Case information

Civil procedure — Class actions — Certification of issues — Tort — Intrusion upon seclusion — Corporation collected and aggregated financial and other information about millions of individuals and corporate entities — Unknown third parties gained unauthorized access to information — Breach discovered in July 2017 and made public in September 2017 — Whether it is plain and obvious that claim for intrusion upon seclusion is not available against collectors and custodians of private information where private information is improperly accessed by third party and defendants are alleged to have acted recklessly.

Case summaries are prepared by the Office of the Registrar of the Supreme Court of Canada (Law Branch). Please note that summaries are not provided to the Judges of the Court. They are placed on the Court file and website for information purposes only.

Equifax Canada Co. operates around the world providing two kinds of services. First, it provides credit reporting and credit protection services to customers by collecting and aggregating financial and other information about millions of individuals and corporate entities. Second, Equifax provides services meant to protect customers from fraud, identity theft and other financial crimes. It accumulates and stores information pertaining to those clients for the purposes of providing those services. Hackers gained unauthorized access to the personal information stored by Equifax. Ms. Owsianik was affected by the breach. She brought an action against Equifax alleging a number of wrongs, including intrusion upon seclusion. She sought to have it certified as a class proceeding. She alleged that Equifax knew that it was a prime target for cybercriminals, acknowledged that properly safeguarding the information held in its database was crucial to the services provided to its customers, and claimed publicly and in its contract with clients that it maintained strict security standards to prevent unauthorized access to and use of the private information. Nonetheless, there were numerous deficiencies in its security systems, Equifax was aware of those deficiencies, it had failed to respond to the intrusion in a timely or effective manner, and its failure to take appropriate steps to guard against unauthorized access to the sensitive information was an intentional or reckless intrusion upon her privacy.

In reasons styled as Agnew-Americano v. Equifax Canada Co., all of the questions proposed by Ms. Owsianik, including the three common issues concerning intrusion upon seclusion, were certified. Thereafter, the matter was styled as Owsianik v. Equifax Canada Co. The Divisional Court granted leave to appeal on this question of law: “Did the motion judge err in finding that the tort of intrusion upon seclusion is available against collectors and custodians of private information, such as the defendants in this case, where the private information is improperly [accessed] by a third party, including in circumstances where the defendants are alleged to have acted recklessly?” It allowed Equifax’s appeal, striking the three issues concerning intrusion upon seclusion. The Court of Appeal dealt with this case together with Michael Obodo v. Trans Union of Canada, Inc., SCC File No. 40555, and Glenn Winder v. Marriott International, Inc., Luxury Hotels International of Canada, ULC, Starwood Canada ULC, SCC File No. 40573. It addressed the shared issues and the issues specific to Ms. Owsianik in these reasons. The Court of Appeal dismissed Ms. Owsianik’s appeal.