Privacy Class Action Not Certified - Setoguchi v Uber B.V., 2021 ABQB 18

• Published date: 08 February 2021
• Subject Matter: Litigation, Mediation & Arbitration, Class Actions
• Law Firm: McCarthy Tétrault LLP
• Author: Canadian Class Actions Monitor, Kara L. Smyth, Dana M Peebles, Cassidy Thomson and Carley Frazer

In a recent data breach class action decision, the Alberta Court of Queen's Bench ("the Court") refused certification, thereby exercising its important gatekeeping function, on the basis that a class action was not a preferable procedure to litigate a matter in which no member of the proposed Class had suffered harm or a loss arising from the breach.

In Setoguchi v Uber B.V., the Plaintiff sought certification of a class action on behalf of users whose personal information was accessed during a third party data breach. The decision of the Court denying certification contains careful analysis of the landscape of data breach jurisprudence in Canada, and reflects on the recent emphasis, in Canadian Courts, on proportionality and practicality.

Background

In late 2016, Uber was attacked by outside actors who accessed the names, telephone numbers and email addresses of a number of users globally (including about 800,000 customers in Canada). Uber paid the outside actors in exchange for an assurance that the data in their hands would be destroyed.

In the 4 years between the breach and the certification motion, neither the Plaintiff nor any member of the proposed Class had come forward with proof of an economic loss or psychological harm arising out of the data incident.

Key Principles

Data breaches are increasingly common in the modern world, and it is no surprise that there has been a corresponding increase in class actions concerning data breaches. The review of the accumulated certification jurisprudence by the Court was therefore timely.

In terms of class action principles generally, the Court relied on Andriuk v Merrill Lynch Canada Inc., 2013 ABQB 422¹ in considering the Court's gate-keeping function (an approach also seen in the Supreme Court of Canada's recent holding in Atlantic Lottery Corp. Inc. v Babstock, 2020 SCC 19, though not cited by the Court).

In canvassing the jurisprudence on class actions involving data breaches, the Court cited with approval the Ontario decision in Kaplan v Casino Rama, 2019 ONSC 2025, where certification was denied in circumstances involving disclosure of non-private personal information and risk of future harm. The Court also referred to the Quebec decision in Bourbonniere c Yahoo Inc., 2019 QCCS 264, which found that "the transient embarrassment and inconvenience [arising from a data breach]. are of the nature of ordinary annoyance and do not constitute compensable damages."²

Finally, the Court imported the...