Law Times

PAGE 10 FOCUS September 8, 2008 • Law times Crusading for privacy protection BY JUDY VAN RHIJN For Law Times R ning for government and big business in the hope that ex- emplary damages under privacy legislation will shock them into a more careful approach. Privacy class action lawsuits ecent losses of confiden- tial information have class action lawyers gun- are an emerging trend for plain- tiff 's lawyers. In the U.S. they are being commenced in cases where confidential informa- tion has been sold or distrib- uted without permission, but the Canadian cases cover situ- ations where personal informa- tion has been lost, leading to the risk of loss of identity and of bank account and credit ac- count violations. Tony Merchant of Merchant Law Group LLP, has instigated a series of class actions utilizing privacy legislation such as the Pri- vacy Act, PIPEDA, and FIPPA, relying on the causes of action of breach of confidence or a viola- tion of privacy. He first became interested in the area when he was part of the Winners/Home- Sense U.S. settlement (Wong v. TJX Companies Inc. in Canada), suing in five jurisdictions as the Canadian representative. That case involved an un- the breach in mid-December 2006 but didn't inform the pub- lic until Jan. 17, 2007. "We didn't utilize privacy in that case," says Merchant. "That was negligence. They knew they were being hacked. They knew people were using the stolen credit card information and they kept it from members of the class. They tried to minimize the situation, and people suffered real losses as a result." Since then, Merchant has be- come more and more interested in the whole area of privacy. "It is a far bigger societal issue than I thought when we pursued Winners Home/Sense. I've de- veloped a hardened attitude to it since then. Some people are affected a great deal by fear of identity theft and use of credit card information. It is a huge di- saster for some of my clients — a constant worry." It is Merchant's opinion that should not be allowing it to be accessed in any way without any precautions." In the case of the Canadian Canola Grower's Association, a class action commenced in June 2008 alleges that the CCGA al- lowed a huge number of people to have ready access to informa- tion gathered under the Advance Payment Program, a govern- ment program to secure advanc- es against the future sale of non-wheat-board crops. People were able to download the files to notebooks which they could take anywhere they liked. In the case in question, the informa- tion was stored on a laptop that fidential information on a data tape that was lost by UPS. In the case involving CIBC and Talvest Mutual Funds, a hard drive con- taining confidential information disappeared. And in the class action against ISM Canada, it is alleged a hard drive holding personal information was stolen. "If you were transporting five million diamonds, you wouldn't say, 'Here's $12.50' and put it in a truck to Toronto," says Mer- chant. He is also contemplating and working on a possible class action against the Canadian Passport Office for a breach in online security which exposed sensitive personal information. in Canadian privacy law," says Lawson. "PIPEDA permits indi- viduals to lodge complaints with the privacy commissioner, and once they have a finding, which can take a year or more, they can make an application as an indi- vidual to the Federal Court for a binding legal ruling." CIPPIC made submissions during the review of PIPEDA for a new statutory right of action through which individuals and classes of individuals can hold organizations accountable and obtain damages. The submission points out that "PIPEDA's focus on individual complaints and individual court actions does not If you were transporting five million diamonds, you wouldn't say, 'Here's $12.50' and put it in a truck to Toronto. authorized intrusion into par- ent company TJX's computer system, resulting in the theft of personal and confidential in- formation about the customers of TJX, including customers of Winners and HomeSense in Canada. TJX became aware of government and large busi- nesses have taken an uncaring approach to protecting people's information. "My sense is they take the view that if something goes wrong they'll clean up the mess rather than take precau- tions, because there is a cost to taking precautions. The courts need to address the problem in the same way that judges 100 years ago did when they discov- ered that companies didn't care about safety. If someone lost a leg, they would just pay dam- ages, rather than change the way they were handling safety in the workplace." Merchant points out that companies are getting a finan- cial benefit from the informa- tion and a benefit from easy storage of information. "They was sent from Carmen, Man. to Winnipeg, where it was left un- attended and stolen. "A large dollop of confiden- tial information was available to many people and wasn't encrypt- ed," says Merchant. "The CCGA also kept information long after they needed to. Two of the lead plaintiffs hadn't taken a loan for, in one case, three years, and, in another, two years. They assumed all their personal information was removed. On a very inexpensive basis, the government of Canada could have set up the informa- tion centrally. If someone wanted information on Tony Merchant, a person could draw it. There would be no need to keep it on their computer." In another of Merchant's class actions, commenced on June 9, it is the customers of Daimler AG who are suing in respect to con- another, and there is no correc- tion to the systems involved," he laments. "Six months after the Passport Office debacle, the gov- ernment of Canada is still seem- ingly uncaring. Part of what class actions are meant to do is effect societal changes. The courts need to make a large award to show they are not going to condone such conduct. We need a large exemplary award of damages." Merchant is not the only one who thinks class actions are required to effect change in privacy practices. Philippa Law- son, director of the Samuelson- Glushko Canadian Internet Policy and Public Interest Clinic at the University of Ottawa, has taken up the push for privacy class actions as part of a program of legislative advocacy. "There is no provision for class actions "These losses occur one after reflect the often widespread na- ture and impact of privacy-relat- ed invasions." CIPPIC contends that punitive damages may be the only meaningful remedy un- der PIPEDA, which it currently sees as a toothless tiger. Lawson doubts that class ac- tions will be successful when pleaded on privacy laws alone. "Traditionally, class actions have been based on tort law — duties, standards of care, and negligence. Some of these may play out with privacy-related legislation, but the actions are not made on the basis of privacy legislation, be- cause it is not set up that way and there is minimal common law privacy. It's wrong that plain- tiffs' counsel have to find those common law hooks. I'm glad to hear that firms are pushing the envelope but I'd also like to see legislative change." LT CLASS ACTIONS IN CANADA Ward Branch class action decision Hollick v. Toronto (City) Class Actions in Canada is the leading text and a comprehensive guide to bringing and defending class actions in Canada. Helping you gain the unique skill of successful class action advocacy, this important work provides examples and direction through analysis of hundreds of class action cases litigated across Canada, as well as a comprehensive bibliography of class action articles. This well-organized, easy-to-read text features: product liability Class Actions in Canada gives you the tools you need for successful class action advocacy. Order your copy today! www.canadalawbook.ca www.lawtimesnews.com BRANCH_Class Actions in Canada (LT 1-3x4).indd 1 LT0908 8/26/08 10:16:37 AM

• Cover