nNovation LLP

Small Canadian regulatory law firm with a big presence

Class Actions

Certification Refused in Quebec Equifax Class Action

by Leave a Comment

Class action plaintiffs were dealt yet another blow in Quebec recently. In a huge victory for Equifax, the Quebec Superior Court declined to certify the class action brought against it in that province stemming from a massive 2017 data breach.

In his October 21st decision, Justice Donald Bisson stated that the representative plaintiff, Daniel Li, did not establish a right of action nor was he adequately representative of the class he sought to represent.

The Quebec Rules of Civil Procedure list four requirements for class certification:

  • the claims of the members of the class raise identical, similar or related issues of law or fact;
  • the facts alleged appear to justify the conclusions sought;
  • the composition of the class makes it difficult or impracticable to apply the rules for mandates to take part in judicial proceedings on behalf of others or for consolidation of proceedings; and
  • the class member appointed as representative plaintiff is in a position to properly represent the class members.

Justice Bisson found that Li failed on requirements (2) and (4).

Hypothetical Harm Not Enough

The Court agreed with Li that Equifax had failed to take necessary measures to protect Li’s personal information or preventing it from falling into the hands of third parties without his consent. It also found Li successfully demonstrated a violation of his right to privacy, reputation, and non-disclosure. The problem for Li, however, was proving that he had actually suffered damages. In this respect, the Court found that the facts alleged did not appear to justify the conclusions sought.

The Court grouped the compensatory damages Li sought into three categories: (i) expenses, troubles, and inconveniences arising from the data breach, including the cancellation of credit cards and arranging for credit monitoring, (ii) moral prejudice, and (iii) “other losses”.

Li had not been a victim of identity theft, had not yet paid for credit monitoring, and had not suffered inconveniences like having to cancel credit cards or arrange for credit monitoring. The Court, following its reasoning from Zuckerman v Target Corporation, concluded that the mere risk of Li suffering any of the above, was insufficient to sustain his claim. The court was equally unpersuaded by Li’s claims of “mental distress” and “other losses.”

Strike one.

Punitive Damages Under Quebec Charter Require Intent, Disregard

Li also sought punitive damages on the basis that Equifax had unlawfully interfered with his and other class members’ right to respect for private life and right to non-disclosure of confidential information protected by Quebec’s Charter of Human Rights and Freedoms. Quebec’s Charter allows plaintiffs to seek punitive damages in cases where illicit and intentional conduct leads to a breach of one’s Charter rights.

But justice Bisson found Li’s statement of claim failed to establish sufficient allegations that Equifax’s conduct merited punitive damages. For a court to award punitive damages under Quebec’s Charter, the person who committed the unlawful interference must have had a state of mind that implies a desire or intent to cause the consequences of the wrongful conduct, or to have acted with full knowledge of the immediate or extremely probable consequences of the conduct. Justice Bisson held that Li’s statement of claim was too light on details to back up such allegations and only stated there was an “unlawful” breach.

Lastly on the subject of punitive damages, justice Bisson found that the fact there was a settlement in an American class action brought against Equifax for the same data breach did not make a difference to the Quebec class action nor the allegations brought by Li.

Strike two.

No Interest, No Representation

To be certified as a representative plaintiff for a class under Quebec law, three factors are considered:

  • the interest pursued;
  • the representative plaintiff’s competence; and
  • the absence of conflict between the representative plaintiff and the other class members.

While the Court appeared not to take issue with the second and third factors, it found that since Li failed to show he had suffered damages, he had no interest to pursue.

Strike three.

The Takeaway

This case makes clear that claimants in any future data breach class action in Quebec will need to show they have suffered actual damages. Hypotheticals just won’t work. And if seeking punitive damages under Quebec’s Charter, claimants must bring allegations showing intent to bring about the consequences of the bad conduct or a willful disregard of the consequences.

Also of note is that the Quebec action is not necessarily closed, as another plaintiff who has suffered damages could come forward and successfully persuade the Court to certify the class. This occurred in Belley v TD Auto Finance Services Inc. Belley was the second attempt to authorize a class action against TD, following an attempt that failed on similar grounds to Equifax. Belley achieved class certification after bringing an arguable case to the Court that he was the victim of identity theft immediately following TD’s loss of his and other customers’ personal information. It now remains to be seen: is there a Belley-in-waiting for Equifax?

Court agrees class actions necessary to enforce PIPEDA

by Leave a Comment

The Ontario Superior Court of Justice recently approved a class action settlement involving a case that arose out of an insurer’s practice of conducting credit checks on claimants for accident benefits. The procedural history of the case is interesting and suggests a possible roadmap for other class proceedings. What is also interesting is the court’s statement that the limited powers of the Office of the Privacy Commissioner of Canada (OPC) are a reason why class actions are important tool for behavioural modification to encourage compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). Justice Glustein stated:

[88] Behavioural modification is a key objective of the Settlement Agreement. If systemic PIPEDA privacy breaches are not rectified by a class procedure, it is not clear what incentive large insurers and others will have to avoid overcollection of information. While the Privacy Commissioner may encourage or require changes to future practices, it has very limited powers to enforce compliance through strong regulatory penalties (see s. 28 of PIPEDA).

Haikola v. The Personal Insurance Company, 2019 ONSC 5982 at para. 88

Procedural History

After a car accident, the plaintiff, Kalevi Haikola, made a claim for accident benefits from his insurer, the Personal Insurance Company. An adjuster from the Personal Insurance Company contacted Haikola and asked for his consent to conduct a credit check. Haikola agreed, allegedly fearing that refusing to permit the credit check might affect his claim. According to the court’s findings, Haikola repeatedly sought answers about why a credit check was necessary but did not obtain a satisfactory answer. So, Haikola complained to the OPC, who found that the Personal Insurance Company was using these credit checks as part of a fraud detection model. In PIPEDA Report of Findings #2017-003, the OPC determined that Haikola’s complaint was well-founded. The OPC concluded that the Personal Insurance Company was unable to justify the use of the credit score and had failed to obtain meaningful consent.

Although the Personal Insurance Company undertook to cease the practice of conducting credit checks, Haikola was not satisfied. Section 14 of the PIPEDA permits individuals to bring an application to Federal Court for a remedy once the OPC renders a decision with respect to an investigation. However, instead of bringing an individual claim, Haikola sought to use section 14 to bring a class action against the Personal Insurance Company. The Personal Insurance Company argued that section 14 could not be used in this way and took the position that the Federal Court could not certify a class action.

Settlement

Haikola and the Personal Insurance Company entered into settlement discussions and, after a mediation, agreed to a settlement in which the Personal Insurance Company would pay an amount of $2,250,000. After taking into account proposed class action counsel fees, the court estimated that the value of the settlement for each affected individual would range between $150 – $180 depending on the take-up by class members.

As part of the settlement Haikola agreed to discontinue the proceeding in Federal Court and commence a class proceeding before the Ontario Superior Court of Justice. This avoided the necessity of determining the jurisdictional question regarding whether the Federal Court could certify a class proceeding. Because the Ontario Superior Court of Justice does not have jurisdiction to hear an application under section 14 of PIPEDA, the answer was to plead the breach of an implied contractual term that the Personal Insurance Company would comply with PIPEDA. Having allegedly failed to do so, Haikola and the class would be entitled to at least a nominal damages award. But a nominal damages award can certainly add up when there are 8,525 affected individuals.

Takeaways

The Ontario court was very receptive to the use of class proceedings to enforce PIPEDA. It was debatable whether or not the claim of an implied term would have been successful had there been a trial. However, Justice Glustein noted that there were reasons why a class proceeding might be preferable than individual complaints to the OPC followed by individual Federal Court actions for a remedy.

Glustein J. found that the likely small damages award hardly justified class members jumping through the hurdles created by PIPEDA. As Haikola’s case itself showed, an individual had to launch a complaint, wait for the OPC to investigate, obtain a report of findings from the OPC and then go to the Federal Court. Indeed, it took the OPC a few months shy of 3 years to issue a final Report of Findings. (Yes, you read that correctly – nearly 3 years! – even though s. 13(1) PIPEDA says that the Commissioner must issue a Report of Findings in 1 year.)

Even with a successful report of findings, the individual would then have to start all over again in Federal Court. As Glustein J. noted, the Federal Court would then conduct a hearing de novo, meaning that the complainant would have to convince the court that the OPC was correct and there was a violation of PIPEDA – all for a small damage award.

The whole set up of PIPEDA was not, in the court’s judgment, designed to achieve individual remedies for systemic breaches.

Look for more cases in which plaintiffs claim breaches of an implied term to comply with PIPEDA in order to avoid the OPC complaints and section 14 process under PIPEDA.