Privacy Commissioner investigation reports
In 2020, the Privacy Commissioner of Canada issued two
investigation reports that provide guidance regarding outsourcing
arrangements involving the processing of sensitive personal
information.
Report of Findings #2020-001 – Financial Institution
Fraud Claims Processing
The Privacy Commissioner of Canada investigated a financial
institution s outsourcing of aspects of its fraud claims
processing to a service provider in India. The investigation
resulted from a complaint by a former employee of the financial
institution. The service provider had access to large amounts of
sensitive personal information about the financial
institution s customers. The Privacy
Commissioner s Report concluded that the financial
institution had satisfied its accountability obligations because