Condon v. Canada

Condon v. Canada
Court (s) Database
Federal Court Decisions
Date
2014-03-17
Neutral citation
2014 FC 250
File numbers
T-132-13
Decision Content
Date: 20140317
Docket:
T-132-13
Citation: 2014 FC 250
Ottawa, Ontario, March 17, 2014
PRESENT: The Honourable Madam Justice Gagné
BETWEEN:
GAELEN PATRICK CONDON
REBECCA WALKER
ANGELA PIGGOTT
Plaintiffs
and
HER MAJESTY THE QUEEN
Defendant
REASONS FOR JUDGMENT AND JUDGMENT
[1] This is a motion brought by Gaelen Patrick Condon, Rebecca Walker, and Angela Piggott [the Plaintiffs] to certify an action as a class proceeding in accordance with rule 334.16 of the Federal Courts Rules, SOR/98-106 [the Rules] against Her Majesty the Queen [the Defendant], named as representative of the Minister of Human Resources and Skills Development Canada [the Minister or HRSDC]. The Minister is responsible for the administration and management of the Canada Student Loans Program [the Program], which provides loans to approved applicants in order to help fund those applicants’ post-secondary education [the Student Loans].
[2] In November 2012, the Minister lost an external hard drive on which it had stored the personal information of the Plaintiffs as well as approximately 583,000 individuals [the Hard Drive], from its offices in Gatineau, Quebec [the Data Loss]. This personal information included the names, dates of birth, addresses, student loan balances, and Social Insurance Numbers [the SIN(s)] of those individuals [the Personal Information]. The Hard Drive has not been recovered.
[3] The Plaintiffs claim various measures of relief from the Defendant on their own behalf as well as on behalf of a class defined as [the Class or Class Members]:
All persons whose personal information was contained in an external hard drive in the control of Human Resources and Skills Development or the National Student Loan Services Centre which was lost or disclosed to others on or about November 5, 2012, but not including senior management of Human Resources and Skills Development Canada, the Canada Student Loans Program, or Ministers and Deputy Ministers of the Ministry of Human Resources and Skills Development.
[4] The Plaintiffs allege several faults and breaches on the part of the Minister and are seeking to recover damages suffered as a result of the Data Loss. The Minister mainly argues that a class proceeding is not the preferable procedure for resolving the Class Members’ claims and that the Plaintiffs have suffered no compensable damages.
[5] For the reasons discussed below, I will grant the motion and certify the action as a class proceeding.
Background
[6] The Plaintiffs are respectively residents of St. John’s, Newfoundland, Sydney, Nova Scotia and Toronto, Ontario, who had applied and obtained Student Loans through the Program during the period from 2002 to 2008. They have repaid or are in the process of repaying their Student Loans.
[7] To receive Student Loans through the Program, Class Members were required to fill out application forms requiring them to provide the Personal Information and agreeing to conditions for use of that information [the Application Form(s)]. They also had to sign various agreements with the Defendant, which also contained terms setting out the conditions for use of that information. The Plaintiffs contend that these Application Forms and various agreements should be construed as contracts [the Contracts]. The details of these Contracts will be discussed below.
[8] On November 5, 2012, the Hard Drive was first reported missing to a manager at the Minister by one of its employees. It had last been seen in August 2012, when it had been used to back up the Personal Information from the Minister’s network prior to a system upgrade planned for mid-October 2012.
[9] The information on the Hard Drive was not encrypted, nor was the Hard Drive stored in a location that was locked “100% of the time.” It was believed to be stored in the bottom drawer of an employee’s filing cabinet, hidden under some files. It was only when that employee went to retrieve the Hard Drive in preparation for another system upgrade that the employee discovered it missing.
[10] From November 5 to November 22, 2012, the loss was internally investigated and a complete search of the Minister’s offices was performed.
[11] On November 28, 2012, the Minister’s security staff was first notified of the Data Loss and on December 7, 2013, it confirmed that the Hard Drive contained the Personal Information of “500K clients” by analyzing the contents of the network drive that are presumed to have been copied to the Hard Drive.
[12] On December 14, 2012 the Defendant notified the Privacy Commissioner of Canada of the Data Loss. On January 7, 2013, the Royal Canadian Mounted Police was asked to investigate the matter and on January 11, 2013, the Minister disclosed the Data Loss to the Canadian public and to the affected Class Members, by way of a statement entitled “Protecting Canadians’ Personal Information at HRSDC” [the Statement]. In the Statement, the Minister called the Data Loss “unacceptable and avoidable,” “unnecessary,” and of a “serious nature.”
[13] The Defendant created a toll free telephone number, following the Minister’s issuance of the Statement, to inform potential Class Members as to whether their Personal Information was stored on the Hard Drive [the Information Line].
[14] The Plaintiffs all called the Information Line and were advised that their Personal Information was stored on the Hard Drive. Angela Piggott spent four hours on the telephone contacting the Information Line and other governmental bodies to request her Student Loans information while Rebecca Walker phoned the Information Line on two separate days and was left on hold for over 30 minutes.
[15] The Defendant advised some Class Members who called the Information Line, including Rebecca Walker and Angela Piggott, that they should contact Equifax Canada Inc. [Equifax] and TransUnion Canada [TransUnion], the two largest Canadian credit reporting agencies, to request copies of their credit reports from those agencies. The Defendant advised Rebecca Walker and other Class Members that if they wished to obtain credit protection, they could do so at their own expense by contracting with Equifax or TransUnion.
[16] In all, the Information Line received over 250,000 phone calls.
[17] At the end of January 2013, the Defendant mailed letters to 333,000 Class Members advising them of the Data Loss [the Letters]. The Defendant did not send Letters to Class Members whose address information had not been updated within the previous three years.
[18] The Letters contained an offer of “credit protection.” They read: “A notation can be placed on your credit file for a period of up to six years, at no cost to you. This notation will have no impact on your credit rating.” The Class Members were to opt in to this program by contacting the Information Line. At its essence, this program provides an annotation on the Class Member’s file with a credit reporting agency [the Credit Flag]. If a lender asks the credit reporting agency for information about the Class Member’s credit, it will advise the lender of the Credit Flag. At first, the credit protection offered only concerned Class Members’ files with Equifax, but it was later extended to include those with TransUnion. In their respective reports, the parties’ experts discuss the distinction to be made between a Credit Flag program and a “credit monitoring” program. They disagree as to the effectiveness of the credit protection program offered by the Defendant.
[19] As of June 21, 2013, 88,548 Class Members had provided their consent to the Minister for the Credit Flag. The Plaintiffs have not done so.
[20] In addition to the credit protection offered, the Defendant has instituted a SIN registry. The affected SIN records have been annotated in the Social Insurance register to indicate that the SIN was involved in an incident. This ensures that any requests for changes or modifications undergo an enhanced authentication process.
[21] On January 17, 2013, the Plaintiff Condon commenced this action by filing a Statement of Claim. On January 23, 2013, the Plaintiffs Walker and Piggott filed a Statement of Claim advancing their own claims. The Plaintiffs and their counsel agreed to cooperate in the prosecution of their claims. With the consent of the Defendant, the Plaintiffs filed a Consolidated Statement of Claim before this Court on April 25, 2013.
Issues
[22] There is only one issue raised by this Motion: Should this action be certified as a class proceeding under rule 334.16 of the Rules?
[23] Motions for certification of class proceedings are governed by rule 334.16 of the Rules, which requires certification if the following criteria are met:
a. The pleadings disclose a reasonable cause of action;
b. There is an identifiable class of two or more persons;
c. The claims of the class members raise common questions of law or fact, whether or not those common questions predominate over issues affecting only individual members;
d. A class proceeding is the preferable procedure for the just and efficient resolution of the common questions of law and fact; and
e. There is a representative plaintiff who:
i. would fairly and adequately represent the interests of the class;
ii. has prepared a plan for the proceeding that sets out a workable method of advancing the proceeding on behalf of the class and of notifying the class members as to how the proceeding is progressing;
iii. does not have, on the common questions of fact and law, an interest that is in conflict with the interests of other class members; and
iv. provides a summary of any agreements respecting fees and disbursements between the representative plaintiff and the solicitor of record.
[24] The Defendant does not challenge the proposed class definition (step (b)) or the appropriateness of the representative plaintiffs (step (e)).
[25] The Plaintiffs submit that even if the Defendant’s arguments on the causes of action and common questions are accepted in their entirety, there still remain causes of action and common questions to be certified; as the Defendant does not contest that the Data Loss amounts to a breach of contract and warranty. The Defendant disagrees and replies that even if there is a breach of contract or warranty, step (a) of the test could not be met in the absence of compensable damages suffered by the Plaintiffs and the Class Members.
[26] Class proceedings provisions in the Rules are essentially the same as the provisions in the British Columbia Class Proceedings Act, RSBC 1996, c 50, and the Ontario Class Proceedings Act, SO 1992, c 6. In Manuge v Canada, 2008 FC 624 at paragraph 24, rev’d 2009 FCA 29, certification restored 2010 SCC 67, Justice Barnes writes:
[24] This Court’s class proceedings rules are modeled on the British Columbia rules and are similar to the Ontario rules; in the result, decisions from those jurisdictions can be looked to for guidance in considering a motion to certify: see Tihomirovs v. Canada (Minister of Citizenship and Immigration), 2006 FC 197 (CanLII), [2006] 4 F.C.R. 341 (F.C.), at paragraph 45. As Justice Frederick Gibson observed in Rasolzadeh v. Canada (Minister of Citizenship and Immigration), [2006] 2 F.C.R. 386 (F.C.), at paragraph 23 the mandatory language of our rule [Federal Courts Rules, r. 334.16] (shall… certify) excludes an overriding discretion to refuse to certify a class proceeding if the prescribed factors for certification are met.
[27] The proper approach to be taken by this Court was summarized by the British Columbia Court of Appeal in Pro-Sys v Infineon, 2009 BCCA 503 at paragraphs 64-65:
[64] The provisions of the [Class Proceedings Act] should be construed generously in order to achieve its objects: judicial economy (by combining similar actions and avoiding unnecessary duplication in fact-finding and legal analysis); access to justice (by spreading litigation costs over a large number of plaintiffs, thereby making economical the prosecution of otherwise unaffordable claims); and behaviour modification (by deterring wrongdoers and potential wrongdoers through disabusing them of the assumption that minor but widespread harm will not result in litigation): Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 (CanLII), 2001 SCC 46, [2001] 2 S.C.R. 534 at paras. 26-29 [Western Canadian Shopping Centres]; Hollick v. Toronto (City), 2001 SCC 68 (CanLII), 2001 SCC 68, [2001] 3 S.C.R. 158 at para. 15 [Hollick].
[65] The certification hearing does not involve an assessment of the merits of the claim; rather, it focuses on the form of the action in order to determine whether the action can appropriately go forward as a class proceeding: Hollick at para. 16. The burden is on the plaintiff to show “some basis in fact” for each of the certification requirements, other than the requirement that the pleading disclose a cause of action: Hollick, at para. 25. However, in conformity with the liberal and purposive approach to certification, the evidentiary burden is not an onerous one – it requires only a “minimum evidentiary basis”: Hollick, at paras. 21, 24-25; Stewart v. General Motors of Canada Ltd., [2007] O.J. No. 2319 (S.C.J.) at para. 19. As stated in Cloud v. Canada (Attorney General) 2004 CanLII 45444 (ON CA), (2004), 247 D.L.R. (4th) 667 at para. 50, 73 O.R. (3d) 401 (C.A.), leave to appeal ref’d [2005] S.C.C.A. No. 50 [Cloud],
[O]n a certification motion the court is ill equipped to resolve conflicts in the evidence or to engage in finely calibrated assessments of evidentiary weight. What it must find is some basis in fact for the certification requirement in issue.
[Emphasis added]
[28] Accordingly, the Plaintiffs argue that they only have a “light burden” to satisfy, and therefore, “even if common issues contain elements of novelty and difficulty, they should be ‘left to be worked out in the laboratory of the trial court.’” In this respect, they have put great emphasis on their limited ability to conduct pre-certification discovery to advance their pleadings.
Relief sought
[29] The Plaintiffs seek the following relief:
a. An order appointing the Plaintiffs as the representative plaintiffs;
b. An order defining the Class (or Class Members) as follows:
All persons whose personal information was contained in an external hard drive in the control of Human Resources and Skills Development or the National Student Loan Services Centre which was lost or disclosed to others on or about November 5, 2012, but not including senior management of Human Resources and Skills Development Canada, the Canada Student Loans Program, or Ministers and Deputy Ministers of the Ministry of Human Resources and Skills Development.
c. An order staying any other proceeding in Federal Court relating to this proposed class proceeding;
d. Orders stating the nature of the claims asserted on behalf of the Class and setting out the relief sought by the Class;
e. An order stating the Common Questions;
f. Orders approving the Litigation Plan, setting the form and content of the Notice Program and assigning the cost of the Notice Program, and defining the opt out process; and
g. Orders providing for such further and other relief as Class Counsel may request and this Honourable Court may deem just.
Analysis
Reasonable Cause of Action (Rule 334.16(1)(a))
[30] The Plaintiffs submit that they have a number of well-established causes of action against the Defendant: a) breach of contract and warranty; b) the commission of the tort of intrusion upon seclusion (invasion of privacy); c) negligence; d) breach of confidence; and e) violation of Quebec law.
[31] There is a relatively low threshold for whether pleadings disclose a reasonable cause of action. In Hunt v Carey Canada Inc, 1990 2 SCR 959 [Hunt] at 980, the Supreme Court of Canada held that the court, in such an assessment, must assume that the facts alleged in the plaintiff’s claim can be proved without the consideration of evidence. With this assumption in mind, the court determines whether it is “plain and obvious” that the plaintiff’s claim fails to disclose a reasonable cause of action. The court is not to evaluate the chances of success, but whether there is some chance of success:
Thus, the test in Canada governing the application of provisions like Rule 19(24)(a) of the British Columbia Rules of Court is the same as the one that governs an application under R.S.C. O. 18, r. 19: assuming that the facts as stated in the statement of claim can be proved, is it "plain and obvious" that the plaintiff's statement of claim discloses no reasonable cause of action? As in England, if there is a chance that the plaintiff might succeed, then the plaintiff should not be "driven from the judgment seat". Neither the length and complexity of the issues, the novelty of the cause of action, nor the potential for the defendant to present a strong defence should prevent the plaintiff from proceeding with his or her case. Only if the action is certain to fail because it contains a radical defect ranking with the others listed in Rule 19(24) of the British Columbia Rules of Court should the relevant portions of a plaintiff's statement of claim be struck out under Rule 19(24)(a)].
[Emphasis added]
[32] Also relying on Hunt, the Defendant insists on the fact that the analysis must be made on the pleadings alone, and so, as with a motion to strike, no evidence may be considered. Nonetheless, the Plaintiffs’ pleadings must be supported by a factual basis. It refers as well to R v Imperial Tobacco Canada, 2011 3 SCR 45 at paragraphs 66-70, where the Supreme Court of Canada explains the test as follows:
[70] The second problem with the argument is that, as discussed above, a motion to strike is, by its very nature, not dependent on evidence. The facts pleaded must be assumed to be true. Unless it is plain and obvious that on those facts the action has no reasonable chance of success, the motion to strike must be refused. To put it another way, if there is a reasonable chance that the matter as pleaded may in fact turn out not to be a matter of policy, then the application to strike must be dismissed. Doubts as to what may be proved in the evidence should be resolved in favour of proceeding to trial. The question for us is therefore whether, assuming the facts pleaded to be true, it is plain and obvious that any duty of care in negligent misrepresentation would be defeated on the ground that the conduct grounding the alleged misrepresentation is a matter of government policy and hence not capable of giving rise to liability in tort.
[33] As the Defendant argues that the Plaintiffs failed to plead a factual basis for any of the types of damages alleged, the causes of action advanced by the Plaintiffs will be separated into two categories: one in which damages are argued not to be an essential element of the cause of action; and one in which they are.
Damages argued not to be an essential element of the cause of action
a) Breach of contract and warranty
[34] The Plaintiffs contend that the Defendant breached certain obligations found in the Contracts, legislation and policies. I will now discuss each of these issues in turn.
Contracts
[35] The Application Forms for the Student Loans contained express terms allowing the Defendant to make certain uses of the Personal Information provided by the Plaintiffs, as well as others which guaranteed that no other uses of the Personal Information would be permitted.
[36] More specifically, these Application Forms contained terms as to how the Personal Information would be collected, stored, disclosed, and ultimately destroyed by the Defendant, including terms that the Defendant would:
a. Keep the Personal Information confidential;
b. Not disclose the Personal Information except as provided by the Statutes;
c. Secure the Personal Information and follow its own internal policies with respect to the secure retention of that Personal Information;
d. Delete or destroy the Personal Information once the Class Member’s Student Loans was repaid in full; and
e. Not disclose the Personal Information once the Class Member’s Student Loans was repaid in full.
[37] In 2002, Rebecca Walker signed the “Canada Student Loans Agreement.” This agreement notably contained the following terms:
3. Personal Information: The information I give under this Agreement will be used solely to administer my Direct Loan. Information about me under the control of the Minister will be administered in accordance with the Privacy Act, and will be stored in personal Information Bank No. HRDC PPU 030. I authorize the Minister to disclose to and obtain from Lenders, financial institutions, consumer credit grantors, credit bureaus or credit reporting agencies all particulars and information relevant to my Direct Loans or Student Loans. […] The Minister may exchange information obtained from any source with any of: the appropriate authority, the financial institution disbursing my loan, my Educational Institution and Lenders, but solely for the purposes of the administration or enforcement of the [Canada Student Financial Assistance Act]. The Minister may exchange information with provincial student financial assistance programs, but solely for the purposes of the determination of eligibility for provincial loan remission.
[Emphasis added]
[38] In 2003, Rebecca Walker also signed a revised version of the “Canada Student Loans Agreement,” which states:
I authorize the Government of Canada and the National Student Loans Service Centre to disclose to and obtain from any other consumer credit providers, credit bureaus or credit reporting agencies all particulars and information relating to my [Canada Student Financial Assistance Loans] and [Canada Student Loans]. […]
I authorize the Government of Canada […] to collect, use and disclose date and information related to any of my [Canada Student Loans] and [Canada Student Financial Assistance loans] that I may have for the purposes of carrying out their duties under, and the administration of the [Canada Student Loans Program].
[39] In 2001 and 2002, Rebecca Walker also signed the “Canada Student Loans Program Schedule 1,” which contained the following terms:
I authorize the payor to disclose to and obtain from any other consumer credit providers, credit bureaus or credit reporting agencies all particulars and information relating to my [Canada Student Financial Assistance Loans] and [Canada Student Loans]. […]
I authorize the federal government […] to collect, use and disclose data and information related to any of my [Canada Student Loans] and [Canada Student Financial Assistance Loans] and that I may have for the purposes of carrying out their duties under, and the administration and enforcement of the [Canada Student Loans Program].
[Emphasis added]
[40] In 2009, the National Student Loans Service Centre sent to Angela Piggott the “Consolidated Loan Agreement,” which contained the following terms:
TERMS AND CONDITIONS APPLICABLE FOR CANADA STUDENT LOANS AND THE CANADA PORTION OF THE INTEGRATED STUDENT LOANS
Whereas Your Canada Student Loans and the Canada portion of your Integrated Student Loans (“CSLs”) have been made to you, the borrower, pursuant to the Canada Student Financial Assistance Act (the “Federal Act”) and the Canada Student Financial Assistance Regulations (the “Federal Regulations”), both as amended from time to time, you agree as follows: […]
TERMS AND CONDITIONS APPLICABLE FOR CANADA STUDENT LOANS AND CANADA-ONTARIO INTEGRATED STUDENT LOANS
[…]
4. You authorize the NSLSC and the Ministers HRSD and TCU to disclose to and obtain from consumer creditors, credit bureaus or credit reporting agencies all particulars and information relevant to collecting on your loan.
5. You agree to notify the NSLSC promptly of any changes in your name or address. If you fail to make a payment on your [Canada Student Loans] or [Ontario Student Loans] required pursuant to this agreement, you authorize […] HRSD and TCU […] to release to the NSLSC and/or the Ministers or their agents, whatever information they need to locate you.
6. The Ministers of HRSD and TCU may exchange information obtained from any source with each other and with any of: financial institutions, the NSLSC, any designated educational institution you have attended and previous lenders holding your Ontario Student Loans issued prior to August 1, 2001 or Canada Student Loans prior to August 1, 2000, if any, but solely for the purposes of the administration or enforcement of the Federal and Provincial Acts and Regulations. […]
[Emphasis added]
[41] Meanwhile, Angela Piggott’s “Canada-Ontario Student Loans Program Loan Agreements,” contained the following language:
I agree that until my loans, overpayments and repayments are repaid, MTCU, HRDC and the NSLC can disclose to and collect from any branch of the federal or any provincial government (including any agencies identified on my OSAP application […]), my educational institutions, my lenders, or financial institutions, consumer credit grantors, credit reporting agencies, credit bureaus and any collection agencies that may be operated or retained or on behalf of MTCU or HRSDC any personal information, including my Social Insurance Number, necessary to administer and enforce my Canada-Ontario Integrated Student Loans.
[Emphasis added]
Enabling Legislation and Statutory terms in Contracts
[42] The Contracts contained terms requiring that Personal Information be collected, retained, and disclosed only in accordance with certain statutes: the Privacy Act, RSC 1985, c P-21, the Canada Student Financial Assistance Act, SC 1994, c 28, the Canada Student Financial Assistance Regulations, SOR 95-329, and what was then known as the Department of Human Resources and Skills Development Act, SC 2005, c 34 (since December 12, 2013, this act is known as the Department of Employment and Social Development Act, SC 2005, c 34).
Policies
[43] It was a term of the Application Forms that the Defendant would follow its policies in handling the Plaintiffs and Class Members’ personal applications. The Plaintiffs argue that the Defendant breached its contractual obligations by failing to do so.
[44] Firstly, the Plaintiffs argue that the Defendant failed to comply with its physical security policies, leaving the Hard Drive vulnerable to loss or theft. Specifically, it failed to comply with its “Locked Containers Policy” and “Clean Desk Policy” by storing the Hard Drive and the Personal Information it contained in a cluttered, unlocked cabinet.
[45] Secondly, the Plaintiffs argue that the Defendant failed to comply with its “Encryption Policy,” which required that any sensitive Personal Information be encrypted, or electronically encoded into a form that cannot be decoded without the proper digital key, before it is stored on a portable device such as the Hard Drive.
[46] Lastly, the Plaintiffs argue that the Defendant failed to comply with the Treasury Secretariat and Privacy Commissioner’s recommendation that disclosure of any sensitive data loss be made as soon as possible.
The Breaches at Issue
[47] In summary, the Plaintiffs allege that the Defendant committed the following breaches of the Contracts:
a. Failure to adhere to the standards for the protection of Personal Information, as set out in the statutes that are expressly referred to in the Contracts;
b. Failure to adhere to the Minister’s policies;
c. Disclosure of Personal Information in a manner not permitted under the Contracts;
d. Failure to destroy the Personal Information in the manner required by the Contracts:
e. Retention of the Personal Information for a period longer than allowed under the terms of the Contracts and for purposes not allowed by the Contracts.
[48] The Plaintiffs contend that contractual claims are one of the most common areas of class action certification. In Robinson v Rochester al, 2010 ONSC 463 at paragraph 44, for instance, the Court said:
Whether a defendant was in a contractual relationship with members of the class, the terms of that contract, and whether the defendant breached the contract may constitute common issues: Hickey-Button v. Loyalist College of Applied Arts & Technology, [2006] O.J. No. 2393 (C.A.).
[49] As for damages, the Plaintiffs acknowledge that their claims, much like those of the Class Members, are for very small sums. However, they submit that nominal damages have long been awarded by Canadian courts in order to recognize a breach of contract, even if it does not have a clear economic impact, or if that impact cannot easily be assessed. They point to Fraser Park South Estates Ltd v Lang Michener Lawrence & Shaw, 2001 BCCA 9 at paragraph 46, which says that every “breach of contract is a violation of a right […] which entitles the victim to damages even if only nominal.”
[50] The Defendant does not submit any arguments concerning the cause of action in breach of contract. It denies, however, that the Plaintiffs have properly alleged a basis in fact for damages suffered as a result of this breach. It further argues that nominal damages should never be awarded in a class action as it would not favour the plaintiffs but rather their counsel, since the latter would be the only ones effectively standing to benefit financially from the outcome.
[51] The Defendant advances an interesting and strong argument on this point but the Plaintiffs’ position, although novel in the context of a class proceeding is supported by sufficient authorities that this cause of action should be considered on the merit of the action. In other words, it is not plain and obvious that the cause of action in contract would fail. As to any disproportionate advantages in favour of the Plaintiffs’ counsel, the Court will also be better positioned to rule on that issue when it hears it on the merit.
b) The Commission of the Tort of Intrusion upon Seclusion (Invasion of Privacy)
[52] The Plaintiffs allege that the Defendant has committed the tort of intrusion upon seclusion. They point us to Jones v Tsige, 2012 ONCA 32 [Jones], where the Ontario Court of Appeal has recently confirmed the tort’s existence in Canada, as a category of a broader tort relating to invasion of privacy. I reproduce some relevant paragraphs from the decision to shed some light on this new tort:
[70] I would essentially adopt as the elements of the action for intrusion upon seclusion the Restatement (Second) of Torts (2010) formulation which, for the sake of convenience, I repeat here:
One who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person.
[71] The key features of this cause of action are, first, that the defendant's conduct must be intentional, within which I would include reckless; second, that the defendant must have invaded, without lawful justification, the plaintiff's private affairs or concerns; and third, that a reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish. However, proof of harm to a recognized economic interest is not an element of the cause of action. I return below to the question of damages, but state here that I believe it important to emphasize that given the intangible nature of the interest protected, damages for intrusion upon seclusion will ordinarily be measured by a modest conventional sum.
(d) Limitations
[72] These elements make it clear that recognizing this cause of action will not open the floodgates. A claim for intrusion upon seclusion will arise only for deliberate and significant invasions of personal privacy. Claims from individuals who are sensitive or unusually concerned about their privacy are excluded: it is only intrusions into matters such as one's financial or health records, sexual practises and orientation, employment, diary or private correspondence that, viewed objectively on the reasonable person standard, can be described as highly offensive.
[…]
[74] As I have indicated, proof of actual loss is not an element of the cause of action for intrusion upon seclusion. However, the question necessarily arises: what is the appropriate approach to damages in cases, like the present, where the plaintiff has suffered no pecuniary loss?
[75] Where the plaintiff has suffered no provable pecuniary loss, the damages fall into the category of what Professor Stephen M. Waddams, The Law of Damages, looseleaf (Toronto: Canada Law Book, 2011), at para. 10.50, describes as "symbolic" and others have labelled as "moral" damages: see Dulude v. Canada, 2000 CanLII 16085 (FCA), [2000] F.C.J. No. 1454, 192 D.L.R. (4th) 714 (C.A.), at para. 30. They are awarded "to vindicate rights or symbolize recognition of their infringement": Waddams, at para. 10.50. I agree with Prof. Waddams' observation that a conventional range of damages is necessary to maintain "consistency, predictability and fairness between one plaintiff and another".
[Emphasis added]
[53] The Plaintiffs contend that this tort applies, that it does not require the breach of privacy to be wilful as recklessness suffices, and that it does not require proof of harm to an economic interest. The Plaintiffs note that the Defendant’s conduct was indeed reckless, as its information technology staff failed to follow the Encryption Policy during a routine system upgrade:
[R]ather than securely deleting the Personal Information from the Hard Drive, the Defendant put the Personal Information in a cabinet that was not always locked—another violation of the HRSDC Policies—and ignored it for several months until another upgrade was planned.
[54] On its part, the Defendant contends that the claim as pleaded does not establish the elements required for the application of the tort of intrusion upon seclusion.
[55] Firstly, the Defendant submits that the Plaintiffs’ pleadings do not allege that the Defendant invaded their private affairs without justification, as is required by the second element of the test for the tort—in fact, paragraph 16 of the Consolidated Statement of Claim describes how the Defendant was lawfully in possession of the Plaintiffs’ Personal Information pursuant to the Contracts.
[56] Secondly, the Personal Information is not sufficiently intrusive to give rise to the cause of action—there is nothing deeply personal about this information that if disclosed could cause embarrassment or humiliation: it is “basic biographical information such as name, date of birth, address, social insurance number and student loan balance.”
[57] Finally, the harms alleged at paragraph 30 of the Plaintiffs’ Consolidated Statement of Claim, namely “inconvenience, frustration and anxiety,” are not as dire as the “distress, humiliation or anguish” put forward by the Ontario Court of Appeal in Jones.
[58] At the certification stage, I am satisfied that the Plaintiffs have sufficiently responded to the Defendants’ arguments. Firstly, they note that they have not claimed that the Defendant collected their Personal Information without lawful justification, but rather that it was disclosed in an unlawful way, and was not destroyed in accordance with statutory requirements. They refer us to paragraph 22 of their Consolidated Statement of Claim, which does in fact corroborate this.
[59] Secondly, the Plaintiffs maintain that, contrary to the Defendant’s contention, the information lost was not “basic biographical information,” but rather financial records as the tort requires—after all, it concerns the existence and amount of a debt obligation.
[60] Thirdly, the tort requires an intrusion that “a reasonable person would regard as highly offensive causing distress, humiliation or anguish,” not that the information at issue causes embarrassment or humiliation. Accordingly, the Defendant’s failure to protect the Personal Information by leaving the Hard Drive in an unlocked filing cabinet could satisfy that test.
[61] Finally, the Plaintiffs could be right when arguing that the Defendant is quibbling over semantics when it contends that the “inconvenience, frustration and anxiety” alleged to have been suffered by the Plaintiffs in their Consolidated Statement of Claim are not sufficiently serious to meet the standard of harm of “distress, humiliation or anguish” required by Jones. Frustration and anxiety could be forms of distress.
[62] On the issue of damages for the tort of intrusion upon seclusion, the Plaintiffs submit that nominal ones can be awarded. The Ontario Court of Appeal in Jones at paragraphs 77 and 87 held that damages are appropriate to remedy “intangible harm such as hurt feelings, embarrassment for mental distress, rather than damages for pecuniary losses,” in an amount “sufficient to mark the wrong that has been done”:
[77] Although the tort of intrusion upon exclusion has not been fully recognized in Ontario law, several cases award damages for invasion of privacy in conjunction with, or under the head of, a traditional tort such as nuisance or trespass. These claims typically involve intangible harm such as hurt feelings, embarrassment or mental distress, rather than damages for pecuniary losses. I attach, as Appendix A, a summary of these cases and the damages awarded and will briefly discuss the facts of some of those cases here.
[…]
[87] […]The factors identified in the Manitoba Privacy Act, which, for convenience, I summarize again here, have also emerged from the decided cases and provide a useful guide to assist in determining where in the range the case falls: (1) the nature, incidence and occasion of the defendant's wrongful act; (2) the effect of the wrong on the plaintiff's health, welfare, social, business or financial position; (3) any relationship, whether domestic or otherwise, between the parties; (4) any distress, annoyance or embarrassment suffered by the plaintiff arising from the wrong; and (5) the conduct of the parties, both before and after the wrong, including any apology or offer of amends made by the defendant.
[63] Since the hearing held in December 2013, the parties have brought to my attention a recent decision by the Ontario Superior Court of Justice, which dismissed a motion to strike out a claim based on the tort of intrusion upon seclusion or invasion of privacy (Hopkins v Kay, 2014 ONSC 321 [Hopkins]). In Hopkins, the plaintiffs allege that the defendants, a hospital, seven of its employees, and a college, wrongfully and intentionally accessed the private medical information of 280 patients without their consent. The parties have not provided me with any arguments relating to this decision. Nonetheless, I take note of Justice Edwards’ comments in the matter:
[30] I am not satisfied from a review of Jones that it should be, as suggested by counsel for the Hospital, restricted to the facts of that case. Rather, I am of the view that the Court of Appeal in Jones has determined that the common law right to proceed with a claim, based on the tort of breach of privacy, as alleged in the plaintiff’s statement of claim is a claim that should be allowed to proceed. This is not a case that, in my view, is so plain and obvious that the court should strike out the claim.
[64] Accordingly, it is not plain and obvious that an action based on the tort of intrusion upon seclusion would fail.
Damages being an essential element of the cause of action
c) Negligence and Breach of confidence
[65] The crux of the Defendant’s argument against the Plaintiffs’ claim for negligence and breach of confidence lies in its adamancy that they have failed to raise any sufficient arguments with regard to the existence of compensable damages.
[66] The damages sought by the Plaintiffs fall into