Newfoundland and Labrador Privacy Class Action Goes Ahead

Written by Christina Catenacci, BA, LLB, LLM, PhD, Content Editor, First Reference Inc.

In February 2024, the Supreme Court of Newfoundland and Labrador certified a privacy class action. The representative plaintiffs, on behalf of 260 individuals (first 240 individuals, and second 20 individuals), alleged that their privacy was violated when an employee of the defendant employer (a health authority) accessed the private information of these individuals that was outside the scope of their employment. The employer became aware of the first and second alleged breaches in 2020 and 2021, respectively. The main claim against the employer was that there was a failure to safeguard the plaintiffs’ private and confidential information, and as a result, they suffered distress, humiliation, anger, upset, mental anguish, shock, fear of identify theft, uncertainty and confusion. Their claims sought damages including aggravated, punitive and exemplary damages. The employer delayed filing the defence until the result of this application for certification.

The plaintiffs argued that the privacy breaches were based upon the statutory tort of breach of privacy under the Privacy Act-breach of privacy based upon the common law tort of intrusion upon seclusion, negligence and breach of contract. They relied on the doctrine of vicarious liability (where the employer would be indirectly liable for the actions of its employees) to support their claims.

In order to determine whether to certify the class action, the court examined section 5 of the Class Actions Act. That is, the court decided whether the pleadings disclosed a cause of action, there was an identifiable class, the claims raised a common issue, the class action was the preferrable procedure to resolve the common issues and there was a person who could fairly and adequately represent the members of the class, had produced a plan of the action and did not have an interest that was in conflict with the interests of class members.

The court noted that the plaintiffs had to show these things but did not have to show that they would likely win. It was a lower bar than that, since any review of the merits of the case was properly left to the trial of the matter where evidence could be weighed then.

The court ultimately decided that the class action could be certified:

• Privacy Act alleged breach claim: The claim disclosed a cause of action against the employer since it was not plain and obvious that this cause of action would be unsuccessful at trial.
• Intrusion upon seclusion claim: The court referred to Jones v Tsige and stated that the tort required intentional intrusion upon the seclusion of another of his private affairs. Here, the court noted that there was a cause of action because it was not clear that it would fail, specifically in regard to the element of intention.
• Negligence claim: The plaintiffs had to show that the employer owed a duty of care to the plaintiffs to protect their private and sensitive information. The duty of care was breached by the employer, the plaintiffs suffered damage and the damage was caused by the employer’s breach. In this case, while the plaintiffs claimed several damages, it was up to the trial judge to decide what remedies were available. At this point, an assessment of damages was not possible, and so it was not plain and obvious that there was no chance of compensable harm to be proven.
• Breach of contract claim: The plaintiffs argued that there was an implied contract in place to not hire people who were not properly trained in patient privacy, to keep their private medical files safe, to keep their personal health information private as required by the Personal Health Information Act, to protect the privacy of their health information given the online statements made in the employer’s policy statements and brochure and to keep their information private as part of a good faith contract. The court noted that the claim was difficult, but not impossible. Thus, it was not plain and obvious that this action would be unsuccessful.
• Class Actions Act claims: The court also decided that there was an identifiable class to support the application for certification, there were indeed common issues that applied to the class, there was a preferrable procedure-judicial economy favoured certification, and the representative plaintiffs could fairly and adequately represent the interests of the class with a workable litigation plan, and no known conflicts with class members.

Therefore, the requirements were met-the plaintiffs’ application for certification could proceed.

What does this mean?

In a nutshell, the plaintiffs met the tests to go ahead with the class action. The judge noted that there would be no costs awarded at this stage. Simply put, depending on the timeline for court dates, this class action will go to trial in the near future. We will keep you posted once the main claims are considered on their merits.