Docket:
T-132-13
Citation: 2014 FC 250
Ottawa, Ontario, March 17, 2014
PRESENT: The Honourable Madam Justice Gagné
BETWEEN:
|
GAELEN PATRICK CONDON
REBECCA WALKER
ANGELA PIGGOTT
|
Plaintiffs
|
and
|
HER MAJESTY THE QUEEN
|
Defendant
|
REASONS FOR JUDGMENT AND JUDGMENT
[1]
This is a motion brought by Gaelen Patrick
Condon, Rebecca Walker, and Angela Piggott [the Plaintiffs] to certify an
action as a class proceeding in accordance with rule 334.16 of the Federal
Courts Rules, SOR/98-106 [the Rules] against Her Majesty the Queen
[the Defendant], named as representative of the Minister of Human Resources and
Skills Development Canada [the Minister or HRSDC]. The Minister is responsible
for the administration and management of the Canada Student Loans Program [the
Program], which provides loans to approved applicants in order to help fund
those applicants’ post-secondary education [the Student Loans].
[2]
In November 2012, the Minister lost an external
hard drive on which it had stored the personal information of the Plaintiffs as
well as approximately 583,000 individuals [the Hard Drive], from its offices in
Gatineau, Quebec [the Data Loss]. This personal information included the names,
dates of birth, addresses, student loan balances, and Social Insurance Numbers
[the SIN(s)] of those individuals [the Personal Information]. The Hard Drive
has not been recovered.
[3]
The Plaintiffs claim various measures of relief
from the Defendant on their own behalf as well as on behalf of a class defined
as [the Class or Class Members]:
All persons whose
personal information was contained in an external hard drive in the control of
Human Resources and Skills Development or the National Student Loan Services
Centre which was lost or disclosed to others on or about November 5, 2012, but
not including senior management of Human Resources and Skills Development
Canada, the Canada Student Loans Program, or Ministers and Deputy Ministers of
the Ministry of Human Resources and Skills Development.
[4]
The Plaintiffs allege several faults and
breaches on the part of the Minister and are seeking to recover damages
suffered as a result of the Data Loss. The Minister mainly argues that a class
proceeding is not the preferable procedure for resolving the Class Members’
claims and that the Plaintiffs have suffered no compensable damages.
[5]
For the reasons discussed below, I will grant
the motion and certify the action as a class proceeding.
Background
[6]
The Plaintiffs are respectively residents of St. John’s, Newfoundland, Sydney, Nova Scotia and Toronto, Ontario, who had applied and
obtained Student Loans through the Program during the period from 2002 to 2008.
They have repaid or are in the process of repaying their Student Loans.
[7]
To receive Student Loans through the Program,
Class Members were required to fill out application forms requiring them to
provide the Personal Information and agreeing to conditions for use of that
information [the Application Form(s)]. They also had to sign various agreements
with the Defendant, which also contained terms setting out the conditions for
use of that information. The Plaintiffs contend that these Application Forms
and various agreements should be construed as contracts [the Contracts]. The
details of these Contracts will be discussed below.
[8]
On November 5, 2012, the Hard Drive was first
reported missing to a manager at the Minister by one of its employees. It had
last been seen in August 2012, when it had been used to back up the Personal
Information from the Minister’s network prior to a system upgrade planned for
mid-October 2012.
[9]
The information on the Hard Drive was not
encrypted, nor was the Hard Drive stored in a location that was locked “100% of
the time.” It was believed to be stored in the bottom drawer of an employee’s
filing cabinet, hidden under some files. It was only when that employee went to
retrieve the Hard Drive in preparation for another system upgrade that the
employee discovered it missing.
[10]
From November 5 to November 22, 2012, the loss
was internally investigated and a complete search of the Minister’s offices was
performed.
[11]
On November 28, 2012, the Minister’s security
staff was first notified of the Data Loss and on December 7, 2013, it confirmed
that the Hard Drive contained the Personal Information of “500K clients” by analyzing
the contents of the network drive that are presumed to have been copied to the
Hard Drive.
[12]
On December 14, 2012 the Defendant notified the
Privacy Commissioner of Canada of the Data Loss. On January 7, 2013, the Royal
Canadian Mounted Police was asked to investigate the matter and on January 11,
2013, the Minister disclosed the Data Loss to the Canadian public and to the
affected Class Members, by way of a statement entitled “Protecting Canadians’
Personal Information at HRSDC” [the Statement]. In the Statement, the Minister
called the Data Loss “unacceptable and avoidable,” “unnecessary,” and of a
“serious nature.”
[13]
The Defendant created a toll free telephone
number, following the Minister’s issuance of the Statement, to inform potential
Class Members as to whether their Personal Information was stored on the Hard
Drive [the Information Line].
[14]
The Plaintiffs all called the Information Line
and were advised that their Personal Information was stored on the Hard Drive.
Angela Piggott spent four hours on the telephone contacting the Information
Line and other governmental bodies to request her Student Loans information
while Rebecca Walker phoned the Information Line on two separate days and was
left on hold for over 30 minutes.
[15]
The Defendant advised some Class Members who
called the Information Line, including Rebecca Walker and Angela Piggott, that
they should contact Equifax Canada Inc. [Equifax] and TransUnion Canada [TransUnion], the two largest Canadian credit reporting agencies, to request copies
of their credit reports from those agencies. The Defendant advised Rebecca
Walker and other Class Members that if they wished to obtain credit protection,
they could do so at their own expense by contracting with Equifax or
TransUnion.
[16]
In all, the Information Line received over
250,000 phone calls.
[17]
At the end of January 2013, the Defendant mailed
letters to 333,000 Class Members advising them of the Data Loss [the Letters].
The Defendant did not send Letters to Class Members whose address information
had not been updated within the previous three years.
[18]
The Letters contained an offer of “credit
protection.” They read: “A notation can be placed on your credit file for a
period of up to six years, at no cost to you. This notation will have no impact
on your credit rating.” The Class Members were to opt in to this program by
contacting the Information Line. At its essence, this program provides an
annotation on the Class Member’s file with a credit reporting agency [the
Credit Flag]. If a lender asks the credit reporting agency for information
about the Class Member’s credit, it will advise the lender of the Credit Flag.
At first, the credit protection offered only concerned Class Members’ files
with Equifax, but it was later extended to include those with TransUnion. In
their respective reports, the parties’ experts discuss the distinction to be
made between a Credit Flag program and a “credit monitoring” program. They
disagree as to the effectiveness of the credit protection program offered by
the Defendant.
[19]
As of June 21, 2013, 88,548 Class Members had
provided their consent to the Minister for the Credit Flag. The Plaintiffs have
not done so.
[20]
In addition to the credit protection offered,
the Defendant has instituted a SIN registry. The affected SIN records have been
annotated in the Social Insurance register to indicate that the SIN was
involved in an incident. This ensures that any requests for changes or
modifications undergo an enhanced authentication process.
[21]
On January 17, 2013, the Plaintiff Condon
commenced this action by filing a Statement of Claim. On January 23, 2013, the
Plaintiffs Walker and Piggott filed a Statement of Claim advancing their own
claims. The Plaintiffs and their counsel agreed to cooperate in the prosecution
of their claims. With the consent of the Defendant, the Plaintiffs filed a
Consolidated Statement of Claim before this Court on April 25, 2013.
Issues
[22]
There is only one issue raised by this Motion:
Should this action be certified as a class proceeding under rule 334.16 of
the Rules?
[23]
Motions for certification of class proceedings
are governed by rule 334.16 of the Rules, which requires certification
if the following criteria are met:
a.
The pleadings disclose a reasonable cause of
action;
b.
There is an identifiable class of two or more
persons;
c.
The claims of the class members raise common
questions of law or fact, whether or not those common questions predominate
over issues affecting only individual members;
d.
A class proceeding is the preferable procedure
for the just and efficient resolution of the common questions of law and fact;
and
e.
There is a representative plaintiff who:
i.
would fairly and adequately represent the
interests of the class;
ii.
has prepared a plan for the proceeding that sets
out a workable method of advancing the proceeding on behalf of the class and of
notifying the class members as to how the proceeding is progressing;
iii.
does not have, on the common questions of fact
and law, an interest that is in conflict with the interests of other class
members; and
iv.
provides a summary of any agreements respecting
fees and disbursements between the representative plaintiff and the solicitor
of record.
[24]
The Defendant does not challenge the proposed
class definition (step (b)) or the appropriateness of the representative plaintiffs
(step (e)).
[25]
The Plaintiffs submit that even if the
Defendant’s arguments on the causes of action and common questions are accepted
in their entirety, there still remain causes of action and common questions to
be certified; as the Defendant does not contest that the Data Loss amounts to a
breach of contract and warranty. The Defendant disagrees and replies that even
if there is a breach of contract or warranty, step (a) of the test could not be
met in the absence of compensable damages suffered by the Plaintiffs and the
Class Members.
[26]
Class proceedings provisions in the Rules are
essentially the same as the provisions in the British Columbia Class
Proceedings Act, RSBC 1996, c 50, and the Ontario Class
Proceedings Act, SO 1992, c 6. In Manuge v Canada, 2008 FC 624 at paragraph
24, rev’d 2009 FCA 29, certification restored 2010 SCC 67, Justice Barnes
writes:
[24] This
Court’s class proceedings rules are modeled on the British Columbia rules and
are similar to the Ontario rules; in the result, decisions from those
jurisdictions can be looked to for guidance in considering a motion to certify:
see Tihomirovs v. Canada (Minister of Citizenship and Immigration), 2006 FC 197 (CanLII), [2006] 4 F.C.R. 341
(F.C.), at paragraph 45. As Justice Frederick Gibson observed in Rasolzadeh
v. Canada (Minister of Citizenship and Immigration), [2006] 2 F.C.R. 386
(F.C.), at paragraph 23 the mandatory language of our rule [Federal Courts
Rules, r. 334.16] (shall… certify) excludes an overriding discretion
to refuse to certify a class proceeding if the prescribed factors for
certification are met.
[27]
The proper approach to be taken by this Court was
summarized by the British Columbia Court of Appeal in Pro-Sys v Infineon,
2009 BCCA 503 at paragraphs 64-65:
[64] The
provisions of the [Class Proceedings Act] should be construed
generously in order to achieve its objects: judicial economy (by
combining similar actions and avoiding unnecessary duplication in fact-finding
and legal analysis); access to justice (by spreading litigation costs over a
large number of plaintiffs, thereby making economical the prosecution of
otherwise unaffordable claims); and behaviour modification (by deterring
wrongdoers and potential wrongdoers through disabusing them of the assumption
that minor but widespread harm will not result in litigation): Western
Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 (CanLII), 2001 SCC 46, [2001] 2
S.C.R. 534 at paras. 26-29 [Western Canadian Shopping Centres]; Hollick v.
Toronto (City), 2001 SCC 68 (CanLII), 2001 SCC 68, [2001] 3 S.C.R. 158 at para.
15 [Hollick].
[65] The
certification hearing does not involve an assessment of the merits of the claim;
rather, it focuses on the form of the action in order to determine whether the
action can appropriately go forward as a class proceeding: Hollick at
para. 16. The burden is on the plaintiff to show “some basis in fact”
for each of the certification requirements, other than the requirement that the
pleading disclose a cause of action: Hollick, at para. 25.
However, in conformity with the liberal and purposive approach to
certification, the evidentiary burden is not an onerous one – it requires only
a “minimum evidentiary basis”: Hollick, at paras. 21,
24-25; Stewart v. General Motors of Canada Ltd., [2007] O.J. No.
2319 (S.C.J.) at para. 19. As stated in Cloud v. Canada (Attorney
General) 2004 CanLII 45444 (ON CA),
(2004), 247 D.L.R. (4th) 667 at para. 50, 73 O.R. (3d) 401 (C.A.), leave to appeal ref’d [2005] S.C.C.A. No. 50 [Cloud],
[O]n a
certification motion the court is ill equipped to resolve conflicts in the
evidence or to engage in finely calibrated assessments of evidentiary
weight. What it must find is some basis in fact for the certification
requirement in issue.
[Emphasis
added]
[28]
Accordingly, the Plaintiffs argue that they only
have a “light burden” to satisfy, and therefore, “even if common issues contain
elements of novelty and difficulty, they should be ‘left to be worked out in
the laboratory of the trial court.’” In this respect, they have put great
emphasis on their limited ability to conduct pre-certification discovery to
advance their pleadings.
Relief sought
[29]
The Plaintiffs seek the following relief:
a.
An order appointing the Plaintiffs as the
representative plaintiffs;
b.
An order defining the Class (or Class Members)
as follows:
All persons whose
personal information was contained in an external hard drive in the control of
Human Resources and Skills Development or the National Student Loan Services
Centre which was lost or disclosed to others on or about November 5, 2012, but
not including senior management of Human Resources and Skills Development
Canada, the Canada Student Loans Program, or Ministers and Deputy Ministers of
the Ministry of Human Resources and Skills Development.
c.
An order staying any other proceeding in Federal
Court relating to this proposed class proceeding;
d.
Orders stating the nature of the claims asserted
on behalf of the Class and setting out the relief sought by the Class;
e.
An order stating the Common Questions;
f.
Orders approving the Litigation Plan, setting
the form and content of the Notice Program and assigning the cost of the Notice
Program, and defining the opt out process; and
g.
Orders providing for such further and other
relief as Class Counsel may request and this Honourable Court may deem just.
Analysis
Reasonable Cause of Action (Rule 334.16(1)(a))
[30]
The Plaintiffs submit that they have a number of
well-established causes of action against the Defendant: a) breach of contract
and warranty; b) the commission of the tort of intrusion upon seclusion
(invasion of privacy); c) negligence; d) breach of confidence; and e) violation
of Quebec law.
[31]
There is a relatively low threshold for whether
pleadings disclose a reasonable cause of action. In Hunt v Carey Canada Inc,
1990 2 SCR 959 [Hunt] at 980, the Supreme Court of Canada held that the
court, in such an assessment, must assume that the facts alleged in the
plaintiff’s claim can be proved without the consideration of evidence. With
this assumption in mind, the court determines whether it is “plain and obvious”
that the plaintiff’s claim fails to disclose a reasonable cause of action. The
court is not to evaluate the chances of success, but whether there is some chance
of success:
Thus, the test in
Canada governing the application of provisions like Rule 19(24)(a) of the
British Columbia Rules of Court is the same as the one that
governs an application under R.S.C. O. 18, r. 19: assuming that
the facts as stated in the statement of claim can be proved, is it "plain and
obvious" that the plaintiff's statement of claim discloses no reasonable
cause of action? As in England, if there is a chance that the
plaintiff might succeed, then the plaintiff should not be "driven from the
judgment seat". Neither the length and complexity of the issues,
the novelty of the cause of action, nor the potential for the defendant to
present a strong defence should prevent the plaintiff from proceeding with his
or her case. Only if the action is certain to fail because it
contains a radical defect ranking with the others listed in Rule 19(24) of the
British Columbia Rules of Court should the relevant portions
of a plaintiff's statement of claim be struck out under Rule 19(24)(a)].
[Emphasis added]
[32]
Also relying on Hunt, the Defendant insists
on the fact that the analysis must be made on the pleadings alone, and so, as
with a motion to strike, no evidence may be considered. Nonetheless, the
Plaintiffs’ pleadings must be supported by a factual basis. It refers as well
to R v Imperial Tobacco Canada, 2011 3 SCR 45 at paragraphs 66-70, where
the Supreme Court of Canada explains the test as follows:
[70] The
second problem with the argument is that, as discussed above, a motion to
strike is, by its very nature, not dependent on evidence. The facts
pleaded must be assumed to be true. Unless it is plain and obvious that
on those facts the action has no reasonable chance of success, the motion to
strike must be refused. To put it another way, if there is a reasonable
chance that the matter as pleaded may in fact turn out not to be a matter of
policy, then the application to strike must be dismissed. Doubts as to what may
be proved in the evidence should be resolved in favour of proceeding to
trial. The question for us is therefore whether, assuming the facts
pleaded to be true, it is plain and obvious that any duty of care in negligent
misrepresentation would be defeated on the ground that the conduct grounding
the alleged misrepresentation is a matter of government policy and hence not
capable of giving rise to liability in tort.
[33]
As the Defendant argues that the Plaintiffs
failed to plead a factual basis for any of the types of damages alleged, the
causes of action advanced by the Plaintiffs will be separated into two
categories: one in which damages are argued not to be an essential element of
the cause of action; and one in which they are.
Damages
argued not to be an essential element of the cause of action
a) Breach of contract and warranty
[34]
The Plaintiffs contend that the Defendant breached
certain obligations found in the Contracts, legislation and policies. I will
now discuss each of these issues in turn.
Contracts
[35]
The Application Forms for the Student Loans
contained express terms allowing the Defendant to make certain uses of the Personal
Information provided by the Plaintiffs, as well as others which guaranteed that
no other uses of the Personal Information would be permitted.
[36]
More specifically, these Application Forms
contained terms as to how the Personal Information would be collected, stored,
disclosed, and ultimately destroyed by the Defendant, including terms that the
Defendant would:
a.
Keep the Personal Information confidential;
b.
Not disclose the Personal Information except as
provided by the Statutes;
c.
Secure the Personal Information and follow its
own internal policies with respect to the secure retention of that Personal
Information;
d.
Delete or destroy the Personal Information once
the Class Member’s Student Loans was repaid in full; and
e.
Not disclose the Personal Information once the
Class Member’s Student Loans was repaid in full.
[37]
In 2002, Rebecca Walker signed the “Canada
Student Loans Agreement.” This agreement notably contained the following terms:
3. Personal
Information: The information I give under this Agreement will be used solely
to administer my Direct Loan. Information about me under the control of the
Minister will be administered in accordance with the Privacy Act, and will
be stored in personal Information Bank No. HRDC PPU 030. I authorize the
Minister to disclose to and obtain from Lenders, financial institutions,
consumer credit grantors, credit bureaus or credit reporting agencies all
particulars and information relevant to my Direct Loans or Student Loans. […]
The Minister may exchange information obtained from any source with any of: the
appropriate authority, the financial institution disbursing my loan, my
Educational Institution and Lenders, but solely for the purposes of the
administration or enforcement of the [Canada Student Financial Assistance Act].
The Minister may exchange information with provincial student financial
assistance programs, but solely for the purposes of the determination of
eligibility for provincial loan remission.
[Emphasis
added]
[38]
In 2003, Rebecca Walker also signed a revised version
of the “Canada Student Loans Agreement,” which states:
I authorize the
Government of Canada and the National Student Loans Service Centre to disclose
to and obtain from any other consumer credit providers, credit bureaus or
credit reporting agencies all particulars and information relating to my [Canada
Student Financial Assistance Loans] and [Canada Student Loans]. […]
I authorize the
Government of Canada […] to collect, use and disclose date and information
related to any of my [Canada Student Loans] and [Canada Student Financial
Assistance loans] that I may have for the purposes of carrying out their duties
under, and the administration of the [Canada Student Loans Program].
[39]
In 2001 and 2002, Rebecca Walker also signed the
“Canada Student Loans Program Schedule 1,” which contained the following terms:
I authorize the payor
to disclose to and obtain from any other consumer credit providers, credit
bureaus or credit reporting agencies all particulars and information relating
to my [Canada Student Financial Assistance Loans] and [Canada Student Loans].
[…]
I authorize the
federal government […] to collect, use and disclose data and information
related to any of my [Canada Student Loans] and [Canada Student Financial
Assistance Loans] and that I may have for the purposes of carrying out their
duties under, and the administration and enforcement of the [Canada Student Loans Program].
[Emphasis added]
[40]
In 2009, the National Student Loans Service
Centre sent to Angela Piggott the “Consolidated Loan Agreement,” which
contained the following terms:
TERMS AND CONDITIONS
APPLICABLE FOR CANADA STUDENT LOANS AND THE CANADA PORTION OF THE INTEGRATED
STUDENT LOANS
Whereas Your Canada
Student Loans and the Canada portion of your Integrated Student Loans (“CSLs”)
have been made to you, the borrower, pursuant to the Canada Student
Financial Assistance Act (the “Federal Act”) and the Canada
Student Financial Assistance Regulations (the “Federal Regulations”),
both as amended from time to time, you agree as follows: […]
TERMS AND CONDITIONS
APPLICABLE FOR CANADA STUDENT LOANS AND CANADA-ONTARIO INTEGRATED STUDENT LOANS
[…]
4. You authorize the
NSLSC and the Ministers HRSD and TCU to disclose to and obtain from consumer
creditors, credit bureaus or credit reporting agencies all particulars and
information relevant to collecting on your loan.
5. You agree to
notify the NSLSC promptly of any changes in your name or address. If you
fail to make a payment on your [Canada Student Loans] or [Ontario Student
Loans] required pursuant to this agreement, you authorize […] HRSD and TCU
[…] to release to the NSLSC and/or the Ministers or their agents, whatever
information they need to locate you.
6. The Ministers of
HRSD and TCU may exchange information obtained from any source with each other
and with any of: financial institutions, the NSLSC, any designated educational
institution you have attended and previous lenders holding your Ontario Student
Loans issued prior to August 1, 2001 or Canada Student Loans prior to August 1,
2000, if any, but solely for the purposes of the administration or
enforcement of the Federal and Provincial Acts and Regulations. […]
[Emphasis added]
[41]
Meanwhile, Angela Piggott’s “Canada-Ontario
Student Loans Program Loan Agreements,” contained the following language:
I agree that until
my loans, overpayments and repayments are repaid, MTCU, HRDC and the NSLC
can disclose to and collect from any branch of the federal or any provincial
government (including any agencies identified on my OSAP application […]), my
educational institutions, my lenders, or financial institutions, consumer
credit grantors, credit reporting agencies, credit bureaus and any collection
agencies that may be operated or retained or on behalf of MTCU or HRSDC any
personal information, including my Social Insurance Number, necessary to
administer and enforce my Canada-Ontario Integrated Student Loans.
[Emphasis added]
Enabling Legislation and Statutory
terms in Contracts
[42]
The Contracts contained terms requiring that
Personal Information be collected, retained, and disclosed only in accordance
with certain statutes: the Privacy Act, RSC 1985, c P-21, the Canada
Student Financial Assistance Act, SC 1994, c 28, the Canada Student
Financial Assistance Regulations, SOR 95-329, and what was then known as
the Department of Human Resources and Skills Development Act, SC 2005, c
34 (since December 12, 2013, this act is known as the Department of
Employment and Social Development Act, SC 2005, c 34).
Policies
[43]
It was a term of the Application Forms that the
Defendant would follow its policies in handling the Plaintiffs and Class
Members’ personal applications. The Plaintiffs argue that the Defendant
breached its contractual obligations by failing to do so.
[44]
Firstly, the Plaintiffs argue that the Defendant
failed to comply with its physical security policies, leaving the Hard Drive
vulnerable to loss or theft. Specifically, it failed to comply with its “Locked
Containers Policy” and “Clean Desk Policy” by storing the Hard Drive and the
Personal Information it contained in a cluttered, unlocked cabinet.
[45]
Secondly, the Plaintiffs argue that the
Defendant failed to comply with its “Encryption Policy,” which required that
any sensitive Personal Information be encrypted, or electronically encoded into
a form that cannot be decoded without the proper digital key, before it is
stored on a portable device such as the Hard Drive.
[46]
Lastly, the Plaintiffs argue that the Defendant
failed to comply with the Treasury Secretariat and Privacy Commissioner’s
recommendation that disclosure of any sensitive data loss be made as soon as
possible.
The Breaches at Issue
[47]
In summary, the Plaintiffs allege that the
Defendant committed the following breaches of the Contracts:
a.
Failure to adhere to the standards for the
protection of Personal Information, as set out in the statutes that are
expressly referred to in the Contracts;
b.
Failure to adhere to the Minister’s policies;
c.
Disclosure of Personal Information in a manner
not permitted under the Contracts;
d.
Failure to destroy the Personal Information in
the manner required by the Contracts:
e.
Retention of the Personal Information for a
period longer than allowed under the terms of the Contracts and for purposes
not allowed by the Contracts.
[48]
The Plaintiffs contend that contractual claims
are one of the most common areas of class action certification. In Robinson
v Rochester al, 2010 ONSC 463 at paragraph 44, for instance, the Court
said:
Whether a defendant
was in a contractual relationship with members of the class, the terms of that
contract, and whether the defendant breached the contract may constitute common
issues: Hickey-Button v. Loyalist College of Applied Arts &
Technology, [2006] O.J. No. 2393 (C.A.).
[49]
As for damages, the Plaintiffs acknowledge that
their claims, much like those of the Class Members, are for very small sums.
However, they submit that nominal damages have long been awarded by Canadian
courts in order to recognize a breach of contract, even if it does not have a
clear economic impact, or if that impact cannot easily be assessed. They point
to Fraser Park South Estates Ltd v Lang Michener Lawrence & Shaw,
2001 BCCA 9 at paragraph 46, which says that every “breach of contract is a
violation of a right […] which entitles the victim to damages even if only
nominal.”
[50]
The Defendant does not submit any arguments
concerning the cause of action in breach of contract. It denies, however, that
the Plaintiffs have properly alleged a basis in fact for damages suffered as a
result of this breach. It further argues that nominal damages should never be
awarded in a class action as it would not favour the plaintiffs but rather
their counsel, since the latter would be the only ones effectively standing to
benefit financially from the outcome.
[51]
The Defendant advances an interesting and strong
argument on this point but the Plaintiffs’ position, although novel in the
context of a class proceeding is supported by sufficient authorities that this
cause of action should be considered on the merit of the action. In other words,
it is not plain and obvious that the cause of action in contract would fail. As
to any disproportionate advantages in favour of the Plaintiffs’ counsel, the
Court will also be better positioned to rule on that issue when it hears it on
the merit.
b) The Commission of the Tort of Intrusion upon Seclusion (Invasion of Privacy)
[52]
The Plaintiffs allege that the Defendant has
committed the tort of intrusion upon seclusion. They point us to Jones v
Tsige, 2012 ONCA 32 [Jones], where the Ontario Court of Appeal has
recently confirmed the tort’s existence in Canada, as a category of a broader
tort relating to invasion of privacy. I reproduce some relevant paragraphs from
the decision to shed some light on this new tort:
[70] I would
essentially adopt as the elements of the action for intrusion upon seclusion
the Restatement (Second) of Torts (2010) formulation which, for the sake of
convenience, I repeat here:
One who
intentionally intrudes, physically or otherwise, upon the seclusion of another
or his private affairs or concerns, is subject to liability to the other for
invasion of his privacy, if the invasion would be highly offensive to a
reasonable person.
[71]
The key features of this cause of action are, first, that the defendant's
conduct must be intentional, within which I would include reckless;
second, that the defendant must have invaded, without lawful justification,
the plaintiff's private affairs or concerns; and third, that a reasonable
person would regard the invasion as highly offensive causing distress,
humiliation or anguish. However, proof of harm to a recognized economic
interest is not an element of the cause of action. I return below to the
question of damages, but state here that I believe it important to emphasize
that given the intangible nature of the interest protected, damages for
intrusion upon seclusion will ordinarily be measured by a modest conventional
sum.
(d) Limitations
[72]
These elements make it clear that recognizing this cause of action will not
open the floodgates. A claim for intrusion upon seclusion will arise only for
deliberate and significant invasions of personal privacy. Claims from
individuals who are sensitive or unusually concerned about their privacy are
excluded: it is only intrusions into matters such as one's financial or health
records, sexual practises and orientation, employment, diary or private
correspondence that, viewed objectively on the reasonable person standard, can
be described as highly offensive.
[…]
[74]
As I have indicated, proof of actual loss is not an element of the cause of
action for intrusion upon seclusion. However, the question necessarily arises:
what is the appropriate approach to damages in cases, like the present, where
the plaintiff has suffered no pecuniary loss?
[75]
Where the plaintiff has suffered no provable pecuniary loss, the damages fall
into the category of what Professor Stephen M. Waddams, The Law of Damages,
looseleaf (Toronto: Canada Law Book, 2011), at para. 10.50, describes as
"symbolic" and others have labelled as "moral" damages: see
Dulude v. Canada, 2000 CanLII 16085 (FCA),
[2000] F.C.J. No. 1454, 192 D.L.R. (4th) 714 (C.A.), at para. 30. They are
awarded "to vindicate rights or symbolize recognition of their
infringement": Waddams, at para. 10.50. I agree with Prof. Waddams'
observation that a conventional range of damages is necessary to maintain
"consistency, predictability and fairness between one plaintiff and
another".
[Emphasis added]
[53]
The Plaintiffs contend that this tort applies,
that it does not require the breach of privacy to be wilful as recklessness
suffices, and that it does not require proof of harm to an economic interest.
The Plaintiffs note that the Defendant’s conduct was indeed reckless, as its
information technology staff failed to follow the Encryption Policy during a
routine system upgrade:
[R]ather than
securely deleting the Personal Information from the Hard Drive, the Defendant
put the Personal Information in a cabinet that was not always locked—another
violation of the HRSDC Policies—and ignored it for several months until another
upgrade was planned.
[54]
On its part, the Defendant contends that the
claim as pleaded does not establish the elements required for the application
of the tort of intrusion upon seclusion.
[55]
Firstly, the Defendant submits that the
Plaintiffs’ pleadings do not allege that the Defendant invaded their private
affairs without justification, as is required by the second element of the test
for the tort—in fact, paragraph 16 of the Consolidated Statement of Claim describes
how the Defendant was lawfully in possession of the Plaintiffs’ Personal
Information pursuant to the Contracts.
[56]
Secondly, the Personal Information is not
sufficiently intrusive to give rise to the cause of action—there is nothing
deeply personal about this information that if disclosed could cause
embarrassment or humiliation: it is “basic biographical information such as
name, date of birth, address, social insurance number and student loan
balance.”
[57]
Finally, the harms alleged at paragraph 30 of the
Plaintiffs’ Consolidated Statement of Claim, namely “inconvenience, frustration
and anxiety,” are not as dire as the “distress, humiliation or anguish” put
forward by the Ontario Court of Appeal in Jones.
[58]
At the certification stage, I am satisfied that
the Plaintiffs have sufficiently responded to the Defendants’ arguments.
Firstly, they note that they have not claimed that the Defendant collected
their Personal Information without lawful justification, but rather that it was
disclosed in an unlawful way, and was not destroyed in accordance with
statutory requirements. They refer us to paragraph 22 of their Consolidated
Statement of Claim, which does in fact corroborate this.
[59]
Secondly, the Plaintiffs maintain that, contrary
to the Defendant’s contention, the information lost was not “basic biographical
information,” but rather financial records as the tort requires—after all, it
concerns the existence and amount of a debt obligation.
[60]
Thirdly, the tort requires an intrusion that “a
reasonable person would regard as highly offensive causing distress,
humiliation or anguish,” not that the information at issue causes
embarrassment or humiliation. Accordingly, the Defendant’s failure to protect
the Personal Information by leaving the Hard Drive in an unlocked filing
cabinet could satisfy that test.
[61]
Finally, the Plaintiffs could be right when
arguing that the Defendant is quibbling over semantics when it contends that
the “inconvenience, frustration and anxiety” alleged to have been suffered by
the Plaintiffs in their Consolidated Statement of Claim are not sufficiently
serious to meet the standard of harm of “distress, humiliation or anguish”
required by Jones. Frustration and anxiety could be forms of distress.
[62]
On the issue of damages for the tort of intrusion
upon seclusion, the Plaintiffs submit that nominal ones can be awarded. The
Ontario Court of Appeal in Jones at paragraphs 77 and 87 held
that damages are appropriate to remedy “intangible harm such as hurt feelings,
embarrassment for mental distress, rather than damages for pecuniary losses,”
in an amount “sufficient to mark the wrong that has been done”:
[77] Although the tort of intrusion upon exclusion has not been
fully recognized in Ontario law, several cases award damages for invasion of
privacy in conjunction with, or under the head of, a traditional tort such as
nuisance or trespass. These claims typically involve intangible harm such as
hurt feelings, embarrassment or mental distress, rather than damages for
pecuniary losses. I attach, as Appendix A, a summary of these cases and the
damages awarded and will briefly discuss the facts of some of those cases here.
[…]
[87] […]The factors
identified in the Manitoba Privacy Act, which, for convenience, I summarize
again here, have also emerged from the decided cases and provide a useful guide
to assist in determining where in the range the case falls: (1) the nature,
incidence and occasion of the defendant's wrongful act; (2) the effect of the
wrong on the plaintiff's health, welfare, social, business or financial
position; (3) any relationship, whether domestic or otherwise, between the
parties; (4) any distress, annoyance or embarrassment suffered by the plaintiff
arising from the wrong; and (5) the conduct of the parties, both before and
after the wrong, including any apology or offer of amends made by the
defendant.
[63]
Since the hearing held in December 2013, the
parties have brought to my attention a recent decision by the Ontario Superior
Court of Justice, which dismissed a motion to strike out a claim based on the
tort of intrusion upon seclusion or invasion of privacy (Hopkins v Kay,
2014 ONSC 321 [Hopkins]). In Hopkins, the plaintiffs
allege that the defendants, a hospital, seven of its employees, and a college,
wrongfully and intentionally accessed the private medical information of 280
patients without their consent. The parties have not provided me with any
arguments relating to this decision. Nonetheless, I take note of Justice
Edwards’ comments in the matter:
[30] I am not satisfied from a review of Jones that
it should be, as suggested by counsel for the Hospital, restricted to the facts
of that case. Rather, I am of the view that the Court of Appeal in Jones has
determined that the common law right to proceed with a claim, based on the tort
of breach of privacy, as alleged in the plaintiff’s statement of claim is a
claim that should be allowed to proceed. This is not a case that, in my
view, is so plain and obvious that the court should strike out the
claim.
[64]
Accordingly, it is not plain and obvious that an
action based on the tort of intrusion upon seclusion would fail.
Damages
being an essential element of the cause of action
c) Negligence and Breach of
confidence
[65]
The crux of the Defendant’s argument against the
Plaintiffs’ claim for negligence and breach of confidence lies in its adamancy
that they have failed to raise any sufficient arguments with regard to the
existence of compensable damages.
[66]
The damages sought by the Plaintiffs fall into
two categories: i) compensation for wasted-time, inconvenience, frustration and
anxiety resulting from the Data Loss; and ii) increased risk of identity theft
in the future. However, as argued by the Defendant, the Plaintiffs have failed
to plead any factual basis for damages in their Consolidated Statement of
Claim. At the end of the hearing, the Plaintiffs informed the Court that should
this be required, they were officially presenting a motion for permission to
amend their Consolidated Statement of Claim in order to rectify the omission.
[67]
The Plaintiffs filed their Consolidated
Statement of Claim in April 2013 while the Defendant filed its Memorandum of
Fact and Law in September 2013. The Plaintiffs therefore had ample time to file
a motion for permission to amend their Consolidated Statement of Claim before
the hearing. They failed to do so.
[68]
In addition, a summary review of the evidence
adduced by both parties leads the Court to the conclusion that the Plaintiffs
have not suffered any compensable damages. The Plaintiffs have not been victims
of fraud or identity theft, they have spent at most some four hours over the
phone seeking status updates from the Minister, they have not availed
themselves of any credit monitoring services offered by the credit reporting
agencies nor have they availed themselves of the Credit Flag service offered by
the Defendant.
[69]
Nor does the evidence adduced support a claim
for increased risk of identity theft in the future. Since the Data Loss,
Equifax has produced reports pertaining to the credit files of the 88,548
individuals who availed themselves of the Credit Flag service. These reports
show that there had been no increase in the relevant indicia that would be
consistent with an increase in criminal activities involving those individuals’
Personal Information. The rate of criminal activities registered was not higher
than the 3% of the population generally victim of identity theft. Moreover,
the Plaintiffs submitted a CBC news article concerning a Class Member who had
been a victim of identity theft yet the article noted no proven causal link
between the Data Loss and that theft.
[70]
The Plaintiffs refer this Court to the Ontario
Superior Court of Justice’s decision in Rowlands v Durham Region Health et
al, 2011 ONSC 719 (Lauwers J) [Rowlands], and to the two decisions
of the Superior Court of Quebec in Larose c Banque Nationale du
Canada, 2010 QCCS 5385 (Beaugé J) [Larose] and Mazzonna v
DaimlerChrysler Financial Services Canada, 2012 QCCS 958 (CanLII)
(Lacoursière J) [Mazzonna]. The first two cases were certified as class
proceedings, whereas the latter was not. However, the Plaintiffs claim that
Justice Lacoursière in Mazzonna would have certified fault as a common
issue, but refused because the representative plaintiff did “not have
standing.”
[71]
For their part, the Defendant claims that the
Plaintiffs wrongly assert Rowlands as supportive of the certification of
this action, as the defendant in that case had consented to the certification.
[72]
I doubt the relevance of the Defendant’s
distinction here, as I note that despite the defendant’s consent, the Judge
still seemingly considered the merits of the certification in that decision:
[8]
The class action that the plaintiff proposes meets the criteria in section
5 of the CPA. In my opinion, without the certifying this action as a
class proceeding, the Class Members would not reasonably be able to obtain
access to justice. This is an appropriate case for certification under
the CPA, and I therefore certify the class action.
[73]
Yet the Defendant’s rejection of the Plaintiffs’
use of Mazzonna at paragraphs 57-62 is more telling. The actual reason
for why the plaintiff did not have “standing,” as the Plaintiffs allege, is
because Justice Lacoursière could not find an appearance of right of damages
suffered by the plaintiff. He distinguished the damages suffered by the
plaintiff from those suffered by the plaintiff in Larose:
[48] The
attorney for Petitioner argues that the Court should not assess, at this stage
of the proceedings, the weight of the evidence on damages and that this should
be done at trial. He invites the Court to draw a comparison with the facts
leading to a recent judgment where Madam Justice Beaugé authorized the
institution of a Class action.
[…]
[53] There
is at least one very significant distinction between the facts alleged in
the Larose case and those alleged in this instance: Mr. Larose was
the victim of three subsequent attempts to defraud him, after being a victim of
identity theft.
[54]
This is not the case of Petitioner and this distinction has a crucial
bearing on the question of damages.
[55]
The Court has to decide whether the Petitioner herself meets the appearance of
right condition on the basis of her own circumstances. In Bouchard v. Agropur
Cooperative et al, the Court of Appeal states:
[109] Il faut
garder à l'esprit qu'avant le jugement d'autorisation, « le recours n'existe
pas, du moins sur une base collective ». Le recours individuel du requérant, à
lui seul, doit donc remplir les conditions de l'article 1003 C.p.c. dont
celle de l'apparence de droit, puisque tout le reste ne relève encore que du
domaine de l'hypothèse.
[56]
In the Court's view, the Petitioner fails to meet the test that she has
suffered damages.
[57] She
did indeed suffer anxiety; she has had to change, minimally, some of her
habits. However, these inconveniences were negligible, so much so that she
never felt the need to take any steps to alleviate her anxiety. The most she
did was to keep the minimum amount of money in the account from which her lease
payments were made and to check, twice a month, rather than once a month, on
the Internet, whether her account had been tampered with.
[58]
This is not enough to meet the threshold, however prima facie,
of the existence of "compensable" damages.
[Emphasis added]
[74]
Justice Lacoursière relied on Mustapha v
Culligan of Canada Ltd, 2008 SCC 27 at paragraph 9, where the Supreme Court
of Canada characterized compensable damages as follows:
[9] This said,
psychological disturbance that rises to the level of personal injury must be
distinguished from psychological upset. Personal injury at law connotes serious
trauma or illness; see Hinz v. Berry, [1970] 2
Q.B. 40 (C.A.) at p. 42; Page v. Smith, at p. 189;
Linden and Feldthusen, at pp. 425-27. The law does not recognize upset,
disgust, anxiety, agitation or other mental states that fall short of
injury. I would not purport to define compensable injury exhaustively,
except to say that it must be serious and prolonged and rise above the ordinary
annoyances, anxieties and fears that people living in society routinely, if
sometimes reluctantly, accept. The need to accept such upsets rather than seek
redress in tort is what I take the Court of Appeal to be expressing in its
quote from Vanek v. Great Atlantic & Pacific Co.
of Canada 1999 CanLII 2863 (ON CA),
(1999), 48 O.R. (3d) 228 (C.A.): "Life goes on" (para. 60).
Quite simply, minor and transient upsets do not constitute personal injury,
and hence do not amount to damage.
[Emphasis in
original]
[75]
Justice Lacoursière also held at paragraph 66 of
Mazzonna that the potential for future damages for the plaintiff who had
not yet been victim of identity theft or unsuccessful attempts to defraud (as
the Defendant argues, this applies to the case at bar) “falls squarely within
the field of ‘speculation’ and ‘unverified hypotheses’ and ought not be
considered in assessing whether there is a prima facie existence
of damages.”
[76]
I note that in approving the settlement of the
parties in Rowlands v Durham Regional Health et al, 2012 ONSC 3948
(CanLII) at paragraph 21, Justice Lauwers wrote favourably of the Mazzonna decision.
[77]
A review of the case law submitted by the
Plaintiffs reveals that damages are rarely awarded for “mild disruption” alone,
but normally in conjunction with other more traditional heads of damages, which
are not available here. Moreover, damages cannot be awarded for merely
speculative injuries.
[78]
The facts of this case being very similar to
those in Mazzonna, I see no reason to depart from the reasoning held by
Justice Lacoursière in that case.
[79]
Accordingly, it is plain and obvious that the
claims based on negligence and breach of confidence would fail for lack of
compensable damages.
e) Violation of Quebec Law
[80]
The Plaintiffs allege that, considering the Personal
Information was being stored in Quebec and was lost by an agent of the Minister
in Quebec, they have claims for moral and material damages pursuant to Quebec
law, as a result of a variety of violations of the Quebec Charter of Human
Rights and Freedoms [the Quebec Charter] and the Civil Code of
Québec [the CCQ].
[81]
At the hearing, the Plaintiffs’ arguments based
on the Quebec Charter were rightfully withdrawn, as it does not apply to
the Government of Canada.
[82]
As for the CCQ, the Plaintiffs allege
that the Defendant violated their privacy interests as protected by articles 3,
35 and 37 of the CCQ, by disclosing the Personal Information without
their consent and contrary to the applicable Contracts and statutes, and by not
having destroyed the information of those Class Members whose loans had been
paid in full. Accordingly, these breaches give rise to moral and material
damages pursuant to article 1457 of the CCQ. As is the case for the tort
of intrusion upon seclusion, the Plaintiffs submit that nominal damages can
also be awarded to remedy intangible harms.
[83]
However, Title Two of Book Ten (Private
International Law) of the CCQ deals with conflict of laws and provides
for the following:
3126. The obligation to make reparation for injury caused to another is
governed by the law of the country where the injurious act occurred. However,
if the injury appeared in another country, the law of the latter country is
applicable if the person who committed the injurious act should have foreseen
that the damage would occur.
In any case
where the person who committed the injurious act and the victim have their
domiciles or residences in the same country, the law of that country applies.
3127. Where an obligation to make reparation for injury arises from
non-performance of a contractual obligation, claims based on the
nonperformance are governed by the law applicable to the contract.
|
3126.
L'obligation de réparer le préjudice causé à autrui est régie par la loi de
l'État où le fait générateur du préjudice est survenu. Toutefois, si le
préjudice est apparu dans un autre État, la loi de cet État s'applique si
l'auteur devait prévoir que le préjudice s'y manifesterait.
Dans tous les cas, si l'auteur et la victime
ont leur domicile ou leur résidence dans le même État, c'est la loi de cet
État qui s'applique.
3127. Lorsque
l'obligation de réparer un préjudice résulte de l'inexécution d'une
obligation contractuelle, les prétentions fondées sur l'inexécution sont
régies par la loi applicable au contrat.
|
[84]
For the purposes of Book Ten, article 3077 of
the CCQ explains that any territorial unit of a country having a
different legislative jurisdiction is to be regarded as a country. Accordingly,
the other Canadian Provinces are foreign jurisdictions for the application of the
CCQ (171486 Canada Inc v Rogers Cantel Inc, [1995] RDJ
91).
[85]
The Plaintiffs do not allege that the laws of
the Province of Quebec govern their Contracts with the Defendant, and so Quebec law does not apply to the non-performance of obligations emanating from those
Contracts. In addition, as it was foreseeable that any damages resulting from
the Data Breach, if any, would be suffered in the provinces of residence of the
Plaintiffs and Class Members, and as no Class Members reside in the Province of
Quebec, Quebec law cannot apply to these proceedings.
[86]
Accordingly, it is plain and obvious that the
Plaintiffs’ claims based on the CCQ would fail.
Identifiable Class of two or more Persons (Rule 334.16(1)(b))
[87]
The Plaintiffs argue that they have met this requirement
for certification. The inquiry is limited to determining whether two or more
people qualify within the proposed class definition, and whether the class has
been defined by reference to objective criteria for this point. They cite Western
Canadian Shopping Centres Inc at para 38:
While there are
differences between the tests, four conditions emerge as necessary to a class
action. First, the class must be capable of clear definition. Class
definition is critical because it identifies the individuals entitled to
notice, entitled to relief (if relief is awarded), and bound by the
judgment. It is essential, therefore, that the class be defined clearly
at the outset of the litigation. The definition should state objective
criteria by which members of the class can be identified. While the
criteria should bear a rational relationship to the common issues asserted by
all class members, the criteria should not depend on the outcome of the
litigation. It is not necessary that every class member be named or
known. It is necessary, however, that any particular person’s claim to
membership in the class be determinable by stated, objective criteria: see
Branch, supra, at paras. 4.190-4.207; Friedenthal, Kane and
Miller, Civil Procedure (2nd ed. 1993), at pp. 726-27; Bywater
v. Toronto Transit Commission (1998), 27 C.P.C. (4th) 172 (Ont. Ct.
(Gen. Div.)), at paras. 10-11.
[88]
The Plaintiffs submit that the Class is defined
by reference to plainly objective criteria that will identify Class
Members—whether or not a person’s Personal Information was contained on the
Hard Drive. On that note, a significant number of potential Class Members
showed interest in the Data Loss by taking active steps to confirm whether
their Personal Information was affected (250,000 contacted the Information
Line), and over 25,000 Class Members contacted or registered with Class Counsel
to receive notice of the certification of the action.
[89]
The Defendant does not contest this step and I
am of the opinion that it is met.
Common questions
of law or fact (Rule 334.16(1)(c))
[90]
The Plaintiffs argue that a class proceeding
will avoid duplication of fact-finding and legal analysis. Accordingly, this
step of the test is satisfied if resolution of a common question (either for or
against the Class Members) will advance the case or move the litigation
forward, and is capable of extrapolation to the Class Members. The Plaintiffs
cite Sivak v Canada, 2012 FC 271 at paragraph 4:
[…] The common issues
do not have to determine the question of liability for all members of the
class, or otherwise dispose of the action, but they must have sufficient
significance in relation to the claim that their resolution will advance the
litigation in a meaningful way.
[91]
The Plaintiffs further submit that this aspect
of the test represents a “low bar.” They point to Cloud v Canada (Attorney
General), 2004 CanLII 45444 (ON CA) at paragraph 52, where the Ontario
Court of Appeal explained that it can be met even if “after the trial of the
common issue the many remaining aspects of liability and the question of
damages would have to be decided individually.” By answering the common
questions, so the Plaintiffs argue, liability will be determined.
[92]
I agree with the Plaintiffs that there are
common questions on the following issues: i) breach of contract, breach of
warranty and the tort of intrusion upon seclusion; ii) damages, including
whether the damages could be assessed in the aggregate pursuant to rule
334.28(1) of the Rules and as to whether the Defendant’s conduct justifies
an award of punitive damages (as a result of the potential application of the
tort of intrusion upon seclusion) ; iii) whether Class Members are entitled to
pre- and post-judgment interest pursuant to the Crown Liability and
Proceedings Act, RSC 1985, c C-50; and finally iv) on the following
injunctive remedies:
a.
Are they entitled to an order that the Defendant
provide them with new SINs?
b.
Are they entitled to an order that the Defendant
provide them with appropriate credit monitoring services?
c.
Is the Defendant liable to pay the cost of the
Administrator, Class Counsel Representative, and Arbitrator in accordance with
the Litigation Plan?
Preferable Procedure for the Just and
Efficient Resolution of the Common Questions (Rule 334.16(1)(d))
[93]
Prior to engaging with rule 334.16(2) of the Rules,
the Plaintiffs argue that the preferability inquiry has to be conducted through
the lens of the three principal goals of class actions. Firstly, as the Court
explains in Bodnar v The Cash Store Inc, 2009 BCSC 74 at paragraph 14, a
class action can “provide access to justice to claimants whose claims would be
otherwise uneconomical if they were to proceed by way of individual trial.”
Secondly, judicial economy would be served by avoiding duplication in
fact-finding and legal analysis, and a class action would ensure that Class
Members not have to participate in the initial discovery process or the trial
of the common issues. Finally, it will allow for behaviour modification. For
this last point, the Plaintiffs cite Hickey-Button v Loyalist College of
Applied Arts & Technology, 2006 CanLII 20079 (ON CA) at paragraph 58,
where the Ontario Court of Appeal noted that “behaviour modification has added
value when directed at public institutions.”
[94]
The Plaintiffs contend that the Defendant
requires such behaviour modification, and this, despite the Minister
implementing any new policies for handling personal information. They remind
this Court that the policies that were in place at the time of the Data Loss
would have been sufficient to prevent the harm suffered had they actually been
followed. This class action thus can, going forward, encourage the diligence
required for such policies to be effective in practice.
[95]
The Plaintiffs point out that the Data Loss was
not an isolated incident as the Minister was responsible for 19 of the 80 data
breaches reported to the Privacy Commissioner by the Defendant’s departments
and agencies in 2011-12, and a third of the data breaches reported by the
Defendant’s departments and agencies in 2010-11.
[96]
Furthermore, the modification of behaviour does
not only look at the Defendant but can look more broadly at other government
departments in order to encourage the development of meaningful policies at the
HRSDC as well as across the government as a whole. For this point, they
analogize Pearson v Inco Ltd, 2005 CanLII 42474 (ONCA) at paragraph 88,
which involves the environmental impact of the actions of numerous operators of
refineries “who are able to avoid the full costs and consequences of their
polluting activities because the impact is diverse and often has minimal impact
on any one individual.”
[97]
As for rule 334.16(2) of the Rules, it
sets forth criteria for determining whether a class proceeding is the
preferable procedure for the fair and efficient resolution of the common
issues, notably:
(a) the questions of law or fact
common to the class members predominate over any questions affecting only
individual members;
(b) a significant number of the
members of the class have a valid interest in individually controlling the
prosecution of separate proceedings;
(c) the class proceeding would
involve claims that are or have been the subject of any other proceeding;
(d) other means of resolving the
claims are less practical or less efficient; and
(e) the administration of the class
proceeding would create greater difficulties than those likely to be
experienced if relief were sought by other means.
[98]
I will address each of these steps in turn.
a) Predominance (Rule 334.16(2)(a))
[99]
I agree with the Plaintiffs that the Common
Questions constitute the “heart of the litigation,” and answers to them will
determine most, if not all, of the claims advanced by the Class Members. Should
the Court decide that some individual participation is required in order to
determine the appropriate damages for each individual, that evaluation would be
driven by the determination of liability, which is best assessed commonly (see Scott
v TD Waterhouse Investor Series (Canada) Inc, 2001 BCSC 1299 at paras 113,
115 and 116).
[100]
Accordingly, this step of the test is met.
b) Valid Interest in Individual
Control of Action (Rule 334.16(2)(b))
[101]
There is no evidence that Class Members would be
better served in advancing or controlling separate individual actions and I am
of the opinion that this step of the test is met.
c) Claims that are or have been the
Subject of other Proceedings (Rule 334.16(2)(c))
[102]
The Plaintiffs contend that no Class Member has
been able to justify the solitary exercise and expense of challenging the Data
Loss in an individual action. There are, in fact, nine other proposed class
actions, but the parties have agreed to advance those claims before this Court.
[103]
The Defendant does not contest this step and I
am of the opinion that it is met.
d) Comparative Practicality (Rules
334.16(2)(d) and (e))
[104]
The Defendant contends that the fact that they
have taken steps to resolve the claims of the Class Members means the class
action is not the preferable procedure. They point to Hollick at paragraph
31, where the Supreme Court of Canada held that the Court must look at all
reasonable means of resolving the class members’ claims and not just at the
possibility of individual actions. In Hollick, this led the Court to
prefer a small claims trust fund that established a no-fault scheme over a
class action. In Bittner v Louisiana-Pacific Corp et al, 1997 CanLII
2904 (BC SC) at paragraph 67, an established complaints procedure was
held to be preferable to a class action.
[105]
In Wallington Grace v Fort Erie (City of)
2003 CanLII 48456 (ON SC) [Grace] at paragraphs 154-157, the Court held
that the action, concerning allegations of property damage due to discoloured
water, should not proceed by way of class action as the townspeople would be
essentially suing themselves through their municipal corporation, with lawyers
receiving millions of dollars in fees, and the taxpayers ultimately having to
be taxed to recover these sums. Justice Crane found the steps taken by
the town to address the complaints to be adequate. This included paying
complainants sums of money up to $350 for alleged property damage, as well as
sending employees into some households to clean water stains from clothing and
appliances. The defendant also provided rebates to taxpayers due to extra water
being run through the taps. While the voluntary system was not perfect and
could be arbitrary, given the “very minor individual damages” involved, it was
sufficient in the view of the judge.
[106]
The Defendant wishes this Court to draw a
parallel between its actions and those found to be sufficient by Justice Crane
in Grace. The Defendant argues that the Credit Flag and the annotations
to the SIN registry are more than sufficient solutions for the Plaintiffs, and
were at no charge to the Plaintiffs.
[107]
The Defendant also maintains that in the case at
bar, the intense media coverage and the review before Parliament that the
government has been subjected to have sufficiently sensitized it to the issue.
The government has since strengthened its policies for the security and storage
of personal information, it has banned the use of portable hard drives, and it
has implemented tougher disciplinary measures for its employees, including
termination, should the privacy and security policies not be followed.
[108]
Moreover, the Privacy Commissioner has already
initiated an investigation into this matter pursuant to her powers under the Privacy
Act. If she finds the complaint to be well-founded, she can issue a
non-binding report with her recommendations.
[109]
The Defendant finally submits that there is a
plethora of pieces of legislation, directives, guidelines and policies, which
govern the federal public sector in relation to the privacy rights of
Canadians. This is the regime chosen by Parliament to address the behaviour of
the federal government in connection with the protection of personal
information.
[110]
Ultimately, I agree with the Plaintiffs that the
class action is preferable over individual actions or the policies and actions
so far implemented and taken by the Defendant as, much like the Supreme Court
of Canada has recently discussed, it will best advance the goals of judicial
economy, access to justice and behaviour modification (AIC Limited v Fischer,
2013 SCC 69, confirming 2012 ONCA 47 [Fischer] at para
21). There is no indication that certifying this action as a class proceeding
will create any greater difficulties than any hypothetical alternatives (1176560
v Great Atlantic & Pacific Company of Canada Ltd, 2002 CanLII 6199 (ON
SC) at para 27).
[111]
I note that the solutions offered by the Defendant
are woefully inadequate for the needs of the Plaintiffs. For one, the
Plaintiffs argue that the Credit Flag offers no compensation as a result of the
alleged Defendant’s breaches. They further argue that it does not provide them
with adequate protection against identity theft. The parties’ experts disagree
on this last point, but I note that a finding as to the sufficiency of the
protection offered is common to all Class Members and so should be determined
on a collective basis by way of a class proceeding. In any event, the Credit
Flag would not compensate any nominal damages should nominal damages be awarded
in favour of the Class Members.
[112]
In Fischer, the Supreme Court of Canada
recently considered the certification of a class action for damages based
on same market timing conduct by the appellant mutual fund managers that had
already been the subject of Ontario Securities Commission [OSC] enforcement
proceedings and a settlement agreement. The Ontario Court of Appeal had
overruled the motion judge’s finding that the class action was not a preferable
procedure, as the OSC had already undertaken a full hearing, which resulted in
some compensation to class members.
[113]
The Supreme Court of Canada confirmed the
Ontario Court of Appeal’s decision. Justice Cromwell noted that the
preferability inquiry has to be conducted through the lens of the three
principal goals of class actions, as listed above, but the ultimate question
for the court to answer is whether other available means of resolving the claim
are preferable, not if a class action would fully achieve those goals. In
undertaking this inquiry, the court must consider both the potential procedural
and substantive dimensions and outcomes of the class action and the proposed
alternatives to it. Once the defendant raises any specific non-litigation
alternatives, and supports it by some evidence, the burden of satisfying the
preferability requirement falls on the plaintiff. The Court at paragraph 1
stresses that the evidentiary threshold is low in this respect, as it only
requires “some basis in fact” that a class action is the preferable procedure.
The Court goes on to say at paragraph 39 that certification is not the time to
"engage in a detailed assessment of the merits or likely outcome of the
class action or any alternatives to it."
[114]
The Plaintiffs have successfully satisfied their
burden in this respect. In each case cited by the Defendants where alternative
procedures were found to be preferable to a class proceeding (Hollick, Bittner,
and Grace), monetary compensation was available to class members through
these alternative procedures. Civil claims cannot be adjudicated by the Privacy
Commissioner or through the regulations and statutes governing the collection
and use of personal information by the Defendant. Moreover, neither of these
procedures can award damages or other remedies to Class Members affected by the
Data Loss.
[115]
Finally, the Privacy Commissioner’s office is
not even equipped to handle the investigations into the complaints brought by
the Class Members—unlike a class proceeding, the Privacy Commissioner is
required to engage in individual investigations for each Class Member.
Undertaking such a process for the thousands of Class Members would overwhelm
her office.
The Representative Plaintiff is Appropriate (Rule 334.16(1)(e))
[116]
The Defendant does not submit arguments against
the Plaintiffs’ contention that the representative plaintiffs are able to
fairly and adequately represent the Class, have developed a plan for proceeding
forward, and do not have a conflict with the Class on the common issues.
Accordingly, I will not engage with the arguments brought forth by the
Plaintiffs here. I simply note that their Litigation Plan is rather
comprehensive.
Conclusion
[117]
On the whole, I will allow the Plaintiffs’
motion for certification of this action as a class proceeding on common
questions pertaining to the Defendant’s alleged breach of contract and warranty
and pertaining to the commission of the tort of intrusion upon seclusion. The
Plaintiffs will be designated as representatives of the Class and the
Litigation Plan and Notice Plan will be approved. In accordance with rule
334.39 of the Rules, there will be no costs awarded in connection with
this motion.
JUDGMENT
THIS COURT’S JUDGMENT is that:
1.
This action is certified as a class proceeding;
2.
The Plaintiffs are appointed as the
representatives of the Class;
3.
The Class (or Class Members) is defined as
follows:
All persons whose
personal information was contained in an external hard drive in the control of
Human Resources and Skills Development or the National Student Loans Services
Centre which was lost or disclosed to others on or about November 5, 2012, but
not including senior management of Human Resources and Skills Development
Canada, the Canada Student Loans Program, or Ministers and Deputy Ministers of
the Ministry of Human Resources and Skills Development.
4.
The nature of the claims asserted on behalf of
the Class and the relief sought by the Class are the following:
With respect to the alleged breach of contract and warranty
a) A declaration that the Defendant failed to adhere to
the standards for the protection of the Personal Information set out in the
statutes that are expressly referred to in the Contracts;
b) A declaration that the Defendant failed to adhere to
the Minister’s Policies, and in particular the Locked Container Policy,
Encryption Policies and Clean Desk Policy;
c) A declaration that the Defendant has disclosed
Personal Information in a manner not permitted under the Contracts;
d) A declaration that the Defendant has failed to
destroy the Personal Information in the manner required by the Contracts;
e) A declaration that the Defendant has retained the
Personal Information for a period longer than allowed under the terms of the
Contracts and for purposes not allowed by the Contracts;
f) An award of nominal damages.
With
respect to an alleged commission of the tort of intrusion upon seclusion
g) A declaration that the Defendant has committed the
tort of intrusion upon seclusion;
h) An award of nominal and/or punitive damages.
5.
The Common Questions are the following:
With respect to the alleged breach of contract and warranty
a) Did the Class Members enter into a Contract with the
Defendant for the provision of student loans?
b) Did the Contract between the Defendant and the Class
Members contain terms that the Defendant would:
- Keep the Personal Information confidential?
- Not disclose the Personal Information except
as provided by the Contract and by applicable statutes?
- Secure the personal Information and ensure
that it would not be lost and/or disclosed other than by the Contract or
applicable statutes?
- Delete, destroy, or otherwise not retain the
Personal Information once the Class Members had repaid their student loan in
full?
- Not disclose the Personal Information once the
Class Members had repaid their student loan in full?
c) As a result of its collection, retention, loss, or
disclosure of the Personal Information, did the Defendant breach any of the
terms particularized in sub-paragraph b? If yes, why?
d) Did the Defendant warrant to Class Members that it would:
- Keep the Personal Information confidential?
- Not disclose the Personal Information except
as provided by the Contract and by applicable statutes?
- Secure the Personal Information and ensure
that it would not be lost and/or disclosed other than by the Contract or
applicable statutes?
- Delete, destroy, or otherwise not retain the
Personal Information once the Class Members had repaid their student loan in
full?
- Not disclose the Personal Information once the
Class Members had repaid their student loan in full?
e) As a result of its collection, retention, loss, or
disclosure of the Personal Information, did the Defendant breach any of the
terms particularized in sub-paragraph d? If yes, why?
f) Is the Defendant liable to pay any damages incurred
by Class Members for breach of contract and warranty and/or the commission of
the tort of intrusion on seclusion?
6.
The attached Litigation Plan, setting the form
and content of the Notice Program and assigning the costs of the Notice
Program, and defining the opt out process is approved;
7.
No costs are granted.
“Jocelyne Gagné”
SCHEDULE “B” to the NoTICE OF
MOTION
litigATION PLAN
student loans privacy breach class
action
AS AT March 14, 2013
DEFINITIONS
1.
Unless otherwise stated, capitalized terms that
are not defined in this litigation plan have the definitions assigned to them
in the statement of claim and amended statement of claim. In addition, the
following defined terms apply:
(a)
“Action” means
this proposed class proceeding, court file No. T-132-13, commenced in the Court;
(b)
“Administrator” means a person appointed
by the Court to carry out the functions described in the Plan;
(c)
“Administrator’s Decision” means the Administrator’s written decision on a Class
Member’s or Applicant’s eligibility or entitlement;
(d)
“Arbitrator” means a person appointed by
the Court to review and adjudicate any appeals made of the Administrator’s
Decisions pursuant to this Plan;
(e)
“Claim Form” means a claim form, in the
form to be approved by the Court, to be completed by the Class Members
and submitted to the Administrator in order for the Class Members
to participate in the procedure described herein;
(f)
“Claimant” means a person that alleges
she or he was on the Government List;
(g)
“Claims Bar Deadline” means the date by
which each Class Member must file a Claim Form subject to the Court
extending the Claims Bar Deadline for individual Class Members;
(h)
“Class Counsel”
means the law firms of Sutts, Strosberg LLP, Falconer Charney LLP, Branch
MacMaster LLP and Bob Buckingham Law;
(i)
“Class Counsel Fees” means the fees, disbursements and taxes approved by the Court;
(j)
“Class Counsel Representative” means a person to represent the interests of the Class in dealing
with issues of general application relating to the damages assessment process;
(k)
“Class” and “Class Members” means
all persons whose personal information was contained in an external hard drive
in the control of Human Resources and Skills Development Canada or the National
Student Loan Services Center which was lost or disclosed to other on or about
November 5, 2012, but not including senior management of Human Resources and
Skills Development Canada, the Canada Student Loans Program, or Ministers and
Deputy Ministers of the Ministry of Human Resources and Skills Development;
(l)
“Court” means the Federal Court (Canada);
(m)
“Government List” means the Government of
Canada’s list of Class Members whose Personal Information was
lost, which list will be delivered to Class Counsel;
(n)
“HRSDC” means Human Resources and Skills
Development Canada;
(o)
“Notice Program” means the method of distributing the Notice described in
paragraph 27(c);
(p)
“NSLP” means
National Student Loans Program;
(q)
“Notice” means the notice to the Class
of the certification of the Action as a class proceeding;
(r)
“Personal Information” means the names, dates of birth, social insurance numbers,
addresses, student loan balances or any other personal information of the Class
Members;
(s)
“Plan” means this litigation plan;
(t)
“Resolution Notice” means the notice of
resolution of the common issues and further directions about the claims
process;
(u)
“Statement of Opposition” means a
Defendant’s concise statement of material facts responding to a Claim Form;
and
(v)
“Website” means the website developed and
maintained by Class Counsel at www.studentloansclassaction.com .
CLASS
COUNSEL
2.
Class Counsel is comprised of the law firms of
Sutts, Strosberg LLP, Falconer Charney LLP, Branch MacMaster LLP and Bob
Buckingham Law. Class Counsel has the requisite knowledge, skill, experience,
personnel and financial resources to prosecute this Action to conclusion.
3.
Class Counsel intends to add other lawyers or
other professionals to their complement if the majority of the Class Counsel
decides that they are necessary. These lawyers or other professionals may be
paid on a contingency basis if there are not experts intending to give expert
evidence to the court.
CLASS
DEFINITION
4.
The plaintiffs seek to represent a Class defined
as follows:
all persons
whose personal information was contained in an external hard drive in the
control of Human Resources and Skills Development Canada or the National
Student Loan Services Center which was lost or disclosed to other on or about
November 5, 2012, but not including senior management of Human Resources and
Skills Development Canada, the Canada Student Loans Program, or Ministers and
Deputy Ministers of the Ministry of Human Resources and Skills Development.
5.
The Court should decide whether each person on
the Government List is a Class Member.
REPORTING TO
AND COMMUNICATING WITH THE CLASS MEMBERS
6.
According to the information released publicly
by the Government of Canada, there are 583,000 Class Members across Canada and
there are no Class Members from Quebec, Nunavut or the Northwest Territories.
7.
Class Counsel have created a Website which
contains information about the status of the action and explains how a class
action operates. In the future, copies of some of the Court documents, Court
decisions and notices and other information relating to the Action will be
posted on and will be accessible from the Website. This will allow Class
Counsel to keep the Class Members, wherever resident, informed of the status of
the Action.
8.
Class Counsel have created a secure registration
system which permits Class Members to register after he or she has selected a
user ID and password. Class Members will particularize their damages resulting
from the disclosure of their Personal Information. For example, a Class Member
will estimate the time he or she spent changing personal information to prevent
identity theft, any emotional distress or inconvenience, and any other out of
pocket expenses.
9.
The registration system will permit Class
Members to update their information from time to time.
10.
The registration system will permit Class
Counsel to read, organize, profile, scan, manage and analyze tens of thousands
of documents and to monitor the frequency of identity theft over the Class.
11.
The Website also lists the direct-dial telephone
number of some of Class Counsel. Class Members can leave a message for Class
Counsel which is usually returned.
12.
From time to time, Class Counsel may send email
updates reporting on the status of the action directly to Class Members who
provided email addresses. Class Counsel will also post these updates on the
Website.
the number
of class members who have registered with class counsel
13.
As of March 14, 2013, approximately 25,000 Class
Members have registered with Class Counsel.
14.
Class Counsel has and will, in some cases,
contact the registered Class Members. In some instances, Class Counsel will ask
for further information about their damages.
LITIGATION
SCHEDULE
15.
Justice Jocelyne Gagné has been appointed as
the Case Management Judge for this Action.
16.
After this Action is certified as a class
proceeding, Class Counsel will ask Justice Gagné to set a litigation schedule
for:
(a)
the motion for certification;
(b)
completion of pleadings;
(c)
the documentary production and delivery of
affidavits of documents by the parties;
(d)
the examinations for discovery;
(e)
the delivery of experts’ reports; and
(f)
the trial of the common issues.
17.
Class Counsel and counsel for the Defendant may
request that the litigation schedule be amended from time to time.
ACCESS TO
AND PRESERVATION OF EVIDENCE
18.
Class Counsel has written to the Defendant to
request confirmation that all electronic communications and all documents with
respect to their investigation into the loss of the hard drive be preserved.
Document
Exchange And Management
19.
The Defendant possesses most, if not all of the
documents relating to the common issues. These documents will be produced to
Class Counsel through the normal production, cross-examination and examination
for discovery processes. The plaintiffs will produce all documents in their
possession.
20.
Class Counsel anticipate and are able to handle
the intake and organization of the large number of documents that will likely
be produced by the Defendant. Class Counsel will use data management systems to
organize, code and manage the documents.
21.
The documents may be maintained on a secure,
password-protected website for the purposes of access by members of Class
Counsel via the Internet.
22.
The same data management systems will be used to
organize and manage all relevant documents in the possession of the plaintiffs,
although the plaintiffs have virtually no documentation relating to the common
issues other than what is available in the public domain.
Plaintiffs’
Experts
23.
The plaintiffs have retained Dr. Norman Archer.
He is an expert about the effect of lost personal information and management of
electronic documents.
24.
The plaintiffs may retain other experts as the
action proceeds.
DISPUTE
RESOLUTION SERVICES
25.
The plaintiffs will participate in non-binding
dispute resolution efforts if the Defendant is prepared to do so.
Notice Of
Certification Of The Action As A Class Proceeding
26.
The Defendant is in possession of all of the
contact information for the Class Members. Class Counsel know the names and
addresses of approximately • Class Members and this number will likely increase because of the
registration process on the Website and as a result of the Notice Program. Class
Counsel have asked the Defendant to deliver the names of the Class Members
after the order is made certifying the Action as a class proceeding after this
opt-out period expires.
27.
As part of the certification order, the Court
will be asked to:
(a)
settle the form and content of the Notice;
(b)
set an opt-out deadline;
(c)
decide on the particulars of the Notice Program
which may change during the certification motion. Presently, Class Counsel
suggests particulars of the Notice Program to be as follows:
(i)
Class Counsel will post the Notice on the
website and email the Notice to any person who registered with Class Counsel
and provided a valid e-mail address;
(ii)
the Defendants should send the Notice to all
Class Members whose email address are known to the Defendant;
(iii)
the Defendant will send the Notice to Class
Members by regular mail exclusive of the emails sent in accordance with
subparagraphs (i) and (ii); and
(iv)
the Defendant will post the Notice on the HRSDC
website.
(d)
appoint Sarkis Isaac (“Sarkis”), an
accountant with Howie & Partners in Windsor, to receive the written
elections to opt out of the class action;
(e)
Class Members may opt out of this Action by
sending a written election to opt-out to Sarkis before the expiration of the
opt-out period;
(f)
no Class Member may opt out of this Action after
the expiration of the opt-out period;
(g)
within 30 days after the expiration of the
opt-out period, Sarkis will deliver to the Court and the counsel for the
Defendant an affidavit listing, under seal, the names and addresses of all
Class Members who have opted out of this Action; and
(h)
after the opt out period expires and after
Sarkis delivers his affidavit particularizing opt-outs, the Defendant will
provide to Class Counsel the list of Class Members who did not opt out of the
Action together with their contact information and the balance owing by the
Class Members to the Defendant for student loans.
28.
Sarkis has repeatedly been appointed by the
Ontario Superior Court to fulfill these tasks in class actions.
Examinations
For Discovery
29.
Class Counsel will seek to examine for discovery
at least one representative of the Defendant and, once known, the employee or
employees who lost or misplaced the hard drive. Class Counsel estimate that
these examinations will take 2 days.
30.
Counsel for the Defendant may examine the
representative plaintiffs. Class Counsel estimate that these examinations will
take 2 days.
31.
The plaintiffs may ask the Court for an order
allowing them to examine additional representatives of the Defendant, if
necessary.
Common
Issues and aggregate damages
32.
The plaintiffs will ask the Court to set a date
in Toronto for the trial of the common issues within six months after the
completion of examinations for discovery.
33.
The Federal Court Rules (SOR/98-106 as amended)
read, in part, as follows:
334.2.6 (1) If a judge determines that
there are questions of law or fact that apply only to certain Individual class
or subclass members, the judge shall set a time within which those members may
make claims In respect of those questions and may
(a) order that the individual
questions be determined In further hearings;
(b) appoint one or more persons to
evaluate the Individual questions and report back to the judge; or
(c) direct the manner in which the
individual questions will be determined.
Judge may
give directions
(2) In
those circumstances, the judge may give directions relating to the procedures
to be followed.
Who may
preside
(3) For the
purposes of paragraph (1)(a), the judge who determined the common questions of
law or fact, another judge or, in the case of a claim referred to in subsection
50(3), a prothonotary may preside over the hearings of the individual
questions.
Defendant’s
liability
334.27 In the case of an action, If,
after determining common questions of law or fact in favour of a class or
subclass, a judge determines that the defendant's liability to individual class
members cannot be determined without proof by those individual class members,
rule 334.26 applies to the determination of the defendant's liability to those
class members.
Assessment
of monetary relief
334.28 (1) A judge may make any order
in respect of the assessment of monetary relief, including aggregate
assessments, that is due to the class or subclass.
Distribution
of monetary relief
(2) A judge
may make any order in respect of the distribution of monetary relief, including
an undistributed portion of an award that is due to a class or subclass or its
members.
Special
modes of proof
(3) For the
purposes of this rule, a judge may
order any special modes of proof.
34.
At the trial of the common issues, the Court
will be asked:
(a)
to assess damages for each of the representative
plaintiffs;
(b)
to award damages in the aggregate. For example,
damages in the aggregate will include the average cost of credit monitoring and
nominal damages to each Class Member; and
(c)
to establish grids for damages for Class Members
or subclasses.
35.
If such an aggregate award is made, the Court
will be asked to approve a distribution protocol. The issue of payment to the
Class Members or the right to set-off the amount that the Class Members owe to
the Defendant for student loans will be decided by the Court after payment of
Class Counsel Fees.
36.
The findings of fact and conclusions on the
common issues will permit the judge at the common issues trial to give
directions, pursuant to rule 334.26 to deal with any remaining individual
issues.
AFTER THE
RESOLUTION OF THE COMMON ISSUES
37.
Assuming that the common issues are resolved by
judgment in favour of the Class, it will be necessary for the Court to
establish and supervise a claims and assessment procedure. The precise
structure of the assessment process will depend upon the conclusions reached by
the judge at the common issues trial. The Class Members may participate in the
process described in the following paragraphs if she or he submits a Claim Form
before the Claims Bar Date.
38.
The representative plaintiffs will ask the Court
to:
(a)
appoint an Administrator. The Administrator
will:
(i) hold any monies recovered at the common issues trial as
aggregate damages in a segregated trust account subject to an application to
the Court to approve payment to the Class Members;
(ii) implement this Plan;
(iii) by receiving and evaluating Claim Forms from Class Members
in accordance with this Plan and protocols approved by the Court;
(iv) deciding whether or not a person is a Class Member when
her or his name does not appear on the Government List; and
(v) deciding how much compensation each individual Class Member
will receive in accordance with grids for damages decided under paragraph 34(c);
(b)
appoint Arbitrators to decide any appeals from
the decisions of the Administrator and to decide any issues not decided at the
common issues trial including quantum of damages; and
(c)
appoint a Class Counsel Representative.
39.
The cost of the Administrator, Arbitrators and
Class Counsel Representative will by paid by the Defendant and the estimate of
their costs shall be addressed at the time of their appointment.
40.
The representative plaintiffs will also ask the
Court to:
(a)
settle the form and content of the Resolution
Notice and the Claim Form;
(b)
order that the Resolution Notice be disseminated
substantially in accordance with the Notice Program set out at paragraph 27(c),
except that the Notice of Resolution shall not be mailed to any Class Member
who validly opted out in accordance with the procedure set by the certification
order;
(c)
set a Claims Bar Deadline by which date the
Class Members must file their Claim Form; and
(d)
set guidelines to clarify how a Class Member
qualifies to be compensated for damages in the grids, in the case of identity
theft, or costs incurred to prevent identity theft, or the time spent changing
Personal Information to prevent identity theft, emotional distress or
inconvenience or any other out-of-pocket expenses.
THE website
and the infrastructure
41.
Class Counsel will transfer the Website (without
privileged material) to the control of the Administrator. Thereafter, the
Administrator will operate the Website. A section of the Website will remain
public and will be accessible to all Class Members and the general public.
42.
The Administrator will conduct the claims
process electronically through the Website. All submissions and communications
will be made through the Website. In its sole discretion, the Administrator may
assist or receive documents from a particular Class Member or Claimant in paper
form, if, for example, the Class Member or Claimant does not have access to a
computer with internet capability or requests assistance.
43.
The Administrator will establish a secure
section of the Website which will require a user id and password to gain
access.
44.
Each Class Member or Claimant will select a user
id and password which will be disclosed only to the Administrator. This will
allow each Class Member or Claimant access to the secure section of a database
on the Website which is relevant only to their individual claim.
45.
In the secure section of the Website, the Class
Member or Claimant may complete the Claim Form, upload documents and upload any
Reply. The Defendant and Class Counsel may review these documents in “read
only” mode, which will allow access to the documents but not modifying of the
documents.
46.
The Defendant will select a user id and password
which will be disclosed only to the Administrator. In this secure section, the
Defendant may deliver any Statement of Opposition and upload their Defendant’s
documents. The specific Class Member or Claimant may review the Statement of
Opposition to their Claim Form and Defendant’s documents in “read only” mode.
47.
In this secure section on the Website, the
Administrator will communicate with the Class Members, the Claimants and the
Defendant and post any written decisions.
48.
The Administrator will post any decision in the
public section of the Website without Personal Information.
49.
The Class Counsel Representative will be
entitled to review any documents in the Website in “read only” mode.
the claim
process
50.
Before the Claims Bar Deadline, each Class
Member and Claimant must deliver electronically to the Administrator through
the Website a completed Claim Form with all supporting documents.
51.
If a Claimant claims that he/she was not on the
Government List and alleges that his or her Personal Information was lost, he
or she must establish, on the balance of probabilities, that he or she is a
Class Member. The Defendant may file a Notice of Opposition. The Administrator
will make its decision in writing and post the decision on the Website. Within
15 days of posting on the Website, the decision is final unless the Claimant
elects to appeal the Administrator’s decision in accordance with paragraph 56.
52.
With the Claim Form, each Class Member must,
among other things:
(a)
self-identify and prove that he or she was on
the Government List by sending one page of correspondence from the Defendant
about the student loans or produce their motor vehicle licence or produce a
birth certificate or some other provincial or federal document to prove his or
her identity;
(b)
address any issues that are not determined at
the common issues trial. For example, the Claim Form may require the Class
Member to provide particulars about identity theft;
(c)
provide a schedule of out-of-pocket expenses
with supporting documents; and
(d)
explain that his or her situation is different
from the ‘usual” Class Member.
53.
The Defendant will have 30 days after the
posting on the Website of the Claim Form and accompanying material, to post
electronically a written Statement of Opposition (which cannot exceed five
pages of written submissions) and electronically all relevant documents in its
possession or control. The Statement of Opposition will be treated as if it is
a statement of defence and affidavit of documents, and will address
eligibility, if applicable, and any damage issues.
54.
The Website will alert the Class Member about
the filing of an electronic copy of the Statement of Opposition and any
documents delivered by the Defendant. Within 10 days of the posting on the
Website of the Statement of Opposition, the Class Member may deliver,
electronically, a written Reply (not to exceed 2 pages). The Website will alert
the Defendant about the filing of a Reply.
the
administrator’s decision
55.
On the basis of the documents delivered to it,
within 30 days, the Administrator will decide in writing whether or not a
Claimant is a Class Member and applying the applicable grid or applicable
rules. The Administrator’s Decision will be uploaded to the relevant secure
section of the Website.
56.
Within 15 days of posting on the Website of the
Administrator’s Decision, the claimant, the Class Member, the Defendant or the
Class Counsel Representative must deliver in writing a Notice of Appeal of the
Administrator’s Decision to the Arbitrator, failing which the Administrator’s
Decision is final.
review of
administrator’s decision by the ARBITRATOR
57.
The Court will designate an Arbitrator(s) in
each Province to deal with all disputes with respect to the Administrator’s
Decisions. The disputes will be dealt with only on the basis of the written
record, without oral evidence or oral argument, unless the Arbitrator orders
otherwise. The Arbitrators will have access to the secure Website in “read
only” mode for the purpose of specific appeals.
58.
The review of the Administrator’s Decision will
proceed in such manner as the Arbitrator directs. The Arbitrator must post on
the Website his or her decision in writing. The claimant, Class Member,
Defendant or Class Counsel Representative may deliver a Notice of Appeal within
15 days to the Prothonotary, failing which the Arbitrator’s decision is final.
59.
The Arbitrator will have the power to award
costs of the review to the successful party.
CLASS
COUNSEL’S ONGOING
REPRESENTATION OF THE CLASS MEMBERS
60.
Class Counsel, other than the Class Counsel
Representative, may continue to act as the lawyer for a particular Class Member
after the common issues are resolved if requested to do so by the Class Member.
The Class Member will be required to pay fees, disbursements and taxes for this
additional service which is not provided as part of Class Counsel’s
responsibility. If a Class Member retains other lawyers or a representative,
the Class Member must pay the fees, disbursements and taxes for their services
on whatever basis they privately agree.
the
procedure for appeals from the arbitrator’s decision to the prothonotary
61.
The Prothonotary will deal with any appeal in
accordance with the Federal Court Rules.
individual
issues
62.
After determining the common issues, the trial
judge will be asked to give directions to the Prothonotary to determine any
individual issues which are not resolved at the trial of the common issues.
63.
If some of the issues are not resolved at the
trial of the common issues, the Court will be asked to authorize a hearing or
hearings before a Prothonotary to allow the Class Members and the Defendant to
adduce general and expert evidence which may be applicable to some or all
individual issues. The type of evidence which may be of general application is,
for example, expert evidence about the effect of identity theft on a person’s
ability to obtain credit in the future.
64.
A Class Member may appear at the individual
stage of the proceedings in person or with counsel. The Class Member will be
responsible for the cost of such representation.
65.
If individual hearings are required, the Court
will be asked to approve protocols for the reference process that:
(a)
establish the procedures to be followed;
(b)
does not allow examinations for discovery
pursuant to Rule 334.22(1) if the claim is less than $25,000;
(c)
limit examinations for discovery of each Class
Member to a maximum of two hours and two hours for the Defendant if the claim
of the Class Member is more than $25,000 but not more than $100,000 exclusive
of prejudgment interest and to a maximum of seven hours if the claim exceeds
$100,000;
(d)
direct that the time limits for examinations for
discovery may only be exceeded by agreement of the parties or by order of the
Referee; and
(e)
provide that the Administrator should have the
power to make any order necessary for a fair determination of each hearing.
66.
Following every hearing,
the Prothonotary shall prepare a written report setting out his/her reasons for
decision. The Prothonotory will deliver this decision to the Class Member, the
Defendant and the Administrator by uploading it to the relevant section of the
Website and filing it with the Court.
67.
The Federal Rules will govern any appeal from
the decision of the Prothonotary.
class
counsel fees and administration expenses
68.
At the conclusion of the common issues trial,
the Court will be asked to approve the agreement among the representative
plaintiffs and Class Counsel and fix Class Counsel Fees.
69.
To the extent that the fees, disbursements and
taxes for the Administrator, the Arbitrator and Class Counsel Representative
were not addressed at the time of their appointment, any issues about these
costs will be addressed in the final order.
FINAL REPORT
70.
After the Administrator makes the final
distribution to Class Members, the Administrator will make its final report to
the Court in such manner as the Court directs and the Court will be asked to
then make an order discharging the Administrator.
review of
the litigation plan
71.
The Court may revise this Plan from time to
time, as required.