The Long Arm of the Law

Privacy breaches, the long arm of the U.S. law and “ordinary drivers” were all hot topics during the Risk and Insurance Management Society (RIMS) Canada Conference held in Ottawa from Sept. 18 to Sept. 21.

Panellists at the conference explored the scope and potential implications of a U.S. legal decision that suggests “mental anguish” can sustain third-party actions for a privacy breach. Economic loss used to be the key ground for such legal actions.  
The conference also included discussion about risks emanating from south of the border. For example, delegates heard experts discuss regulatory developments in the United States that place Canadian businesses – even those with remote links to the United States – at risk of prosecution by the U.S. government under the Foreign Corrupt Practices Act. In addition, cases advancing through the U.S. courts are establishing what panellists described as a blueprint for expanding civil liabilities here in Canada.

Finally, panellists suggested Canadian regulators and courts are interpreting Canadian law so as to expand the definition of what constitutes an “ordinary driver,” thus increasing the standard placed on municipalities for maintaining and ensuring the conditions of roadways.  

Proof of mental anguish sustains privacy breach legal actions

Victims of a privacy breach may no longer have to rely on proving economic loss as a result of the privacy breach to sustain a third party action. They can also show the breach caused mental anguish.

Aaron Konarsky, director of risk management and integrated controls at Canada Lands Co., spoke about the matter as a panel member during the seminar, Privacy Update: Hot Issues for Risk Professionals.

“Traditionally, in a third party action against an organization, you have to prove the loss of information would result in economic loss of the individual,” Konarsky told delegates. “So basically, someone took your information, they put a bogus mortgage on your property or they used your identity to borrow – those are economic losses that would generally sustain a third party action.”

But now the tide has turned. U.S. case law is on the books suggesting that victims need only prove the breach caused them mental anguish, Konarsky said.

In the United States a few years ago, the Department of Veteran Affairs accidentally released medical records of their veterans. The case eventually settled for $20 million.

But the case was not about those records being used for economic advance, Konarsky observed.

“The case was around these veterans’ personal medical information being out there, and the mental anguish they suffered from worrying about what would happen to it,” he said. “Would they be embarrassed? And whose hands would that information fall into? There is the blue print for what we see going forward as far as civil exposure for organizations. You don’t have to prove economic loss. If you suffered mental anguish, that’s actionable as a third party loss.”

Causal link to prosecute Canadian companies

Regulators around the world are cracking down on corrupt practices, putting companies at increased risk of “crippling” prosecution. And in some situations, the causal link between a company and the claim need only be “minute” for a foreign regulator to flex its muscle.

Jay Cassidy, senior vice president at Marsh Canada, made the observation as a panel member during a seminar that explored the theme Regulatory Expansion: Could it lead to an increased D&O and governance exposure at home and abroad?

Cassidy noted the United States adopted the Foreign and Corrupt Practices Act in 1977, and the act remained virtually dormant over the decades. But as a result of the Bernie Madoff financial pyramid scandal, as well as the global economic downturn, authorities are more aggressively pursuing companies and individual directors allegedly engaged in illegal practices, he said.

For Canadian companies, the causal link to the United States required for the U.S. Securities Exchange Commission (SEC) to enforce the Foreign and Corrupt Practices Act is “minute,” Cassidy said. “From a Canadian perspective, we need to keep our eyes on this,” he said.

“There doesn’t need to be a close proximity geographically. A Canadian-owned and operated company that doesn’t even have its feet in the U.S. is at risk. If funds flow through a U.S. bank, or if your servers are hosted in the U.S., the SEC can exert its enforcement.”

And it’s not just the penalties and fees that will wreak havoc on a Canadian company. “If there are $63 million in penalties, you’ve probably spent double that to investigate and defend the claim,” Cassidy said.

As a result, risk managers are encouraged to re-visit their Directors and Officers liability program, study their internal controls to prevent illegal activities and consider buying separate coverage to cover the costs of the investigation and defending of the claim, so as not to drain the limits of the D&O policy before a penalty is even levied.

Ontario courts expand interpretation of “ordinary drivers”

The interpretation of ‘ordinary driver’ in Ontario’s courts has expanded to include drivers who “sometimes make mistakes.” This has increased municipalities’ exposure to liability for not keeping safe roads, according to Steven Stieber, a managing partner at Stieber Burlach LLP.

Stieber spoke as a panel member during The Rising Cost of BI Claims: Why You Should Be Concerned, a seminar held at the RIMS Canada 2011 Conference.

Stieber referenced the 2010 Ontario Superior Court of Justice case Deering v Scugog. In this case, a novice driver was driving a group of friends down a rural road at night to see a movie. As she drove up over the crest of a hill (10 km-h faster than the speed limit), the headlights of an oncoming vehicle appeared to be in her lane. She swerved and lost control of the vehicle.

Both she and her sister, a passenger in the car at the time, were left quadriplegic.

Both sisters sued the municipality of Oshawa and Scugog. They alleged the municipality had failed to keep the road safe because no speed limit was posted and the road had no painted centre line at the time of the accident.

Citing the written decision from the case, Stieber said the court ruled: “The ordinary motorist includes those of average range of driving ability – not simply the perfect, the prescient or the especially perceptive driver or one with exceptionally fast reflexes but the ordinary driver who is of average intelligence, pays attention, uses caution when conditions warrant, but is human and sometimes makes mistakes.”

“So we [municipalities] have to protect that driver, although there was some degree of contributory negligence,” said Stieber. “That is a very, very difficult standard to meet. Apart from the [issue of the] resources available to meet it, the costs make it very difficult to meet it.”