Q&A with Alex Cameron
In Canada, litigation and regulatory activity regarding privacy and data breaches have increased dramatically. I spoke with Alex Cameron of Fasken Martineau, a leading attorney in this area in Canada, about the factors contributing to the increasing risk and potential liability for organizations doing business in Canada. With the recent landmark changes to Canadian privacy law, discussed here, including mandatory breach notification, record keeping for all breaches, and fines, the trends identified below are sure to continue.

Can you give an overview on the general uptick in Canadian litigation for privacy/ data breaches? What’s driving this?
Canada has seen an unprecedented increase in data breach litigation and class action certifications. As reflected in the Table of Cases below, we have seen claims advanced in cases involving unauthorized access or loss (e.g. hacking, rogue employees, lost hard drives), as well as business practice cases (e.g. using information for commercial purposes without obtaining adequate consent). The prevalence of breach notifications, and broader awareness about privacy rights and remedies, have caught the attention of individuals and class action lawyers and is contributing to the increase in litigation.

Another significant factor that has encouraged litigation is the potential for plaintiffs to obtain awards in the absence of harm, whether through claims for invasion of privacy, waiver of tort, or breach of contract. Individuals do not need to show that they are victims of fraud or identity theft as a result of a breach in order to obtain an award of damages. Individual plaintiffs have obtained awards ranging from several hundred dollars to tens of thousands of dollars for relatively minor privacy breaches, which has translated to staggering damages claims in class actions with a large number of affected individuals.

Can you give an overview of the tort of ‘intrusion upon seclusion’ and its ramifications?
The Jones v. Tsige case, released in 2012, recognized for the first time in Canada a form of the United States’ common law tort of invasion of privacy: intrusion upon seclusion. In the Jones case, the defendant, an employee of a bank, viewed the plaintiff’s banking information without authorization on a number of occasions—there was no use or disclosure of information, no humiliation, and ultimately no harm that flowed from the breach.

The Jones case is important because it introduced not only the right to sue for invasion of privacy but also the possibility of obtaining damages for the breach itself, without showing harm. Although the defendant’s conduct in invading the plaintiff’s privacy must be intentional (or reckless) and highly offensive (causing distress, humiliation or anguish), proof of harm is not an element of the cause of action. The plaintiff in Jones obtained an award of $10,000 in damages to “mark the wrong that has been done.”

The historic Jones decision has unquestionably contributed to the increase in privacy litigation in Canada. In virtually every privacy claim launched since the decision was released, plaintiffs have claimed intrusion upon seclusion and alleged that the defendant’s conduct was “reckless.” Claims for intrusion upon seclusion have been certified to proceed in a number of recent class actions.

What are you seeing in terms of the plaintiff’s evolving claims and arguments for recovery in the wake of a privacy breach?
Plaintiffs have advanced a variety of legal theories and claims in this area. We’re seeing statutory claims such as breach of data protection laws and statutory privacy torts in certain provinces, the common law tort claim for intrusion upon seclusion discussed above, as well as claims for vicarious liability, negligence and misrepresentation, among others.

More recently, plaintiffs have sought recovery based on “waiver of tort” whereby they are seeking a disgorgement of the profits made by the defendant in breaching privacy for commercial gain or in failing to incur costs for measures necessary to protect privacy. This claim is at issue in a number of cases and has recently been certified to proceed as part of a prominent class action. The emergence of the waiver of tort claim in this field is significant because recovery could be substantial, and because plaintiffs will undoubtedly seek broad discovery of documents and information regarding the defendant’s profits and internal business decisions in relation to privacy.

Breach of contract is another important claim emerging in this area. Plaintiffs in some cases are alleging that their contractual relationship (e.g. with an employer, business or other organization) includes the obligation to protect privacy, including on the basis that privacy policies form a part of the contract. As we have seen in a recent case, since a court can award nominal damages for a breach of contract in the absence of harm, this line of argument may have significant ramifications for class actions. If plaintiffs can demonstrate that a large class had the same contract with the defendant, and that it was breached, even a nominal award for each plaintiff could translate into a significant claim if the class is large.

Can you give us a summary of Canada’s Anti-Spam Law (CASL) and penalties for violators?
CASL is an onerous opt-in regime that has serious ramifications for all organizations that do business in Canada and for those that promote their products and services to Canadian markets. The law regulates two main areas. The first is the sending of commercial electronic messages to and from Canada, including marketing and other promotional messages. Under CASL, it is prohibited to send such messages unless the recipient has expressly opted-in in the prescribed manner, or one of a variety of exemptions applies. CASL has considerably narrowed email marketing and related activities in Canada, including in both the consumer and business-to-business context. The second area regulated by CASL regards the installation and update of computer programs, including apps, and in many cases requires express consent in the prescribed manner.

Violations of CASL can lead to the imposition of significant administrative monetary penalties (up to $1 million for individuals and $10 million for organizations) by the regulator. Damages and statutory damages (i.e., no proof of harm required) will also be available through a private right of action that will come into force in 2017. We have already seen enforcement activity under CASL which resulted in a $1.1 million penalty in one case involving inadequate consents, an undertaking to pay $150,000 in a case where consents were not proven and an undertaking to pay $48,000 in another case involving an inadequate unsubscribe mechanism. Directors, officers and others can also be held liable for penalties and damages if they directed, authorized, assented to, acquiesced in or participated in the commission of the violation.

Have you seen many recent uninsured losses that may not be in the public eye?
I routinely work on data breach and related matters (both in Canadian matters and in international matters with a Canadian component) and it is by far the exception that organizations have been insured in Canada. At the outset of a breach response which has not come to us through an insurer, the usual response I am met with when I ask if the organization has cyber or related insurance is: “No. Organizations can buy insurance for this?” I am confident that this is changing in Canada. There is unquestionably a growing awareness of the role for insurance in this area, which has translated into increased purchase of cyber and related products. Our clients and service providers now frequently raise the question of cyber insurance as part of an overall risk management and privacy strategy.

Are you seeing an increased initiative by plaintiff lawyers to promote these law suits or claims once the privacy regulators get involved?
Plaintiffs typically commence litigation long before privacy regulators take action, particularly in the class action field where class counsel may file competing claims in different provinces. Breach notifications often trigger interest in a potential claim. Regulators will not always take action in a particular file and, even in cases where they do so, it may be many months, or up to a year or more before findings are made public. That said, whether litigation is commenced before or after commissioners take action, it is certainly the case that commissioners’ investigations and findings can have a significant impact on the litigation. Commissioners’ investigations can assist plaintiffs in understanding the factual and evidentiary basis for litigation claims. Although adverse commissioners’ findings are not binding on the courts in litigation, they can change the landscape of the litigation.

What are your views on the Breach Coach^® initiative for large clients. Are you seeing them built into incident response plans? If not, do you feel they should be?
Based on what I’ve seen, incident response plans for data breaches have not been developed in Canada as a matter of course, and nor has the role of Breach Coach^® been built into such plans where they are developed. They should be. The importance of the specialized experience and competence that a Breach Coach brings to the table cannot be overstated. As we have seen again and again in the Canadian cases, an organization’s response to an incident is of crucial importance.

A botched response can create additional reputational harm and legal liability over and above that which may be associated with the initial incident. In Canada, many of the plaintiff’s statements of claim in in this area include allegations relating to the organization’s response to an incident (e.g., that the organization did not act quickly enough, that it did not share sufficient or accurate information in its notification, or that it did not take steps to mitigate harm). On the other hand, a well-handled response can both reduce the likelihood of litigation and also potentially eliminate or mitigate liability for the initial incident. Another important aspect is that a Breach Coach can help ensure that solicitor-client and litigation privilege considerations are taken into account in respect of communications and other information generated in the wake of an incident.

In Conclusion…
We want to thank Alex for his expert insight cyber risk and the state of litigation in Canada regarding data breach liability. Many companies in the U.S., Canada and other countries have cross-border legal/regulatory exposure, especially when they handle information about individuals. The evolving landscape in Canada is one to keep watch on. In addition, it is important to be aware that sending electronic messages to Canada and installing software on systems or devices located in Canada can attract significant liability under Canada’s Anti-Spam Law, including for directors and officers.

Table: Highlights of Privacy Litigation and Damage Awards in Canada 2013-2015