Sweet v. Canada

Sweet v. Canada
Court (s) Database
Federal Court Decisions
Date
2022-08-25
Neutral citation
2022 FC 1228
File numbers
T-982-20
Notes
Reported Decision
A correction was made on November 25, 2024
Decision Content
Date: 20220825
Docket: T-982-20
Citation: 2022 FC 1228
Ottawa, Ontario, August 25, 2022
PRESENT: The Honourable Mr. Justice Southcott
CERTIFIED CLASS ACTION
BETWEEN:
TODD SWEET
Plaintiff
and
HER MAJESTY THE QUEEN
Defendant
ORDER AND REASONS
I. Overview
[1] This decision relates to a motion by the Plaintiff dated December 2, 2021, seeking an order certifying this action as a class proceeding under Rule 334.16 of the Federal Courts Rules, SOR/98-106 [the Rules] and granting an order under Rule 334.17. This action relates to data breaches in which hacker(s) gained access to the personal, financial and other information of what appears to be thousands of Canadians through Government of Canada websites.
[2] As explained in greater detail below, the Plaintiff’s motion is granted, because I have found that the Plaintiff has satisfied the requirements of Rule 334.16.
II. Procedural Background
[3] The Plaintiff, Todd Sweet, is the proposed class representative for the proposed class proceeding. He is a resident of Clinton, British Columbia. The Defendant, Her Majesty the Queen, is named as representative of the Government of Canada [the Government] including the Minister of National Revenue of Canada (the Minister responsible for the Canada Revenue Agency [CRA]) and the Minister of Families, Children, and Social Development (the Minister responsible for Employment and Social Development Canada [ESDC]).
[4] The Plaintiff asserts that, on July 2, 2020, he logged in to his CRA online account after receiving emails notifying him that his email address had been removed from his account. He discovered that his direct deposit information had been changed and that, on June 29, 2020, using his account, an unknown and unauthorized individual had made four applications for the Canada Emergency Response Benefit [CERB], a program initiated by the Government to provide financial assistance to qualifying Canadians during the COVID-19 pandemic.
[5] The Plaintiff is one of a potential class of what appears to be thousands of people whose online Government accounts (including CRA accounts [styled for users as My Accounts], My Service Canada Accounts for which ESDC is responsible, and other online accounts accessed via the Government of Canada Branded Credential Service Key [GCKey]) were vulnerable to hackers from approximately June to August of 2020, due to what the Plaintiff alleges were operational failures by the Defendant to properly secure the portals providing access to these accounts. The Plaintiff further alleges that, by obtaining unauthorized access to those accounts, hacker(s) were able to commit identity theft and CERB fraud and access sensitive and personal information including, e.g., Social Insurance Numbers [SINs], direct deposit banking information, tax information, dates of birth, records of employment, information regarding employment insurance, and other benefits information.
[6] On August 24, 2020, the law firm Murphy Battista LLP [Murphy Battista] commenced this action in the Federal Court on behalf of proposed class representatives who alleged that their online Government accounts had been accessed by hackers. However, in early April 2021, that firm experienced its own data breach, in which unauthorized parties were able to gain access to the firm’s networks. The Defendant subsequently brought a motion to stay this action, because the Federal Court lacks the jurisdiction to hear a third party claim that the Defendant intended to pursue against the law firm, seeking contribution and indemnity in relation to any liability of the Defendant to members of the proposed class who may have had their information compromised in both the Government data breaches and the law firm data breach.
[7] Present Plaintiff’s counsel, Rice Harbut Elliott LLP [Rice Harbut], subsequently replaced Murphy Battista and, in opposing the Defendant’s stay motion, prepared pleading amendments intended to narrow the proposed class and the scope of its claim (to exclude persons who contacted Murphy Battista about this class action) such that the Defendant would no longer have a basis to assert its claim for contribution and indemnity. Those amendments culminated with a draft Third Amended Statement of Claim [Third SOC], which would also replace the previously proposed class representatives with Mr. Sweet as Plaintiff.
[8] This proceeding is being case managed by the undersigned and Associate Justice Ring. By Order and Reasons dated December 20, 2021, I dismissed the Defendant’s stay motion and, by Order dated January 20, 2022, I approved the filing of the Third SOC and the substitution of Mr. Sweet as the proposed representative Plaintiff for the class.
[9] The parties subsequently completed the service and filing of their records for the certification motion, which they argued orally in Vancouver on May 11-13, 2022. The Plaintiff’s filings culminated with a Reply Memorandum of Fact and Law, which attached a draft Fourth Further Amended Statement of Claim [Fourth SOC] that the Plaintiff seeks leave to file (opposed by the Defendant) in the event the amendments therein are necessary to respond to certain of the Defendant’s arguments. The Plaintiff seeks certification of a class defined as follows (with the underlined portion representing the only change from the Third SOC to the Fourth SOC):
All persons whose personal or financial information in their Government of Canada Online Account was disclosed to a third party without authorization on or after March 1, 2020, excluding Excluded Persons.
“Government of Canada Online Account” means:
a)Canada Revenue Agency account;
b)My Service Canada account; or
c)another Government of Canada online account, where that account is accessed using the Government of Canada Branded Credential Service (GCKey).
“Excluded Persons” means all persons who contacted Murphy Battista LLP about the CRA privacy breach class action, with Federal Court file number T-982-20 prior to June 24, 2021.
(Collectively “Class” or “Class Members”)
[10] The Plaintiff advances causes of action against the Defendant based on the torts of systemic negligence, breach of confidence, and intrusion upon seclusion, as well as invoking the vicarious liability provisions of the Crown Liability and Proceedings Act, RSC 1985, c C-50. He pleads that he and the other class members have suffered damages including: costs incurred in preventing identity theft; identity theft; increased risk of future identity theft; damage to credit reputation; mental distress and comparable effects; monies withdrawn from their bank accounts without their consent; loans applied for in their names without their consent; credit card fraud; inability to access benefits and payments they were entitled to and other losses resulting therefrom; out-of-pocket expenses; time lost in communication with the CRA, ESDC and other Crown agencies to address the data breaches; and time lost in precautionary communications with third parties such as credit agencies to inform them of the potential that personal and financial information may have been compromised.
[11] The present motion seeks an order certifying this action as a class action and granting an order under Rule 334.17 in connection with such certification. This includes certifying the following proposed common questions:
Systemic Negligence
Did the Defendant owe the Class a duty of care?
If so, what was the applicable standard of care?
Did the Defendant breach the applicable standard of care?
Did the Defendant’s breach of duty cause damage to the Class?
Breach of Confidence
Is the Defendant liable for the tort of breach of confidence vis-à-vis Class Members?
Intrusion Upon Seclusion
A. Is the Defendant liable for the tort of intrusion upon seclusion vis-à-vis Class Members?
Damages
Can the Court make an aggregate assessment of all or part of the damages suffered by Class Members and, if so, in what amount?
Does the conduct of the Defendant merit an award of punitive damages and, if so, in what amount?
[12] The Defendant takes the position that the request for certification should be denied, arguing that none of the requirements for certification are met. The Defendant has also filed motions, asking that the Court strike an affidavit of one of the Plaintiff’s factual witnesses (Elizabeth Emery) and strike certain paragraphs of the report of one of the Plaintiff’s experts (Dr. Douglas Allen) or alternatively ascribe little weight to such evidence. These motions were argued at the commencement of the hearing of the certification motion and are addressed in these Reasons.
III. Issues
[13] Based on the parties’ written and oral submissions, the issues for the Court’s determination are as follows:
Should the Court strike certain paragraphs of Dr. Allen’s expert report?
Should the Court strike the affidavit of Elizabeth Emery?
Has the Plaintiff satisfied the criteria of Rule 334.16, such that this proceeding should be certified?
[14] I note that the Plaintiff’s Memorandum of Fact and Law raised as additional issues whether Rice Harbut should be appointed as class counsel and whether the Defendant should be required to disclose to Rice Harbut and the notice provider the names, mailing addresses, and email addresses of all class members, where that information is within the knowledge of the Defendant. However, the appointment of Rice Harbut has already been confirmed in my Order dated January 20, 2022, and at the hearing of the present motion, the Plaintiff’s counsel advised that he was advancing no particular submissions on the disclosure issue at this juncture. Counsel proposed that, if the proceeding is certified, this issue can be addressed subsequently through the case management process. This Judgment and Reasons therefore do not address that issue.
IV. Analysis
A. General Principles
[15] Before turning to analysis of the issues, it is useful to set out some general principles that apply to the certification of class proceedings. As I understand it, none of these principles are in dispute between the parties. This motion is governed principally by Rules 334.16(1) and (2), which provide as follows:
Certification
Autorisation
Conditions
Conditions
334.16 (1) Subject to subsection (3), a judge shall, by order, certify a proceeding as a class proceeding if
334.16 (1) Sous réserve du paragraphe (3), le juge autorise une instance comme recours collectif si les conditions suivantes sont réunies :
(a) the pleadings disclose a reasonable cause of action;
a) les actes de procédure révèlent une cause d’action valable;
(b) there is an identifiable class of two or more persons;
b) il existe un groupe identifiable formé d’au moins deux personnes;
(c) the claims of the class members raise common questions of law or fact, whether or not those common questions predominate over questions affecting only individual members;
c) les réclamations des membres du groupe soulèvent des points de droit ou de fait communs, que ceux-ci prédominent ou non sur ceux qui ne concernent qu’un membre;
(d) a class proceeding is the preferable procedure for the just and efficient resolution of the common questions of law or fact; and
d) le recours collectif est le meilleur moyen de régler, de façon juste et efficace, les points de droit ou de fait communs;
(e) there is a representative plaintiff or applicant who
e) il existe un représentant demandeur qui:
(i) would fairly and adequately represent the interests of the class,
(i) représenterait de façon équitable et adéquate les intérêts du groupe,
(ii) has prepared a plan for the proceeding that sets out a workable method of advancing the proceeding on behalf of the class and of notifying class members as to how the proceeding is progressing,
(ii) a élaboré un plan qui propose une méthode efficace pour poursuivre l’instance au nom du groupe et tenir les membres du groupe informés de son déroulement,
(iii) does not have, on the common questions of law or fact, an interest that is in conflict with the interests of other class members, and
(iii) n’a pas de conflit d’intérêts avec d’autres membres du groupe en ce qui concerne les points de droit ou de fait communs,
(iv) provides a summary of any agreements respecting fees and disbursements between the representative plaintiff or applicant and the solicitor of record.
(iv) communique un sommaire des conventions relatives aux honoraires et débours qui sont intervenues entre lui et l’avocat inscrit au dossier.
Matters to be considered
Facteurs pris en compte
(2) All relevant matters shall be considered in a determination of whether a class proceeding is the preferable procedure for the just and efficient resolution of the common questions of law or fact, including whether
(2) Pour décider si le recours collectif est le meilleur moyen de régler les points de droit ou de fait communs de façon juste et efficace, tous les facteurs pertinents sont pris en compte, notamment les suivants :
(a) the questions of law or fact common to the class members predominate over any questions affecting only individual members;
a) la prédominance des points de droit ou de fait communs sur ceux qui ne concernent que certains membres;
(b) a significant number of the members of the class have a valid interest in individually controlling the prosecution of separate proceedings;
b) la proportion de membres du groupe qui ont un intérêt légitime à poursuivre des instances séparées;
(c) the class proceeding would involve claims that are or have been the subject of any other proceeding;
c) le fait que le recours collectif porte ou non sur des réclamations qui ont fait ou qui font l’objet d’autres instances;
(d) other means of resolving the claims are less practical or less efficient; and
d) l’aspect pratique ou l’efficacité moindres des autres moyens de régler les réclamations;
(e) the administration of the class proceeding would create greater difficulties than those likely to be experienced if relief were sought by other means.
e) les difficultés accrues engendrées par la gestion du recours collectif par rapport à celles associées à la gestion d’autres mesures de redressement.
[16] As a general statement of the objectives of class action legislation, Chief Justice McLachlin provided the following explanation in Hollick v Toronto (City) 2001 SCC 68 at para 15:
15 The Act reflects an increasing recognition of the important advantages that the class action offers as a procedural tool. As I discussed at some length in Western Canadian Shopping Centres (at paras. 27-29), class actions provide three important advantages over a multiplicity of individual suits. First, by aggregating similar individual actions, class actions serve judicial economy by avoiding unnecessary duplication in fact-finding and legal analysis. Second, by distributing fixed litigation costs amongst a large number of class members, class actions improve access to justice by making economical the prosecution of claims that any one class member would find too costly to prosecute on his or her own. Third, class actions serve efficiency and justice by ensuring that actual and potential wrongdoers modify their behaviour to take full account of the harm they are causing, or might cause, to the public. …
[17] Other than the first requirement of Rule 334.16(1)—that the pleadings disclosing a reasonable cause of action, the test for which will be explained later in these Reasons—the threshold for meeting the requirements for certification is the establishment of “some basis in fact” to support the certification order. The law is clear that the “some basis in fact” threshold does not require that the party seeking certification establish the certification requirements on a balance of probabilities. Indeed, this standard does not require that the Court resolve conflicting facts and evidence at the certification stage. Rather, it reflects the fact that, at the certification stage, the Court is ill-equipped to resolve conflicts in the evidence or to engage in finely calibrated assessments of evidentiary weight (see Pro-Sys Consultants Ltd v Microsoft Corporation, 2013 SCC 57 [Pro-Sys] at paras 101-102).
B. Should the Court strike certain paragraphs of Dr. Allen’s expert report?
[18] The Plaintiff’s certification motion record includes a report dated December 11, 2020, by Dr. Douglas Allen, an economist with Delta Economic Group Inc. As identified in his report, Dr. Allen was instructed to address two questions:
What would an economist consider is the scope of costs associated with identity theft?
What methodologies exist to estimate an average cost of this particular identity theft?
[19] The Plaintiff relies on Dr. Allen’s evidence as relevant to the following proposed common issue that he seeks to certify:
Can the Court make an aggregate assessment of all or part of the damages suffered by Class Members and, if so, in what amount?
[20] In response to Dr. Allen’s report, the Defendant’s motion record includes a report dated July 13, 2021, by Chris Polson and Jake Dwhytie of PricewaterhouseCoopers LLP [the PWC Report]. The Plaintiff in turn served a reply report by Dr. Allen dated July 22, 2021. The Defendant subsequently cross-examined Dr. Allen on both his reports.
[21] The Defendant’s motion relates to the first of Dr. Allen’s reports [the Allen Report] and seeks:
to strike certain paragraphs on the basis that they violate a jurisprudential prohibition, applicable at the certification stage of a proceeding, against introducing evidence quantifying damages; and
to strike certain other paragraphs on the basis that they violate a jurisprudential prohibition, applicable at the certification stage of a proceeding, against using a random sampling of actual class members to calculate damages.
[22] Invoking the criteria prescribed by R v Mohan, [1994] 2 SCR 9, 114 DLR (4th) 419 [Mohan] for the admissibility of expert evidence, the Defendant argues that these two sets of paragraphs of the Allen Report are inadmissible, because they are both irrelevant and unnecessary to assist the Court in deciding the certification motion.
[23] First, the Defendant challenges paragraphs 12a, 14a, 21a (last sentence), 26-28, 31 and 38 of the Allen Report. These paragraphs relate to the first of two methodologies the Allen Report proposes for estimating the average cost of the identify theft that is the subject of this action. That methodology involves using information that is publicly available from a random sampling survey on identity theft. Dr. Allen explains how such information could be employed in that quantification methodology, including arriving at what he refers to as a base or floor estimate of the average cost per person.
[24] The Defendant recognizes that the Court can consider at the certification stage whether aggregate damages can be considered a common issue, but it emphasizes that the quantification of damages is not a matter to be considered at this stage. The Defendant relies, inter alia, on Pro-Sys at paras 113-115, which noted that, during a certification proceeding, a court may contemplate whether loss to the class members can be established on a class-wide basis and that this process may require the use of expert evidence. However, the Supreme Court explained that it is not necessary at the certification stage that the methodology establish the actual loss to the class, only that that there is a methodology capable of doing so.
[25] Against this jurisprudential backdrop, I do not find the first set of impugned paragraphs of the Allen Report problematic. The Plaintiff offers that evidence not for the purpose of quantifying his damages or those of the proposed class members but rather to support his position that there is an available methodology for quantifying the class members’ damages on an aggregate basis. This is a purpose expressly contemplated by Pro-Sys as relevant to the certification stage of a proceeding. As explained by the Court of Appeal for Ontario in Fulawka v Bank of Nova Scotia, 2012 ONCA 443 [Fulawka] at para 81 (cited by the Federal Court in McCrea v Canada (Attorney General), 2015 FC 592 [McCrea] at para 351), a plaintiff is required to adduce supporting evidence to demonstrate that there is a workable methodology for determining issues of causation or damages, if proposed, on a class-wide basis.
[26] Next, the Defendant argues that paragraphs 14b, 32-36, and 39 of the Allen Report are inadmissible for violating a certification stage prohibition against using a random sampling of actual class members to calculate damages. As previously noted, Dr. Allen proposes two methodologies for calculating damages. The second methodology involves conducting a survey of a random sample of class members. The Defendant submits that such a methodology is prohibited by law, because it requires proof by individual class members.
[27] In support of this position, the Defendant relies on the decision of the Court of Appeal for Ontario in Fulawka at paragraph 137, which rejected an expert’s random sampling methodology because it impermissibly required proof from individual class members in order to arrive at an aggregate damages figure. The Court reasoned that this methodology was antithetical to the requirement in s 24(1)(c) of the Ontario Class Proceedings Act, 1992, SO 1992, c 6 [the Ontario Act], which authorizes a common issues trial judge to assess damages on an aggregate basis where the aggregate amount of the defendant’s liability can reasonably be determined without proof by individual class members.
[28] In response, the Plaintiff identifies other authorities from courts in Ontario and British Columbia that he argues support his position that Fulawka is a jurisprudential outlier on the point on which the Defendant relies. These authorities include a recent decision of the Ontario Superior Court of Justice in Fresco v Canadian Imperial Bank of Commerce, 2020 ONSC 4288 at paras 20-22, in which Justice Belobaba described the decision on this point in Fulawka as an outlier, inconsistent with other jurisprudence of the Court of Appeal for Ontario and the language of the Ontario Act. Justice Belobaba invited the Court of Appeal to revisit this point.
[29] However, in the appeal from Justice Belobaba’s decision, the Court of Appeal for Ontario declined this invitation, neither affirming nor departing from Fulawka (see Fresco v Canadian Imperial Bank of Commerce, 2022 ONCA 115 at paras 89-90). The Court concluded that any ruling on the disputed point would have to wait until the completion of the plaintiff's proposed damages report, when it would be known whether statistical sampling would be used to fill any evidentiary gaps.
[30] While these cases upon which the Plaintiff relies may suggest that the law in Ontario on this point is somewhat unsettled, it remains the case that Fulawka represents the most recent pronouncement on the law in Ontario by its Court of Appeal. However, I find compelling the Plaintiff’s argument that Fulawka is based on a provision of the Ontario Act that does not appear in the Rules of the Federal Court that apply to the present proceeding. The Defendant acknowledges that the Rules do not contain a provision similar to s 24(1)(c) but argues that, in McCrea at para 351, the Federal Court explicitly reviewed and adopted the principles of certification set out in Fulawka.
[31] In my view, McCrea does not assist the Defendant, who relies on Justice Kane’s summary at paragraphs 350-352 of a list of principles set out at paragraph 81 of Fulawka regarding the establishment of a common issue. McCrea does not refer to, and I do not read it as necessarily endorsing, the analysis at paragraph 137 of Fulawka, based on s 24(1)(c) of the Ontario Act, upon which the Defendant’s argument relies.
[32] The Plaintiff notes that Rule 348.28 addresses the Federal Court’s authority to make aggregate assessments in class proceedings as follows:
334.28 (1) A judge may make any order in respect of the assessment of monetary relief, including aggregate assessments, that is due to the class or subclass.
334.28 (1) Le juge peut rendre toute ordonnance relativement à l’évaluation d’une réparation pécuniaire, y compris une évaluation globale, qui est due au groupe ou au sous-groupe.
…
…
(3) For the purposes of this rule, a judge may order any special modes of proof.
(3) Pour l’application de la présente règle, le juge peut ordonner le recours à des modes de preuve spéciaux.
[33] I agree with the Plaintiff’s submission that these provisions do not include the restriction found in s 24(1)(c) of the Ontario Act. Indeed, Rule 334.28(3) expresses in broad terms the Court’s authority to order special modes of proof in connection with an aggregate assessment.
[34] The Plaintiff also notes that, in Cuzzetto v Business in Motion International Corporation, 2014 FC 17 [Cuzzetto] at paras 102-103, Justice Rennie (then of the Federal Court) cited Rule 334.28 and stated that aggregate damages awards are available even if identifying class members who would be entitled to an award would be impractical or would require a case-by-case analysis. This statement appears inconsistent with the principle from Fulawka upon which the Defendant relies. Moreover, Justice Rennie explained in Cuzzetto that some guidance as to the appropriate amount of an aggregate award could be derived from an analysis which included data provided by class members in response to a survey conducted by counsel (at paras 99, 100, and 106).
[35] The Defendant also advances an argument that the prohibition against random sampling described in Fulawka should apply to this proposed class proceeding, because there is no commonality among the proposed class members in relation to any damages to which they might be entitled as a result of the data breaches. Therefore, says the Defendant, a methodology employing a random sampling of the losses of actual class members would not assist the Court in accurately calculating aggregate damages.
[36] In my view, this argument does not speak to the admissibility of Dr. Allen’s evidence. It is available to the Defendant to take the position on the main certification motion that the test for identification of common issues, including the application of that test to the proposed aggregate damages issue in particular, is not met. However, I do not see how this argument supports a conclusion that the impugned paragraphs of the Allen Report are inadmissible pursuant to a prohibition that is absent from the Rules.
[37] In relation to both sets of impugned paragraphs, I find that the evidence in the Allen Report is relevant to the Court’s task of determining whether to certify the proposed common issue surrounding aggregate damages. I also accept the Plaintiff’s submissions that economic models for assessing the cost of identity theft are beyond the ordinary understanding of a Court. I therefore consider the impugned evidence to satisfy both the relevance and necessity criteria of Mohan.
[38] The Defendant notes that Dr. Allen acknowledged in cross-examination that his report is based on certain assumptions, including that all losses suffered by the proposed class members resulted from the data breaches at issue, that the harm suffered was common throughout the class, that the Court has already found that the Defendant had a common duty to the class, and that the Court has ruled in the Plaintiff’s favour concerning causation and the applicable standard of care. The Defendant argues that such assumptions are prejudicial, because they depend on a finding of liability not yet made. The Defendant also submits that it is prejudicial for the Allen Report to be presenting a quantification figure.
[39] I find no merit to these arguments. It is not uncommon for an expert to make assumptions about the resolution of factual or legal issues upon which the expert is not personally opining. Obviously, if the assumptions turn out to be inaccurate, that may undermine the value of the opinion on the issue on which the expert is opining or indeed may eliminate that issue. However, I disagree with the Defendant’s position that the fact the assumptions underlying the opinion are favourable to one party serves to prejudice the other party and thereby render the opinion inadmissible. The Court is capable of recognizing assumptions for what they are.
[40] Similarly, the fact that the Allen Report arrives at a floor or base quantification figure in demonstrating one of its proposed methodologies does not detract from the Court’s ability to consider the methodological evidence, as distinct from its possible result, for the purpose that is relevant to the certification motion.
[41] I find the impugned paragraphs of the Allen Report admissible in the certification motion. The Defendant also relies on the evidence in the PWC Report in support of an argument that, if the impugned paragraphs are admitted, the Allen Report should be afforded little weight. I will return to that argument later in these Reasons, when analysing whether the Plaintiff has satisfied the criteria of Rule 334.16 such that this proceeding should be certified.
C. Should the Court strike the affidavit of Elizabeth Emery? [42] The Defendant seeks to strike the second Affidavit of Elizabeth Emery, affirmed on July 23, 2021 [the Second Emery Affidavit], contained in the Plaintiff’s reply motion record for certification on the basis that it fails to identify the source of the affiant’s information and belief, is irrelevant to the certification criteria, contains unreliable opinion evidence, and constitutes improper reply.
[43] To place the Second Emery Affidavit in context, it is useful to explain briefly the evidentiary record before the Court in the certification motion. In its original motion record, the Plaintiff filed a number of affidavits from proposed class members (or those who would have been members of the proposed class before the change in the proposed definition explained above), a first affidavit from Ms. Emery (then an articled clerk and now a lawyer at Murphy Battista, the law firm representing the previous plaintiffs in this matter), and two expert reports (including the Allen Report referenced earlier in these Reasons). The Defendant’s response includes affidavits from various government officials and expert reports of PricewaterhouseCoopers LLP (including the PWC Report referenced earlier in these Reasons). The Plaintiff’s reply evidence contains additional affidavits including the Second Emery Affidavit.
[44] The Second Emery Affidavit appends various newspaper articles reporting on the wait times for the CRA helpline, the precautionary suspension of My Accounts by CRA in February and March of 2021, and the impact of CERB fraud on taxpayers’ income tax. Ms. Emery also appends a news release indicating that the Taxpayers’ Ombudsperson will conduct a review of the communications CRA provided to taxpayers when it locked users out of their My Accounts in February 2021, as well as a statement from CRA regarding its decision to lock users’ My Accounts to prevent unauthorized access.
[45] Ms. Emery states that her affidavit is affirmed in reply to the Defendant’s responding motion record and specifically the PWC Report (which, as previously explained, responds to the Allen Report’s opinion on methodologies for quantifying damages) and the affidavits of two government officials, Brian Rae and Mahmoud Gad.
[46] Mr. Rae is the Director, Digital Operations Division, in the Digital Services Directorate, Assessment, Benefit and Service Branch of CRA. His affidavit, affirmed June 8, 2021 [the Rae Affidavit] explains the CRA My Accounts; different ways to register for and log in to My Accounts; links between CRA and ESDC; My Accounts’ security measures during the summer 2020 data breaches; CRA’s disabling of online access and notification letters to affected individuals; CRA’s timeframes for sending notification letters and follow-up letters; CRA’s security check letters; its disabling of online access to My Accounts in February 2021; and the revocation of individual credentials in March 2021.
[47] Mr. Gad is a Senior Technical Advisor in the Information Technology Branch of CRA. In his affidavit affirmed June 30, 2021 [the Gad Affidavit], he addresses CRA’s multi-layered security approach to the defence of its networks, systems, and portal applications against infiltration by hostile actors; login methods for CRA portal services; actions taken by CRA in response to the data breaches (also described as cyber security incidents); details regarding the credential stuffing attack (explained later in these Reasons as the type of cyber security incidents involved in this matter); the impact of the cyber security incidents; the CRA information technology security analysis of whether individual affiant accounts were affected by the cyber security incidents; and the payment of CERB to individuals who qualified but did not receive it as a result of actions of bad actors. (I note that, in their evidence and submissions, the parties use the terms “hacker”, “bad actor” and “threat actor” relatively interchangeably to refer to the person or persons who perpetrated the relevant data breaches.)
[48] In challenging the admissibility of the Second Emery Affidavit, the Defendant first argues that it consists entirely of hearsay evidence that is outside Ms. Emery’s personal knowledge and is therefore inadmissible because it offends the requirements of Rule 81(1) by failing to identify the deponent’s source of information and belief. Ms. Emery states in her affidavit that she has personal knowledge of the facts and matters deposed to therein. She also states that, where facts are not within her personal knowledge, she has stated the source of the information and believes that information to be true. However, the Defendant argues that these boilerplate statements do not satisfy Rule 81(1), which requires an explanation of the basis for a deponent’s belief sufficient to demonstrate the reliability thereof (see, e.g., Kish v Facebook Canada Ltd, 2021 SKQB 198 at para 17; Williams v Canon Canada Inc, 2011 ONSC 6571 at para 102; Thorpe v Honda Canada, Inc, 2010 SKQB 39 at para 27).
[49] The Plaintiff’s counsel admits that the boilerplate statements in the Second Emery Affidavit are inelegant but argue that this does not affect the admissibility of the evidence, because it is not being relied upon for a hearsay purpose, i.e., to establish the truth of its contents. Therefore, Rule 81(1) does not apply. The Plaintiff relies on authority that, on a certification motion where the moving party need only establish that there is some basis in fact for the certification criteria, evidence can be admitted, even though it would not be admissible for the truth of its contents, in order to support, along with other evidence, that there is some basis in fact for those criteria (see, e.g., Canada v Greenwood, 2021 FCA 186 at para 96; Johnson v Ontario, 2016 ONSC 5314 [Johnson] at paras 54-67). As I summarized the conclusions in Johnson in Tippett v Canada, 2019 FC 869 [Tippett] at para 24:
24. The Plaintiff relies on the decision in Johnson v Ontario, 2016 ONSC 5314 at paras 54-67, which explained that, while a certification motion is not to be treated as an “evidentiary free for all,” the procedural nature and purpose of the motion must be kept in mind. The Court held that, while the evidence contained in inquest material and newspaper articles, as well as an ombudsman report referenced therein, was not admissible for the truth of its contents, it could be considered and assessed, along with the frailties it may contain, to determine whether the moving party has met the onus of establishing some basis in fact for the certification requirements.
[50] Relying on these principles, I do not find the Second Emery Affidavit inadmissible based on the Defendant’s hearsay arguments. For the same reasons, I reject the Defendant’s arguments that the evidence is inadmissible because it includes unreliable opinions. To the extent the news articles attached as exhibits to the Second Emery Affidavit include statements of opinions, they are not at this stage of the proceeding being introduced for the truth of their contents, and their reliability is not presently at issue.
[51] The Defendant also submits that the Second Emery Affidavit should be struck because it is irrelevant to the issues in the certification motion and is not proper reply evidence. The Defendant asserts this argument first in relation to the evidence in the Second Emery Affidavit said to be offered in reply to paragraphs 66 to 71 of the Rae Affidavit, in which Mr. Rae explains that CRA disabled online accounts in February 2021 and revoked potentially compromised credentials in March 2021. The Defendant notes Mr. Rae’s evidence that these measures related to accounts that were not compromised in the 2020 breaches. The Defendant therefore submits that the articles attached to the Second Emery Affidavit, reporting on taxpayers’ reactions to these measures, are unrelated to the allegations in this proceeding. The Plaintiff responds that the Defendant cannot be certain that the risks to which CRA was responding in 2021 were unrelated to the 2020 breaches. I accept this submission, as the disputed articles include a Times Colonist report on the concerns of a taxpayer, reacting to being locked out of his account in February 2021, after having also been affected by CRA’s data breach in August 2020.
[52] As to whether this evidence, related to taxpayers’ reactions to the measures taken by CRA in February and March 2021, is proper reply, I am guided by the explanation in Angelcare Development Inc v Munchkin, Inc, 2020 FC 1185 at para 10 (quoting from Halford v Seed Hawk Inc, 2003 FCT 141):
10. From the principle against case splitting, Justice Pelletier in Halford draws a general rule on the scope of reply evidence, stating at paragraph 14 that:
14. evidence which simply confirms or repeats evidence given in chief is not to be allowed as reply evidence. It must add something new. But since the plaintiff is not allowed to split its case, that something new must be evidence which was not part of its case in chief. That can only leave evidence relating to matters arising in defence which were not raised in the plaintiff's case in chief. …
[Emphasis in original.]
[53] The Defendant’s materials responding to the certification motion describe the February and March 2021 measures as demonstrating proactive steps taken by CRA to contain and eradicate the cyber security incident. This evidence therefore relates to a matter arising in defence, and it is appropriate for the Plaintiff to reply with evidence on what he would characterize as adverse effects of those measures and potentially linking those measures to the 2020 data breaches. I therefore find that the paragraphs of the Second Emery Affidavit and related exhibits, offered in reply to paragraphs 66 to 71 of the Rae Affidavit, are admissible.
[54] However, I have reached the opposite conclusion on the evidence offered in reply to paragraphs 47 and 48 of the Rae Affidavit. In those paragraphs, Mr. Rae explains how CRA provided notification to some of the My Account holders affected by the 2020 data breaches, including security protocols to be employed when they contacted the CRA call centre in response to such notification. The Second Emery Affidavit references (at paragraph 2) and attaches (at Exhibits B and C) articles on lengthy wait times and resulting frustration experienced by callers. However, the Defendant points out that several of the proposed class member affiants provid