Executive Summary: Key Legal and Evidentiary Issues

• Causation between Nexun’s CGI remediation fees and any proven contractual or civil fault by Vincent Bédard regarding IT access and project deletions
• Scope of an employee’s post-resignation cooperation duties and alleged breach of loyalty in managing critical technological infrastructure
• Impact of the absence of a comprehensive “crash plan” and formal succession planning on the employer’s own responsibility for IT vulnerability
• Weight of CGI’s technical evidence on project deletions in Azure DevOps versus broader, non-fault-based reasons for a global IT recovery mandate
• Consequences of failing to send a prior mise en demeure before hiring a third party and later seeking reimbursement of those external costs
• Distinction between a large-scale reorganization of IT assets for multiple entities and compensable damages that are the direct and immediate result of a specific fault

Facts and background of the dispute

Nexun Media Inc. is a Québec company that relied heavily on the technical expertise of its long-time employee, Vincent Bédard, who had worked there for about twenty years. He acted as programmer and “webmaster,” in practice managing key technological tools and platforms used in the company’s operations, including Webnames, Office 365, Azure Portal and Azure DevOps. The company president, Marco Vachon, acknowledged he did not personally have the technical skills to administer these systems. As Nexun grew increasingly dependent on a single technical resource, Vachon says he sought from 2017 onward to reduce that dependence. He referred to the idea of a “crash plan,” namely a document listing access procedures, user names and passwords for the various systems. Emails from August 2017 to another employee, Sandra Thivierge, mention the need to document administrative access. However, no such crash plan was ever finalized by Bédard. At the hearing, he explained that he was carrying a heavy workload and that any static document would quickly become outdated as platforms and configurations evolved. This perceived lack of formal documentation formed part of Nexun’s narrative about its technological vulnerability at the time of Bédard’s departure. On 30 October 2019, Bédard tendered his resignation in writing. In that letter, he indicated he would send the requested IT codes in a subsequent email and also expressed willingness to remain available to Nexun as a service provider or consultant, if desired. The next day, an email was in fact sent containing a username and password. Nexun later argued that this information was ambiguous and insufficient, providing no clear picture of the structure of its technological environment. In contrast, Bédard maintained that what he transmitted was the “master” code needed for any competent IT professional to regain control of Nexun’s infrastructure. Following his resignation, Bédard did not immediately disappear from Nexun’s technology landscape. He continued to perform certain technical tasks as a consultant in November 2019, December 2019 and January 2020, issuing invoices either to Nexun or to the related entity Centre d’estimation de construction inc. (CEC). Vachon acknowledged receiving several of those invoices, though he disputed their validity or exigibility.

Events leading to the CGI intervention

On 24 January 2020, Nexun, through Vachon, authorized IT firm CGI to intervene. The mandate was to remove Bédard’s access to Azure Portal, Azure DevOps, Office 365 and Webnames for both Nexun and CEC, and more broadly to help the business retake control of its IT assets. Shortly thereafter, relations between Nexun and Bédard broke down over payment of his consulting invoices. On 28 January 2020, in the context of this dispute and announcing that he was ceasing his collaboration, Bédard emailed Nexun the Azure account password, noting that the same password applied to several other platforms. CGI’s subsequent technical work identified that projects in Azure DevOps had been deleted on 27 and 28 January 2020. According to CGI, only the organization owner or someone with administrative project rights could have deleted those projects, and at that time, based on the information CGI had, only Bédard held that role. CGI reported that it regained control of DevOps on 29 January 2020, after also taking administrative control of Office 365 and the email account [email protected]. CGI was able to restore thirty-seven projects that had been only temporarily deleted, using Microsoft’s 30-day retention feature. On 20 February 2020, Vachon filed a complaint with the Québec City police service concerning Bédard’s alleged actions, but there is no indication in the judgment that any criminal charge was ever laid.

Nature of Nexun’s claim and legal framework

Nexun sued Bédard in the Small Claims Division of the Court of Québec, seeking 15,000 CAD. The company did not claim for permanent loss of files or loss of clientele; the projects had been restored, and no specific loss of customers was quantified. Instead, the claim focused on the professional fees charged by CGI to help Nexun regain control of its IT environment. Nexun argued that those expenses were a direct consequence of Bédard’s conduct: his alleged lack of cooperation during the transition, inadequate disclosure of access credentials, retention of administrative rights, and the deletions in Azure DevOps. The court analyzed the matter under Québec civil law principles of contractual liability. The plaintiff had to prove three elements: a fault by the defendant, the existence of damage, and a causal link between the fault and the damage. It also had to satisfy the burden of proof on a balance of probabilities and show that the damages claimed were the direct and immediate consequence of the alleged contractual breach. The judgment does not concern any insurance policy or specific contractual clauses governing coverage or indemnity; the “policy” language in this dispute is practical rather than textual, focusing on internal expectations about documentation, post-employment cooperation and management of access rights, rather than on written insurance or indemnity clauses.

Assessment of the CGI mandate and causation

The CGI report played a central evidentiary role. It confirmed that CGI was mandated to recover control over Webnames, the Microsoft Webmaster Nexun account, Office 365, Azure Portal, access privileges and Azure DevOps. It also corroborated that deletions of DevOps projects occurred on 27 and 28 January 2020, and that CGI restored those projects. The court accepted this technical evidence as more reliable than the general atmosphere of mistrust described by Vachon; thus, it accepted that some form of intervention in DevOps had occurred and that CGI had undertaken restoration work. However, the judge emphasized that CGI’s engagement was far broader than simply undoing deletions in DevOps. The report outlined a comprehensive, structured initiative to recover and reorganize all of Nexun’s technological assets. The agenda included not only DevOps restoration but also reclaiming domain management, reconfiguring personal Microsoft accounts, restructuring Office 365, adjusting Azure Portal, assigning new access privileges, assessing the “before and after” situation, and identifying additional tasks to be completed. This demonstrated a global recovery and reorganization of the IT environment. This broader framing was reinforced by the 24 January 2020 authorization, where Vachon instructed CGI to remove Bédard’s access not only for Nexun but also for CEC. The court thus saw the CGI mandate as a wide-ranging project covering multiple entities and systems, not a narrow response to a single wrongful act. Even assuming, for argument’s sake, that Bédard committed a fault by deleting (or attempting to delete) projects in DevOps, the court stressed that Nexun still needed to prove what portion of the CGI fees directly and immediately flowed from that specific wrongful conduct. The evidence failed on this point. The CGI report did not break down its work by discrete task. It did not show how many hours or what cost was attributable to DevOps restoration, as opposed to recovering Webnames, reconfiguring the Microsoft account, restructuring Office 365, adjusting Azure Portal, assigning new privileges, or completing remaining tasks. Nor did it clearly distinguish what part of the work benefited Nexun versus other related entities, including CEC and “Constructeur Virtuel,” the name under which CGI actually issued its invoices.

Other contributing factors and absence of formal notice

The court highlighted several contextual factors that undermined the causal chain between Bédard’s alleged fault and the totality of the CGI fees. Nexun’s heavy dependence on a single technical resource meant that any departure of that person would pose a structural risk, irrespective of wrongdoing. The lack of a formal succession plan or immediate technical replacement aggravated this vulnerability. The company’s choice to retain a large, sophisticated IT firm like CGI to secure and reorganize the full suite of IT services also reflected a strategic decision by the business, not solely a reaction to an isolated wrongful act. Finally, the mandate extended to more than one corporate entity, further muddying the question of who truly incurred, and for whose benefit, the CGI costs. Crucially, the court noted that Nexun had not sent Bédard a prior written mise en demeure before incurring the bulk of the CGI expenses. It did not give him precise notice of the alleged shortcomings, a deadline to cure them, or explicit warning that, failing corrective action, the costs of a third-party intervention would be charged to him. In Québec civil law, when one party intends to have a third party perform what it considers its co-contractor’s obligation and then recoup those costs, the absence of such a formal notice weighs significantly against a claim for reimbursement. It affects the assessment of causation, the necessity of the expenses, and ultimately the right to shift those costs onto the defendant. Given that Nexun’s claim was not for permanent data loss but for the wide-ranging cost of a global IT recovery and reorganization, the lack of a prior, targeted mise en demeure was particularly damaging to its case.

Outcome and implications of the decision

The Court of Québec concluded that Bédard’s departure did indeed leave Nexun in a position of heightened technological vulnerability and that an external intervention was necessary to retake control over various platforms. However, the court held that Nexun did not meet its burden of proving, on a balance of probabilities, that the entire 15,000 CAD in CGI fees was the direct and immediate consequence of a civil fault attributable to Bédard. The evidence showed instead a broad operation of recovery, securitization and reorganization of technological assets for more than one entity, in a context where Nexun had long depended heavily on Bédard’s expertise and had not put in place clear technical succession measures. As a result, the court rejected Nexun’s claim in its entirety. The successful party in this litigation is the defendant, Vincent Bédard. The judgment dismisses the claim for 15,000 CAD in damages and awards him his court costs (“frais de justice”). The decision does not specify any exact monetary figure for those costs, which in the small claims context are usually limited and regulated rather than full indemnity of legal expenses. Accordingly, Bédard faces no damages liability, while Nexun recovers nothing of the CGI fees it sought and must bear its own litigation costs, with only standard, unspecified court costs ordered in Bédard’s favour.