The directive itself provides that institutions must restrict that use in accordance with their mandate. Our website provides a list of statutory reasons for which social insurance numbers can be used, as well as the programs that are authorized.
On May 1st, 2008. See this statement in context.