A class action suit that sought compensatory and punitive damages against credit-reporting company Equifax Inc. following a massive global data breach that affected more than 143 million people worldwide, including 19,000 Canadians, was refused certification after Quebec Superior Court held that Quebec law does not recognize compensatory damages for data breaches.
The decision, the latest of a rapidly growing body of Quebec jurisprudence dealing with security breaches, underlines that being the victim of a data breach is insufficient to claim damages even though there is prime facie evidence that a fault occurred, according to class action lawyers.
In a ruling that falls in line with recent Quebec jurisprudence, Quebec Superior Court Justice Donald Bisson held that the class action representative was not an “adequate” class representative, was unable to demonstrate that he suffered harm, and that “at the moment Quebec law does not recognize compensatory damages merely because personal information is in the hands of a third party” even though it is non-authorized.
“The principle established under Quebec law is that in order to be able to claim compensatory damages, the person who undertook the class action must have suffered a prejudice,” observed Anne Merminod, a Montreal class action lawyer with Borden Ladner Gervais LLP.
“This decision confirms that a hypothetical harm, the fear that one day this information may end up in the hands of someone with bad intentions is insufficient,” added Merminod.
On September 7, 2017, Equifax publicly announced that hackers had accessed the personal information of more than 143 million people. Equifax estimated that approximately 19,000 Canadians were affected, almost all of whom had their social insurance number, and other identifiers, compromised.
The breach occurred after hackers gained access to Equifax’s systems through a vulnerability the company had known about for more than two months but had not fixed, according to an investigation conducted by the Office of the Privacy Commissioner of Canada (OPC). Equifax had implemented poor security safeguards, retained information too long, had inadequate consent procedures, and offered limited protection measures to affected individuals after the breach, added the OPC report. Since the breach, Equifax had taken steps to improve their security, accountability and data destruction programs, and has agreed to enter into a compliance agreement with the OPC.
The credit-reporting company also agreed on July 2019 to settle with the U.S. Consumer Financial Protection Bureau, the Federal Trade Commission and 48 states and pay US$700 million in monetary relief to consumers and a civil penalty.
Lawsuits were also filed across Canada, including Saskatchewan, Ontario and Quebec.
The Quebec class action, launched by class action representative Daniel Li, sought damages and redress for harm, inconveniences, economic losses, mental distress or other losses from the unauthorized access to their confidential personal and information records. He argued that Equifax failed to safeguard personal and financial information of members of the group, contrary to article 1457 of the Civil Code of Quebec (CCQ). He also argued that the firm failed to respect the reputation and privacy of the class by preventing the disclosure of private information to third members without authorization, contrary to articles 3, 35, and 37 of the CCQ. Li also maintained that Equifax, through their acts or omissions, unlawfully interfered with the class’ right to respect for private life and their right to nondisclosure of confidential information protected by sections 5 and 9 of the Quebec Charter of Human Rights and Freedoms.
Justice Bisson, formerly a class action lawyer, held that Li had shown a fault occurred when Equifax failed to take necessary measures to protect personal information of the class, and that the company also breached the class’ privacy. But Justice Bisson underscored that the demonstration of an alleged fault does not presuppose the existence of a prejudice. He referred to recent case law, including the short but important Quebec Court of Appeal’s decision in Sofio c. Organisme canadien de réglementation du commerce des valeurs mobilières, 2015 QCCA 1820 that established the principle that the existence of tangible and financially compensable prejudice must be demonstrated in order for a class action to be authorized.
The risk that Li may be the victim of a fraud or identity theft in the future is a hypothetical and uncertain harm that is prohibited under article 1611 of the CCQ, said Justice Bisson in Li c. Equifax inc. 2019 QCCS 3440, issued on October 21st. “A risk is not a certain prejudice,” he said succinctly.
“The role of a class action is not to compensate for hypothetical harm, and in this sense, this kind of action, unless there is a clear manifestation of consequences suffered by some people, is an extremely difficult class action suit,” remarked Bruce Johnston, a class action expert with Trudel, Johnston and L’Ésperance in Montreal who was one of the driving forces behind the landmark tobacco class action.
The decision also highlights the importance of carefully choosing class representatives, said class action experts. A class representative must demonstrate prime facie the existence of a real prejudice, said Merminod, referring to the Supreme Court of Canada decision in Mustapha v. Culligan of Canada Ltd, 2008 2 SCR 114 which held that a prejudice is “serious and prolonged and rise(s) above the ordinary annoyances, anxieties and fears that people living in society routinely, if sometimes reluctantly, accept.”
Johnston added that it’s equally important for the class bar to be “conscious of the burden at the certification stage and to make sure that the class representative qualifies and can allege things that are not generalities but can allege damage that he suffered and that others in the class may have suffered,” said Johnston.
The class action representative is now in the midst of analyzing his options, said Erik Lowe, a class action lawyer with the Merchant Law Group who represented Li.
“We argued that the fact that personal information is in the hands of someone who may have bad intentions is a harm in itself,” said Lowe. “The Court decided otherwise, and it’s potentially something that we will contest.”
Lawyers representing Equifax declined to comment.
This story was originally published in The Lawyer’s Daily.