Paul Sofio v. OCRCVM (IIROC), 2014 QCCS 4061 (under appeal) - The Quebec Superior Court refuses to authorize a class action where the loss of personal data did not result in fraud or identity theft.
The Quebec Superior Court recently refused to authorize a class action against the Investment Industry Regulatory Organization of Canada (IIROC) after an IIROC employee lost a laptop containing the personal data of approximately 50,000 clients of investment firms. The lost laptop was protected by a password. However, contrary to IIROC policy, the data on the laptop was not encrypted. The laptop was lost in February 2013, but IIROC did not realize until March 22, 2013 that the information on the laptop included personal data of investment firm clients.
On April 24, 2013, the Petitioner - along with other individuals whose data was on the lost laptop - received a notice from IIROC advising him of the lost laptop, a call-in line to respond to questions, and of the offer of a free alert service with Equifax Canada for 6 years to reduce the potential of fraud. The Petitioner also received a notice advising of ways to protect himself from identity theft, including periodic verification of bank accounts, credit cards, mail, and credit-related activity with Equifax and TransUnion (Canada’s two major credit-reporting agencies). He would later receive a notice advising that IIROC was offering him additional measures such as credit surveillance for one year through Equifax (over and above the free alert service with Equifax for 6 years) and posting a fraud warning on his credit record with TransUnion. There was no known case of identity theft or fraud resulting from the loss of the laptop.
The Petitioner sought to have a class action authorized against IIROC for all individuals and companies of less than 50 people whose personal data was lost in Quebec by IIROC or one of its employees in 2013. The Petitioner sought a judgment most notably awarding him and other members of the class damages of CAD 1000 each.
The Court was of the view that the Petitioner met all the criteria for the authorization of a class action, except for that of identifiable damage, and refused to authorize the class action:
- The Court agreed that the recourses of the members of the class would raise identical, similar or related questions of law or fact. In fact, IIROC did not contest this point (article 1003a) of the Quebec Code of Civil Procedure (“CCP”)).
- On the issue of the facts alleged seeming to justify the conclusions sought, the Court agreed that the Petitioner met the burden of proving prima facie the fault of IIROC, but concluded that there
was no “compensable” damage. Although the Court recognized that moral damages had been awarded in class actions before (for stress, shock, inconveniences, etc.), it was of the view that the inconveniences alleged by the Petitioner (having to check accounts on a monthly basis, regularly checking the mail, remembering not to give out any personal information by phone, mail or email) were not exceptional and were part of life in modern society. The few exchanges between the Petitioner and the credit agencies appeared to flow from the insufficient information provided by the Petitioner to the agencies and some confusion regarding the protection provided. The Court highlighted the fact that there had yet to be any reported case of identity theft of or fraud resulting from the loss of the laptop (and acknowledged that a class action was authorized in Larose v. National Bank of Canada, where identity theft occurred). In light of the circumstances, the stress associated with the events was not considered to rise to the level of “compensable” damage (art. 1003b) of the CCP).
- The Court agreed that the composition of the group would have made the application of articles 59 or 67 of the CCP difficult or impracticable (art. 1003c) of the CCP).
- The Court also agreed that the Petitioner, the member who would have been ascribed the status of representative, would have been in a position to represent the members adequately. The Petitioner was an accountant, his role was rather limited, and he appeared to have followed the IIROC recommendations (art. 1003d) of the CCP). An appeal was filed in this matter on September 19, 2014.
The present case supports the existing jurisprudence in Quebec that requires that a petitioner demonstrate compensable damage, such as identity theft, to meet the test of article 1003b) CCP and to succeed at the authorization stage. Mere inconvenience related to life in modern society is not enough to meet the threshold of compensable damage.