A First in Canada: Privacy Class Action Dismissed on the Merits

Litigation Partner Shaun E. Finn was interviewed by The Lawyer’s Daily about his views on a long-awaited decision of the Superior Court of Québec dismissing a privacy breach class-action on the merits.

In Lamoureux c. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), the Court founds that Defendant IIROC committed two faults:

• losing a laptop containing the personal information of various investors; and
• failing to encrypt the laptop to ensure that this information would be fully protected, pursuant to its own internal policies.

However, heeding guidance from the Supreme Court of Canada in Mustapha v. Culligan of Canada Ltd., the Court noted that the “generally negative feelings felt” following the loss of the computer and the personal information it contained did not cross the threshold of the “annoyances, anxieties and fears that people living in society routinely, if sometimes reluctantly, accept.”

“The fact that there was a fault, a breach, a failure, insufficient protection — that’s part of the picture, of course, but it alone is not sufficient,” pointed out Shaun E. Finn, Co-leader of BCF’s Class Action Defence group. “You also have to establish or prove on a balance of probabilities that there was a prejudice, harm, and that it was sufficiently significant to put a dollar figure to it.”

Since it is the first privacy class action in Canada to be decided on the merits, “there’s no doubt in my mind that the courts in other provinces will look to it as sort of a precedent-setting case,” said Mr. Finn, co-author (with Danielle Miller Olofsson) of the book Privacy and Data-Protection Class Actions in Canada: a Practical Handbook.