In this recently released decision, the Ontario Court of Appeal clarified that in circumstances where a company’s database is stolen by hackers, the tort of intrusion upon seclusion is not applicable or available. The tort of intrusion upon seclusion is available when a person with access or control over private information uses, or partakes in allowing others to use, that information for illegitimate purposes.
Although a hacker based loss of private data certainly satisfies some elements of the tort of intrusion upon seclusion, it is missing one key element: the active involvement of anyone in control of that data. As stated by the Court of Appeal:
“… the defendants did not do anything that could constitute an act of intrusion or invasion into the privacy of the plaintiffs. The intrusions alleged were committed by unknown third-party hackers, acting independently from, and to the detriment of, the interests of …(those in charge of the database).”
The court went on to observe that there needs to be a legal connection that binds the actions of the hackers to those in charge of the database: something such as evidence that the defendants acted in consort with, or were vicariously liable for, the hacker’s conduct.
This does not mean that those who lose private data at the hands of a hacker are free of potential liability: their liability, if any, can be based on other theories of liability that can potentially address their failure to take adequate steps to protect the plaintiffs from the intrusion upon their privacy at the hands of independently acting hackers: such as a breach of the company’s common law duty of care, or their contractual and statutory responsibilities to the plaintiffs to properly store the data.
This was a pleadings case, and nothing was decided on the facts. The Plaintiffs obviously wanted to be able to pursue the tort of intrusion upon seclusion against the defendants because this tort does not require a plaintiff to prove that an actual pecuniary loss was sustained. Based on this ruling, the Plaintiffs may have a slightly harder case to advance.
Owsianik v. Equifax Canada Co., 2022 ONCA 813
https://www.canlii.org/en/on/onca/doc/2022/2022onca813/2022onca813.html