Paul Sofio v. OCRCVM (IIROC), 2014 QCCS 4061 (under appeal) - The Quebec Superior Court refuses to authorize a class action where the  loss of personal data did not result in fraud or identity theft.

The Quebec Superior Court recently refused to authorize a class action against the Investment  Industry Regulatory Organization of Canada (IIROC) after an IIROC employee lost a laptop containing   the personal data of approximately 50,000 clients of investment firms. The lost laptop was protected by a password. However, contrary to IIROC policy, the data on the laptop was not encrypted. The laptop was lost in February 2013, but IIROC did not realize until March 22, 2013  that the information on the laptop included personal data of investment firm clients.

On April 24, 2013, the Petitioner - along with other individuals whose data  was on the lost laptop  - received a notice from IIROC advising him of the lost laptop, a call-in line to respond to questions, and of the offer of a free alert service with Equifax Canada  for 6 years to reduce  the potential of fraud. The Petitioner also received a notice advising of ways to protect himself from identity theft, including periodic verification  of bank accounts, credit cards, mail, and credit-related activity with Equifax and TransUnion  (Canada’s two major credit-reporting agencies). He would later receive a notice advising that IIROC was offering him additional measures such as credit surveillance for  one year through Equifax (over and above the free alert service with Equifax for 6 years) and  posting a fraud warning on his credit record with TransUnion. There was no known case of identity theft or fraud resulting from the loss of the laptop.

The Petitioner sought to have a class action authorized against IIROC for all individuals and  companies of less than 50 people whose personal data was lost in Quebec by IIROC or one of its  employees in 2013. The Petitioner sought a judgment most notably awarding him and other members of  the class damages of CAD 1000 each.

The Court was of the view that the Petitioner met all the criteria for the authorization of a class  action, except for that of identifiable damage, and refused to authorize the class action:

  • The Court agreed that the recourses of the members of the class would raise identical, similar  or related questions of law or fact. In fact, IIROC did not contest this point (article 1003a) of  the Quebec Code of Civil Procedure (“CCP”)).
  • On the issue of the facts alleged seeming to justify the conclusions sought, the Court agreed  that the Petitioner met the burden of proving prima facie the fault of IIROC, but concluded that there

was no “compensable” damage. Although the Court recognized that moral damages had been awarded in class actions before (for  stress, shock, inconveniences, etc.), it was of the view that the inconveniences alleged by the  Petitioner (having to check accounts on a monthly  basis, regularly checking the mail, remembering not to give out any  personal information by phone, mail or email) were not exceptional and were part of life in modern  society. The few exchanges between the Petitioner and the credit agencies appeared to flow from the  insufficient information provided by the Petitioner to the agencies and some confusion regarding the protection  provided. The Court highlighted the fact that there had yet to be any reported case of identity theft of or fraud resulting from the loss of the laptop (and acknowledged that a  class action was authorized in Larose v. National Bank of Canada, where identity theft occurred). In light of the circumstances, the  stress associated with the events was not considered  to rise to the level of “compensable” damage  (art. 1003b) of the CCP).

  • The Court agreed that the composition of the group would have made the application of articles 59  or 67 of the CCP difficult or impracticable (art. 1003c) of the CCP).
  • The Court also agreed that the Petitioner, the member who would have been ascribed the status of  representative, would have been in a position to represent the members adequately. The Petitioner  was an accountant, his role was rather limited, and he appeared to have followed the IIROC recommendations (art. 1003d) of the CCP). An appeal was filed in this matter on September 19, 2014.

The present case supports the  existing jurisprudence in Quebec that requires that a petitioner  demonstrate compensable damage, such as identity theft, to meet the test of article 1003b) CCP and to succeed at the authorization stage. Mere inconvenience related to life in modern society  is not enough to meet the threshold of compensable damage.