Canada has same federal law also...use of our Canadian Social Insurance No. (SIN) is under very restricted purposes. Our federal govn't websites gives clear guidance to all Canadians on restricted use/provision of SIN. There are provincial adjudicative/court-related bodies which will receive and hear cases of violations of personal information such as SIN, medical, etc.

For any health care provider in Canada, each Canadian has their home provincial government health care card no. That card...eventually is tied to SIN because application process for card requires SIN (or 1-2 other legislated pieces of federal I.D., ie. most likely passport or Canadian residency card). Our Medicare health insurance system requires one gives the health care card no. ..to initiate patient care/appointments. Not the SIN.

Any conscientious human resources dept. or company never asks for SIN by email. The risk is too great..especially when computer server memory is backed up for storage.