Class action over loss of personal information dismissed on the merits

Quebec Superior Court decision called ‘a first in Canada’

Class action over loss of personal information dismissed on the merits
Anne Merminod was a counsel representing IIROC against a class action over loss of personal information.

A class action lawsuit over loss of personal information has been dismissed at the merit stage, marking a first in Canada, say the lawyers representing the defendant, as well as providing a blueprint for an appropriate response when a privacy breach occurs.

In the March 26 decision in Danny Lamoureux c. Investment Industry Regulatory Organization of Canada, Justice Florence Lucas of the Superior Court of Quebec dismissed the claim for punitive damages, notably finding that the defendant, IIROC, had responded diligently when the loss of personal information became apparent.

“It’s the first privacy class action [decision] that was rendered on the merits across Canada,” says Anne Merminod, a partner in Borden Ladner Gervais LLP in Montreal who alongside Stéphane Pitre and Alexandra Hebert represented the defendant in the case.

Other cases have been dismissed at the certification/authorization stage, she says, but this is the “very first class action on the merits that analyzes a privacy breach,” and examined the type of damages that can be claimed, whether the response of the defendant was it appropriate, and when a claim for punitive damages should be awarded.

On February 22, 2013, an inspector working for the Investment Industry Regulatory Organization of Canada forgot his laptop computer on a train. The missing computer contained personal information relating to individuals collected from securities brokers who were under inspection, and despite IIROC’s efforts the computer was never recovered.

In the wake of that loss, a class action was first brought by Paul Sofio in Quebec’s Superior Court. Sofio claimed for each of the class members $10,000 in compensatory damages resulting from the “stress, inconvenience and actions made necessary” that receipt of the letter from IIROC caused him, notably stress, and the steps taken to call Equifax or TransUnion. He made no claim for punitive damages. Sofia’s suit was dismissed at the authorization stage, with the court finding no compensable injury; this decision was upheld on appeal.

The Court of Appeal of Quebec relied on the 2008 Supreme Court of Canada decision in Mustapha v. Culligan of Canada Ltd., says Merminod, which stated that an injury must rise above the ordinary annoyances, anxiety and fear that people in society routinely accept; the injury must be serious, prolonged, and rise above those ordinary annoyances and anxiety. The Court of Appeal of Quebec’s Justice Marie-France Bich “said that receiving a letter from a company informing you that your information was lost, and the time taken to call Equifax and TransUnion to protect your identity, was not sufficient” to constitute an injury,” Merminod adds.

Ten days after the appellate court decision, Danny Lamoureux then started a class action which was authorized in October 2017. Lamoureux pleaded that he had been victimized by the theft of his personal information through unlawful uses of his identity in 2015.

His allegations were twofold: first, that the IIROC’s response to the loss of data was too slow, that the services offered by IIROC to protect the class members’ information were inadequate, and that the class members were informed of the data loss too late. Second, the class members claimed damages suffered because of the loss, similar to Sofio’s claims: inconvenience and stress following receipt of the letter, and (for Lamoureux) subsequent identity theft. The class members also claimed punitive damages.

Justice Lucas looked at IIROC’s response to the data loss, which included identifying the loss, taking steps to assess the extent of the breach, notifying the parties involved including the investors, relevant regulatory bodies, and any affected organizations. IIROC also took steps to protect the affected investors, through providing security protection from TransUnion and Equifax for years to come. Justice Lucas found that “IIROC’s response was diligent, and that barred the award of punitive damages,” says Merminod, since under Quebec law punitive damages are awarded only when a plaintiff can establish an unlawful and intentional interference.

The minimum threshold for compensable injury was not reached, either, as no causation was found between the loss of data and the attempted identity theft, as demonstrated by an expert witness, says Merminod; while there was no dispute that Lamoureux had been the victim of fraud, this was not related to the IIROC’s data loss two years earlier.

There are currently more than 80 class actions involving privacy breaches in progress across the country, Merminod told Canadian Lawyer. Class actions have become an increasingly common venue for users and consumers to seek damages from data loss, and the pandemic has also triggered class action lawsuits across numerous sectors and will continue to give rise to many new class actions in the following years.

And, although Quebec is a civil law province, she says, “many companies will be extremely interested to see how IIROC responded to the loss,” and whose efforts were lauded by Justice Lucas, she says. “That’s applicable to anyone in Canada, the U.S., or Europe,” as data loss and privacy breaches occur regularly, with even high-tech giants such as Google, Facebook, LinkedIn, and even Equifax being the target of hacks.

“It’s almost impossible to protect fully against that,” she says. “Privacy breaches will happen, and it will happen even more because everyone works remotely [during COVID], and our system is not as strong when people work remotely.” In this case, Justice Lucas said that IIROC’s response was “state of the art” in protecting the affected members once the data loss had occurred; “that's why it's a blueprint.”

Related stories

Free newsletter

The Canadian Legal Newswire is a FREE newsletter that keeps you up to date on news and analysis about the Canadian legal scene. A separate InHouse Edition is delivered on a regular basis, providing targeted news and information of interest to in-house counsel.

Please enter your email address below to subscribe.

Recent articles & video

Loblaw Financial successful in tax appeal at Supreme Court

Building your lawyer 'brand' through social media works, but be careful: Young Lawyers Summit panel

Roundup of law firm hires, promotions, departures: Dec. 6, 2021 update

Saskatchewan legislation limits deposits into side accounts associated with life insurance contracts

Queen's Law professor leads work to update parenting plan resources

Epiq acquires Simplex Services, as company seeks to expand flexible legal talent services

Most Read Articles

Vancouver lawyer Glen Orris given a three-week suspension for communicating with prospective juror

M&A growth explosive in Canadian financial services sector flush with capital: Torys LLP report

Healthcare provider agrees to settle proposed cyberattack class action for up to $3.4 million

Young Lawyers Summit: honing professionalism and practice management