The Office of the Privacy Commissioner of Canada ('OPC') issued, on 4 August 2020, its report of findings ('the Findings') following its investigation into a complaint of TD Canada Trusts' decision to outsource the processing of fraud claims to a third-party service provider. In particular, the Findings note that the complaint highlighted TD's decision to outsource aspects of its fraud claims processing services to a third-party service provider in India and that TD did not obtain consent for, or allow customers to opt-out of, the transfer of personal information to a service provider in a foreign jurisdiction. 

In this respect, the Findings outline that the third-party service provider was using TD customers' information to manage fraud claims for TD and that TD was not required to obtain separate consent for or to provide customers the choice to opt-out of, the transfer of personal information to the third-party service provider for that same purpose. In addition, the Findings highlight that TD was sufficiently open about this transfer, provided customers with information pertaining to its transfers, and also made this information available through its privacy resources, as well as had been accountable with respect to the information it transferred and ensured a comparable level of protection for that information. As such, the Findings conclude that the complaint was not well-founded and that TD had met its requirements under Canada's federal private sector privacy legislation.

You can read the press release here and the Findings here.