own personal information, especially if the information is sensitive.12 Subsection 30(1)(b) of LA FOIP also requires that access to one’s own personal information will be provided upon giving sufficient proof of his or her identity. Authentication is the process of proving or ensuring that someone is who they purport to be. Authentication typically relies on one or more of the following: • Something you know (e.g., password, security question, PIN, mother’s maiden name). • Something you have (e.g., smart card, key, hardware token). • Something you are (e.g., biometric data, such as fingerprints, iris scans, voice patterns).13 In some cases, one of these factors may be used alone to authenticate an individual. For others, combinations may be used. There are multiple ways to confirm the identity of the applicant. The degree of authentication should be appropriate to the sensitivity of the personal information involved. Social Insurance Numbers Local authorities should be careful not to collect information beyond that required to fulfill the purpose to comply with section 24 of LA FOIP and the data minimization principle. Identification purposes are not in themselves considered a legitimate basis for requiring an individual to provide a social insurance number. If a social insurance number is being requested for identification purposes only, the local authority must not in any way suggest that the social insurance number is required as a condition for providing records or services. Even where it is reasonable to ask an applicant for proof of identity, a request for a social insurance number must be presented and treated as optional. In verifying identity, a local 12 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 3 at p. 89. 13 Service Alberta, Bulletin #17, Consent and Authentication at p. 2.
RkJQdWJsaXNoZXIy MTgwMjYzOA==