The applicants sought judicial review and appealed decisions of the Information and Privacy Commissioner of Ontario (IPC).
The IPC had found that ransomware attacks encrypting the applicants' data containers constituted an unauthorized 'use' and 'loss' of personal information, triggering statutory duties to notify affected individuals under PHIPA and the CYFSA.
The Divisional Court dismissed the applications and appeal, holding that the IPC's interpretation was reasonable and purposive.
The court found that the encryption of data, which made it temporarily unavailable, amounted to 'handling' or 'dealing with' the information, thereby constituting an unauthorized use that required notification regardless of whether the data was actually viewed or exfiltrated.