Tort Of Intrusion Upon Seclusion Does Not Apply To Third Party Data Breach

• Published date: 02 December 2022
• Subject Matter: Litigation, Mediation & Arbitration, Privacy, Data Protection, Class Actions
• Law Firm: McCarthy Tétrault LLP
• Author: Canadian Class Actions Monitor, Dana M Peebles and Cassidy Bishop

On November 25, 2022, the Ontario Court of Appeal released a trilogy of decisions that firmly shut the door on the pleading of the tort of intrusion upon seclusion by plaintiffs advancing proposed class actions against companies that have suffered a third party data breaches.

Unless successfully appealed to the Supreme Court of Canada, these decisions -Owsianik v. Equifax Canada Co.,2022 ONCA 813("Owsianik"); Obodo v. Trans Union of Canada, Inc.,2022 ONCA 814("Obodo"); andWinder v. Marriott International, Inc.,2022 ONCA 815- raise a significant barrier to the certification of class actions in instances where criminals have accessed stored personal information of customers, but there is no evidence of resulting harm to those individuals.

BACKGROUND

In June 2022, the Ontario Court of Appeal heard the appeals in three proposed data breach class actions together:

• Owsianik v. Equifax Canada Co., 2021 ONSC 4112;
• Obodo v. Trans Union of Canada, Inc., 2021 ONSC 7297; and
• Winder v. Marriott International, Inc., 2022 ONSC 390.

In all three proceedings:

• The plaintiffs had pleaded the tort of intrusion upon seclusion in circumstances where third party hackers accessed and/or used the personal information of the plaintiffs and others which the defendants had collected in the course of business. The plaintiffs alleged the defendants were liable, under this tort, for failing to take adequate steps to protect the personal information from bad actors.
• The defendants argued that the intrusion upon seclusion cause of action could not be certified under s. 5(1)(a) of the OntarioClass Proceedings Act,1992 because tort only applies to defendants who actually invade or intrude upon the privacy of a plaintiff - not defendants who have failed to prevent an invasion or intrusion by a third party.
• The relevant lower court agreed with the defendants.

The Ontario Court of Appeal released its lead decision in Owsianik and dismissed all three appeals.

ANALYSIS

The Test under Section 5(1)(a)

The Court started with the test under s. 5(1)(a) of the OntarioClass Proceedings Act,1992 which requires a plaintiff to establish that his or her pleading discloses a cause of action in order to have the action certified as a class proceeding. The threshold is low; a plaintiff will meet this requirement unless it is "plain and obvious" that the cause of action cannot succeed against the defendant.

However, the recent Supreme Court of Canada decision inAtlantic Lottery v Babstock,2020 SCC 19(see...