Law Times

Law Times • sepTember 5, 2016 Page 11 www.lawtimesnews.com FOCUS Privacy breaches result in legal actions BY MARG. BRUINEMAN For Law Times T he emerging domi- nance of the digital world is resulting in a number of privacy con- cerns over cybersecurity breach- es and improper use of personal information, creating a very ac- tive area for class actions. And although dozens of suits have been launched in recent years, and many have settled, the courts and lawmakers have yet to weigh in and provide clear direction on what is actionable and how. "This is probably the most ex- citing area of class actions at the moment," says Barry Glaspell, a partner with Borden Ladner Gervais LLP in Toronto, who closely examined this issue for the Advocates' Society in a paper with colleague Daniel Girlando. He figures at least 30 class ac- tions during the past four years have been launched related to privacy breaches, and all are at various stages. Many have been certified and some have been settled, but courts have yet to fully weigh in to provide direc- tion and determine caps or re- strictions to damages. The breaches involve infor- mation that: is lost or accessed but hasn't been used or disclosed; has been harvested by compa- nies looking to profit from it; is stolen or hacked; and the preda- tor who takes private informa- tion into the public realm. The question that emerges is: Where is all this going in Cana- dian law? The trend of class actions in the area of data breaches and privacy follows one that has oc- curred in the United States. But the rules around damages re- mains unclear in both countries. "They really haven't reached the stage where court has vali- dated them by way of final judg- ments or damage awards," says Ira Nishisato, a Toronto litiga- tor focusing on cybersecurity and technology law, also with Borden Ladner Gervais LLP. "I think what it means is that peo- ple are not hesitating to launch these sorts of class actions aris- ing out of one form of breach or another. But we're just not yet at the point where we can say these claims will necessarily succeed at the end of the day. "The notion that the disclo- sure of personal information can give rise to harm is not par- ticularly new or profound," adds Nishisato. "But I think the ques- tion of what sort of harm should really be compensable is where the battle lines will be drawn." He points to database breach- es where the personal informa- tion of tens of thousands of peo- ple maintained by an organiza- tion or company was taken but not used for nefarious purposes. That's where class actions in- volving privacy breaches may differ from other types of tort law, which traditionally have required both a cause of action as well as damages that the suit would seek to recover. Nishisato sees this as a key battleground in the future. The tort of intrusion upon seclusion resulting from Jones v. Tsige, even though it was not a class action, is a big driver of pri- vacy class actions because the On- tario Court of Appeal awarded $10,000 in damages even though there was no proof of harm. Jones involves a woman working at a bank accessing 174 records of her spouse's former wife over four years. She didn't circulate any of the information she gleaned. "That type of tort claim is re- ally well designed for a class action because generally the damages are going to be small," says Brian Radnoff, a partner at Lerners LLP in Toronto, where he practices commercial litigation. "I think most large companies have or try to have the best compliance pro- grams. But it is definitely going to be an area of risk for them." As soon as a security breach is known, Radnoff expects to see plaintiffs' counsel in action, put- ting together a class action. A second new privacy tort — unauthorized public disclosure of embarrassing facts — has also emerged in Ontario. An anony- mous plaintiff in Jane Doe 464533 v. N.D. was awarded $100,000 when her boyfriend posted an intimate video on the Internet without her consent. As a result, plaintiffs are see- ing potential recovery of moral or symbolic damages without pecu- niary or psychiatric damage. Glaspell expects the Supreme Court of Canada to eventually deliberate over the existence and elements of these two torts. He also expects it to examine in what circumstances employers should be held vicariously liable for breaches by employees. "The case law hasn't decided yet whether an employer is go- ing to be vicariously liable for these new torts," he says. His- torically, employers have been held vicariously liable for negli- gence of employees but not for punitive damages. "The big issue for defendants is whether the corporation is going to be held vicariously liable for the bad be- haviour of employees." And while Jones set a cap at $20,000, the courts have yet to put restrictions on the dam- ages to a significant degree, adds Glaspell. The lengthy conditions at- tached to use of Wi-Fi, online services and the downloading of applications and programs is commonly known to often go unread. And how companies use the information they've es- sentially been given is attracting attention. The practice of pro- grams that use customer infor- mation to provide more relevant ads on web sites raises the issue of meaningful consent. "That's something I think we're going to see a lot more in the coming years because of the new uses of information: Big Data, analytics, they've been tar- geting customers in a custom- ized way," says Molly Reynolds, a privacy lawyer focusing on liti- gation and advisory with Torys LLP in Toronto. LT Barry Glaspell says he expects the Supreme Court will end up examining in what circumstances employers should be held liable for privacy breaches. REGISTER ONLINE www.lexpert.ca/cpdcentre For more information, please contact Lexpert® at 1-877-298-5868 or e-mail: lexpert.questions@thomsonreuters.com EXECUTIVE PROFESSIONAL DEVELOPMENT FULLY ACCREDITED IN-CLASS PROGRAMS & LIVE WEBINARS 4th Annual Conducting Effective Workplace Investigations Unearthing the Truth: Dig Deeper with Workplace Investigations Sarah Graves Partner, Fasken Martineau DuMoulin LLP Toronto & Webinar November 8 Drafting and Negiotiating Effective Cloud Computing Agreements Get Ahead in the Cloud Lisa R. Lifshitz Partner, Torkin Manes LLP Toronto & Webinar November 9 2nd Annual Managing Regulatory Risks Winning Strategies for a Game of Risk Joan Young Partner, Co-Chair, B.B., Administrative and Public Law, McMillan LLP Toronto & Webinar November 9 2nd Annual Duties and Risks for Directors The Board Game: A World of Infinite Risks Aaron Emes & Stephanie Stimpson Partners of Torys LLP Toronto & Webinar November 15 8th Annual Dealing with the Lease: A State of the Art Update Innovation + Ideas in Leasing Stephen J. Messinger Senior Partner, Minden Gross LLP Toronto & Webinar November 16 5th Annual Anti-Bribery and Corruption Compliance Navigating Muddy Waters John Boscariol Partner, McCarthy Tétrault LLP Vancouver & Webinar November 28 8th Annual Aboriginal Law An Update on Aboriginal Law Thomas Isaac Partner, Cassels Brock & Blackwell LLP Toronto & Webinar November 30 9th Annual Advertising and Marketing Law Managing Legal Risk in a Technology Driven World Brenda Pritchard Partner, Gowling WLG Toronto & Webinar December 1 8th Annual Information Privacy and Data Protection Viewing and Being Viewed- Minimize Digital Risk David Young Principal, David Young Law & Bill Hearn Partner, Fogler, Rubinoff LLP Toronto & Webinar December 1 9th Annual Corporate Governance 2016: What You Need To Know Are You Prepared for Changes in Corporate Governance? Walied Soliman & Orestes Pasparakis Partners of Norton Rose Fulbright Canada LLP Toronto & Webinar December 8 Untitled-5 1 2016-08-30 1:36 PM

• Cover