Canada: Fertile Ground For Civil Actions And Class Actions For Personal Information

Bulletin #8 | Special Series - Bill 64 & Act to modernize legislative provisions as regards the protection of personal information

Tabled before the National Assembly of Québec, Bill 64, An Act to modernize legislative provisions as regards the protection of personal information amends the rules of civil law by introducing a new cause of action against persons keeping personal information and by providing a new category of punitive damages applicable in case of infringement of a right protected under the Act respecting the protection of personal information in the private sector (the "Private Sector Privacy Act") and under articles 35 to 40 of the Civil Code of Québec.

Proposed Measures

By adding a single section to the Private Sector Privacy Act, Bill 64 has the potential to profoundly alter the liability regime applicable to a breach of certain rights protected by the Private Sector Privacy Act and the Civil Code of Québec. The proposed section is reproduced below:

New Cause of Action with No-Fault Liability

The first paragraph of the new section would establish a new cause of action with no-fault liability against persons keeping personal information in the event of an injury resulting from the unlawful infringement of a right conferred by the Act or by articles 35 to 40 of the Civil Code.

The text of the new section reverses the applicable burden of proof, and provides for automatic liability unless evidence of force majeure is adduced. It should be reiterated that one must establish that an event is unforeseeable and irresistible in order for a defence of force majeure to be successful, which is a particularly stringent criterion to meet. Therefore, in practice, in the event of the unlawful infringement of the confidentiality of information in their custody, persons keeping personal information will not be able to exonerate themselves by simply establishing the absence of fault on their part, even if the unlawful infringement is the act of a third party.

Introduction of a New Category of Punitive Damages

The second paragraph of this new section 93.1 provides the award, where the infringement is intentional or results from a gross fault, of punitive damages of at least $1,000. Thus, not only would the Private Sector Privacy Act be one of the few Québec laws to provide for punitive damages, but it would also be one of the exceptional cases where minimum damages are provided for.

Comments

The new section 93.1 of the Private Sector Privacy Act raises several important questions to be taken into consideration by businesses keeping personal information:

• How to prevent the risk of unlawful infringement in the context of no-fault liability?
• How can one reconcile the provisions of section 93.1 with articles 35 to 40 of the Civil Code, which provide for the protection of one's privacy and the possibility to have inaccurate information in a file corrected? Could the refusal to make a correction be construed as an unlawful and intentional infringement giving rise to automatic punitive damages of $1,000?
• What will be the impact of the proposed amendment on applications for authorization of class actions stemming from data breaches, as well as on the amount of damages claimed?

With an already low threshold at the authorization stage of class actions in Québec, the proposed amendment will undoubtedly lead to a sharp increase in applications resulting from data breaches and fuel the race to the courthouse among lawyers representing applicants to have their applications for authorization stamped first. It will be interesting to follow the impact of this legislative change on the arguments available to defendants to challenge a claim based on this new cause of action and the overall strategy to be pursued in the face of such a claim.

Originally published August 10, 2020.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.