Case information

Civil procedure — Class actions — Certification of issues — Tort —Contract — Commercial entity collected personal information from its customers for profit — Information accessed and downloaded by third party criminals — Whether it is plain and obvious that criminals’ actions cannot amount to compensable loss as against commercial entity — Whether viable claim in negligence or for nominal damages in breach of contract requires that customers whose information was taken show that the information was used to their detriment.

Case summaries are prepared by the Office of the Registrar of the Supreme Court of Canada (Law Branch). Please note that summaries are not provided to the Judges of the Court. They are placed on the Court file and website for information purposes only.

(SEALING ORDER) (CERTAIN INFORMATION NOT AVAILABLE TO THE PUBLIC)

In October 2016, Uber B.V. and the other respondents (“Uber”) experienced a data breach involving the theft of the personal information of millions of drivers and users. Uber received a ransom demand and paid the hackers in return for an assurance that the data would be destroyed, not disseminated. Uber disclosed the incident in November 2017 and indicated that it would take some steps to monitor affected persons. It reported the incident and has been subject to investigations and penalties worldwide, including in Canada. Ms. Setoguchi, an Uber user at the time of the breach, commenced a claim which she sought to have certified on behalf of those in Canada whose information was accessed from Uber by unauthorized persons on or around that date, other than those in Quebec, whose interests were subject to a separate action. Ms. Setoguchi alleged breach of contract and in negligence. She alleged that, under the user and privacy agreements, Uber had breached the obligation to protect the information owed to the class members by transferring their information to a third-party cloud-based service without their consent, concealing the breach from users and authorities, disclosing the information to the third party, and failing to employ adequate security measures to protect the information.

The certification judge held that a class proceeding was not the preferable procedure because it was not clear that class-wide harm could be shown and because proceeding as a class would not improve access to justice because the damages would be nominal, at best. The Court of Appeal dismissed Ms. Setoguchi’s appeal.