Another privacy class action dismissed due to lack of compensable damages

Privacy class actions seem to be having a bit of a rough time as of late.

“The need to change a password at a higher frequency cannot give rise to a serious compensable loss claim.”

Following a trend that has become reasonably well established in Québec and is expanding across Canada, the province’s Superior Court has refused to certify a privacy class action on the basis that the representative plaintiff did not experience any compensable harm. In Bourbonnière c. Yahoo! Inc., Justice Tremblay considered a certification application brought by a putative class of individuals affected by a range of data breaches suffered by Yahoo! Inc. and Yahoo! Canada Corp. Yahoo! had announced a number of incidents, including one that saw information about 500 million users stolen in 2014, another in 2013 which also involved information theft and unauthorized access to account data using a forged digital cookie file.

The representative plaintiff testified that she had no reason to believe that she had been a victim of identity theft or fraud as a result, and had not identified any suspicious financial transactions. In addition, she continues to use her Yahoo! mail account and has not signed up for any identity theft protection or credit monitoring products.

The Court summarized her harm at paragraphs 36 and 37:

[36] In summary, Plaintiff has not incurred any out-of-pocket costs associated with the protection of her personal and/or financial information.

[37] The only prejudice suffered by the Plaintiff relates to the inconvenience of having to change her passwords in all of the accounts associated with her Yahoo email address and the alleged embarrassment suffered as a result of spam emails that were sent to her friends. The Court is of the view that such prejudice is insufficient to justify a class action.

This conclusion was based on a growing line of authorities in Québec. The Court referred to Mustapha v. Culligan of Canada Ltd of the Supreme Court of Canada, standing for the proposition that “compensable injury must be ‘serious and prolonged’ and rise above the ordinary annoyances, anxieties and fears that a person living in society may experience”.

[42] Similarly, in Mazzonna, a case involving the loss of data tape, the Superior Court concludes that the anxiety felt by the plaintiff upon and after learning that her personal information had been lost and the modification of habits in the manner in which she managed her bank account, is not enough to meet the threshold, even on a prima facie basis, of the existence of compensable damages.

[43] The present case can be distinguished from other data security incident cases such as Zuckerman and Belley since, unlike these two other cases, Plaintiff has not incurred any expenses for credit monitoring services nor was she a victim of identity theft.

[44] The transient embarrassement [sic] and inconveniences invoked by the Plaintiff are of the nature of ordinary annoyance and do not constitute compensable damages recoverable under the applicable law. Indeed, the need to change a password at a higher frequency cannot give rise to a serious compensable loss claim.

The Court also had issues with the composition of the class, particularly a subclass referred to as the “Collateral Victims”, being “all other persons, businesses, entities, corporations, financial institutions or banks who suffered damages or incurred expenses as a result of the data security incidents”. As the plaintiffs had not identified any single “Collateral Victim”, the court concluded that this particular subclass was “artificial” and questioned its existence.

The application for certification was dismissed. It is notable that a parallel Ontario proceeding is ongoing.

A previous version of this was written for the Canadian Technology Law Association newsletter.

Quebec court sends Facebook class-action packing to California

The Quebec Superior Court has just declined jurisdiction over a proposed class-action lawsuit against Facebook over its privacy policies and practices by upholding the choice of law and forum selection clause in the Facebook Terms of Use. Check out: St-Arnaud c. Facebook Inc., 2011 QCCS 1506 (CanLII)

Quebec movie theatre ordered to pay $10K in damages for bag search

According to CTV News, a Quebec movie theatre is liable for $10,000 in damages when it searched a family's bags (ostensibly for video recording equipment) and exposed the eldest daugther's birth control pills to her unknowing parents. See: CTV.ca Cinema ordered to pay $10K in damages for search.

(Before extending this decision to the rest of Canada, remember that the private right of damages for privacy invasion is different in Quebec.)

Montreal Second Cup owner forced to take down bathroom surveillance camera

I got a number of calls today from media outlets today about a controversy that has erupted in Montreal. It appears a Second Cup franchisee recently installed a fake surveillance camera in bathroom stalls in an effort to dissuade drug users from using the bathrooms to shoot up.

My thoughts are summed up in the following quote from the Canadian press:

The Canadian Press: Montreal Second Cup owner forced to take down bathroom surveillance camera

... Still, privacy advocates are uncomfortable with the creeping presence of cameras in more intimate places such as bathrooms. Whether the camera works or not, the effect, they say, is the same.

"One of the weird things about this area of law is the fact that it is designed in many ways to protect people's feelings," said David Fraser, a privacy lawyer based in Halifax. ."It's about people not wanting to feel they're under surveillance."

For Fraser, the underlying issue is the sense of violation that comes with feeling one's private space is being subjected to anonymous, prying eyes.

"There isn't any real material difference between a fake camera and a real camera," he said. "Whether they're real or fake, you still have the feeling of being watched." ...

Montreal mall fake toilet-cam raising concerns

I was interviewed about this on a Montreal radio station on Friday. It's an interesting issue, because information is not being collected:

Toilet cam working even when it doesn't

Toilet cam working even when it doesn't

Mall customer outraged but landlord says dummy is effective

MICHELLE LALONDE, The Gazette

Published: Friday, August 03

Yes, that's a real surveillance camera on the ceiling of the men's washroom off the food court of Les Cours Mont Royal - but don't worry, it's not operating.

That reassurance was not good enough for at least one Montreal businessman who was outraged to see a video camera in a public bathroom at the downtown Montreal mall.

The camera is inside a protective dome and appears to be pointed toward the washroom's common area, where the urinals are. As of yesterday, there were no signs explaining what the camera is for or whether it is on.

When the man asked a maintenance person about the camera, he was told it wasn't actually functioning but was there to discourage certain activities.

"If the video surveillance is not functional, what assurances do we have that it will not be in the future?"the man wrote in a complaint to mall owners Soltron Realty Inc., which he forwarded to The Gazette on the condition his name not be published.

"If it is functional," the letter continued, "who is watching, is the information secure and will we find our pictures on the Internet? ... I find the use of surveillance camera (real or fake) inside a washroom to be absolutely unethical, immoral and most likely illegal." Unless the camera is removed within 10 days, the man said, he will lodge a complaint with Quebec's privacy commission.

A spokesperson for Soltron said the camera was installed in the washroom several years ago to discourage "sexual misconduct and drug use." Carmela Amorosa, marketing director for Soltron, said the company realized it was illegal to place an operating camera in a public bathroom, but felt some action was necessary.

"It is working," Amorosa said. "Now we don't have these problems. We are doing this to protect our customers from this sort of behaviour in the bathroom." But the case raises questions about the right to privacy and video surveillance, said sources in Quebec's Justice Department, as well as federal and provincial agencies that safeguard privacy.

"People are right to be concerned about being monitored," said Colin McKay, of the federal Office of the Privacy Commissioner.

"The case is interesting because they are not technically collecting information, they are just giving that impression. But perception for a lot of people is a legitimate concern. If they are doing it as a deterrent, they should make that clear." Luc Fortin, an aide to Benot Pelletier, the cabinet minister responsible for Quebec's privacy commission, said it is unclear whether a complaint about camera surveillance in a public washroom would be heard by the Privacy Commission or the Human Rights Commission.

"If it is a question of voyeurism, that would clearly be a case for the Human Rights Commission, but if the camera is being used to gather information and set up a file about a specific person, it would be something we would deal with," Fortin said.

"It's not technically illegal" to install video cameras in public bathrooms, "but companies that do it certainly risk complaints," said Robert Sylvestre of the Quebec Human Rights Commission.

Several court cases have resulted in jurisprudence and a set of principles about video surveillance in public places, he said.

"One of those principles is that the operator of the camera should be able to show that other methods have been tried and failed before they resorted to this."