Privacy class action update: Appeal dismissed in the IIROC security breach action

After the Investment Industry Regulatory Organization of Canada (IIROC or in French OCRCVM) who monitors all trading activity across the country suffered a security breach in April 2013 (an employee lost a USB drive containing the personal information of individuals with accounts at various brokerage firms), a class action was filed against IIROC, claiming 1,000$ for each individual. In August 2014, the class action was not authorized. One of the reasons that this class action was not authorized was the lack of evidence of any real damages sustained by the class representative.

Plaintiff  appealed the decision and also attempted to introduce new evidence pertaining to identity theft. The appeal was dismissed by the Quebec Court of Appeal on November 6, 2015. This judgement is good news for organizations that, following a breach, act diligently to minimize any potential harm (promptly informing customers, etc.), especially in cases in which no real damages have been sustained.

For a summary of active Canadian privacy class actions, please click here.

This content has been updated on November 11, 2015 at 12 h 17 min.