Case information

Civil procedure — Class actions — Certification of issues — Tort — Intrusion upon seclusion — Vicarious liability — Whether party which gathers and aggregates personal information into database can be held liable for damages to compensate for loss of privacy in circumstances where that party recklessly enables hackers but does not, itself, steal the information — To what extent does doctrine of vicarious liability apply to tort of intrusion upon seclusion — Extent to which doctrine of vicarious liability applies where there is no employment relationship between party which gathered information and third-party hackers.

Case summaries are prepared by the Office of the Registrar of the Supreme Court of Canada (Law Branch). Please note that summaries are not provided to the Judges of the Court. They are placed on the Court file and website for information purposes only.

Trans Union of Canada, Inc., a credit services company, accumulated and stored the personal information of millions of people in its database. It provides its customers with credit profiles of the persons whose information is included in the database. Although Trans Union imposes security measures, those measures had several shortcomings. On 10 days over a two week period in 2019, hackers used credentials stolen from a Trans Union customer to obtain consumer credit files containing the personal information of more than 37,000 Canadian customers without their knowledge or consent. No internal warning was raised until Trans Union identified an unusual amount of activity during their billing process. Several weeks passed before Trans Union suspended and eventually terminated the customer whose user credentials had been used. Users were notified several weeks later, and some compensation was offered to affected customers.

Mr. Obodo, one of the affected customers, moved to certify claims for class members in Manitoba, British Columbia Saskatchewan, Newfoundland and Labrador and Quebec based on intrusion upon seclusion, negligence, and breach of provincial privacy statutes.

The certification judge certified claims based in negligence and some of the claims based on breaches of privacy legislation. He found that the Ontario courts have no subject-matter jurisdiction over the breaches of provincial privacy legislation. He did not certify other questions, including the questions concerning intrusion upon seclusion. The Court of Appeal dealt with this case together with Glenn Winder v. Marriott International, Inc., Luxury Hotels International of Canada, ULC, Starwood Canada ULC, SCC File No. 40573, and Alina Owsianik v. Equifax Canada Co., Equifax, Inc., SCC File No. 40577. It addressed the shared issues in its reasons in Owsianik, but the issues specific to Mr. Obodo’s appeal in separate reasons. It dismissed both aspects of Mr. Obodo’s appeal.