Date: 20260505

Docket: T-982-20

Citation: 2026 FC 590

Ottawa, Ontario, May 5, 2026

PRESENT: The Honourable Mr. Justice Southcott

CERTIFIED CLASS ACTION

BETWEEN:

TODD SWEET

Plaintiff

and

HER MAJESTY THE QUEEN

Defendant

REASONS FOR ORDER

I. Overview

[1] This decision addresses a motion brought by Todd Sweet, the representative Plaintiff in the within class action, with the consent of the Defendant, His Majesty the King, seeking the approval of: (i) the parties’ settlement of this proceeding; (ii) the payment of an honorarium to Mr. Sweet and two other class representatives; and (iii) the legal fees and disbursements sought by class counsel.

[2] This action relates to data breaches in which hacker(s) gained access to the personal, financial and other information of Canadians through Government of Canada [Government] websites. The Court previously certified this action as a class proceeding by Order and Reasons dated August 22, 2022 (Sweet v Canada, 2022 FC 1228) [the Certification Decision].

[3] For the reasons explained in more detail below, this motion is granted. The terms of the settlement are fair, reasonable, and in the best interests of the class as a whole. The proposed honoraria and class counsel’s proposed legal fees disbursements are also all fair and reasonable. The Court will issue two Orders (one approving the settlement and honoraria and the other approving the fees and disbursements), materially in the form proposed in the Plaintiff’s motion materials, with the exception that the Order approving the settlement will also afford to the individuals who objected to the settlement an opportunity to opt out of this class proceeding.

II. Background

[4] The Plaintiff, Mr. Sweet, is a resident of Clinton, British Columbia. The Defendant, His Majesty the King, is named as representative of the Government including without limitation the Minister of National Revenue (the Minister responsible for the Canada Revenue Agency [CRA]) and the Minister of Families, Children, and Social Development (the Minister responsible for Employment and Social Development Canada [ESDC]).

[5] The Plaintiff asserts that, on July 2, 2020, he logged in to his CRA online account after receiving emails notifying him that his email address had been removed from his account. He discovered that his direct deposit information had been changed and that, on June 29, 2020, using his account, an unknown and unauthorized individual had made applications for the Canada Emergency Response Benefit [CERB], a program initiated by the Government to provide financial assistance to qualifying Canadians during the COVID-19 pandemic.

[6] The Plaintiff is one of a potential class of what appears to be tens of thousands of people whose online Government accounts (including CRA accounts styled for users as My Accounts, My Service Canada Accounts for which ESDC is responsible, and other online accounts accessed via the Government of Canada Branded Credential Service Key [GCKey]) were vulnerable to hackers in periods in 2020, due to what the Plaintiff alleges were operational failures by the Defendant to properly secure the portals providing access to these accounts. The Plaintiff further alleges that, by obtaining unauthorized access to those accounts, hacker(s) were able to commit identity theft and fraud under CERB and other Government benefit programs and to access sensitive and personal information including, e.g., Social Insurance Numbers [SINs], direct deposit banking information, tax information, dates of birth, records of employment, information regarding employment insurance, and other benefits information.

[7] The Certification Decision provided the following explanation of the nature of the data breaches that gave rise to this action (at paras 66-74):

66. In the summer of 2020, GCKey and CRA’s My Account were the subject of what the cybersecurity industry describes as a “credential stuffing attack” by a threat actor, predominantly targeting CRA and ESDC as a means of fraudulently applying for COVID relief benefits (CERB and the Canada Emergency Student Benefit [CESB]) that had been introduced by the Government in the spring of 2020). Credential stuffing is a form of cyber attack that relies on the use of stolen credentials (username and password) from one system to attack another system and gain unauthorized access to an account. This type of attack relies on the reuse of the same username and password combinations by people over several services. Threat actors sell lists of credentials on the Dark Web. Credential stuffing usually refers to the attempt to gain access to many accounts through a web portal using an automated bot system rather than manually entering the credentials. On dates in July 2020, CRA’s My Account experienced large numbers of failed logins, which have since been identified as a precursor to, or otherwise part of, a credential stuffing attack against that service.

67. A threat actor attempting to access a particular My Account through credential stuffing would typically have encountered the requirement to successfully answer one of the five security questions selected by the user. However, during the attack that occurred in the summer of 2020, the threat actor(s) were able to bypass the security questions, and access My Account, because of a misconfiguration in CRA’s credential management software. CRA learned of this method to bypass the security questions on August 6, 2020, when it received a tip from a law enforcement partner that such a method was being sold on the Dark Web. Among other steps taken to respond to the data breach, CRA subsequently identified the relevant misconfiguration in its software, which it remedied on or about August 10, 2020.

68. In the meantime, at least 48,110 My Accounts were impacted by the unauthorized use of credentials, meaning that the threat actor was able to enter a valid CRA user ID and password. Of those 48,110 My Accounts, 21,860 involved no progress by the threat actor beyond entering the ID and password, such that the threat actor did not access the accounts. This is potentially understood as a stage of the attack in which the threat actor was ensuring that the credentials worked. The threat actor(s) actually logged in to 26,250 My Accounts. In 13,550 of the My Accounts, although the security question bypass was used, the threat actor only viewed the homepage, meaning that some personal information was accessed, but no application was submitted for CERB. In 12,700 of the My Accounts, the threat actor changed the relevant taxpayer’s direct deposit banking information and fraudulently applied for CERB.

69. The defendant’s expert evidence explains that post-incident analysis revealed that the credential stuffing attack against CRA’s CMS system occurred between July 27 and August 10, 2020. I understand that, at least at this stage of the proceeding, the plaintiff does not necessarily accept these temporal limits on the duration of the attack.

70. CRA initially treated as potentially compromised any My Account where a valid set of credentials was used, even if the account was not actually accessed, and sent notification letters to the account holders, including offering enhanced protection services for a period at no cost.

71. Turning to the attack on GCKey, the evidence is that on June 18, 2020, and on various dates in July 2020, it experienced large numbers of failed logins, which have since been identified as a precursor to, or otherwise part of, a credential stuffing attack against the GCKey service. 2Keys advised the Government on August 4, 2020 that they had noticed some login anomalies in the previous days, and August 5, 2020, 2Keys determined that the suspicious login activity was a large-scale credential stuffing attack on the GCKey service.

72. ESDC is the Government department that suffered the greatest impact from the attack on GCKey. ESDC has identified 5,957 accounts across several Enabled Services that were potentially impacted by the attack, of which 3,439 accounts were accessed by someone (including potentially the rightful owner) between July 15 and August 5, 2020, including access for purposes of changing banking information or addresses. Subsequent analysis concluded that the remaining 2,518 of the 5,957 accounts showed no access. 3,200 compromised MSCAs were used to access CRA My Accounts via the link between MSCA and CRA, and 1,200 of those accounts were used to apply for CERB or other COVID-related benefits.

73. Among other steps taken to respond to the data breach, the Defendant’s evidence is that, as of August 14, 2020, 2Keys was able to block all botnet traffic on the GCKey service and block the credential stuffing attack from occurring further. On August 14, 2020, ESDC also disabled the link between the MSCA and CRA My Account. Again, I understand that the plaintiff does not necessarily accept this temporal limit on the duration of the attack.

74. Between August 1, 2020, and August 25, 2020, ESDC sent notification letters to all affected ESDC account holders that use the GCKey service, informing them that their accounts may have been accessed as a result of the credential stuffing attack. ESDC offered two years of credit monitoring with Equifax to anyone whose information may have been accessed as a result of the attack.

[8] Supported by evidence adduced in this motion, the parties confirm that the vast majority of client accounts compromised through this data breach were those of CRA and ESDC, although Health Canada and Transport Canada could not rule out unauthorized access to a small number of their client accounts. The Defendant has complied a list of all compromised accounts. As explained later in these Reasons, that list forms the foundation of the proposed settlement that is the subject of the within motion.

[9] On August 24, 2020, the law firm Murphy Battista LLP [Murphy Battista] commenced this action in the Federal Court on behalf of Ms. Anne Campeau and other proposed class representatives who alleged that their online Government accounts had been accessed by hackers. However, in early April 2021, that firm experienced its own data breach, in which unauthorized parties were able to gain access to the firm’s networks. The Defendant subsequently brought a motion to stay this action, because the Federal Court lacks the jurisdiction to hear a third party claim that the Defendant intended to pursue against the law firm, seeking contribution and indemnity in relation to any liability of the Defendant to members of the proposed class who may have had their information compromised in both the Government data breach and the law firm data breach.

[10] Present Plaintiff’s counsel, Rice Harbut Elliott LLP (now Rice Parsons Leoni & Elliott LLP [Rice Parsons or Class Counsel], subsequently replaced Murphy Battista and, in opposing the Defendant’s stay motion, prepared pleading amendments intended to narrow the proposed class and the scope of its claim (to exclude persons who contacted Murphy Battista about this class action prior to June 24, 2021 [the Excluded Persons]) such that the Defendant would no longer have a basis to assert its claim for contribution and indemnity. Those amendments culminated with a draft Third Amended Statement of Claim [Third SOC], which would also replace the previously proposed class representatives with Mr. Sweet as Plaintiff.

[11] This proceeding is being case managed by the undersigned and Associate Justice Ring. By Order and Reasons dated December 20, 2021, I dismissed the Defendant’s stay motion and, by Order dated January 20, 2022, I approved the filing of the Third SOC and the substitution of Mr. Sweet as the proposed representative Plaintiff for the class.

[12] On May 16, 2022, Ms. Tanis Seminoff commenced a proposed class proceeding against the Defendant in the Supreme Court of British Columbia with Court File No. S-223955 on behalf of the Excluded Persons [the Seminoff Proposed Class Action].

[13] The parties argued the certification motion in the present proceeding on May 11 to 13, 2022, and on August 22, 2022, the Court issued the Certification Decision, certifying this action as a class proceeding [the Class Action], with common questions of law or fact related to causes of action in systemic negligence, breach of confidence, and intrusion upon exclusion, and the following class definition:

All persons whose personal or financial information in their Government of Canada Online Account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020, excluding Excluded Persons.

“Government of Canada Online Account” means:

a. Canada Revenue Agency account;

b. My Service Canada account; or

c. another Government of Canada online account, where that account is accessed using the Government of Canada Branded Credential Service (GCKey).

“Excluded Persons” means all persons who contacted Murphy Battista LLP about the CRA privacy breach class action, with Federal Court file number T-982-20 prior to June 24, 2021.

[14] The Certification Decision granted the Plaintiff leave to further amend his Statement of Claim to reflect this definition. On November 14, 2022, the Plaintiff filed a Fourth Further Amended Statement of Claim, and on December 21, 2022, the Defendant filed its Statement of Defence.

[15] By Order dated August 11, 2023, the Court also approved, among other things, the plan for delivering notice of certification to class members, which provided for a 90-day period for class members to opt out of this class action [the 2023 Notice Order]. By the deadline of November 27, 2023, under the 2023 Notice Order, a total of 405 class members had delivered valid opt-out forms to Class Counsel.

[16] Subsequent to the certification of this matter, the parties commenced a dialogue regarding the potential for a negotiated resolution of all claims in both the Class Action and the Seminoff Proposed Class Action. On September 25, 2024, the parties attended a mediation with the Honourable J. Douglas Cunningham, K.C. acting as the mediator. Following the mediation, the parties reached an agreement in principle on a settlement amount and distribution of settlement funds, which forms the basis of the settlement agreement for which the parties seek Court approval in the present motion.

[17] On November 7, 2025, on consent of the parties in furtherance of their intention to seek Court approval of the proposed settlement, I issued an Order [the 2025 Notice Order] that, among other things: (a) amended the class definition to include the Excluded Persons (so as to encompass class members in the Seminoff Proposed Class Action); (b) appointed KPMG Inc. as claims administrator with respect to the proposed settlement [the Claims Administrator]; (c) approved the form of notice of the settlement approval hearing [the Notice of Approval Hearing], a further period and process for class members to opt out of the Class Action, and a period and process for class members to object to the proposed settlement; and (d) approved a plan for distribution of the Notice of Approval Hearing. The parties and the Claims Administrator then carried out the notice plan as contemplated by the 2025 Notice Order.

[18] Pursuant to the 2025 Notice Order, the current class definition is as follows:

All persons whose personal or financial information in their Government of Canada Online Account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020, including the Excluded Persons.

“Government of Canada Online Account” means:

a. Canada Revenue Agency account;

b. My Service Canada account; or

c. another Government of Canada online account, where that account is accessed using the Government of Canada Branded Credential Service (GCKey).

“Excluded Persons” means all persons who contacted Murphy Battista LLP about the CRA privacy breach class action, with Federal Court file number T-982-20 prior to June 24, 2021.

[19] Henceforth in these Reasons, references to Class Members will mean those who meet the above class definition.

[20] As of the deadline under the further opt-out period in the 2025 Notice Order, an additional 264 opt-outs had been received, bringing the total number of opt-outs to 669. An additional 8 opt-outs were received after the deadline. As of the deadline for objections in the 2025 Notice Order, there were 29 objections to the proposed settlement. One additional objection was received after the deadline.

[21] The parties finalized the terms of their proposed settlement in a Final Settlement Agreement dated March 23, 2026 [the FSA], and on March 25, 2026, the Plaintiff filed his Motion Record in support of the within motion. The FSA, a copy of which is included in the Motion Record, attaches as Schedule “A” a Distribution Protocol that represents the parties’ plan for distributing settlement funds thereunder [the Distribution Protocol]. Further terms of the FSA will be explained later in these Reasons.

[22] The Court heard oral argument on this motion in Vancouver on March 31, 2026, from the parties and from a small number of objectors. The Defendant supports the Plaintiff’s motion for approval of the proposed settlement and takes no position on the request for approval of the legal fees and disbursements sought by Class Counsel (or, as I understand it, on the request for honoraria to be paid to Mr. Sweet, Ms. Campeau, and Ms. Seminoff). As will be explained in more detail later in these Reasons, the objectors oppose approval of the settlement, the legal fees and disbursements sought by Class Counsel, or both.

III. Issues

[23] Based on the evidence and argument in the Plaintiff’s Motion Record, including copies of the written objections, and the oral submissions of the parties and objectors, the issues raised by this motion are whether the Court should approve:

1. The FSA including the Distributional Protocol;

2. The parties’ proposed Notice of Settlement Approval;

3. Honoraria for Mr. Sweet, Ms. Campeau and Ms. Seminoff in the amounts sought; and

4. Class Counsel fees and disbursements in the amount sought.

IV. Analysis

A. The FSA including the Distributional Protocol

(1) Terms of settlement

[24] Before reviewing and applying the general principles that govern whether to approve a proposed settlement in a class proceeding, I will explain the principal terms of the settlement that the parties have achieved.

[25] Pursuant to the FSA, the Defendant has agreed to pay an all-inclusive sum of $8,760,500.90 [the Settlement Amount], which includes compensation for Class Members as well as taxes, legal fees, honoraria, claims administration costs, and disbursements. This is a “claims-based” settlement, meaning that Class Members are required to submit a claim to the Claims Administrator in order to receive compensatory payments.

[26] To that end, the Claims Administrator has developed, in consultation with Class Counsel, an online claim portal through which Class Members can submit their claims. Alternatively, upon request to the Claims Administrator, Class Members may submit a claim in paper form.

[27] Claims must be submitted before the end of what the FSA defines as the Claim Period, which commences 60 days following the Effective Date and ends six months thereafter. The Effective Date is in turn defined as the date upon which the Court approves the proposed settlement and the time to appeal that approval has expired without any appeal being taken or, if an appeal is taken, all appeals and any time period for a further appeal have concluded [the Effective Date].

[28] The FSA divides Class Members into the following two groups that are eligible to make claims against the Settlement Fund:

A. Access Claimants - These are Class Members whose personal information contained in their Government online accounts was accessed by unauthorized third parties during the Breach Period (the meaning of which is described below). The parties agree that this group is comprised of approximately 34,304 Class Members and that their accounts are known to the Defendant; and

B. Fraud Claimants - These are Class Members who had their Government online accounts taken over by unauthorized third parties during the Breach Period and who had their personal information (including direct deposit information) modified, allowing for: (i) fraudulent applications for CERB and/or other identified Government benefits to be made in their names without their knowledge; or (ii) CERB and/or other identified Government benefits they were to receive to be diverted to an unauthorized bank account without their knowledge. The parties agree that this group is comprised of approximately 13,661 Class Members and that their accounts are known to the Defendant.

[29] The FSA identifies the Breach Period as the period of unauthorized access by third parties to Class Members’ Government online accounts during the credential stuffing attack between June 26 and August 18, 2020, and, for “Represent-a-Client” [RAC], between October 8 to November 25, 2024. I understand that RAC refers to a CRA portal that was indirectly (and subsequently) affected by the credential stuffing attack, through a mechanism by which a representative whose account was compromised in the credential stuffing attack was replaced with an unknown representative, who was then able to access personal information of the original representative’s clients.

[30] Only Access Claimants and Fraud Claimants (and only those still alive), representing a subset of the Class Members, are eligible to submit a claim for payment by the Claims Administrator from the Settlement Amount. As reflected in the above descriptions of these two groups, the parties agree that the Defendant has been able to identify the list of eligible claimants, i.e., those Class Members who were affected in the manner set out in those descriptions.

[31] At the hearing of this motion, Class Counsel explained that the effect of these limitations upon which Class Members are eligible to submit a claim is to provide compensation only to those whose online accounts were compromised as a result of the data breach that is the subject of this action, as opposed to others whose accounts were compromised in another manner. By way of example, it is noteworthy that the representative Plaintiff, Mr. Sweet, is a Class Member but would not be eligible for compensation under the FSA, as it has been determined that, while bad actors accessed his CRA account, this was not as part of the relevant credential stuffing attack.

[32] For each of the two groups of eligible claimants, the FSA identifies the level of compensation that is potentially available. Access Claimants will be entitled to claim compensation for the loss of time and inconvenience, at a rate of $20/hour up to a maximum of four hours, while Fraud Claimants will be entitled to claim such compensation at the same rate up to a maximum of 10 hours.

[33] Both Access Claimants and Fraud Claimants, with approved claims, may also submit a claim for special compensation for out-of-pocket costs related to identity theft up to a maximum of $5000 per claimant. Examples of such out-of-pocket costs include unreimbursed credit charges, professional or other fees incurred in connection with Identity Theft (as defined in the FSA), and fees or penalties resulting from credit freezes, provided such costs are reasonably related to and incurred within 12 months of the Breach Period and have not already been otherwise reimbursed or compensated.

[34] As previously noted, the Settlement Amount represents an all-inclusive figure of $8,760,500.90, meaning that not only compensation for Class Members, but also all legal fees, disbursements, and honoraria that the Court may approve, as well as taxes on interest earned on the Settlement Amount (which will be held by the Claims Administrator in an interest-bearing account prior to distribution) and all claims administration costs incurred by the Claims Administrator, must be paid from this amount (plus accrued interest). As explained in Section 4 of the FSA, the proposed settlement contemplates approved honoraria, legal fees, and disbursements being paid within 14 days of the Effective Date, following which the Net Settlement Proceeds (as defined in the FSA) will be available for distribution to Access Claimants and Fraud Claimants in accordance with the FSA and the attached Distribution Protocol that governs the mechanics for submission and payment of claims.

[35] The FSA provides that the maximum amounts available to pay Access Claimants and Fraud Claimants are, respectively, $2,720,000 and $2,800,000. Each of those amounts is subject to reduction on a pro-rata basis if the total of all approved claims for the relevant group of claimants exceeds that amount.

[36] An additional amount of $500,000 is available to pay Special Compensation to Access Claimants and Fraud Claimants, although this amount is also subject to adjustment. If the total of the approved claims for either the Access Claimants or the Fraud Claimants does not exceed the relevant limit identified above, the excess will be added to the $500,000 available to pay Special Compensation. That amount (i.e., $500,000 plus any excess) is also subject to reduction on a pro-rata basis if the total of all approved claims for Special Compensation exceeds that amount.

[37] Finally, in the event that funds remain available after all claims by eligible claimants have been paid, those funds will not revert to the Defendant but rather will be paid out cy-pres to qualified donee(s) selected by the parties and approved by the Court.

[38] At the hearing of this motion, Class Counsel explained that the initial stages of administering the proposed settlement have proven to be more costly than originally estimated, principally due to the cost of physically mailing the Notice of Approval Hearing to Class Members for whom email addresses were not available. As a result of those increased administration costs (estimated as of March 18, 2026, to approximate $973,800.71 inclusive of HST), counsel explained that the limits for Access Claimants, Fraud Claimants, and Special Compensation were estimated to be, respectively, $2,529,899.20, $2,604,308, and $465,055. Class Counsel emphasized that the requested legal fees (to which I will turn later in these Reasons) are based on a percentage of only the compensatory payments to Class Members. In other words, as the compensatory component of the Settlement Amount decreases due to an increase in claim administration costs, the legal fees are reduced as well.

[39] Class Counsel also explained that, even though the compensatory limits have been reduced from those contemplated by the FSA, it is still their expectation that there will be excess funds available in the pools available for both Access Claimants and Fraud Claimants. By way of example, counsel explained that there are 34,304 Access Claimants but funds available to compensate (to the $80 per claimant limit) only 31,623 claims. However, 31,623 claims would represent a 92% take-up among eligible claimants, which counsel submits would be a very rare result. As such, while it is theoretically possible that the terms of the FSA will operate to effect a pro rata reduction in the pool of funds available to Access Claimants, counsel submits that it is far more likely that there will be excess funds available, which will be added to the pool for Special Compensation.

[40] As previously noted, if excess funds remain available following distribution of Special Compensation Claims, the FSA provides that such funds are to be paid to a cy-pres donee. The parties have identified the Privacy and Access Council of Canada [PACC] as the intended recipient of such excess. The Motion Record includes an affidavit sworn by Ms. Sharon Polsky, the President of PACC, which explains that PACC is an independent, nonpartisan, federally incorporated nonprofit organization that is dedicated to the development of the access to information, information privacy, and data protection profession across the private, nonprofit and public sectors. Ms. Polsky states that, if PACC were to receive any portion of the proceeds of settlement from the Class Action, those funds would be applied toward outreach efforts across Canada to advance awareness about access, privacy, and data protection laws, compliance, and best practices, and research exploring laws, technologies, and global trends affecting Canadians’ privacy and access rights and responsibilities.

[41] The FSA incorporates the Distribution Protocol, which governs the claims process intended to be employed to distribute the Settlement Amount to eligible Class Members. The Distribution Protocol sets out the Claims Administrator’s duties and responsibilities (including reporting obligations), the manner in which Access Claimants and Fraud Claimants may submit claims (including for Special Compensation), and the circumstances in which the Claims Administrator may determine such claims to be valid and ultimately pay such claims.

[42] Notably, the Distribution Protocol provides that Special Compensation is not available for: (a) any CERB or other Government benefits that a claimant was entitled to receive but failed to receive as a result of identity theft, or any related taxes, penalties or interest; or (b) fraudulent transactions on a credit card that was lawfully obtained by the claimant. Class Counsel explained at the hearing that these categories of claims are not compensable under the FSA, because the Government has otherwise made Class Members whole in relation to such claims (for instance, in relation to CERB) or because such claims (on a lawfully obtained credit card) are not casually linked to the data breach that is the subject of the Class Action.

[43] Finally, I note that the FSA, if approved by the Court, provides for a comprehensive release, as of the Effective Date, by all Class Members (other than those who have opted out of the Class Action) in favour of the Defendant, the Attorney General of Canada, and their respective representatives, employees, agents, servants, predecessors, successors, executors, administrators, heirs and assigns. This release would apply to all claimants from both the Class Action and the Seminoff Proposed Class Action, including Class Members who are not eligible for compensation under the proposed settlement.

(2) General principles governing class action settlement approval

[44] Rule 334.29(1) of the Federal Courts Rules, SOR/98-106 [the Rules] requires that a class proceeding settlement be approved by a judge of this Court. On approval, a settlement binds every class member who has not opted out of or been excluded from the class proceeding (Rule 334.29(2)).

[45] The legal principles applicable to the approval of a class proceeding settlement are well established. The central question is whether the proposed settlement is “fair, reasonable, and in the best interests of the class as a whole” (see, e.g., Tk'emlúps te Secwépemc First Nation v Canada, 2023 FC 327 [Tk'emlúps] at para 47; Hudson v Canada, 2022 FC 694 at para 186; Lin v Airbnb, Inc, 2021 FC 1260 [Lin] at para 21; McLean v Canada, 2019 FC 1075 [McLean] at para 65; Condon v Canada, 2018 FC 522 [Condon] at para 17).

[46] In considering whether to approve a settlement agreement, the Court considers only whether the proposed settlement is reasonable, not whether it is perfect (Tk'emlúps at para 48; Merlo v Canada, 2017 FC 533 [Merlo] at para 18). The Court also does not have the power to modify or alter the settlement; it can only approve it or reject it (Tk'emlúps at para 48; Merlo at para 17).

[47] As noted in Condon, the reasonableness of a settlement agreement means that the agreement only need fall “within a zone or range of reasonableness” (at para 18). This approach recognizes that resolution of litigation is not an exact science. A zone or range of reasonableness allows for a spectrum of possible resolutions, including a mix of terms negotiated between parties at arm’s length (see Toronto Standard Condominium Corporation No. 1654 v Tri-Can Contract Incorporated, 2022 FC 1796 [Tri-Can] at para 16).

[48] The Rules do not contain any provision expressly requiring a plan for distribution of settlement funds (i.e., a distribution protocol) in the event of a proposed settlement. However, in considering motions for settlement approval, the Court has approved a distribution protocol where it is fair, reasonable and in the best interests of the class (Breckon v Cermaq Canada Ltd, 2024 FC 225 at para 15 of the Order; Regan v Masonite International Corporation, 2025 FC 721 at para 89).

[49] In applying the “fair, reasonable, and in the best interests of the class as a whole” test, the Court has been guided by non-exhaustive lists of factors that, while articulated somewhat differently from case to case, broadly include the following:

A. the likelihood of recovery, or the likelihood of success;

B. the amount and nature of discovery evidence;

C. settlement terms and conditions;

D. future expense and likely duration of litigation;

E. recommendations of neutral parties, if any;

F. number of objectors and nature of objections;

G. presence of good faith and absence of collusion;

E. information conveying to the court the dynamics of, and the positions taken by, the parties during the negotiation;

F. the degree and nature of communications by counsel and the representative plaintiffs with class members during the litigation; and

G. the recommendations and experience of counsel

(see Percival v Canada, 2024 FC 824 at para 67; McLean at para 66; Tk'emlúps at para 49; Tri-Can at para 14; Lin at para 22; Condon at paras 19-20).

[50] Such factors are merely guidelines. In a particular case, some factors may be given more weight than others, some may not be satisfied, and some may be irrelevant (see Condon at para 20). As such, the factors identified above are also not to be applied mechanically. Nor does every factor need to be present. Rather, the weight attributed to each factor will vary according to the circumstances and the factual matrix of the proceeding (see Tri-Can at para 15).

[51] The below analysis of factors relevant to the case at hand takes into account the parties’ submissions, as well as those of the objectors.

(3) Likelihood of success / Future expense and likely duration of litigation / Balancing of costs and benefits of settlement

[52] The Plaintiff’s submissions in support of approval of the settlement focus significantly on the risks associated with proceeding to a hearing of the common issues on the merits. The Plaintiff submits that the Court should consider the significant legal uncertainty faced by the Class Members, noting that where the possible litigation of an action is likely to be complicated and its outcome highly uncertain and risky, courts have held that it is preferable and in the interests of the class members to receive timely compensation (Condon at para 59).

[53] The Plaintiff submits that, if the settlement is not approved and further prosecution of the Class Action is required, this will require document production, discoveries, interlocutory motions, and eventually a common issues trial, plus the possibility of appeals. The Plaintiff emphasizes: (a) the risk of the parties being involved in prolonged and time-consuming litigation, which Class Counsel estimate would take at least another 2 to 4 years and cost several hundred thousand dollars in disbursements; (b) the risk that the Court could accept one or more of the Defendant’s defences to the allegations of systemic negligence, intrusion upon seclusion, and breach of confidence; and (c) the risk that, even following success at a common issues trial, many Class Members may not be able to prove damages because of difficulties in establishing causation.

[54] In relation to the possibility of the Defendant succeeding in its defence positions, the Plaintiff notes its expectation that the Defendant would argue, in relation to the systemic negligence allegation: (a) that it did not owe a relevant private duty of care to Class Members; (b) that the circumstances of this case are novel and that a full duty of care analysis would have to be undertaken by the trial judge to assess the alleged duty of care; and (c) that, even if a duty of care is found to exist, it would be negated by policy concerns of indeterminate liability. The Plaintiff also references other policy arguments, relevant to assessing the existence of a novel duty of care, that could be available to the Defendant in a common issues trial, including an assertion that the Government’s decision to roll out COVID emergency benefits using existing online systems was a core policy decision, made during an unprecedented global pandemic, which should not attract liability.

[55] I agree that it is legitimate for the Plaintiff to identify these risks. In relation to the indeterminate liability argument in particular, I expressed the view in the Certification Decision that that argument was among the strongest of the Defendant’s submissions opposing the Plaintiff’s certification motion. The Court was not prepared to conclude at that stage that it was plain and obvious, based on the Defendant’s indeterminate liability argument, that the Plaintiff had not disclosed a viable cause of action in systemic negligence, but I noted the authorities favouring the Defendant’s position and that it remained available to the Defendant to advance that argument at a common issues trial (at paras 114-116). The Defendant confirmed in its submissions at the hearing of the present motion that, if the Class Action proceeded to trial, it would be strenuously advancing this argument.

[56] In relation to the cause of action for breach of confidence, the Plaintiff expects that the Defendant would argue that it did not itself misuse the Class Members’ personal information, intentionally or otherwise. Rather, it was the bad actors who have unlawfully obtained the information to use for fraudulent purposes. The Plaintiff references John Doe v Canada, 2023 FC 1636, in which the Court held that the plaintiffs had not satisfied the elements of the tort of breach of confidence, including because the misuse of their confidential information was not intentional (at para 177).

[57] In relation to the cause of action for intrusion upon seclusion, the Plaintiff expects the Defendant to argue that there can be no liability for this tort in a data breach case where the Defendant did not itself intrude but rather is alleged to have failed to adequately protect personal information. The Plaintiff references recent decisions from the Court of Appeal for Ontario that he is concerned could support such a defence position (Owsianik v Equifax Canada Co, 2021 ONSC 4112, aff’d 2022 ONCA 813, leave to appeal to SCC dismissed 40577 (13 July 2023); Obodo v Trans Union of Canada, Inc, 2022 ONCA 814, leave to appeal to SCC dismissed 40555 (13 July 2023); Winder v Marriott International, Inc, 2022 ONCA 815, leave to appeal to the SCC dismissed 40573 (13 July 2023)).

[58] Again, I find merit to the Plaintiff’s concerns in raising the risk of the Defendant successfully advancing defence arguments in response to the Plaintiff’s reliance on the torts upon which the Class Action is based.

[59] I also agree with the concern that Class Members could struggle to establish causation i.e., that any losses they experienced subsequent to the credential stuffing attack would not have occurred but for the attack. As the Plaintiff notes, he expects that at trial the Defendant would rely upon an expert report of Prof. Fred Cate, prepared for the Defendant and included in the Motion Record, which refers to the difficulty attributing specific instances of fraud to specific data breaches.

[60] I also accept that the duration and cost of further litigation, in the absence of an approved settlement, favour such approval.

(4) Terms and conditions of settlement and Distribution Protocol

[61] I have canvassed the terms of the FSA (and included Distribution Protocol) earlier in these Reasons. As explained in that summary of the terms of the proposed settlement, not all Class Members would be eligible to receive compensation thereunder, and the categories and amounts of compensation available even to Class Members who are eligible to claim are arguably relatively modest.

[62] The modesty of the amounts of compensation potentially available to an eligible Class Member is one of the principal concerns raised by the Class Members who have objected to the proposed settlement. I will turn to those objections shortly, as well as the Plaintiff’s submissions in support of the reasonableness of the amounts. Leaving aside for the moment the amounts of compensation available, for the reasons explained below, I otherwise accept Class Counsel’s submission that the terms of the FSA and Distribution Protocol represent a reasonable, fair, economical, and practical resolution of the Class Action.

[63] In relation to the mechanics of the claim process, I note that both Access Claimants and Fraud Claimants would be able to make claims through the submission of a claim form accompanied by an attestation, specifying the number of hours that the claimant spent communicating with government officials, law enforcement officials, or credit agencies addressing issues related to the data breach. No other documentary support would be required for such a claim. Claims for Special Compensation will require documentary support for the claimed out-of-pocket costs and to demonstrate that such costs were reasonably incurred as a result of the data breach. I consider these mechanics to strike an appropriate balance between achieving an accessible claims process and requiring evidentiary support for claims that are potentially larger and where it is reasonable to suspect that such support would be available.

[64] While not all Class Members would benefit from the proposed settlement, Class Counsel explain that the Defendant is prepared to agree to compensation only for Class Members who were affected by the credential stuffing attack that is the basis of the allegations in the Class Action. That is, the settlement reasonably focuses upon the particular allegations advanced against the Defendant.

[65] In that respect, it is also significant that Class Members who would not benefit from the settlement (including deceased Class Members) and, indeed, all Class Members have been afforded opportunities to opt out of the Class Action, so that their claims would not be barred by the release contemplated by the FSA. The FSA also provides that the claim of Class Members who have opted out will be tolled (i.e., any applicable limitation period extended) from the time the Class Action was filed on August 24, 2020, until the Effective Date.

[66] Moreover, the Notice of Approval Hearing approved by the 2025 Notice Order, which provided notice not only of the date and time of the settlement approval hearing but also of the right to opt out of the Class Action, expressly explained that not all Class Members would be entitled to payment under the proposed settlement. The Notice of Approval Hearing further informed Class Members that they could confirm whether they were eligible for payment by consulting the list of eligible claimants on the Claim Administrator’s website and advised Class Members whose names did not appear on the list and who wished to pursue individual claims for compensation to follow the prescribed opt-out procedure.

[67] There remains an issue, which surfaced at the hearing of this motion, surrounding the potential for objectors, who have not to-date opted out of the Class Action, to be afforded a further opportunity to do so if the proposed settlement is approved. I will address that issue shortly when considering the objections. However, that issue aside, I am satisfied that the proposed settlement is fair, notwithstanding that some Class Members would have their claims released without receiving compensation.

(5) Recommendation and experience of Class Counsel

[68] The Plaintiff references jurisprudence supporting a strong initial “presumption of fairness” when a settlement was negotiated at arm’s length by experienced class counsel (A.B. v Canada, 2025 FC 282 at para 49 citing Heyder v Canada (Attorney General), 2019 FC 1477 [Heyder] at para 64; Tataskweyak Cree Nation v Canada (Attorney General), 2021 FC 1415 at para 97 citing Nunes v Air Transat AT Inc, 2005 CanLII 21681 (ONSC) at para 7).

[69] I accept that Class Counsel in this matter are experienced class action litigators, having represented plaintiffs in class proceedings in the courts of British Columbia, Alberta, Saskatchewan, Ontario, and Québec, as well as in the Federal Court. Class Counsel’s endorsement of the settlement, and the fact that it was negotiated at arm’s length, carry some weight in favour of its approval.

(6) Recommendations of neutral parties

[70] In relation to this factor, the Plaintiff notes that this matter was mediated before the Honourable J. Douglas Cunningham, K.C., who served as a Justice of the Ontario Superior Court for two decades, including serving as Associate Chief Justice of the Superior Court of Justice. The Plaintiff references Justice Cunningham’s experience both on the bench and in private practice, including in class action litigation. The Plaintiff submits that, although Justice Cunningham did not adjudicate the settlement, he assisted in guiding negotiations and contributed to the structuring of the settlement, and that the parties reached an agreement in principle (later reduced to the FSA) shortly following the mediation.

[71] The Court accepts that Justice Cunningham’s involvement in the mediation, and the experience he thereby brought to bear, contributed to the parties’ ability to achieve the proposed settlement. It is also reasonable to draw some inference to the reasonableness of a settlement that was negotiated between arm’s length parties with the assistance of a neutral and experienced mediator. However, in the absence of any express endorsement by the mediator of the terms of the settlement, I do not place significant weight on this factor.

(7) Objections

[72] As previously noted, as of the February 20, 2026 deadline for objections prescribed by the 2025 Notice Order (and published through the Notice of Approval Hearing approved therein), there were 29 objections. One further objection was received on or about March 1, 2026, after the deadline. Four of the objectors appeared at the hearing of this motion, either in person or virtually. The objector who attended in person was unable to stay until the stage of the hearing at which the Court heard objectors’ submissions, but she provided Class Counsel with a written explanation of her objection, which counsel read to the Court. The three objectors who attended virtually all provided oral submissions in support of their positions.

[73] As the Plaintiff submits, the majority of the objections relate to the level of compensation available under the FSA, while a smaller number express concerns with the claims process itself or object to the amount of the proposed Class Counsel legal fees. I will return to the objection to the legal fees when addressing that issue later in these Reasons. In relation to the settlement itself and its mechanics, I would summarize the objections as follows:

A. A significant number of the objectors take the position that the proposed compensation is inadequate. Some objectors assert that the level of compensation should be increased (or set at the same level as the proposed honoraria for representative plaintiffs), that an additional level of compensation should be added to the settlement structure for more serious claims, that liability should be imposed personally upon the Minister of National Revenue and/or the Chief Executive Officer of CRA, or that particular objectors’ individual circumstances warrant a level of compensation beyond that contemplated by the settlement;

B. Many objectors, including those who provided submissions at the hearing, emphasize their particular experiences following the data breach, including mental, physical, and financial harm, adverse impacts on employment or personal transactions, and effects upon their credit or anxiety or ongoing costs such as credit monitoring arising from concern about such effects;

C. Several objectors, including those who argue that the level of compensation contemplated by the FSA is inadequate, describe lengthy and repeated challenges and frustrations in their communications with CRA in efforts to resolve issues arising from the data breach. These issues included inability to reach CRA, lengthy periods on hold on the telephone, dropped calls, delays in processing tax returns, multiple reassessments of their returns, and lengthy periods during which the objectors were unable to access their online accounts and otherwise access services such as the direct deposit of tax refunds;

D. One objector asserts that the proposed claims process is unclear and difficult to access.

[74] At the hearing of this motion, following the objectors’ oral submissions, I provided Class Counsel with opportunity to reply to those submissions. With respect to the objector’s assertion that the proposed claims process is unclear and difficult to access, I agree with Class Counsel’s reply that, in the event that any eligible claimant has difficulty navigating the claims process, both the Claims Administrator and Class Counsel will be available to assist. Furthermore, the Distributional Protocol provides a process whereby an eligible claimant will be notified by the Claims Administrator of any deficiencies in their claim and provided 45 days to correct errors or submit a new claim.

[75] In relation to the level of compensation contemplated by the proposed settlement, Class Counsel emphasized that the Court’s role in this motion is a binary one, i.e., the Court must either: (a) approve the proposed settlement represented by the FSA; or (b) reject the settlement, in which case the parties will be obliged to return to advancing the litigation towards a common issues trial or pursue further settlement negotiations. That is, it is not available to the Court to modify the parties’ settlement.

[76] I agree with this characterization of the Court’s role. In other words, the only means by which compensation available to Class Members might exceed those contemplated by the FSA would be for the Court to reject the settlement and for the Plaintiff to litigate this matter further in an effort to achieve a more favourable result either at trial or through further negotiation. Of course, whether such a result might be achieved is necessarily speculative and, as explained earlier in these Reasons, pursuing the matter to trial carries risk of the Defendant prevailing in advancing defence arguments that would entirely deprive Class Members or some of them of any compensation.

[77] I also accept Class Counsel’s submission, in reply to the suggestion that personal liability be imposed on the Minister of National Revenue and/or the Chief Executive Officer of CRA, that this is not a foreseeable result, either through further litigation or further settlement discussions, particularly as the Plaintiff’s pleadings (fashioned in accordance with the architecture of Canada’s public liability regime) do not assert such a claim.

[78] More broadly, Class Counsel has drawn the Court’s attention to other privacy breach cases in which class action settlements, involving comparable or lesser levels of compensation, have been approved by the relevant court. For instance, in Drew v Walmart Canada Inc, 2017 ONSC 3308 [Drew], Justice Perell of the Ontario Superior Court of Justice approved a settlement that provided that class members with documented evidence of time spent responding to a data breach could receive $15/hour for up to five hours; class numbers who could not provide any documented evidence of such losses could receive $15/hour for up to two hours; and claims for out-of-pocket costs could be reimbursed to a maximum of $5000 (at paras 10, 19).

[79] Similarly, in Condon, the settlement approved by Justice Gagné of this Court fixed payments at $60 for each class member who completed a claim form. This figure was based on a rate of $15/hour for a maximum of four hours of time spent responding to the data loss (at paras 9, 23). However, I note that class members were also entitled to recover actual proven losses in an uncapped amount through an arbitration system (at para 10).

[80] In Mallette v Bank of Montreal, 2021 ONSC 2924 [Mallette], Justice Smith approved a settlement for class members whose personal information was compromised through a data breach, providing for compensation based on a rate of $18/hour spent in addressing the breach, although at different maximum numbers of hours (and with the potential for additional modest lump sum payments) depending on the sort of information involved (at para 37).

[81] In Lozasnski v The Home Depot, Inc, 2016 ONSC 5447 [Lozasnski], Justice Perell approved a settlement resulting from a data breach, in which class members could receive $15/hour of compensation for up to five hours of their time, as well as up to $5000 for documented financial losses (at para 45).

[82] Obviously, the terms of settlement in these authorities are not identical, either to each other or to the proposed settlement in the case at hand. In particular, class members’ ability to recover actual proven losses in an uncapped amount in Condon appears more generous than the $5000 applicable to Special Compensation in the present matter. However, conscious that a proposed settlement need not be perfect, but rather is required to fall within a range or zone of reasonableness, and employing the above authorities as a guide to that assessment, I am satisfied that the levels of compensation that the parties have negotiated are reasonable.

[83] In so concluding, I emphasize that I am conscious of the fact that these levels of compensation may be wholly inadequate for some Class Members, particularly those who allege that they have suffered significant mental, physical, and financial harm as a result of the data breach that is the subject of the Class Action. However, I agree with Class Counsel’s submission that such circumstances may be an inevitable result of a settlement which is intended to provide a reasonable level of compensation for a class of claimants but is not necessarily suitable for every Class Member. As Class Counsel notes, of the approximately 48,000 Class Members who are eligible to make claims under the proposed settlement, only 29 (or 30 if one were to include the late objection) of these have objected to the settlement, representing an objection rate of 0.0006%. These figures support a conclusion that the proposed settlement is in the best interests of the class as a whole.

[84] However, the fact that a proposed settlement may not be suitable for every Class Member is intended to be addressed by the potential for Class Members to opt out of the Class Action, so that they can preserve the right to pursue individual actions. In recognition of this point, although not taking a position on the issue, Class Counsel identified at the hearing the possibility that the Court (if approving the settlement) could also afford the objectors a further opportunity to opt out, following notice to be provided by Class Counsel. Some of the objectors, while taking the principal position that the settlement should be rejected, approved of this possibility and encouraged the Court to provide a further opt-out opportunity in the event the settlement was approved.

[85] While the Defendant’s position on this motion for settlement approval is largely aligned with that of the Plaintiff, the Defendant does not agree that the Court should provide a further opt-out opportunity. The Defendant takes the position that providing such an opportunity to the objectors would be unfair both to the other Class Members, who were required to decide whether or not to opt out of the proposed settlement within the deadlines prescribed by the 2003 Notice Order and the 2005 Notice Order, and to the Defendant which negotiated the FSA with knowledge of the existing number of opt-outs. The Defendant similarly takes the position that no extension of time should be afforded to the 8 Class Members who submitted opt-outs after the February 20, 2026 deadline prescribed by the 2025 Notice Order.

[86] Indeed, at the hearing, the Defendant raised concern as to whether the Court had the authority to provide a further opt-out opportunity or whether that would represent the Court effectively varying the terms of the FSA which, as noted earlier in the Reasons, it is not available to the Court to do.

[87] In support of this latter point, the Defendant referred to the Court to Heyder, in which Justice Fothergill rejected a motion by a class member to opt out of a class proceeding after the deadline to do so had expired. Consistent with the Defendant’s submission, the Court noted that a supervising court’s jurisdiction to administer a settlement agreement is limited to filling a gap or applying a term of the agreement. A supervising court has no jurisdiction to rewrite the terms of the settlement unless this power is expressly conferred by the terms of the settlement. Once a settlement is concluded, no provision in the agreement or the settlement approval order should be changed unless all parties agree or the provision is invalid (at para 16).

[88] Justice Fothergill distinguished the opt-out provision in the relevant settlement agreement from the late claims provision considered by the Court in Heyder v Canada, 2023 FC 28, which provision expressly prohibited the acceptance of claims after the prescribed deadline, except with leave of the Court. The Court concluded that it therefore lacked the authority to grant the class member leave to opt out of the proceeding (Heyder at paras 20-23).

[89] I am not convinced that the Court is without the authority to grant the objectors a further opportunity to opt out of the Class Action. While I accept the principles from Heyder canvassed above, in my view the circumstances of the matter at hand are distinguishable from those that were before Justice Fothergill. Paragraph 11 of the 2025 Notice Order, which created the second opt-out period in the matter at hand, expressly states that no Class Member may out opt out of the Class Action after the conclusion of the relevant notice, except with leave of the Court [my emphasis].

[90] Moreover, section 2.3(a)(iii) of the FSA contemplates Class Counsel filing a motion for an order approving the form and content of a process for Class Members to opt out of the Class Action and the proposed settlement. Section 2.3(c) further provides that such order shall be in a form agreed upon by the parties and approved by the Court. The language in paragraph 11 of the 2025 Notice Order, which resulted from the motion required by section 2.3(a)(iii) of the FSA, was in the form of draft Order submitted to the Court in support of that motion. As such, in my view, the FSA (as applied by the parties) itself contemplates the Court having the authority to extend the deadline for Class Members to opt out of the Class Action.

[91] It is nevertheless necessary for the Court to consider whether it is appropriate to exercise that authority. Heyder references a test (explained in Johnson v Ontario, 2022 ONCA 725 [Johnson] at para 52) in which the Court considers: (i) whether a class member’s delay in opting out is due to excusable neglect (in good faith and with reasonable basis); and (ii) any prejudice that will accrue to participating class members, the defendant or the integrity of the process, from permitting a late opt-out (Heyder at para 28). Class Counsel also refers the Court to Crider v Nguyen, 2016 ONSC 4400 [Crider], in which Justice Perell found no unfairness to the defendant in allowing a class member to opt out, because the defendant was aware that there were going to be a few individual actions to defend and, but for the late timing of the class member’s formal opt-out, her decision to do so came as no surprise (at para 58).

[92] As explained at paragraph 27 of Heyder (citing paragraphs 48 and 51 of Johnson), while the right to opt out is fundamental not just to a class member but to the integrity of the class proceeding scheme, Court-imposed deadlines nevertheless have purposes, are meant to be treated seriously, and are intended to have consequences. Consistent with that principle and applying the test referenced above, I find no basis to extend the deadline for the eight Class Members who submitted opt-outs after the February 20, 2026 deadline prescribed by the 2025 Notice Order.

[93] However, I consider the circumstances of the Class Members who submitted objections to the proposed settlement to warrant a further opportunity to opt out. The “excusable neglect” (employing the language of the above-referenced test) arises from the fact that, upon receipt of the 2025 Notice Order, these objectors faced the dilemma of whether to object to the proposed settlement, with a view to achieving an outcome of the Class Action with which they were more content, or to opt out of the Class Action, so as to have the opportunity to pursue individual actions against the Defendant.

[94] Their decision to object represents an intention to remain Class Members in an effort to improve (from their perspective) the outcome of the Class Action. However, they necessarily made that decision without knowing whether their effort to oppose Court approval of the proposed settlement would be successful. In my view, if the Court decides to approve the settlement notwithstanding their objections, it would therefore be entirely reasonable for the objectors to wish to have no further part in the Class Action and instead to opt out of this proceeding.

[95] In this respect, the circumstances of the objectors in the matter at hand are distinct from those in Heyder. In that matter, the deadline for opting out of the class proceeding did not expire until following the Court’s approval of the settlement (see para 3). As such, unlike in the case at hand, class members in Heyder knew the status of settlement approval when making the decision whether to opt out.

[96] Given the circumstances of the objectors in this Class Action, i.e., the fact that they did not previously know whether the settlement to which they objected would be approved, I do not consider it to be unfair in relation to other Class Members (who have not objected to the settlement), or prejudicial to such other Class Members or to the integrity process, to afford the objectors an opportunity for a further opt-out.

[97] Nor do I consider this to be prejudicial to the Defendant in a manner that would warrant depriving the objectors of such opportunity. I appreciate that, if some or all of the objectors chose to opt out and to pursue individual actions against the Defendant within the limited time available before tolling (of the applicable limitation period) under the FSA expires, this would add to the Defendant’s litigation burden and risk. However, as described in Crider at paragraph 58, the Defendant was aware when negotiating the settlement of the potential for individual actions to defend.

[98] I also recognize that the FSA was not signed until March 2026, following the expiry of the February 28, 2026 deadline for opt-outs set by the 2025 Notice Order. However, there were 450 opt-outs by the deadline set by the 2023 Notice Order, and an additional 264 opt-outs by the deadline under the 2025 Notice Order, bringing the total to 669. Even if all objectors chose to opt out, this would increase the number of opt-outs by less than 5%. The Defendant has not adduced evidence or advanced argument to support a conclusion that such an increase is material to whatever final negotiations took place between issuance of the 2025 Notice Order and the execution of the FSA.

[99] While the number of objections to the settlement represents a very small percentage of the Class Members, even that small number would weigh somewhat against approving the settlement, particularly if approval would leave those objectors who assert more significant losses resulting from the data breach without the potential to pursue a claim for such losses through individual actions. However, based on the above analysis, the Court has authority to mitigate that effect and, in my view, should do so, in the interests of both protecting the objectors and supporting approval of the settlement in the best interests of the class as a whole.

(8) Conclusion

[100] Having considered all the factors canvassed above, I find that the proposed settlement is fair, reasonable, and in the best interests of the class as a whole. Subject to the remaining issues to be canvassed in these Reasons, surrounding the parties’ proposed Notice of Settlement Approval, the proposed honoraria for the representative plaintiffs, and Class Counsel’s fees and disbursements, and with the inclusion of a brief further period for the objectors to opt out of the Class Action (following notice to be provided by Class Counsel), I am prepared to issue an Order in the form proposed by counsel, approving the FSA and giving effect to its terms.

B. Notice of Settlement Approval

[101] Rule 334.34 requires Court approval of the content of, and means of giving, notice that a class proceeding settlement has been approved. While expressly applicable to notice that a proceeding has been certified, Rule 334.32(3) and (4) set out factors to be considered in determining the means of giving notice in a class proceeding and options for such means.

[102] Taking those factors into account, and with a view to reaching the maximum number of Class Members, the Plaintiff proposes a notice plan involving emailing or mailing known Class Members where possible and achieving national publication of notice via digital and social media, including the Defendant posting notice in both official languages on the Cision Newswire service.

[103] The Plaintiff explains that this notice plan is the same plan that was proposed in respect of the Notice of Approval Hearing and approved by the Court in the 2025 Notice Order. I am content with the plan and, subject to considering below the proposed honoraria and Class Counsel’s fees and disbursements, which are referenced in the proposed form of notice, I am also content with the proposed form.

C. Honoraria for Mr. Sweet, Ms. Campeau and Ms. Seminoff

[104] The FSA contemplates that, in addition to bringing a motion seeking approval of the proposed settlement, the Plaintiff would seek approval of honoraria for Mr. Sweet, Ms. Campeau and Ms. Seminoff in the amounts, respectively, $5000, $1500 and $1500, to be paid out of the Settlement Amount.

[105] There is no specific Rule that provides for the payment of honoraria to representative plaintiffs in class actions. However, the Court has recognized that honoraria may be awarded to representative plaintiffs who sacrificed their time, resources, and privacy for the benefit of others (see, e.g., Merlo at paras 68-74).

[106] In Toth v Canada, 2019 FC 125 [Toth], at paragraph 96, the Court referred to relevant factors for consideration in determining whether representative plaintiffs should receive an honorarium. These factors include a plaintiff’s active involvement in the litigation, significant personal hardship or inconvenience in connection with the prosecution of the litigation, time spent in advancing the litigation, communication with other class members, and participation in the litigation including settlement negotiations and trial. In Toth, the Court approved payment, from class counsel’s fees, of $50,000 to the representative plaintiff (at paras 94, 105).

[107] In the matter at hand, the honoraria sought are amounts far more modest than in Toth and are in line with the lower end of the range in cases referenced by Class Counsel (Merlo at para 3, in which the Court approved an honorarium of $15,000 for each of the two representative plaintiffs; Condon at paras 114 and 120, in which the Court approved an honorarium of $5000 for each of the three representative plaintiffs).

[108] I accept that Mr. Sweet, as the current representative Plaintiff in this matter, actively participated in, and made a significant contribution to, this Class Action, through the certification stage and following steps of this litigation, culminating in the proposed settlement and this motion for settlement approval. Ms. Campeau also contributed as the then representative plaintiff upon the initial commencement of the Class Action, prior to her replacement by Mr. Sweet following the Murphy Battista data breach, and Ms. Seminoff then contributed through the commencement of the Seminoff Proposed Class Action on behalf of the Excluded Persons. However, those contributions were less significant than those of Mr. Sweet and, consistent with Class Counsel’s proposal, merit smaller honoraria.

[109] I agree that the payment of honoraria to Mr. Sweet, Ms. Campeau and Ms. Seminoff from the Settlement Amount is appropriate, both in principle and in the amounts proposed.

D. Class Counsel fees and disbursements

(1) General Principles

[110] Rule 334.4 provides that all payments to counsel flowing from a class proceeding must be approved by the Court. The overarching test applicable to class counsel fees is that they must be fair and reasonable in the circumstances (Condon at para 81).

[111] To assist in determining whether this test is met, the Court has established a non-exhaustive list of factors to consider:

1. Risk undertaken by class counsel;

2. Results achieved;

3. Time and effort expended by class counsel;

4. Complexity and difficulty of the matter;

5. Degree of responsibility assumed by class counsel;

6. Fees in similar cases;

7. Expectations of the class;

8. Experience and expertise of class counsel;

9. Ability of the class to pay; and

10. Importance of the litigation to the plaintiff

(see Toth at para 112; Condon at paras 81-83; Merlo at paras 78-98).

[112] As with the factors governing the approval of settlement agreements, the weight of the factors listed above will vary according to the particular circumstances of each class action. However, the jurisprudence shows that risk that class counsel undertook in conducting the litigation and the degree of success or results achieved for the class members through the proposed settlement are two critical factors in assessing the fairness and reasonableness of a contingency fee request by class counsel (see Toth at para 113, quoting Condon at para 83). The risk undertaken by class counsel includes the risk of non-payment but also the risk of facing a contentious case and a difficult opposing party (see Wenham v Canada (Attorney General), 2020 FC 590 at para 34).

[113] It is well accepted that for class proceedings legislation to achieve its policy goals – access to justice, behaviour modification, and judicial efficiency (see Hollick v Toronto (City), 2001 SCC 68 at para 27) – class counsel must be well rewarded for their efforts, and that contingency agreements negotiated with representative plaintiffs should be respected (Lin at para 73). Further, a percentage-based fee retainer agreement is presumed to be fair and should only be rebutted or reduced in clear cases based on principled reasons (see Lin at para 73, citing Condon at para 85).

[114] The following analysis will focus upon the particular factors emphasized by Class Counsel in support of their request for approval of fees and disbursements consistent with the Retainer and Contingency Fee Agreement negotiated with Mr. Sweet in the case at hand.

(2) Retainer Agreement

[115] On November 18, 2021, Mr. Sweet executed a Retainer and Contingency Agreement with Murphy Battista [the Retainer Agreement], which provides that they would be paid on a contingency basis with fees calculated as 33.33 % of the amount awarded to the class in settlement or judgment, plus disbursements and taxes.

[116] While the Retainer Agreement was executed with Murphy Battista, the Rice Parsons firm subsequently assumed carriage of this matter as Class Counsel (as explained earlier in these Reasons), and it is they who now seek approval of fees calculated in accordance with the Retainer Agreement. However, counsel explained at the hearing of this motion that these fees will be split with Murphy Battista. The Court does not have, and does not require, visibility on the precise division of fees among the law firms that have been involved in pursuing litigation arising from the data breach.

(3) Fees and disbursements claimed

[117] Against the backdrop of the Retainer Agreement, Class Counsel have prepared a draft Order reflecting their request for approval of the following, payable to Class Counsel as a first charge on the settlement funds: (a) total fees of $2,090,182.18, inclusive of taxes, with 90% of that figure ($1,881,163.96 inclusive of taxes) being paid as an interim fee within 14 days of the Effective Date; and (b) disbursements of $89,255.81 inclusive of taxes, to be paid within 14 days of the Effective Date.

[118] Class Counsel explained at the hearing that the $2,090,182.18 figure, which represents 33.33% of compensatory payments to Class Members plus applicable taxes, is calculated based on the most recent estimates of the limits of compensation available for Access Claimants, Fraud Claimants, and Special Compensation which, as explained earlier in these Reasons, are somewhat reduced from the figures in the FSA as a result of increased administration costs incurred by the Claims Administrator. That is, the reduction in the compensatory component of the Settlement Amount due to an increase in claims administration costs has also reduced the request for the legal fees.

[119] Similarly, counsel explained that the purpose of the 10% holdback reflected in the draft Order is to allow for a final adjustment of fees and disbursements once final claims administration costs and disbursements are known. Further payment to Class Counsel in respect of fees and disbursements, beyond that reflected in the draft Order, would be made only following a further motion to the Court.

(4) Result achieved, complexity of the matter, risks, time, and degree of responsibility

[120] Class Counsel submit that they successfully navigated this matter through several years of intensive litigation, including a contested certification hearing and extensive settlement negotiations with the Defendant. Referencing the authorities cited earlier in these Reasons in which comparable levels of compensation were achieved for victims of data breaches (Drew; Condon; Mallette; Lozasnski), counsel submit that they thereby achieved a fair settlement for Class Members in keeping with similar cases.

[121] Supported by an affidavit sworn by Mr. David Honeyman, a lawyer with Rice Parsons, counsel also explain that, as of March 18, 2026, they and Murphy Battista have together expended 3029.7 hours in this litigation, representing $2,031,071.40 of docketed time, and have incurred $89,255.81 in disbursements. Class Counsel note that they did not seek any third-party financing for the litigation in this matter and argue that, as such, they incurred additional financial risk, including self-funding the disbursements, and saved Class Members the cost typically associated with third-party funders.

(5) Quality and skill of class counsel

[122] Consistent with the Court’s observations earlier in these Reasons, Class Counsel note their experience as class action litigators, having represented plaintiffs in class proceedings in the courts of British Columbia, Alberta, Saskatchewan, Ontario, and Québec, as well as in the Federal Court.

(6) Ability of class members to pay

[123] Class Counsel submit that, given the expense and complexity of this litigation, there was no feasible way for Class Members to have retained Class Counsel on a fee-for-service basis. They also note that Mr. Sweet as representative Plaintiff has approved the fees sought in this matter.

(7) Importance of matter to class members

[124] Referencing an affidavit sworn by Mr. Sweet in which he explains his experience in having his CRA account hacked and his personal financial information used for fraudulent purposes, including his subsequent efforts to address those circumstances and resulting anxiety and stress, Class Counsel submit that this Class Action is important to the Class Members. Counsel also note that, as of March 18, 2026, 5,232 people identifying themselves as Class Members have registered their interest in this case with Class Counsel.

[125] In relation to Mr. Sweet’s evidence of his experience, I note counsel’s explanation that Mr. Sweet is not actually a victim of the particular data breach that is the subject of the Class Action. However, consistent with the submissions received from the objectors, I accept counsel’s submission that many Class Members will have had experiences similar to those described by Mr. Sweet.

(8) Fees in similar cases

[126] Class Counsel note authorities referencing contingency fees of 33.33% as presumptively valid (Merlo at para 98; Denluck v The Board of Trustees for the Boilermakers’ Lodge 359 Pension Plan, 2021 BCSC 242 at para 42) and finding the range of reasonable fees to be between 15% and 33.33%, with fees in the higher range to be reasonable particularly where there would be a significant risk and uncertainty at trial (Jost v Canada (Attorney General), 2025 FC 1193 at para 51), which characterization counsel submit applies to the case at hand.

[127] Counsel has also drawn the Court’s attention to Lin, in which the Federal Court rejected a fee of 33% in the context of modest results achieved for class members. However, I agree with Class Counsel’s submission that Lin is distinguishable from the case at hand, in which the result achieved compares favourably with other privacy breach settlements, as canvassed above. As Class Counsel further note, and again in contrast with the circumstances of the matter at hand, the 33% fee claimed in Lin would have represented a multiplier of between 2.3 and 2.7 of actual time spent by counsel in that case (at para 98).

(9) Conclusion

[128] I am conscious that some of the objectors argue that counsel’s fee request is excessive, in the context of the compensatory amounts available to individual eligible Class Members under the settlement. However, as Class Counsel undertook this proceeding on a contingency basis in the context of the liability risks identified earlier in these Reasons, they clearly assumed a degree of risk and, as previously canvassed, they achieved a result consistent with data breach class action precedents. Moreover, the amount of fees claimed pursuant to that contingency arrangement is comparable to the fees calculated based on docketed time, meaning that, unlike in some contingency matters, counsel have not achieved a material fee premium to compensate them for their risk.

[129] Taking into account those factors, and the other considerations canvassed above including relevant precedents, I am satisfied that the fee request is reasonable and will issue an Order approving Class Counsel’s fees and disbursements on the terms proposed.

V. Conclusion

[130] In summary, the Court finds that the terms of the FSA are fair, reasonable, and in the best interests of the class as a whole and are therefore approved. The proposed honoraria to representative plaintiffs, Class Counsel’s proposed legal fees, and Class Counsel’s disbursements are also all fair and reasonable and are therefore approved.

[131] The Plaintiff has submitted two separate draft Orders, one related to approval of the settlement and the honoraria, and the other related to approval of legal fees and disbursements. I will issue those Orders, materially in the form proposed other than to include in the former order an additional opt-out opportunity for objectors. In relation to that Order, the Court provided counsel an opportunity to submit a further proposed form of Order with revisions to capture the additional opt-out opportunity, and the Court is prepared to adopt those revisions. I will issue the two Orders separate from these Reasons, so as to avoid encumbering the Orders with the length of my Reasons.

"Richard F. Southcott"

FEDERAL COURT

SOLICITORS OF RECORD

DOCKET:	T-982-20
STYLE OF CAUSE:	TODD SWEET v HER MAJESTY THE QUEEN
PLACE OF HEARING:	VANCOUVER, BRITISH COLUMBIA
DATE OF HEARING:	March 31, 2026
REASONS FOR ORDER:	SOUTHCOTT J.
DATED:	may 5, 2026

APPEARANCES:

Anthony Leoni David A. Honeyman	For The PLAINTIFF
Sharon Johnston Stephen Kurelek Jamie Hansen	FOR THE DEFENDANT

SOLICITORS OF RECORD:

Rice Harbut Elliott LLP Vancouver, British Columbia	FoR THE PLAINTIFF
Attorney General of Canada Vancouver, British Columbia	FOR THE DEFENDANT