Security Incident: The Quebec Superior Court confirms that the mere fact of being a victim of an incident is insufficient to support a claim for damages

Security incidents involving consumers’ personal information are increasingly being reported in the media. Consumers are worried about fraud or identity theft and companies that have suffered such incidents are often the subject of class actions, with more than 80 class actions involving privacy breaches currently in progress across the country.

The Superior Court of Québec recently reiterated that, even at the stage of authorizing a class action, the plaintiff must prove prima facie that compensable prejudice has occurred in Bourbonnière c. Yahoo! Inc., 2019 QCCS 2624 (CanLII). This decision confirms the principle established by the Court of Appeal in 2015 in Sofio v. OCRCVM that it is not sufficient to only demonstrate the fault of a corporation that is the subject of a loss or theft of personal information in order to obtain compensation. The existence of tangible and financially compensable prejudice (financial fraud or identity theft for example) must be demonstrated in order for a class action to be authorized. Simple ordinary and temporary inconvenience, psychological distress or embarrassment do not constitute damages that can be compensated.

In contexts where most individuals affected by a security incident would not necessarily suffer any tangible prejudice (especially given that more organizations are offering credit monitoring services following the occurrence of such breaches), this decision provides an update on the types of class actions that might be rejected at the authorization stage.

This content has been updated on May 2, 2024 at 13 h 53 min.