Invasion of privacy class-action against Equifax proceeds in Ontario

A class-action lawsuit arising from last year’s Equifax cyber breach is proceeding in Ontario on the basis of a new invasion-of-privacy tort that has caught the eye of Canada’s property and casualty insurers because it allows courts to award damages even when no economic loss is proven.

In a ruling released Jan. 24, the Ontario Superior Court of Justice ruled that law firm Sotos can proceed with a class action against Equifax Inc. and Equifax Canada Co. The representative plaintiffs are Bethany Agnew-Americano and a “Jane Doe” plaintiff who is requesting anonymity from the court because of the sensitivity of information that Jane Doe says fell into the wrong hands.

In the Jan. 24 ruling – Agnew-Americano v. Equifax Canada – Justice Benjamin Glustein stayed a separate class action lawsuit against Equifax filed by Merchant Law Group on behalf of Laura Ballantine. Allegations that Equifax failed to take adequate steps to protect consumers’ privacy have not been proven in court. The Jan. 24 ruling was not on the merits of the lawsuit but rather on which of two class-actions would proceed.

Merchant Law – whose lawsuit is now pretty much dead in the water – had argued unsuccessfully that the Sotos lawsuit should not proceed. This is because Sotos wants one cause of action to be “intrusion upon seclusion,” which was recognized in 2012 by the Court of Appeal for Ontario as a new tort in 2012.

Justice Glustein decided it was not obvious that an intrusion-upon-seclusion lawsuit against Equifax would fail.

The tort of intrusion upon seclusion is significant for liability insurance providers because “if your personal privacy has been invaded, even if you haven’t suffered any economic harm, you could still sustain an action,” Brian Rosenbaum, senior vice president and national cyber and privacy practice leader at Aon Canada Inc., said during the International Cyber Risk Management Conference, held in March, 2017.

Equifax announced in 2017 that cyber criminals were able to access personal information through a security vulnerability on its website. Information on Canadians that may have been compromised included names, addresses, social insurance numbers and – in some cases – credit card numbers.

An intrusion upon seclusion lawsuit, “if viable, provides a broader claim” than one of negligence, ‘which opens up a defendant’s exposure,” Justice Glustein wrote Jan. 24, 2018 in Agnew-Americano v. Equifax Canada.

The ruling that established intrusion upon seclusion was Jones v. Tsige, released in 2012 by the Court of Appeal for Ontario. Bank of Montreal employee Winnie Tsige has accessed Bank of Montreal customer records for Sandra Jones, who was also a BMO employee. Tsige was in a relationship with Jones’s former husband. Jones sued Tsige and in 2011 the Ontario Superior Court of Justice ruled against Jones, finding there is no common-law tort of invasion of privacy in Ontario. That finding was overturned on appeal, with Jones being awarded $10,000 in damages.