Presentation to Canadian insurance defence counsel and insurance professionals and adjusters.

1. Presented By
CICMA cyber
security Update
Dan Michaluk
October 18, 2021

2. o Self-regulatory organization oversees all
investment dealers
o Laptop with unencrypted data left of subway in
2013 – never found
o Estimated 48,000 affected individuals
o Robust, transparent response by the
organization
o Plaintiff a victim of identity theft
o Claimed compensatory damages (actual
attempted fraud plus anxieties) and punitive
damages based on response
Lamoreaux
The first class action merits decision
2

3. o No compensable damages proven
• Normal anxiety associated with receiving a
notification is not compensable
• Testimony provided (translation) “few details,
concrete facts or significant manifestations of
their psychological states”
• No causation proven regarding identity theft –
some evidence that plaintiff’s social insurance
number and driver’s license were not even
ever received by defendant from his
brokerage
• Defendant provided necessary protective
measures
Lamoreaux
The first class action merits decision
3

4. o No punitive damages - response exemplary
• conducted investigations and carried out internal
checks
• promptly informed the police
• retained a firm of consultants as quickly as possible to
perform forensic investigation
• notified the privacy commissions concerned of the loss
• notified the brokerage firms having investors concerned
about the situation
• notified the class members concerned of the loss of
their personal information, by means of bilingual letters
• published a press release announcing the loss
• informed class members that it was unaware of any
identity theft
Lamoreaux
The first class action merits decision
4

5. o Ontario cases are about the scope of liability
for the common law privacy torts, which give
access to moral damages
o In negligence, no harm means no foul
o Privacy torts are intentional, so the wrong
arises from the act alone, and one who is
reckless has bad intent
o Defendant attacked in 2017 via exploit of
web application vulnerabilities
o Announced as affecting 100,000 Canadians,
20,000 ultimately notified
Owsianik
Big wins for defendants in Ontario
5

6. o Div. Ct. overturns intrusion upon seclusion
certification decision
o “The intrusion need not be intentional; it can
be reckless. But it still has to be an intrusion.
It is the intrusion that has to be intentional or
reckless and the intrusion that has to be
highly offensive. Otherwise the tort assigns
liability for a completely different category of
conduct, a category that is adequately
controlled by the tort of negligence.”
o Leave to appeal to Ont. CA granted last
month
Owsianik
Big wins for defendants in Ontario
6

7. o About the theft of credit card application data
by a former employee of a bank’s cloud
service provider – alleged to have used her
understanding to conduct exploits
o “A failure to prevent an intrusion, even a
reckless failure to prevent, is not an intrusion.”
o No vicarious liability either - “absurd and
unfair” to impose liability on a defendant for
the actions of a former employee
o Contractual claims failed based on the
contract terms
Thompson
Big wins for defendants in Ontario
7

8. o The Lamoreaux and Owsianik defences are critical
to the outcome the privacy class action “dialogue”
o The Lamoreaux case provides good practical
guidance for responders
o This cynic’s view - all the harm flows from
notification alone
o We therefore must notify based on the facts and
evidence – never, never notify because there’s a
speculative risk of unauthorized access or theft
o Yes, there is mischief, which is why we will see
logging regulation come into force in the next five
years – e.g. PHIPA
We are at an inflection point
Where does that leave us?
8

9. o If class actions prove themselves to be the
wrong means of enabling justice, will there
be alternatives
o Ontario has posed an administrative
compensation regime in its privacy reform
materials
o Questions
• Will it be exclusive?
• Will it be capped
New administrative compensation regime?
Keep an eye on Ontario
9

10. Questions?
Questions?

11. For more information, contact:
The information contained herein is of a general nature and is not intended to constitute legal advice, a complete statement of the law, or an opinion on
any subject. No one should act upon it or refrain from acting without a thorough examination of the law after the facts of a specific situation are considered.
You are urged to consult your legal adviser in cases of specific questions or concerns. BLG does not warrant or guarantee the accuracy, currency or
completeness of this presentation. No part of this presentation may be reproduced without prior written permission of Borden Ladner Gervais LLP.
© 2020 Borden Ladner Gervais LLP. Borden Ladner Gervais is an Ontario Limited Liability Partnership.
Thank You
Dan Michaluk
Partner
416.367.6097
dmichaluk@blg.com