British Columbia courts need to delve deeply into whether the province has a tort for invasion of privacy, a judge on the appeals court suggested in a recent ruling following a data breach at a Vancouver-based financial institution.
“Today, personal information has played a vital role in people’s lives, and the failure to recognize at least a limited illegal act of invasion of privacy may be viewed by some as anachronistic,” wrote Judge Harvey Groberman for the BC Appeals Court at Tucci v . Peoples Trust Company, published August 31.
Based on the Tucci ruling, a class action lawsuit against Peoples Trust can be certified. Allegations that Peoples Trust is in any way liable for a breach have not been proven in court.
Gianluca Tucci and Andrew Taylor are listed as representative plaintiffs.
The August 31, 2020 ruling includes several changes to an earlier class action certification order published in 2017. However, the defendant trust company lost its offer to bring the lawsuit out of court.
However, one key takeaway from the original 2017 British Columbia Supreme Court ruling, David M. Masuhara, remains: invasion of privacy and tampering with seclusion are not criminal offenses in BC
The main reason this was not overturned on appeal is because plaintiffs suing People’s Trust did not raise this on appeal. “The interesting question of whether the law needs to be reconsidered has to await another appeal,” wrote Judge Groberman in his most recent unanimous decision in Tucci for the British Columbia Court of Appeals.
In his ruling, Justice quoted Groberman Jones v. Tsige, published by the Ontario Court of Appeals in 2012. In this case, the Ontario Court of Appeals created a new tort in Ontario, Patrick Hawkins, attorney at Borden Ladner Gervais LLP, said during a 2016 presentation to the Property Casualty Underwriters Club. Hawkins was generally on cyber risk rather than the class action lawsuit against People’s Trust in BC
“Unlike traditional tort law or traditional civil law and civil damage, proof of damage is not required for a recognized economic interest,” Hawkins said of the Ontario Act in 2016 by Jones v. Tsige. “So you don’t have to prove that someone actually suffered harm. Just because you’re a little annoyed and someone has checked your private records, it may be a circumstance in which we are awarding damages. “
It can be argued that the new tort in Ontario has the potential to increase a company’s liability risk in the event of a cyber breach.
The BC class action lawsuit against Peoples Trust grew out of a breach in 2013 when cyber attackers in China accessed one of the Peoples Trust databases. The cybercriminals obtained personal information – including names, addresses, email addresses, phone numbers, dates of birth, social security numbers, occupations and, in the case of credit card applicants, their mothers’ maiden names – from Peoples Trust customers.
As it stands, plaintiffs in the People’s Trust class action lawsuit can still argue that the financial institution will be held liable for breach of contract and negligence that does not imply a break in seclusion.
Originally in 2017, British Columbia Supreme Court, Masuhara, said one of the questions for the class action lawsuit was whether the nominal damage to a class member could be assessed as a whole. This wording could cause confusion, the appeals court ruled in 2020. Therefore, the question is now being rephrased to ask whether some of the damage to class members should be assessed as a whole.
Another change in the appeal process – in favor of the defendant – concerned the treatment of non-residents who are class members. Originally, both BC residents and non-BC residents were certified as class members in 2017 unless they opt out. As a result of the appeal ruling, the British Columbia Supreme Court must now consider whether the non-resident subclass follows an opt-in or opt-out model
Feature image via iStock.com/baona