Privacy Breach Class Actions in Québec: Key decisions and Recent Developments

Over the years, class actions related to cyber-security incidents have followed a similar formula. A corporate Defendant (such as Yahoo, Equifax, Nissan Canada, Target, Desjardins, Capital One etc.) suffers a cyber-security incident which may have compromised the personal information of its consumers. The corporation then communicates with its consumers to inform them that the breach occurred. From that moment, Plaintiff-side class action firms rush to file applications for authorization to institute a class action on behalf of those individuals whose personal information may have been compromised in the privacy breach. In Québec, only the first firm to file such an application enjoys carriage of the class action. To date, privacy breach class actions filed in Québec have met one of two outcomes: dismissal at the authorization stage or settlement post-authorization. At this time, not one privacy breach class action has been adjudicated on the merits in Québec. Accordingly, no reported… Lire la suite

Public Facebook Profiles Aren’t Public Information

By Vinay Desai    LawyerBorden Ladner Gervais S.E.N.C.R.L., S.R.L. In its most recent report of findings entitled“Company’s re-use of millions of Canadian Facebook user profiles violatedprivacy law”, the Office of the Privacy Commissioner (the “OPC”) dealt with the often murky issue of personal information thatis publicly available and confirmed its view that Facebook profiles that areset to public are not considered “publicly available” information under the Personal Information Protection and ElectronicDocuments Act (“PIPEDA”). Assuch, this finding reinforces the notion that the colloquial meaning of “publicinformation” does not correspond to the legal definition of “publiclyavailable” under Canadian privacy law and confirms the OPC’s jurisdictionagainst foreign entities collecting personal information from Canadians. Investigation The OPC investigated the practices of a NewZealand company – Profile Technology –which operated a website called The Profile Engine, which collectedprofile information originally set to “public” on Facebook while providingsearch function services for users. The operator of the website argued… Lire la suite