Hacked Companies Can’t Be Tagged With “Intrusion Upon Seclusion”
Published:
January 26, 2023
Author(s):
In November 2022, the Ontario Court of Appeal definitively decided an organization whose information systems are breached by a malicious third party isn’t exposed to a civil claim for intrusion upon seclusion – even if the organization holding the information didn’t properly handle or store that information. Only the party that actually did the intruding can be the target of an intrusion upon seclusion claim. The trilogy of cases, Owsianik v. Equifax Canada Co., Winder v. Marriott International, Inc. and Obodo v. Trans Union of Canada, Inc. and, clears up a question that’s lingered since the Court’s landmark 2012 decision in Jones v. Tsige. And it carries serious implications for plaintiffs in data breach claims and class actions. While such organizations aren’t necessarily off the hook for liability and can still be liable based on other legal claims, like negligence and breach of contract, most other claims – unlike intrusion upon seclusion – require plaintiffs to prove a pecuniary loss. And that’s a typically difficult, often impossible, hurdle for plaintiffs to overcome.
Intrusion Upon Seclusion: The Lingering Question
When a data breach occurs, organizations face several sources of exposure, including the inevitable privacy breach civil lawsuits that now seem to follow every significant data breach. Privacy breach lawsuits generally, and data breach class action lawsuits specifically, are increasingly common in Canada. Canadian law around civil claims for privacy and data breaches has been developing incrementally. To date, Canadian courts recognize six key legal claims for breach of another’s privacy rights. One of them: intrusion upon seclusion. The Ontario Court of Appeal first recognized intrusion upon seclusion as a civil claim for invasion of privacy in its landmark 2012 decision in Jones v. Tsige.
Elements. To succeed, the Court concluded a plaintiff must prove the defendant:
- Intruded on their seclusion or private affairs, physically or otherwise.
- Did so intentionally or recklessly.
- Did so without lawful justification.
- That intrusion would be highly offensive to a reasonable person, causing distress, humiliation or anguish.
No Pecuniary Loss. Importantly, the plaintiff does not have to prove they suffered a financial loss to succeed in a claim of intrusion upon seclusion. This makes intrusion on seclusion an attractive claim for many plaintiffs, especially in large scale data breach class actions where despite the fact of a data breach, the plaintiffs often don’t suffer any actual loss – only the risk of a loss.
The Question. Since Jones v. Tsige, numerous privacy class actions have been launched, many alleging intrusion upon seclusion as at least one, typically among multiple, basis for liability. Yet a question has lingered: can intrusion upon seclusion be the basis of liability for an organization that while holding the plaintiff’s information, didn’t breach the plaintiff’s privacy itself, but was the victim of a third party’s malicious act? Plaintiffs have argued they can because (they allege) the breach is the result of the organization’s recklessness, usually with respect to the handling or safeguarding of personal information.
The Trilogy: The Answer
In November 2022, the Ontario Court of Appeal answered the lingering question with a definitive no. The Court heard the three cases together. In each of Owsianik v. Equifax Canada Co., Winder v. Marriott International, Inc. and Obodo v. Trans Union of Canada, Inc., the defendant organization held the plaintiffs’ personal information; in each, the organization’s systems were hacked; and in each, a group of plaintiffs sought to certify a proposed class action against the organization. Certification requires there be a legally viable claim. In turn, determining whether there was a legally valid claim against the organizations that held the information required the Court to answer the question lingering after Jones v. Tsige. While the Court issued three separate and consistent sets of reasons, the Court’s most extensive reasons were in the Owsianik decision:
State of Mind. The Court summarized the elements of the intrusion upon seclusion claim and explicitly categorized the conduct, state of mind, and consequences requirements:
- The Conduct Requirement. The defendant must have invaded or intruded upon the plaintiff’s private affairs or concerns, without lawful excuse.
- The State of Mind Requirement. The conduct that constitutes the intrusion or invasion must have been done intentionally or recklessly.
- The Consequence Requirement. A reasonable person would regard the invasion of privacy as highly offensive, causing distress, humiliation or anguish.
The Court rejected the plaintiffs’ argument that the “state of mind” requirement applied to the defendant organization, and was clear: the state of mind requirement applies to the “intruder”. If the named defendant’s conduct doesn’t amount to an invasion of privacy, then its recklessness with respect to the consequences of some other conduct – like the negligent storage of the information – can’t be the basis for liability for invading the plaintiffs’ privacy.
Other Claims. The Court confirmed the organization could, however, still be liable to the plaintiffs on some other basis, such as negligence, breach of contract, or breach of a statutory obligation – but not for intrusion upon seclusion.
Remedy. The Court similarly rejected the plaintiffs’ argument that if intrusion upon seclusion didn’t apply to the defendant organization, the plaintiffs would be left without a remedy in these circumstances. The Court distilled this argument to the issue that other available claims – breach of contract and negligence – require the plaintiffs prove a pecuniary loss, leaving plaintiffs who can’t prove pecuniary loss with no remedy. Acknowledging that the claim for “moral damages” rather than pecuniary damages could negatively affect the plaintiffs’ ability to certify the claim as a class action, this doesn’t mean there’s no remedy – just no procedural advantage. The plaintiffs are in the same position as any other party that makes a claim in negligence and contract and must prove pecuniary loss. However, the Court noted that if Parliament or the provincial legislatures wanted to extend the law to provide “moral” damages (damages for non-pecuniary loss) in cases like this, they can do so.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss mitigating your data breach liability exposure.
Related Lawyers
Related Services
Related Industries
McInnes Cooper has prepared this document for information only; it is not intended to be legal advice. You should consult McInnes Cooper about your unique circumstances before acting on this information. McInnes Cooper excludes all liability for anything contained in this document and any use you make of it.
© McInnes Cooper, 2023. All rights reserved. McInnes Cooper owns the copyright in this document. You may reproduce and distribute this document in its entirety as long as you do not alter the form or the content and you give McInnes Cooper credit for it. You must obtain McInnes Cooper’s consent for any other form of reproduction or distribution. Email us at [email protected] to request our consent.
