Court File and Parties

COURT OF APPEAL FOR ONTARIO

DATE: 20210315 DOCKET: C68449 and C68460

Hoy, Brown and Thorburn JJ.A.

BETWEEN

Family and Children’s Services of Lanark, Leeds and Grenville Applicant (Respondent)

and

Co-operators General Insurance Company Respondent (Appellant)

AND BETWEEN:

Laridae Communications Inc. Applicant (Respondent)

and

Co-operators General Insurance Company Respondent (Appellant)

AND BETWEEN:

Co-operators General Insurance Company Applicant (Appellant)

and

Laridae Communications Inc. Respondent (Respondent)

Counsel: Danielle Marks, Kenneth Gerry and Robert Dowhan for the appellant, Co-operators General Insurance Company Timothy Hill and Brian Chung for the respondent, Laridae Communications Inc. David Boghosian for the respondent, Family and Children’s Service of Lanark, Leeds and Grenville

Heard: November 13, 2020 by video conference

On appeal from the judgment of Justice Andra Pollak of the Superior Court of Justice, dated May 8, 2020, with reasons reported at 2020 ONSC 2198.

Thorburn J.A.:

Overview

[1] In April 2016, someone hacked into a password-protected portal managed by the respondent Family and Children’s Services of Lanark, Leeds and Grenville (“FCS”). The hacker took a confidential report containing details about the case files and investigations of 285 people. A hyperlink to the report was posted on two Facebook pages.

[2] Both FCS and Laridae Communications Inc. (“Laridae”) were insured by Co‑operators General Insurance Company (“Co-operators”).

[3] FCS and Laridae claim Co-operators has a duty to defend against two claims: (i) a $75 million class action brought against FCS in which the representative plaintiff alleges that the leaked document contained defamatory material, and that FCS was negligent in securing its website; and, (ii) a third-party claim in that proceeding brought by FCS against Laridae for negligence and breach of contract.

[4] Co-operators denies having any duty to defend FCS or Laridae, relying on policy exclusion clauses in the policies that exclude claims arising from the distribution or display of data by means of an internet website.

[5] FCS, Laridae, and Co-operators brought applications to interpret the policies under Rule 14.05(3)(d) of the Ontario Rules of Civil Procedure, R.R.O. 1990, Reg. 194.

[6] In her endorsement, dated May 8, 2020, the application judge found that the Co-operators had a duty to defend both claims. She held that:

a) the applicability of the data exclusion clauses was a “novel interpretation issue” and accordingly the duty to defend should only be denied on a full record, not on an application;

b) the data exclusion clause does not exclude Co-operators’ duty to defend the class action;

c) the data exclusion clause does not exclude Co-operators’ duty to defend the third-party claim against Laridae; and,

d) neither FCS nor Laridae has any reporting obligations to Co-operators, in light of the conflict of interest between the two insured and the insurer.

[7] In these companion appeals, Co-operators claims these conclusions were wrong. Co-operators argues that the duty-to-defend issue can properly be determined on the application, and that the data exclusion clauses preclude coverage of both the class action against FCS and the third-party claim brought by FCS against Laridae. It also argues that, even if there was duty to defend, Co‑operators would have the right to participate in the insured parties’ defences.

[8] For the reasons discussed below, I would allow the appeal. The existence of a duty to defend in this case can be resolved by application. Co-operators has no duty to defend FCS in the class action proceeding, and no duty to defend Laridae in the third-party claim. Even if such a duty did exist, it would not deprive Co-operators of its right to participate in the defence, including receiving reports from counsel.

[9] Below, I set out (i) the terms of the contract between FCS and Laridae; (ii) the claims made in the class action against FCS, and by FCS against Laridae in the third-party claim; and (iii) Co-operators’ refusal to defend the claims. I then outline the relevant policy provisions, and summarize the application judge’s decision. Finally, I analyze and provide my conclusions regarding: (i) whether the duty to defend can be denied on the basis of the material before the application judge; (ii) whether Co-operators has a duty to defend; and (iii) whether, if Co‑operators had a duty to defend, it would have the right to participate in the defence.

Background

[10] FCS was a children’s aid society, authorized under the Child and Family Services Act, R.S.O. 1990, c. C.11 at the relevant times. [1] FCS serves several communities in Eastern Ontario. As an authorized children’s aid society, one of FCS’s functions is to investigate allegations of child abuse.

(1) The Contract between FCS and Laridae

[11] In August 2015, FCS issued a request for proposals for communication services, in which it asked prospective bidders to, among other things, “review and refresh [the FCS website] to ensure it remains functional to meet our communication needs now and going forward as well as to ensure we maintain compliance with applicable legislative requirements.”

[12] On October 22, 2015, FCS retained Laridae.

[13] Under the October 2015 contract (“the Contract”) Laridae agreed to provide a range of communications and marketing services. Laridae agreed, among other things, to:

a) Identify and implement recommendations to enhance the existing communication platforms/infrastructure of FCS;

b) Create and implement communication protocols for delivery of internal and external communications including blogs, tweets, videos etc.;

c) “Review and refresh the [FCS] website to meet functionality and communication requirements, now and in the future, while maintaining compliance with applicable legislative requirements”; and

d) Provide training for FCS staff to enhance internal and external communications capacity.

[14] The Contract required Laridae to obtain commercial general liability insurance coverage that would name FCS as an additional insured under its policy. Laridae obtained a policy for the period November 1, 2015 to November 1, 2016.

[15] On May 25, 2016, Laridae and FCS entered into a subsequent scope of work agreement to provide enhanced strategic communications services including ongoing support with internal and external strategic communications; public relations; government relations; crisis communications; media management and training; liaison with legal counsel, insurance, associations and other organizations; branding; policy development; and board governance.

(2) The Claims at Issue

(a) The class action proceeding against FCS and others

[16] On July 22, 2016, a proceeding was commenced under Class Proceedings Act, 1992, S. O. 1992, c. 6. against FCS, its executive director, and a number of other defendants, seeking general, specific, and punitive damages of $75 million.

[17] In late 2015, FCS prepared a confidential statistical report (“the Report”) for its board of directors. The report was stored electronically in a portal – a page in FCS’s website providing access or links to another site through a cloud website, for members of FCS’s board of directors. The portal was supposed to be secure. The Report was part of a confidential statistical report prepared for FCS board of directors and contained personal information of 285 clients or subjects of FCS investigations. Specifically, the Report documented new FCS cases arising between April and November 2015.

[18] M.M. claims that on or about April 18, 2016, a client of FCS discovered the Report posted on two public Facebook pages. M.M. alleged that one or more individuals illegally hacked the portal on FCS’s website, which was insecure; stole the Report; and published the hyperlink to the Report, thereby disclosing personal and highly sensitive information of class members – some of which was untrue.

[19] Paragraphs 15 through 19 of the amended statement of claim read as follows:

15. The personal information of 285 clients and subjects of [FCS] investigations was contained in an electronic file forming part of a confidential statistical report (“report”) prepared for [FCS]'s board of directors on new cases arising between April and November of 2015. The report was held electronically in a portal for board members.

16. Information contained in the report concerning some class members was untrue.

17. On or about April 18, 2016 a client of [FCS] discovered that the report was posted on Smith's Falls Swapshop Facebook page and the Facebook page of Families United.

18. The plaintiff pleads that Jane Doe and/or Kelley Denham illegally hacked the portal, which portal [sic] was not secure, and made the report public by posting it on Smith's Falls Swapshop Facebook page and/or other public websites, thereby disclosing personal and highly sensitive information of the plaintiff and class members.

19. As a result, the personal information of the class members has now been made readily available to any unauthorized third party who accessed the information, bought the information, or found the information posted on the internet, resulting in damages as set out below. [Emphasis added.]

[20] On December 21, 2017, common issues were certified in relation to three of the ten causes of action set out in the amended statement of claim: negligence; intrusion upon seclusion; and breach of s. 7 of the Canadian Charter of Rights and Freedoms., arising from a third party’s unauthorized access to the portal and subsequent publication of the Report.

(b) FCS’s third-party claim against Laridae

[21] On May 28, 2018, FCS commenced a third-party claim against Laridae, seeking general and special damages, and contribution and indemnity for liability arising from the class action. FCS alleges that Laridae was negligent in providing advice and professional services and breached its contractual obligations to FCS.

[22] FCS claims its website was designed to be secure and password protected, so that FCS could upload documents intended for authorized users.

[23] FCS alleges that on or about February 11, 2016, it learned that an unauthorized internet user obtained a number of non-public documents from the secure section of the FCS website. The unauthorized user posted screenshots of the confidential personal documents to a video on YouTube.

[24] FCS alleges that Laridae advised FCS that it had “enhanced the security features of the [w]ebsite” and that it had “added two additional security features to the [w]ebsite, which were sufficient to prevent Internet users from obtaining unauthorized access to documents” in the secure section. Notwithstanding the repairs, in April 2016, a second incident took place whereby a hyperlink to the Report was posted on Facebook accounts.

[25] FCS advanced both a breach of contract claim and a negligence claim. Particulars of the negligence claim advanced by FCS against Laridae, reproduced from para. 17 of the statement of claim, are as follows:

(a) Laridae negligently represented that the Website was secure following the February Incident, when it was not;

(b) Laridae failed to take the necessary steps to identify or repair the potential vulnerabilities prior to, or following, the February Incident;

(c) Laridae failed to take reasonable or adequate care in all the circumstances in advising FCS on its response to the February Incident;

(d) Laridae failed to warn [FCS] of any vulnerabilities in relation to the website or the Secure Section at any time prior to or until the February Incident; and

(e) such further particulars as are in the knowledge of Laridae.

[26] The breach of contract claims are, in essence, that Laridae failed to take the necessary steps to ensure that unauthorized internet users could not access non-public documents on the FCS website. FCS further alleges that Laridae advised that the website was secure, following the February 2016 breach, when it was not.

(3) Co-operators’ Refusal to Defend and the Relief Sought by FCS and Laridae

[27] Laridae was insured under the terms of two policies of insurance issued by Co-operators: a commercial general liability policy (“the CGL Policy”) and the Professional Liability Policy. As required by the Contract, Laridae added FCS as an additional insured under the terms of the CGL Policy.

[28] Several months after receiving the amended statement of claim, FCS requested that Co-operators defend and indemnify it with respect to the class action. In February 2018, Co-operators denied the FCS request, citing an exclusion in CGL Policy for “data,” and any personal injury arising from the distribution or display of data.

[29] Laridae also requested that Co-operators defend and indemnify it with respect to FCS’s third-party claim. In June 2018, Co-operators denied the Laridae request, citing the “Data Exclusion” in the Professional Liability Policy which provided that “[t]here shall be no coverage under this policy in connection with any claim … arising directly or indirectly from the distribution or display of data by means of an Internet Website … designed or intended for electronic communication of ‘data’”.

[30] Both FCS and Laridae brought applications to the Superior Court. Laridae sought a declaration that Co-operators had a duty to defend it from FCS’s third-party claim under both policies. FCS sought a declaration that Co-operators was obliged to defend it in the class action under the CGL Policy and that FCS may retain and instruct counsel of its choice to be paid by Co-operators and who would not have to report to Co-operators; and an order requiring Co-operators to reimburse FCS for the costs of defending the proceedings to date. Co-operators also brought an application, seeking a declaration that it did not have a duty to defend or indemnify Laridae or FCS under the CGL Policy, or Laridae under the Professional Liability Policy.

The Insurance Policies

(a) The Commercial General Liability Policy

[31] The CGL Policy provides coverage for bodily injury and property damage liability. The relevant provisions of the CGL Policy are set out below. Significant clauses are underlined.

[32] The CGL Policy provided for a range of coverage, including personal injury liability under Coverage B:

1. Insuring Agreement

a. We will pay those sums that the insured becomes legally obligated to pay as compensatory damages because of “personal injury” to which this insurance applies. No other obligation or liability to pay sums or perform acts or services is covered unless explicitly provided for under SUPPLEMENTARY PAYMENTS – COVERAGES A, B AND D. We will have the right and duty to defend any “action” seeking those compensatory damages but:

2. We may investigate and settle any claim or “action” at our discretion.

b. This insurance applies to “personal injury” only if caused by an offence:

1. Committed in the “coverage territory” during the policy period; and,

2. Arising out of the conduct of your business, excluding advertising, publishing, broadcasting or telecasting done by or for you….

[33] Personal injury is defined in the CGL Policy as:

[I]njury other than “bodily injury”, arising out of one or more of the following offences:

d. Oral or written publication of material that libels or slanders a person or organization or disparages a person’s or organization’s goods, products or services; or

e. Oral or written publication of material that violates a person’s right of privacy.

[34] The “Common Exclusions” provision in the policy, applicable to the personal injury provisions in Coverage B, provides that:

This insurance does not apply to: …

4. Data

a. Liability for:

1. erasure, disruption, corruption, misappropriations, misinterpretation of “data”;

2. erroneously creating, amending, entering, deleting or using “data”; Including any loss of use there from;

b. “Personal injury” arising out of the distribution, or display of “data” by means of an Internet Website, the Internet, an intranet, extranet, or similar device or system designed or intended for electronic communication of “data”.

[35] “Data” is defined in the CGL Policy as “representations of information or concepts in any form.”

(b) The Professional Liability Policy

[36] The Professional Liability Policy provides that:

1. BASIC COVERAGE

The “Insurer” will pay on behalf of the “Insured” all sums which the “Insured” shall become legally obligated to pay as compensatory damages resulting from “Claims” first made against the “Insured” during the “Policy Period” by reason of liability for an error, omission, or negligent act in the course of “Professional Services.”

3. DEFENCE AND SETTLEMENT

With respect to each Insurance as is afforded by this policy the Insurer shall have the right and duty to defend any suit or arbitration proceeding against the “Insured” seeking compensatory damages payable under the terms of this policy, even if any of the allegations of the suit are groundless, false or fraudulent and investigate and negotiate the settlement of any “claim” or suit as it deems expedient.…

[37] The Professional Liability Policy included a data exclusion. The exclusion reads:

DATA EXCLUSION

There shall be no coverage under this policy in connection with any claim based on, attributable to or arising directly or indirectly from the distribution, or display of “data” by means of an Internet Website, the Internet, an Intranet, Extranet, or similar device or system designed or intended for electronic communication of “data”.

For the purposes of this endorsement, “data” means representations of information or concepts, in any form.

[38] This wording is the same as the exclusion in the CGL Policy except that it adds the words “directly or indirectly” after the word “arising”. The definition of ‘data’ is the same, except that it adds a comma before “in any form”.

The Application Judge’s Decision

[39] On the application, Co-operators argued it had no duty to defend, because coverage was excluded by the data exclusion clauses. FCS and Laridae argued that the data exclusion clause did not exclude all the claims against them. In the alternative, FCS and Laridae argued that exclusion clauses which have the effect of nullifying the insurance the insurer undertook to provide, will not be enforced. They argued that this was an important issue that should not be determined on a “duty to defend” application.

[40] The application judge concluded, at para. 28, that the claims in respect of which FCS and Laridae sought coverage “are broad and comprehensive and not limited to the distribution of the Report on the internet. The Claims do include damages for non-electronic distribution (i.e. physical distribution) of the Report or other private information.” In coming to that conclusion, she relied on para. 19 of the amended statement of claim in the class action, which asserts that “the personal information of the class members can be accessed by any unauthorized third party who accessed the information, bought the information, or found the information posted on the internet…”.

[41] However, although all three parties brought applications regarding the interpretation of the insurance policies, the application judge held that whether Co‑operators should be able to rely on the data exclusion clauses to deny a duty to defend was an important issue that should not be determined on an application. At para. 36, she held that:

[U]ntil the courts have had an opportunity to adjudicate the complex issues raised by these broadly worded data exclusion clauses, it would be improper for this court, having regard to present jurisprudence to uphold Co-operators’ denial of a duty to defend.

[42] After making this remark, she went on to find there was a possibility of coverage:

Further, I can not find on these Applications that Co-operators has not discharged its onus of establishing that the substance of the Claims clearly fall within the Data Exclusion Clauses and that there is no possibility of coverage under the Policies. Rather, in addition to the issue of the interpretation of the Data Exclusion Clauses, it is apparent that there are claims and allegations in the Class Proceeding and the Third-Party Claim that would not [be] excluded by the Data Exclusion Clauses. As there is at least some possibility that the Claims are covered under the Policies, I find that Co-operators owes a duty to defend Laridae and FCS.

[43] Finally, the application judge held that if there is a conflict of interest due to competing interests as between FCS and Laridae, Co-operators must fund each defence with independent counsel, neither of whom reports to Co-operators. The judgment provides that FCS and Laridae “are each entitled to appoint and instruct counsel, such instruction shall not include resolution or settlement of any part or portion of the litigation without the consent of Co-operators, and is without prejudice to the rights of Co-operators to bring a motion to vary the Order if the conflict of interest is resolved.”

Analysis

(1) The First Issue: Whether the duty to defend could be addressed by way of application

[44] The application judge erred in concluding that it would be improper to deny the duty to defend on the materials before her.

[45] FCS, Laridae, and Co-operators all elected to proceed by way of application. Both FCS and Laridae argued that declarations in their favour could be made on their applications, but that a declaration against their interests could not.

[46] The application judge remarked, at para. 32, that the “novel interpretive issue” of data exclusion clauses had “not yet been judicially considered” and should be considered on a full record and not by way of application. As noted above, at para. 36, she agreed with FCS and Laridae that it would be “improper” to uphold Co-operators’ denial of the duty to defend “until the courts have had the opportunity to adjudicate the complex issues raised by these broadly worded data exclusion clauses”. She therefore held that Co-operators had a duty to defend as it had not discharged its onus of establishing that the substance of the claims clearly falls within the data exclusion clause.

[47] There was no basis for the application judge’s acceptance of this seemingly asymmetrical treatment of FCS and Laridae, on the one hand, and Co-operators, on the other.

[48] Rule 14.05(3)(d) of the Rules of Civil Procedure, R.R.O. 1990, Reg. 194 provides that a proceeding may be brought by application where the relief claimed is the determination of rights that depend on the interpretation of a contract. An application will however be converted to an action where there are material facts in dispute, complex issues requiring expert evidence or the weighing of evidence, or other need for discoveries or further pleadings: see Fort William Band v. Canada (Attorney General), 76 O.R. (3d) 228 (S.C.), at paras. 5 and 28-31.

[49] This application involved the interpretation of the policy provisions and the application of those provisions to the claims as pleaded to see if there is a possibility that some of the claims may be covered by the policy.

[50] The agreements, describing the services that Laridae was to provide FCS, were in the record before the application judge, as were the CGL Policy and the Professional Liability Policy. There were no material facts requiring a trial.

[51] As discussed below, the policy provisions are clear and unambiguous and the application judge is presumed to know the law – even if the law is, in her view, unclear or unsettled. She could and should have, addressed both (i) the scope and effect of the data exclusion clauses in the policy, and (ii) FCS and Laridae’s argument that giving effect to the exclusion clauses would nullify coverage under the policies.

[52] She erred in failing to do so and I will therefore conduct the analysis.

(2) The Second Issue: Whether Co-operators owed a duty to defend to FCS and Laridae

[53] I begin my analysis of the duty to defend with a discussion of the applicable principles.

(a) The principles applicable on a duty-to-defend application

The role of the insurance policy and its interpretation

[54] The relationship between an insured and an insurer is a contractual one governed primarily by the terms of the insurance policy.

[55] The language of the policy is construed in accordance with the usual rules of construction, rather than inferred expectations unapparent on a fair reading of the document. This is particularly so in the case of commercial insurance policies involving sophisticated parties. The insurer must explicitly state the basis on which coverage may be limited: Hanis v. Teaven, 2008 ONCA 678, 92 O.R. (3d) 594, leave to appeal refused, [2008] S.C.C.A. No. 504, at para. 2.

[56] Where the language of the insurance policy is ambiguous, the courts rely on general rules of contract construction and should prefer interpretations of the policy that are consistent with the reasonable expectations of the parties. Courts should avoid interpretations that would give rise to an unrealistic result or one that would not have been in the contemplation of the parties at the time the policy was concluded. However, these rules of construction do not operate to create ambiguity where there is none: Progressive Homes Ltd. v. Lombard General Insurance Co. of Canada, 2010 SCC 33, [2010] 2 S.C.R. 245, at para. 23.

[57] In interpreting a policy to determine possible coverage, the process is as follows:

a) When the policy language is unambiguous, the court should give effect to that language, reading the policy as a whole;

b) Where the language of the policy is ambiguous, general rules of contract construction apply and the court should prefer interpretations of the policy that are consistent with the reasonable expectations of the parties. Courts should avoid interpretations that would give rise to a result that is unrealistic; and,

c) Only when the rules of contract construction fail to resolve the ambiguity, courts will construe the policy against the insurer who drafted the policy. This means that coverage provisions are interpreted broadly, and exclusion clauses narrowly: Progressive Homes Ltd., at paras. 22-24; Simpson Wigle Law LLP v. Lawyers’ Professional Indemnity Co., 2014 ONCA 492, 120 O.R. (3d) 655, at para. 54.

The insurer’s duty to defend against claims

[58] Whether there is a duty to defend is determined by the allegations pleaded in the underlying lawsuit read together with the terms of coverage provided in the insurance policy. The duty to defend is broader than the duty to indemnify. An insurer has a duty to defend where, on the facts as pleaded, there is a possibility that a claim within the policy may succeed: Nichols v. American Home Assurance Co., [1990] 1 S.C.R. 801, at p. 810. The court must try to ascertain the substance and true nature of claims pleaded: Tedford v. TD Insurance Meloche Monnex, 2012 ONCA 429, 112 OR (3d) 144, at para. 14; Monenco Ltd. v. Commonwealth Insurance Co., 2001 SCC 49, [2001] 2 S.C.R. 699, at paras. 34-35.

[59] If the pleadings allege facts which, if true, would require the insurer to indemnify the insured for a claim, the insurer is generally obliged to provide a defence, even though the actual facts may differ from the allegations in the statement of claim: Monenco, at para. 28; Alie v. Bertrand & Frère Construction Co. (2002), 222 D.L.R. (4th) 687 (Ont. C.A.), at para. 182.

[60] The insurer’s defence obligation is not governed by facts outside of the pleaded allegations. Courts have been cautioned against referring to extrinsic evidence that is not explicitly cited by the parties in their pleadings, for fear of making findings binding on the parties that might be contrary to the evidence tendered on the full record at trial: Monenco, at paras. 36-37.

[61] Where a loss arises from several causes, some of which fall within coverage and some of which are not covered, there is a duty to defend absent clear exclusory language denying coverage for multiple independent concurrent causes or ‘mixed claims’: Derksen v. 539938 Ontario Ltd., 2001 SCC 72, [2001] 3 SCR 398, at para. 48. This is because, as noted by Doherty J.A. in Hanis, at para. 23:

I see no unfairness to the insurer in holding it responsible for all reasonable costs related to the defence of covered claims if that is what is provided for by the language of the policy. If the insurer has contracted to cover all defence costs relating to a claim, those costs do not increase because they also assist the insured in the defence of an uncovered claim. The insurer's exposure for liability for defence costs is not increased. Similarly, the insured receives nothing more than what it bargained for – payment of all defence costs related to a covered claim.

[62] In the event of mixed claims, the insurer has a duty to defend against the entire claim, subject to an entitlement to recover all or an appropriate portion of their costs of the defence from the insured following the ultimate disposition of the underlying actions: St. Paul Fire & Marine Insurance Co. v. Durabla Canada Ltd. (1996), 137 D.L.R. (4th) 126 (Ont. C.A.).

(b) Analysis of the application judge’s decision respecting the duty to defend

[63] Applying these principles to the claims and the CGL Policy and Professional Liability Policy, for the reasons that follow, I find that Co-operators owes no duty to defend either FCS or Laridae.

Is the data exclusion clause ambiguous?

[64] The first step in the coverage analysis is to review the policy to determine whether it is ambiguous.

[65] The application judge did not engage in an analysis of the policy provisions nor did she state whether the policy provision or the exclusion clause was ambiguous. She cited Tedford for the proposition that “the usual principles governing the construction of insurance contracts apply” to the interpretation of insurance polices, including the contra proferentem rule: see Tedford, at para. 14. However, the contra proferentem rule applies to resolve ambiguities: see Non-Marine Underwriters, Lloyd's London v. Scalera, 2000 SCC 24, [2000] 1 S.C.R. 551, at para. 71. It does not apply where, as in this case, the insurance policy is clear and unambiguous on its face.

[66] Laridae is insured under the Professional Liability Policy, which provides coverage for “all sums the Insured shall become legally obligated to pay as compensatory damages resulting from ‘Claims’” by reason of “liability for any error, omission, or negligent act in the course of ‘Professional services’.”

[67] Both Laridae and FCS are insured under the CGL Policy, which provides coverage for compensatory damages for “personal injury [other than bodily injury] … caused by an offence” that “arises out of the conduct of [the insured’s] business”.

[68] However, both the Professional Liability Policy and the CGL Policy contain exclusion clauses. The CGL Policy clearly excludes claims “arising out of the distribution or display of ‘data’ by means of an Internet Website, the Internet, an intranet, extranet, or similar device or system designed or intended for electronic communication of ‘data’”. The Professional Liability Policy is even clearer, as it excludes any claims that arise “directly or indirectly” from the distribution or display of data. Both policies define ‘data’ as representations of information or concepts in any form.

[69] Because these policy provisions are clear and unambiguous, the court need not consider the reasonable expectations of the parties in interpreting the exclusion provision in the policy, nor does the court need to make recourse to extraneous sources: Allstate Insurance Co. of Canada v. Aftab, 2015 ONCA 349, 335 O.A.C. 172, at para. 19.

Is there a possibility that some of these claims are covered by the policy notwithstanding the exclusion clause?

[70] The second step is to apply the policy provisions to the claims to see if there is a possibility that some of the claims may be covered by the policy. This is determined by ascertaining the substance and true nature of the claims pleaded.

[71] In characterizing the class action and the third-party claims, the application judge stated, at para. 28, that:

The Claims in these Applications are broad and comprehensive and not limited to the distribution of the Report on the internet. The Claims do include damages for non-electronic distribution (i.e. physical distribution) of the report or other private information. Paragraph 19 of the Amended Statement of Claim in the Class Proceeding asserts that “the personal information of the class members can be accessed by any unauthorized third party who accessed the information, bought the information, or found the information posted on the internet...” [Emphasis added.]

[72] The application judge did not consider these claims at length in her analysis.

[73] As noted above, she held, at para. 36, that, “it is apparent that there are claims and allegations in the Class Proceeding and the Third-Party Claim, that would not be excluded by the Data Exclusion Clauses.”

[74] On appeal, FCS and Laridae take the position that the application judge was correct in holding that some claims extend beyond the policy exclusion and, thus, Co-operators has a duty to defend both because (i) the link to the Report is not a display of ‘data’ within the meaning of the exclusion clauses; and (ii) the damages sought are broad enough to include physical, not just electronic, distribution of the personal information. In the alternative, (iii) they renew their argument before the application judge that the data exclusion clauses are unenforceable.

(i) Is the link a “display of data” within the meaning of the policy exclusion?

[75] In the third-party claim against Laridae, FCS alleges that an “image of a link” to the Report was published on the Facebook page. On appeal, Laridae argues that one cannot click on an image to access the webpage or document directly. Instead, the text from the image must be typed into a separate webpage in order to access the content. Laridae claims that, strictly construed, such an image does not fit within the definition of ‘data’ as “representations of information or concepts in any form”. Rather, the image simply enables the user to obtain the information by taking further steps.

[76] The application judge makes no reference to this argument, and it is not clear that this argument was advanced below. In any event, I do not agree.

[77] The definition of ‘data’ is clear and unambiguous. Both a hyperlink and an image of a hyperlink constitute “representations of information” within the meaning of the policy exclusions. It is the representation of the source of the electronic file containing personal information.

[78] In the class proceeding against FCS, M.M. as the representative plaintiff claims that the wrongdoers:

[H]acked the portal, which portal [sic] was not secure, and made the report public by posting it on Smith’s Falls Swapshop Facebook page and/or other public websites, thereby disclosing personal and highly sensitive information of the plaintiff and class members.

As a result, the personal information of the class members has now been made readily available to any unauthorized third party who accessed the information, bought the information, or found the information posted on the internet, resulting in damages as set out below.

[79] The damages resulted from hacking the portal using the hyperlink to connect one electronic document to another. This is a “system designed or intended for the electronic communication of ‘data’”. As such, the link to the Report is a display of data within the meaning of the policy exclusion.

(ii) Is there a possibility some claims are covered by the policy notwithstanding the exclusion clause?

[80] FCS and Laridae further submit that the trial judge correctly found that the claims are “not limited to the distribution of the Report on the Internet” and include “damages for non-electronic distribution (i.e. physical distribution) of the report or other private information” and accordingly some of the claims advanced against them are not covered by the exclusion clause.

[81] FCS and Laridae argue that there are two concurrent, but discrete, claims advanced against the insured. They say that even if the online display or distribution of personal confidential information is not covered by the policy, Co‑operators owes a duty to defend if the physical display or distribution of the personal confidential information may be covered.

[82] I do not agree. As I will explain, while the trial judge adverted to the requirement to ascertain the substance and true nature of the claims pleaded, she erred by failing to do so and as a result concluded that “there are claims and allegations in the Class Proceeding and the Third-Party Claim that would not [be] excluded” by the relevant exclusion clauses. FCS and Laridae rely on Derksen. In that case, adverse weather conditions developed at a construction site, so work was halted earlier than usual. During the cleanup, a sign, a shaft, and a steel baseplate were removed from the site and placed in the truck. The steel baseplate was not secured. The truck was later driven along the highway and the steel baseplate flew off the truck and went through the windshield of a school bus, killing one child and injuring others.

[83] The policy in that case excluded coverage for bodily injury or property damage arising out of the ownership, use, or operation of an automobile. However, the Supreme Court held that the insurer had a duty to defend the action because, although the policy excluded coverage for the use or operation of the automobile, the underlying cause of the accident was the failure to clean up the work site by securing the items in the truck before driving the vehicle.

[84] The Supreme Court held that this cause was unrelated to the use or operation of the motor vehicle as the defendant could be found liable for negligently loading and storing the steel baseplate on the truck even if there was no negligent use or operation of the motor vehicle.

[85] However, in CUMIS General Insurance Co. v. 1319273 Ontario Ltd., 2008 ONCA 249, 91 O.R. (3d) 147 (“CUMIS (ONCA)”), a decision rendered several years later by this court, a policy exclusion for “bodily injury or property damage arising out of the ownership, maintenance, use or operation by or on behalf of the insured of any automobile” was held to exclude all claims for damages arising from an incident in which a motorcyclist was struck by a ladder that fell off a truck, seriously injuring him. The motorcyclist claimed that in cleaning up the work site, one of the defendant’s employees negligently loaded and stored the ladder onto the truck. At paras. 36, Laskin J.A. distinguished Derksen and accepted the application judge’s reasoning that:

[T]he “substance and true nature” of the claim is that the Respondent's employee failed to load and properly secure the ladder to the company's vehicle…. The Statement of Claim clearly suggests that the employee intended to clean up the work site by loading the ladder onto the truck and that he did so, but failed to secure the ladder properly to the truck…: CUMIS General Insurance Co. v. 1319273 Ontario Ltd. (2006), 84 O.R. (3d) 113, at paras. 15-16.

[86] Laskin J.A. agreed that “the ‘substance and true nature’ of the claim involves the allegations of negligently loading and storing the ladder on the truck,” not a negligent cleanup of a worksite as was alleged in Derksen: Cumis (ONCA), at para. 36.

[87] In the amended statement of claim, M.M. as representative of the class claims:

a) “The personal information … was contained in an electronic file … held electronically in a portal”;

b) The portal was “illegally hacked”, the personal information was posted on “Smith’s Falls Swapshop Facebook page and/or other public websites”; and,

c) It was “made readily available” to an unauthorized person who “accessed, bought or found the information on the internet” resulting in damages to the Class.

[88] In this case, contrary to the assertion made by the application judge, there is no claim in the class action that there was a physical display or distribution of the confidential personal information. The claim is that the confidential report was made public, “by posting it on Smith's Falls Swapshop Facebook page and/or other public websites, thereby disclosing personal and highly sensitive information of the plaintiff and class members” and that, “[a]s a result, the personal information of the class members has now been made readily available … resulting in damages” (emphasis added).

[89] The pleading in the class action is that the damages arose from posting the Report on the internet. This is sufficient to conclude that there is no duty to defend the class action as this allegation fits squarely within the policy exclusion.

[90] Moreover, even if the class action did include an allegation that physical copies of Report were taken or created, which it does not, the substance and true nature of the claim for damages arises from the wrongful appropriation of confidential personal information and posting it on the internet. There is only one chain of causation as all injury flows from the display or distribution of physical copies follows from the first wrongful act.

[91] This is also true in the case of the third-party claim. In the third-party claim, FCS claims:

a) Contribution and indemnity for any damages payable in the class action;

b) Damages for negligent advice and representations in the course of providing general consulting services under its agreement with FCS;

c) Damages for failing to adequately secure the website; and,

d) Damages relating to reputational harm, investigation costs, and repair costs.

[92] While I appreciate that Rule 29.01 of the Rules of Civil Procedure allows a defendant to commence a third-party claim against a person who is not a party to the action for “an independent claim for damages or other relief arising out of … a related transaction or occurrence or series of transactions or occurrences”, there is no independent claim for damages in this case.

[93] The data exclusion clause excludes claims that arise from the display and distribution of the confidential personal information on the internet. All of the injuries pleaded in the third-party claim arise, ultimately, from the distribution of the Report on the internet. There is only one chain of causation. As in the class action, the substance and true nature of the claim for damages arises from the wrongful appropriation of confidential personal information and posting it on the internet.

[94] Accordingly, the data exclusion clause excludes coverage for the defence of both the class action and the third-party claim and, on the facts as pleaded, there is no possibility that a claim within the policy may succeed.

(iii) Would denial of coverage result in nullification of coverage under the policy?

[95] The third point raised by FCS and Laridae is that, if the data exclusion clause in the policies applies in this case, giving effect to the data exclusion clause would impermissibly nullify coverage under the policy.

[96] In Zurich Insurance Co. v. 686234 Ontario Ltd. (2002), 62 O.R. (3d) 447 (Ont. C.A.), leave to appeal to S.C.C. refused, [2003] S.C.C.A. No. 33, Borins J.A. explained, at para. 28, that even a clear and unambiguous exclusion clause will not be applied where:

a) it is inconsistent with the main purpose of the insurance coverage;

b) the result would be to effectively nullify the coverage provided by the policy; and,

c) to apply the exclusion clause would be contrary to the reasonable expectations of the ordinary purchaser of the coverage.

[97] However, this case is distinguishable from Zurich.

[98] First, unlike the decision in Zurich, the exclusion is entirely consistent with the main purpose of the insurance coverage, which is to provide compensatory damages for personal injury arising from the conduct of business except in accordance with specific exclusions under the policy. The policies provide coverage for a range of services provided by Laridae and specifically, its provision of “Professional Services” to FCS. Only one of those services was to update and secure the FCS website.

[99] Second, given that the Co-operators policies provide coverage for a range of services which extend beyond the terms of this policy exclusion, the exclusion clause would not nullify the coverage provided under the policy.

[100] Third, exclusion of these claims pursuant to the exclusion clauses would not be contrary to the reasonable expectation of the parties. The potential effect of the data exclusion clauses is apparent on the face of the policies. Unlike Zurich, where “a reasonable policyholder would expect that the policy insured the very risk that occurred”, a reasonable policyholder in this case would expect that the data exclusion clause would exclude the dissemination of a sensitive Report over social media: Zurich, at para. 39.

[101] In G & P Procleaners and General Contractors Inc. v. Gore Mutual Insurance Co., 2017 ONCA 298, 335 O.A.C. 172, at paras. 24-25, this court considered and rejected a similar nullification argument. This court observed that commercial general liability policies:

… are not “all-risk” policies. They do not insure the manner in which the insured conducts its business. They do not generally cover the cost of repairing the insured’s own defective or faulty work product. That is what the parties in the present case bargained for. To hold them to that bargain is entirely reasonable and does not render the coverage under the policy meaningless. [Citations omitted.]

[102] Like the insurer in G & P Procleaners, the Co-operators’ policies do not insure against all risks. They clearly articulate what is and is not covered. Non-bodily injury arising from the display or distribution or data on the internet is not covered by their terms. To hold the parties to this bargain is consistent with the provisions in the policy, it does not nullify the effect of the policies, and it accords with the reasonable expectations of the parties.

Conclusion on the duty-to-defend issue

[103] In summary, I find that Co-operators owes no duty to defend either FCS or Laridae because (i) the exclusion clauses are unambiguous, (ii) all claims asserted in these proceedings are covered by the clear language of the exclusion clauses, and (iii) denial of coverage would not nullify the policies.

(3) The Third Issue: Removal of the Right to Participate in the Defence

[104] Given my conclusion that Co-operators has no duty to defend, it is unnecessary to address the third issue.

[105] However, I note that the parties agreed at the hearing that, if Co-operators did have a duty to defend, Co-operators should receive reports from counsel who have been acting for FCS and Laridae for the last four years, and have the ability to jointly instruct counsel.

[106] They also agreed that, should Co-operators have a duty to defend, it would be appropriate to establish a joint protocol for the management of documents and the litigation, similar to that ordered by this court in Markham (City) v. AIG Insurance Company of Canada, 2020 ONCA 239, 445 D.L.R. (4th) 405, leave to appeal refused, [2020] S.C.C.A. No. 170.

[107] The establishment of such a protocol reflects the balance between the insured’s right to a full and fair defence of the civil action and the insurer’s right to control that defence because of its potential ultimate obligation to indemnify: see Brockton (Municipality) v. Frank Cowan Co., 57 O.R. (3d) 447 (Ont. C.A.). It also reflects the fact that an insurer that has reserved its rights on coverage does not lose its right to control the defence and appoint counsel unless, in the circumstances, a reasonable apprehension of conflict of interest would arise if counsel were to act for both the insurer and the insured: Brockton, at paras. 39-40, 43; citing Zurich of Canada v. Renaud & Jacob, [1996] R.J.Q. 2160 (C.A.), per Lebel J.A..

[108] The onus is on the insured to establish such a reasonable apprehension of conflict of interest on the part of the insurer: Brockton, at para. 49; Wal-Mart Canada Corp. v. Intact Insurance Co., 2016 ONSC 4971, 133 O.R. (3d) 716; and Brookfield Johnson Controls Canada LP v. Continental Casualty Company, 2017 ONSC 5978.

Disposition

[109] For the above reasons, I would allow the appeal and hold that Co-operators has no duty to defend either the class action or the third-party claim.

[110] I would award costs to Co-operators in the amount of $15,000 for the appeals and $30,000 for the applications, as agreed by the parties.

Released: March 15, 2021 “A.H.” “J.A. Thorburn J.A.” “I agree. Alexandra Hoy J.A.” “I agree. David Brown J.A.”

[1] Today, FCS is authorized under the Child, Youth and Family Services Act, 2017, S.O. 2017, c. 14.