Cyber class action claims at an inflection point

Cyber class action claims at an inflection point

• 1.
  Presented By CICMA cyber securityUpdate Dan Michaluk October 18, 2021
• 2.
  o Self-regulatory organizationoversees all investment dealers o Laptop with unencrypted data left of subway in 2013 – never found o Estimated 48,000 affected individuals o Robust, transparent response by the organization o Plaintiff a victim of identity theft o Claimed compensatory damages (actual attempted fraud plus anxieties) and punitive damages based on response Lamoreaux The first class action merits decision 2
• 3.
  o No compensabledamages proven • Normal anxiety associated with receiving a notification is not compensable • Testimony provided (translation) “few details, concrete facts or significant manifestations of their psychological states” • No causation proven regarding identity theft – some evidence that plaintiff’s social insurance number and driver’s license were not even ever received by defendant from his brokerage • Defendant provided necessary protective measures Lamoreaux The first class action merits decision 3
• 4.
  o No punitivedamages - response exemplary • conducted investigations and carried out internal checks • promptly informed the police • retained a firm of consultants as quickly as possible to perform forensic investigation • notified the privacy commissions concerned of the loss • notified the brokerage firms having investors concerned about the situation • notified the class members concerned of the loss of their personal information, by means of bilingual letters • published a press release announcing the loss • informed class members that it was unaware of any identity theft Lamoreaux The first class action merits decision 4
• 5.
  o Ontario casesare about the scope of liability for the common law privacy torts, which give access to moral damages o In negligence, no harm means no foul o Privacy torts are intentional, so the wrong arises from the act alone, and one who is reckless has bad intent o Defendant attacked in 2017 via exploit of web application vulnerabilities o Announced as affecting 100,000 Canadians, 20,000 ultimately notified Owsianik Big wins for defendants in Ontario 5
• 6.
  o Div. Ct.overturns intrusion upon seclusion certification decision o “The intrusion need not be intentional; it can be reckless. But it still has to be an intrusion. It is the intrusion that has to be intentional or reckless and the intrusion that has to be highly offensive. Otherwise the tort assigns liability for a completely different category of conduct, a category that is adequately controlled by the tort of negligence.” o Leave to appeal to Ont. CA granted last month Owsianik Big wins for defendants in Ontario 6
• 7.
  o About thetheft of credit card application data by a former employee of a bank’s cloud service provider – alleged to have used her understanding to conduct exploits o “A failure to prevent an intrusion, even a reckless failure to prevent, is not an intrusion.” o No vicarious liability either - “absurd and unfair” to impose liability on a defendant for the actions of a former employee o Contractual claims failed based on the contract terms Thompson Big wins for defendants in Ontario 7
• 8.
  o The Lamoreauxand Owsianik defences are critical to the outcome the privacy class action “dialogue” o The Lamoreaux case provides good practical guidance for responders o This cynic’s view - all the harm flows from notification alone o We therefore must notify based on the facts and evidence – never, never notify because there’s a speculative risk of unauthorized access or theft o Yes, there is mischief, which is why we will see logging regulation come into force in the next five years – e.g. PHIPA We are at an inflection point Where does that leave us? 8
• 9.
  o If classactions prove themselves to be the wrong means of enabling justice, will there be alternatives o Ontario has posed an administrative compensation regime in its privacy reform materials o Questions • Will it be exclusive? • Will it be capped New administrative compensation regime? Keep an eye on Ontario 9
• 10.
  Questions? Questions?
• 11.
  For more information,contact: The information contained herein is of a general nature and is not intended to constitute legal advice, a complete statement of the law, or an opinion on any subject. No one should act upon it or refrain from acting without a thorough examination of the law after the facts of a specific situation are considered. You are urged to consult your legal adviser in cases of specific questions or concerns. BLG does not warrant or guarantee the accuracy, currency or completeness of this presentation. No part of this presentation may be reproduced without prior written permission of Borden Ladner Gervais LLP. © 2020 Borden Ladner Gervais LLP. Borden Ladner Gervais is an Ontario Limited Liability Partnership. Thank You Dan Michaluk Partner 416.367.6097 [email protected]