The Court of Appeal confirmed the Superior Court’s landmark judgment dealing with the loss of personal information in Lamoureux c. OCRCVM.1 The class action filed by the plaintiff, Danny Lamoureux, is dismissed entirely in the first judgment rendered at the merits stage for a matter involving a loss of personal information in Canada.
Facts overview
On February 22, 2013, an inspector working for the Investment Industry Regulatory Organization of Canada (the IIROC) forgot his laptop computer on a train. The missing computer contained certain personal information relating to individuals collected from securities brokers who were under inspection. Despite IIROC’s best efforts, the computer was never found.
In the wake of that loss, a class action was first brought by Mr Sofio. His suit was dismissed at the authorization stage, there being no serious appearance of right, since the petitioner had failed to demonstrate a compensable injury.2 The Court of Appeal affirmed the judgment.3 Following this setback, Mr Lamoureux took his own class action, which was authorized in October 2017.
Contrary to Mr Sofio, Mr Lamoureux pleaded that he had indeed been victimized by the theft of his personal information.
Analysis
The judgment in Appeal confirms Justice Lucas’s decision which clarified the circumstances that can give rise to damage awards for personal information losses:
- Normal inconveniences of life in society are not compensable: Affirming the Court of Appeal in Sofio and relying on the holding of the Supreme Court in Mustapha,4 the judgment reaffirms that mere fears, annoyances, stress, steps to protect their identity and worries experienced by the class members concerned, relating to the loss of their personal information (the monitoring of their accounts, the measures taken by credit agencies, the shame they felt) were all (translation) “normal inconveniences that anyone living in society encounters and should be obliged to accept”.5
- Necessity to prove the causal link between the breach and the illicit use of the information: The Court of Appeal concluded that the Appellant had the burden of proof to demonstrate on a balance of probabilities that the illicit use of the personal information was the result of the breach.
- IIROC’s diligent behaviour barred punitive damages: IIROC’s fault was unintentional and it had taken the required measures, in timely fashion, in accordance with applicable standards in such circumstances, as the expert evidence abundantly proved.
Conclusion
The judgment confirms that fears, annoyances, stress, and worries experienced by the class members concerned, relating to the loss of their personal information, are normal inconveniences that should not be compensated.
This judgment underlines that evidence establishing a rapid and diligent response, in compliance with applicable standards in such circumstances, are important in the analysis of punitive damages.
1 Lamoureux c. OCRCVM, 2022 QCCA 685 (BLG translation; see also the original judgment in French), Lamoureux c. OCRCVM, 2021 QCCS 1093 (BLG translation; see also the original judgment in French).
2 Sofio c. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), 2014 QCCS 4061.
3 Sofio c. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), 2015 QCCA 1820.
4 Mustapha c. Culligan du Canada ltée, 2008 CSC 27, [2008] 2 R.C.S. 114.
5 Para. 7.
