Quebec Superior Court decision called ‘a first in Canada’
A class action lawsuit over loss of personal information has been dismissed at the merit stage, marking a first in Canada, say the lawyers representing the defendant, as well as providing a blueprint for an appropriate response when a privacy breach occurs.
In the March 26 decision in Danny Lamoureux c. Investment Industry Regulatory Organization of Canada, Justice Florence Lucas of the Superior Court of Quebec dismissed the claim for punitive damages, notably finding that the defendant, IIROC, had responded diligently when the loss of personal information became apparent.
“It’s the first privacy class action [decision] that was rendered on the merits across Canada,” says Anne Merminod, a partner in Borden Ladner Gervais LLP in Montreal who alongside Stéphane Pitre and Alexandra Hebert represented the defendant in the case.
Other cases have been dismissed at the certification/authorization stage, she says, but this is the “very first class action on the merits that analyzes a privacy breach,” and examined the type of damages that can be claimed, whether the response of the defendant was it appropriate, and when a claim for punitive damages should be awarded.
On February 22, 2013, an inspector working for the Investment Industry Regulatory Organization of Canada forgot his laptop computer on a train. The missing computer contained personal information relating to individuals collected from securities brokers who were under inspection, and despite IIROC’s efforts the computer was never recovered.
In the wake of that loss, a class action was first brought by Paul Sofio in Quebec’s Superior Court. Sofio claimed for each of the class members $10,000 in compensatory damages resulting from the “stress, inconvenience and actions made necessary” that receipt of the letter from IIROC caused him, notably stress, and the steps taken to call Equifax or TransUnion. He made no claim for punitive damages. Sofia’s suit was dismissed at the authorization stage, with the court finding no compensable injury; this decision was upheld on appeal.
The Court of Appeal of Quebec relied on the 2008 Supreme Court of Canada decision in Mustapha v. Culligan of Canada Ltd., says Merminod, which stated that an injury must rise above the ordinary annoyances, anxiety and fear that people in society routinely accept; the injury must be serious, prolonged, and rise above those ordinary annoyances and anxiety. The Court of Appeal of Quebec’s Justice Marie-France Bich “said that receiving a letter from a company informing you that your information was lost, and the time taken to call Equifax and TransUnion to protect your identity, was not sufficient” to constitute an injury,” Merminod adds.
Ten days after the appellate court decision, Danny Lamoureux then started a class action which was authorized in October 2017. Lamoureux pleaded that he had been victimized by the theft of his personal information through unlawful uses of his identity in 2015.
His allegations were twofold: first, that the IIROC’s response to the loss of data was too slow, that the services offered by IIROC to protect the class members’ information were inadequate, and that the class members were informed of the data loss too late. Second, the class members claimed damages suffered because of the loss, similar to Sofio’s claims: inconvenience and stress following receipt of the letter, and (for Lamoureux) subsequent identity theft. The class members also claimed punitive damages.
Justice Lucas looked at IIROC’s response to the data loss, which included identifying the loss, taking steps to assess the extent of the breach, notifying the parties involved including the investors, relevant regulatory bodies, and any affected organizations. IIROC also took steps to protect the affected investors, through providing security protection from TransUnion and Equifax for years to come. Justice Lucas found that “IIROC’s response was diligent, and that barred the award of punitive damages,” says Merminod, since under Quebec law punitive damages are awarded only when a plaintiff can establish an unlawful and intentional interference.
The minimum threshold for compensable injury was not reached, either, as no causation was found between the loss of data and the attempted identity theft, as demonstrated by an expert witness, says Merminod; while there was no dispute that Lamoureux had been the victim of fraud, this was not related to the IIROC’s data loss two years earlier.
There are currently more than 80 class actions involving privacy breaches in progress across the country, Merminod told Canadian Lawyer. Class actions have become an increasingly common venue for users and consumers to seek damages from data loss, and the pandemic has also triggered class action lawsuits across numerous sectors and will continue to give rise to many new class actions in the following years.
And, although Quebec is a civil law province, she says, “many companies will be extremely interested to see how IIROC responded to the loss,” and whose efforts were lauded by Justice Lucas, she says. “That’s applicable to anyone in Canada, the U.S., or Europe,” as data loss and privacy breaches occur regularly, with even high-tech giants such as Google, Facebook, LinkedIn, and even Equifax being the target of hacks.
“It’s almost impossible to protect fully against that,” she says. “Privacy breaches will happen, and it will happen even more because everyone works remotely [during COVID], and our system is not as strong when people work remotely.” In this case, Justice Lucas said that IIROC’s response was “state of the art” in protecting the affected members once the data loss had occurred; “that's why it's a blueprint.”
