In March, the Superior Court of Quebec rendered a landmark judgement dismissing a class action for the loss of personal information. The decision is the first in Canada to dismiss such a suit on its merits.
In Lamoureux v. OCRCVM, Justice Florence Lucas dismissed the action filed by plaintiff Danny Lamoureux in its entirety. The case concerned a February 2013 incident in which an Investment Industry Regulatory Organization of Canada inspector left his laptop computer on a train. The device was never recovered and contained personal information collected from securities brokers relating to individuals under inspection.
Investor Paul Sofio filed an initial application for authorization to institute a class action against the IIROC. Quebec’s superior court rejected the application, finding a prima facie absence of compensable harm.
Despite this and the Court of Appeal’s refusal to review the judgment, another investor, Lamoureux, filed a new application, pleading the theft of his personal information had victimized him. The superior court authorized that class action in 2017.
In dismissing Lamoureux’s suit, the superior court found the worry and inconvenience suffered by class members were akin to normal inconvenience, and there was no evidence of unlawful use of the lost information. It also noted that the IIROC had quickly reacted by implementing appropriate measures to address the incident and notify the investors. The court, therefore, dismissed the request for punitive damages.
The decision emphasizes that in class action and privacy cases, the harm must be serious enough to give rise to compensation. The prejudice resulting from the mere occurrence of a cybersecurity incident is insufficient for compensation. The case also demonstrates how privacy issues, among others, are rising in the class action area.
“I’ve seen a lot of developments in privacy class actions,” says Lara Jackson, a litigator at Cassels Brock & Blackwell LLP in Toronto, adding that the Lamoureux decision provides “some important guidance … to companies on what actually constitutes private information and compensable harm, and how the company’s response to data breaches can be factored into the court’s consideration of the merits.”
Lamoureux established and followed some earlier jurisprudence on preliminary motions, “but this was on the merits,” says Jackson. “It confirmed that injury beyond general inconveniences has to be proven for privacy class actions, and that normal inconvenience, such as the fears and stress experienced by class members, or delays in obtaining additional credit, are considered to be acceptable inconveniences and not giving rise to compensable damages.”
Litigators have anticipated privacy as “a growth area,” says David Sterns, a class actions lawyer at Sotos LLP in Toronto. “I think we’re all waiting to see what will happen with privacy cases.”
One case that may point the way forward is the Equifax case, Sterns says. The U.S.-based credit reporting agency suffered a massive data breach in September 2017, leading to class-action lawsuits in the United States and Canada.
“The evidence was pretty shocking as to how bad their systems were, and how easy it was for them to be hacked, how many warnings they’d received,” he says. A class-action lawsuit was brought in Canada — under the newish common law tort of intrusion upon seclusion — and was certified. On appeal, however, Ontario’s Divisional Court ruled in June that since “Equifax did not do the hacking,” it was not liable for intrusion upon seclusion.
Learn more on how to start a class action lawsuit in Canada in this article.
The Equifax decision marked the first time an appellate court had considered the scope of the intrusion upon seclusion tort since Ontario’s Court of Appeal first recognized it as a cause of action in Jones v. Tsige in 2012.
There was “a very strong dissent” from Justice Harriet Sachs, Sterns says, and he and his fellow counsel are seeking to appeal the decision to the Ontario Court of Appeal. “But I think that might put a chill on privacy class actions if it’s not overturned. … We certainly believed that in the right case — and Equifax is the right case — there should be liability for reckless data security by a company in cases where it’s very foreseeable that they could be subjected to a hack.”
Privacy and data issues have been a burgeoning area of plaintiff issues and class actions for years, says Lenczner Slaght LLP’s Paul-Erik Veel, but now they are being scrutinized by governments and regulators.
“The reality is, when we live in a big data world, things will go wrong. There will be data breaches. There will be circumstances where appropriate consent wasn’t obtained. And I think those cases are going to be increasingly common.”
As new technological platforms evolve, there will be more legal challenges arising from those, Veel predicts. For businesses that can scale up very quickly and “gain billions of users virtually overnight, … those very same attributes that make those businesses so scalable and profitable” also opens them to significant risk when there is an impact of harm to potentially millions of people when something goes wrong with that technology or platform.
Ranjan Agarwal identifies three main “buckets” of risk: consumer/competition class actions, employment class actions, and equity, diversity and harassment class actions.
As a society more focussed on consumerism, “we buy on the internet and transact on our phones,” which offers more opportunities for violations of consumer protection or competition law that result in class actions, says the Bennett Jones LLP partner.
Second, Agarwal anticipates a continuing rise in employment class actions resulting from changes in the workforce, including an even greater rise in the so-called gig economy, which places novel pressures on employers and employees. Agarwal cites the Uber case; in August, the Ontario Superior Court of Justice certified a class-action lawsuit against the San Francisco-based technology giant. Uber drivers in the class argue they are entitled to minimum wage, vacation pay and other protections because they say they meet the definition of employees under Ontario’s Employment Standards Act.
(Uber has been fighting the proposed $400-million class proceeding brought by Ontario driver David Heller since he started it in 2017. In June 2020, the Supreme Court of Canada dismissed the appeal brought by Uber to stay the class proceeding in favour of arbitration in the Netherlands.)
“If people move away from a traditional employer-employee relationship, but believe that they should be still subject, for example, to the minimum” provided under Employment Standards legislation, “I think that is an area that ends up being ripe for class actions,” says Agarwal.
The third area concerns equity, diversity and harassment, with more “#MeToo” class actions anticipated for sexual harassment. As that “movement matures, and there is more of a focus on diverse workplaces, and racism in workplaces or in institutions, … I think we’re going to see more class actions that make allegations about institutional abuse or harassment.”
Jackson also predicts an increase in ESG issues. “I think some of those will give rise to securities class actions against public issuers in their disclosure of their ESG policies versus allegations of what’s happening.”
COVID’s long reach
In September, Ontario’s Superior Court of Justice fully certified a $300-million Canada-wide class action against Aviva Insurance Company of Canada on behalf of policyholders who suffered substantial business interruption losses due to the COVID-19 pandemic. Around 28,000 small and large businesses had bought Aviva policies which provided coverage for business losses caused by an “outbreak of a contagious or infectious disease” within 25 kilometres of the policyholder’s premises when orders of civil authorities resulting from such outbreaks restricted access to the business premises.
Aviva had denied coverage to policyholders for COVID-19-related claims on the ground that the insurance policies did not cover global pandemics. With the class now certified, class counsel have urged Aviva policyholders who have experienced business interruption losses because of the pandemic to submit claims to the insurer.
Nursing homes have also seen increased class actions against them as residents have become sick and died of COVID-19 since 2020, Veel notes.
Ontario’s new preferability requirement plays out
Ontario’s Bill 161 received royal assent in July 2020 and took effect that October. Its changes to the Class Proceedings Act are starting to work their way through the courts and could result in more filings in other jurisdictions, such as British Columbia, that are seen to be more plaintiff-friendly, says Jackson.
The most significant amendment to Ontario’s Act was the preferable procedure portion of the certification test, which now includes superiority and predominance elements similar to U.S. Federal Rule 23(b)(3). The predominance requirement requires that the common issues predominate over individual issues.
Jackson says that precertification motions are now being recognized as a legitimate way to dispose of a class proceeding in whole or in part or to narrow the issues prior to the merits being considered. “That is defendant-friendly because it means that courts are now required to hear precertification motions in advance of certification to help with procedural efficiency and speedier resolution of class actions, and data that should be more advantageous to defendants in terms of at least being able to address class actions that can be disposed of at an earlier stage.”