On August 4, 2020, the Office of the Privacy Commissioner of
Canada (OPC) released a set of findings1 concerning a
decision by TD Canada Trust (TD) to outsource its processing of
fraud claims to a third-party service provider located in India.
The findings are notable because they represent a departure from
recent commentary by the OPC on a possible requirement to obtain
consent for outsourcing of personal information processing and a
return to the OPC's long-standing position on this issue.
Background
As we reported in a previous articles (on
April 16, 2019;
June 12, 2019; and
September 24, 2019), the OPC surprised many in the business
community by announcing a consultation on transborder data flows
that proposed a potential requirement to obtain consent of data
subjects to the outsourcing their personal information to third
party service providers. Prior to this consultation, the OPC's
guidance concerning the "Accountability" principle in the
Personal
