Kaplan Decision Offers New Insight Into Privacy Class Actions

The Ontario Superior Court's decision in Kaplan v. Casino Rama, 2019 ONSC 2025 (Kaplan) calls into question the use of class proceedings as the procedure to address privacy breach losses. In Kaplan, Justice Belobaba declined to certify the proposed class action, which arose out of a cyber attack of Casino Rama's computer systems, on the basis that the action "collapses in its entirety at the requirement of commonality" under section 5(1)(c) of the Class Proceeding Act1.

What you need to know

Despite the low bar to certify class proceedings in Canada, class actions based on third party hacking may be rejected when the "type and amount" of personal information affected by a breach varies between different categories of class members. While companies are also victims of criminal hacking efforts, organizations could be liable for the harm to affected individuals if their inaction or insufficient security measures facilitate an intrusion into their systems. Although many privacy class actions are built on negative findings from regulatory investigations, such findings are not determinative of civil liability. Courts continue to favourably consider an organization's prompt and effective management of a cyber-incident, including cooperation with regulators and timely notice to affected individuals. Background

In Kaplan, the Court was asked to certify a class proceeding against Casino Rama after an anonymous hacker broke into the casino's computer systems and stole a variety of personal information related to customers, employees and suppliers online. After Casino Rama refused to pay the ransom demanded by the hacker, the hacker posted the personal information of 11,000 individuals online. Casino Rama notified those affected by the breach and offered many individuals free credit monitoring services for one year. It also contacted the appropriate authorities and closed the websites that contained stolen information. Two and a half years after the breach, there was no evidence that anyone affected by the breach had been subject to fraud or identify theft, nor had they suffered compensable financial or psychological loss.

Decision

Justice Belobaba warned at the outset of his analysis that the proposed class action "collapse[d] in its entirety" at the commonality stage.2 Despite this, he went on to consider each of the proposed causes of action. Justice Belobaba also discussed the impact of the Ontario regulator's recent finding from its investigation...