VERIFYING THE IDENTITY

OF AN APPLICANT

Ministry of Justice
Access and Privacy Branch

Telephone: (306) 798-0222

Email: accessprivacyjustice@gov.sk.ca

September 2017
 2

VERIFYING THE IDENTITY OF AN APPLICANT

PURPOSE

This document provides guidance on establishing the identity of an applicant when they submit
an access to information request for personal information as defined at section 24 of The
Freedom of Information and Protection of Privacy Act (the Act).

Records containing personal information may be very sensitive in nature, so care must be taken
to ensure that proper safeguards are in place when these types of records are released.
Government institutions must also be aware of their obligations under section 29 of the Act to
ensure that personal information is disclosed with proper authority. When providing an
applicant with access to personal information, a government institution must be satisfied that
the individual receiving the information is indeed the individual the information is about or a
duly appointed representative of that person.

WHAT TYPES OF REQUESTS DOES THIS PERTAIN TO?

The identity of the applicant must be verified when an access to information request is for
personal information; requests for general, non-personal information do not require
verification of the applicant’s identity. The list of personal information that is captured under
section 24 of the Act is broad but non-exhaustive, so government institutions should err on the
side of caution when processing access to information requests that may involve personal
information. A key factor in determining whether something is personal information or not
under the Act is whether the information can be used to identify the person or persons it deals
with.

Examples of personal information requests include access to records from a personnel file
relating to a harassment complaint, information in an inmate file from a correctional facility, a
client file from a particular program or service area or other information which is of a personal
sensitive nature. When an applicant is seeking their own personal information, their identity
should be confirmed as soon as possible.

The applicant’s identity should also be confirmed when they are seeking personal information
about someone other than themselves. For example, this could be the case when the applicant
has an advocate acting on their behalf. In these circumstances, the government institution
should ask for a copy of the consent of the subject individual prior to processing the request.

When an Access to Information Request is submitted by an applicant who is acting on behalf of

the individual to whom the information relates, it is critical to establish that the applicant has
the authority to act for the other person. This authority can be established by providing a
Power of Attorney, proof of guardianship or consent for disclosure signed by the person to
whom the records relate. A template consent for release form is included as Appendix A.
Ideally, this documentation should be provided when the Access to Information Request is
submitted; if it is not provided at that time, it should be collected by the government institution
as soon as possible.
 3

VERIFYING IDENTITY BEFORE RELEASING RECORDS

Government institutions must take reasonable steps to verify the identity of the applicant
before personal information is released to them. In order for government institutions to meet
their obligations to protect personal information, applicants must be able to prove that they are
who they say they are before personal information is released to them.

Whenever possible, records containing personal information should be picked up in person by

the applicant; this allows for the surest verification. It will, however, not always be possible for
applicants to present themselves in person to receive responsive records. When records are to
be sent to applicants either through standard mail or electronically, reasonable steps must be
taken to ensure that the records are adequately protected and the applicant’s identity is
verified. It is not recommended that government institutions release records containing
personal information if they are not reasonably able to confirm the applicant’s identity.

When an applicant is receiving records in person, two pieces of identification should be viewed
before the records are released. Whenever possible, identification documents should be valid
originals and not copies of documents. The primary piece of identification should be some
form of government issued photo identification such as a driver’s license, passport or
immigration documents. Secondary identification documents do not require a photo. A birth
certificate, credit card or other similar documents may be accepted as a secondary
identification document.

In person, identity verification is straightforward. Ask for the identification documents and
check to make sure the documents are legitimate and current. With photo identification, check
that the person presenting the identification matches the person in the photo (i.e. hair is the
same color and they appear the same general age as the document indicates).

Verifying the identity of an applicant who does not present themselves in person is more
difficult. Prior to mailing or emailing records to an applicant, reasonable efforts must be made
to verify the applicant’s identity. You may have to rely on information provided in the access to
information request, such as proper spelling of name, correct address and postal code.
Whenever possible, speak to the applicant to verify this information. If an applicant cannot be
spoken to in person, government institutions should proceed with caution in releasing records
containing personal information.

There may be times when the applicant will not be able to pick up records and will have
someone else do that for them. In this case, Appendix A can be sent to the applicant to
complete and return. This document will allow the person they authorize to act on their behalf
to pick up the records.

It is not necessary or recommended to retain a copy of any identification documents for your
file. If this information is collected, then it must be properly protected and retained according
to institutional policies. A note should be made to the file indicating that the identification of
the applicant was viewed. The note should specify what pieces of identification were viewed;
however, the actual registration numbers of the identification should not be recorded.
 4

APPLICANTS PICKING UP RESPONSIVE RECORDS

Applicants should be advised in advance that their identity will be verified before records are
released to them. Attached, as Appendix B, is a sample letter that can be used for this purpose.

If the applicant is picking up records in person, they should be accommodated (where possible)
by providing the records from a branch office of your government institution that is near them.

Attached, as Appendix C, is a document that may be completed and placed on your file as proof
that the applicant’s identity has been verified.

MAILING RESPONSIVE RECORDS TO THE APPLICANT

When responding to an applicant by mail, extra precautions such as a double envelope system
should be considered. The envelope, both outer and inner if using a double envelope system,
should be marked “personal and confidential”. An additional step is to use tape to ensure the
envelope is adequately sealed, rather than relying on the glue on the envelope. When sending
sensitive personal information by mail, government institutions should consider using
registered mail or other guaranteed delivery services. The applicant should be contacted when
the package has been sent so that they will have an idea of the approximate date of delivery.

EMAILING RECORDS TO THE APPLICANT

Care must be taken when emailing personal information. Applicants should be advised of
security concerns related to emails and should provide written confirmation that they wish for
the information to be provided to them in this format.

When personal information is being sent by email, use the email address specifically provided
by the applicant for this purpose. Be sure to double check that you have entered the correct
email address before the email is sent. Included with the email should be a confidentiality
notice instructing recipients on the steps they must take if they are not the intended recipients,
such as notifying the sender, deleting the email and not retaining any copies. Personal
information should be sent in an encrypted password protected format; the password should
be sent in a separate email. It is recommended that you contact the applicant to ensure they
have received the email.
 5

APPENDIX A – SAMPLE REPRESENTATIVE CONSENT FORM

I, ____________________________________________________ [Applicant’s Name], confirm

that I authorize

______________________________________________ [Name of Representative]

to act as my representative and to exercise the rights granted to me by The Freedom of

Information and Protection of Privacy Act on my behalf.

I consent to [Government Institution] releasing records containing my personal information to

my representative.

This consent will be in effect until ____________________________________.

____________________________________ Applicant’s signature

____________________________________ Witness Signature

____________________________________ Date
 6

APPENDIX B - SAMPLE LETTER TO THE APPLICANT

[Date]

[Name of Applicant]
[Address]

Dear [Name of Applicant]:

RE: Your Access to Information Request Number [Application Number]

The [name of government institution] received your Access to Information Request for personal
information under The Freedom of Information and Protection of Privacy Act on [date request received]
and is now ready to release the requested records to you. Please contact [name of person the applicant
should contact to make arrangements for
pick-up ] at [telephone number] to make arrangements to pick up the records.

As your request relates to personal information, you will be required to personally pick up your records
and provide two pieces of identification before the records will be released to you. You will be advised
of the location when you contact our office. The first piece of identification must be original, valid photo
identification and come from the Primary ID list below. The second piece of identification can be any
one of the items listed in the Secondary ID list below:

PRIMARY ID
• Driver’s license
• Passport
• Canadian Citizenship Card
• Permanent Resident Card
• Canadian Record of Landing/Canadian
Immigration Identification Record
SECONDARY ID
• Birth certificate
• School ID card (student card)
• Bank or credit card (only if applicant's
name is on card)
• Vehicle registration (only if applicant's
signature is shown)
• Picture employee ID card
• Other documents which would be
considered acceptable identification for
cheque cashing purposes at banks or other
financial institutions

If you have any questions regarding release of the requested records, please contact [name of Access
Co-ordinator], [proper title of Access Co-ordinator], at [insert their telephone number]. We look forward
to hearing from you at your earliest convenience.

Sincerely,

[Name of Access Officer]

cc: [Access Co-ordinator]

 7

APPENDIX C - VERIFICATION OF APPLICANT’S IDENTITY

[Name of Government Institution]

Access to Information Request Number: _________________

Applicant

I, _____________________________________, acknowledge receipt of the records pertaining to the

above Access to Information Request.

__________________________________
[Applicant’s Name]

Government Representative

I, _____________________________________, confirm that the Applicant has provided the following

identification to confirm his/her identity.

Primary identification provided:

Driver’s license
Passport
Citizenship documents
Immigration documents

Secondary identification provided:

Birth certificate
Credit card
Other: ________________________________________

________________________________ ___________________________________
[Government Representative’s Name] Date