Invasion of the Data Snatchers BC Court of Appeal Clarifies Possible Scope of Privacy Claims Against Data Custodians in Data Breaches Blake Cassels Graydon LLP JDSupra

pOn July 4 2024 the BC Court of Appeal issued a duo of class action appeal decisions considering the potential scope of statutory and common law privacy claims against data custodians that fall victim to cyberattacks in data breach cases In both GD v South Coast British Columbia Transportation Authority GD and Campbell v Capital One Financial Corporation Campbell the BC Court of Appeal affirmed that numerous causes of action may arguably be available even against data custodians innocent of any intentional wrongdoing including the statutory tort of violation of privacy pursuant to the BC Privacy Act These decisions follow the BC Court of Appeals decision earlier this year in Situmorang v Google LLC in which the court left open the question of whether the tort of intrusion upon seclusion exists in BC in addition to the statutory tort of violation of privacyppIn GD the BC Supreme Court dismissed an application to certify a proposed class action against the South Coast British Columbia Transportation Authority Translink arising from a cyberattack in which the personal information of Translinks employees and other third parties was allegedly compromised Among other things the BC Supreme Court found that the proposed class members did not have statutory claims against Translink for violation of privacy pursuant to the BC Privacy Act because their privacy was wilfully violated by thirdparty cyberattackers not by Translink The Court held that it was clear that the target of the statutory tort in a data breach case can only be the cyberattacker not the data custodianppOn appeal the BC Court of Appeal set aside the chambers judges decision on whether there was a viable cause of action under the BC Privacy Act In doing so the BC Court of Appeal stated that it is at least arguable to claim against a data custodian who has collected plaintiffs private information but failed to safeguard it from an unrelated cyberattacker that the data custodian has committed the statutory tort of wilful violation of privacy Without purporting to define the theoretical limits of the statutory tort the BC Court of Appeal stated that it is at least arguable that the willfulness requirement could include the mental state of reckless failure to safeguard a persons private information in the defendants possession thereby enabling the information to be disclosed to other persons The BC Court of Appeal partially justified these conclusions by noting the quasiconstitutional status of privacy interests the BC Privacy Acts purpose of protecting these constitutionally recognized interests the rapid growth of information collection and the potential for misuseppIn Campbell the BC Supreme Court granted an application to certify a proposed class action against Capital One which also arose from a cyberattack in which the personal information of credit card applicants was allegedly compromised Among other things the BC Supreme Court held that 1 a negligent data custodian may be jointly and severally liable with a cyberattacker for the tort of intrusion upon seclusion 2 breach of confidence was not sufficiently pleaded because the element of alleged misuse was missing and 3 it has jurisdiction to adjudicate claims under other provinces privacy legislationppOn appeal the BC Court of Appeal affirmed the chambers judges decision to certify the class proceeding In doing so it rejected the availability of joint and several liability between a negligent data custodian and a cyberattacker for moral damages but declined to consider whether it might be available for compensatory damages The Court rejected a cause of action for breach of confidence because no link was pleaded between the alleged misuse of data by the custodian ongoing retention of confidential information and the alleged harm to the proposed class members conduct of the cyberattackers and it also found that BC has subject matter jurisdiction over claims under other provinces privacy legislationppSee more ppDISCLAIMER Because of the generality of this update the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations
Attorney Advertisingpp
Blake Cassels Graydon LLP
var today new Date var yyyy todaygetFullYeardocumentwriteyyyy
ppRefine your interests ppBack to TopppExplore 2024 Readers Choice AwardsppCopyright var today new Date var yyyy todaygetFullYeardocumentwriteyyyy JD Supra LLCp