COURT OF APPEAL FOR ONTARIO DATE: 20221125 DOCKET: C69989

Doherty, Tulloch and Miller JJ.A.

BETWEEN

Michael Obodo Plaintiff (Appellant)

and

Trans Union of Canada, Inc. Defendant (Respondent)

Counsel: Christopher Du Vernet and Carlin McGoogan, for the appellant Craig T. Lockwood, Lauren Harper and Jessica Habib, for the respondent

Heard: June 6, 2022

On appeal from the order of Justice Benjamin T. Glustein of the Superior Court of Justice, dated November 4, 2021, with reasons reported at 2021 ONSC 7297.

Doherty J.A.:

I. Overview

[1] This appeal was heard with the appeals in Owsianik v. Equifax Canada Co., 2021 ONSC 4112, 18 B.L.R. (6th) 78 (Div. Ct.) and Winder v. Marriott International, Inc., 2022 ONSC 390. All three appeals raise the applicability of the tort of intrusion upon seclusion, recognized in Jones v. Tsige, 2012 ONCA 32, 108 O.R. (3d) 241, to defendants who collected and stored the private information of others and whose failure to take adequate steps to secure that information allowed independent third-party “hackers” to access and/or use that private information. These defendants are referred to as “Database Defendants”.

[2] The appellant (Mr. Obodo) on behalf of himself and the proposed class raised many of the same issues and made many of the same arguments as were advanced by the appellant in Owsianik. I have addressed those arguments in my reasons in Owsianik, and will not repeat my analysis here. These reasons should be read with the reasons in Owsianik.

[3] In these reasons I will address arguments not considered in Owsianik. I am satisfied that those arguments, like the arguments advanced in Owsianik, cannot succeed. I would dismiss the appeal.

II. The Relevant Allegations

[4] This proceeding is at the certification stage. Mr. Obodo moved to certify various claims. The motion judge certified claims based in negligence, and some of the claims based on various provisions in provincial privacy legislation. He declined to certify the intrusion upon seclusion claim, holding that he was bound by the decision of the majority of the Divisional Court in Owsianik: Obodo v. Trans Union of Canada, Inc., 2021 ONSC 7297, at paras. 111-15. This appeal addresses only the refusal to certify the intrusion upon seclusion claim. The other aspects of the motion judge’s ruling are not challenged.

[5] The allegations relevant to the intrusion upon seclusion claim made by Mr. Obodo are very similar to those made in Owsianik. Trans Union of Canada, Inc. (“Trans Union”) is in the same business as Equifax Canada Co. and Equifax Inc. (collectively, “Equifax”). Like Equifax, Trans Union accumulates and stores in its database the personal information of millions of people for reasons associated with the credit-related services provided by Trans Union to its customers. As in Owsianik, the database was breached by unknown third-party hackers.

[6] In the Amended Statement of Claim, Mr. Obodo alleged that Trans Union, in furtherance of its business activities, gathered and aggregated a significant volume of personal and private information belonging to Mr. Obodo and other class members. Trans Union used that information in providing services to its clients. The information included names, birthdates, addresses, information on debts owing, payment histories, and social insurance numbers.

[7] Over a two-week period in June and July 2019, hackers, using credentials stolen from a Trans Union customer, accessed the database through a customer portal. In early October 2019, Trans Union notified the affected parties that their information had been improperly accessed by hackers. Trans Union offered certain compensation to affected parties.

[8] The improperly accessed information included information pertaining to about 37,000 Canadians. Those individuals make up the proposed class.

[9] Mr. Obodo claims that Trans Union represented that it took reasonable steps to secure the information in the database and that its protective measures were consistent with industry standards. He alleges, however, that the steps taken by Trans Union to secure the information were woefully inadequate and below industry standards. Mr. Obodo further alleged that Trans Union did not have procedures in place to identify the intrusion in a timely fashion and minimize the harm caused by the hackers. Mr. Obodo offered an expert opinion in support of the allegations. Trans Union challenges that expert. The merits of the expert’s opinions are for another day.

[10] The Amended Statement of Claim alleged that the hackers’ intrusion upon the seclusion of Mr. Obodo and the other class members was “enabled and facilitated” by Trans Union. Trans Union “enabled and facilitated” the intrusion by:

• gathering the information;
• aggregating the information into a central location;
• setting up a portal which allowed access to the database by customers of Trans Union;
• failing to implement effective security measures;
• failing to effectively monitor access through the portal;
• failing to implement other security measures; and
• failing to have in place measures that would minimize the negative impact of any unauthorized intrusion into the database.

III. The Issues on Appeal

A. Jurisdiction to Hear the Appeal

[11] Before examining the substantive grounds of appeal raised on this appeal and not addressed in Owsianik, I will consider a preliminary jurisdictional question raised by the respondent.

[12] Trans Union submits that the statutory provisions governing appeals in this proceeding are those found in s. 30 of the Class Proceedings Act, 1992, S.O. 1992, c. 6, as of November 18, 2019, the date this proceeding was commenced: Class Proceedings Act, 1992, s. 39(1). Trans Union submits that amendments to the appeal provisions that came into effect after this proceeding was commenced do not apply.

[13] I agree with Trans Union’s reading of s. 39(1) of the Class Proceedings Act, 1992. Section 30(2) of the Class Proceedings Act, 1992, as it read in November 2019, applies. That provision provided for an appeal from an order certifying a proceeding as a class proceeding to the Divisional Court, but only with leave of a judge of the Superior Court.

[14] Trans Union submits that s. 30(2) of the Class Proceedings Act, 1992 applies to this appeal since the order under appeal certified the proceeding as a class proceeding. Trans Union contends that the order remains an order certifying a proceeding as a class proceeding even though Mr. Obodo challenges only the part of the order that refused to certify the intrusion upon seclusion claim. On this reasoning, the appeal lies with leave to the Divisional Court and not to this court.

[15] Appeals are creatures of statute: R. v. Meltzer, [1989] 1 S.C.R. 1764, at p. 1773. Section 6(1)(b) of the Courts of Justice Act, R.S.O. 1990, c. C.43 (“CJA”) sets out the Court of Appeal’s general power to hear appeals from final orders made by Superior Court justices. Specific statutes, including the Class Proceedings Act, 1992, also vest appellate jurisdiction in various courts in respect of the orders of Superior Court judges identified in those statutory provisions. A proper characterization of the nature of the order under appeal is an essential step in determining the appropriate appellate forum.

[16] I agree with Trans Union that the order under appeal is for some purposes properly characterized as an order certifying a proceeding as a class proceeding. To the extent that the Class Proceedings Act, 1992 governs rights of appeal, the appeal from the order certifying the proceeding as a class proceeding goes to the Divisional Court with leave. However, the motion judge’s order does more than identify the claims that can and cannot go forward as part of a class action. By holding that the intrusion upon seclusion claim did not disclose a cause of action against Trans Union, the motion judge effectively determined that the claim could not go forward. The order was a final order. Mr. Obodo cannot pursue the intrusion upon seclusion claim against Trans Union in any forum, absent a successful appeal.

[17] In Cavanaugh v. Grenville Christian College, 2013 ONCA 139, 360 D.L.R. (4th) 670, the motion judge declined to certify an action as a class proceeding against one defendant on the basis that the pleadings did not disclose a cause of action against that defendant. The motion judge also refused to certify the proceeding as a class proceeding against other defendants on the basis that the plaintiffs had failed to show that a class proceeding was the “preferable procedure”.

[18] On appeal, this court held that the order refusing to certify the proceeding on the basis that a class proceeding was not the “preferable procedure” was an order refusing to certify the proceeding, appealable to the Divisional Court under s. 30 of the Class Proceedings Act, 1992. The court further held that the order refusing to certify the proceeding against one defendant on the basis that the claim did not disclose a cause of action against that defendant was more than simply an order refusing to certify the action. The order determined the outcome of the claim and was appealable to the Court of Appeal under s. 6(1)(b) of the CJA.

[19] In Cavanaugh, this court emphasized that the appropriate appellate forum should be determined by reference to the substance of the challenged order and not necessarily the label placed on the motion giving rise to the order. The court observed, at para. 17:

However, the motion judge’s order does much more than simply refuse to certify the action as a class proceeding against the Diocese. The order dismisses the claim “immediately”. The motion judge’s order goes well beyond a determination that the Diocese will not be part of any class proceeding. Under that order, the appellants are barred not only from proceeding against the Diocese by way of a class action proceeding, but are precluded from proceeding against the Diocese entirely. If that order stands, the appellants’ action against the Diocese is over.

[20] The language from Cavanaugh has direct application here. If this order stands, the intrusion upon seclusion claim against Trans Union “is over”. While the motion judge did not dismiss the claim, as the motion judge in Cavanaugh did, the absence of an express reference to a dismissal of the claim does not change the substance of the order made. Just as in Cavanaugh, the motion judge’s order here effectively dismissed the intrusion upon seclusion claim brought against Trans Union. The appeal route available to a party seeking to challenge an order that effectively brings the claim to an end should reflect that reality. This court has jurisdiction to hear the appeal under s. 6(1)(b) of the CJA.

B. Is the Distinction Between Trans Union’s Liability for the Actions of an Employee and its Liability for the Actions of a Third-Party Hacker Untenable?

[21] In his factum, counsel for Mr. Obodo submits:

Notably, several of these cases were certified on the basis that the intruder was an employee of one of the Defendants, such that the Defendant could potentially be vicariously liable for their conduct. It is respectfully submitted that it would be anomalous if a Defendant could be found liable for enabling an intrusion if it was the employer of the intruder, but not if the intruder was unknown to it. Victims of intrusions upon seclusion suffer the same loss regardless of whether the intruders were employed by the enabler, and yet would arbitrarily be denied a remedy if the intruder came from outside of the enabler’s organization. [Emphasis added.]

[22] Mr. Obodo describes Trans Union as “an enabler”. There is, however, no allegation that Trans Union and the unknown hacker were co-conspirators, acted in concert, or in pursuit of a common unlawful goal. To the contrary, the allegation is that the hacker gained access to Trans Union’s database by stealing information from one of Trans Union’s customers.

[23] Absent a properly pleaded allegation of conspiracy or common enterprise, Trans Union could only be liable for the intrusion upon seclusion perpetrated by the third-party hacker if Trans Union was somehow vicariously liable for the actions of the hacker. In the Amended Statement of Claim, at para. 1(i), Mr. Obodo seeks a declaration that Trans Union is vicariously liable for the acts and omissions committed by the hacker. Mr. Obodo does not, however, plead any facts which could, in law, render Trans Union vicariously liable for the actions of the third-party hacker.

[24] As I read the submission made by Mr. Obodo (see above at para. 21), the nature of the loss suffered by Mr. Obodo and other members of the class dictates that Trans Union is liable for the actions of the independent third-party hacker.

[25] The appellant’s submission ignores the rationale for the doctrine of vicarious liability and the limits on that doctrine. An employer may be liable for the torts of its employees. Liability rests primarily on policy considerations which are, in turn, predicated on the existence of an employer-employee relationship and a connection in some sense between that relationship and the employee’s tortious misconduct: Bazley v. Curry, [1999] 2 S.C.R. 534, at pp. 548-54; 671122 Ontario Ltd. v. Sagaz Industries Canada Inc., 2001 SCC 59, [2001] 2 S.C.R. 983, at para. 25.

[26] The appellant’s submission comes down to an attempt to impose the equivalent of vicarious liability on Trans Union in the absence of any employer-employee relationship between the actual intruder and Trans Union. That relationship is a precondition to the imposition of vicarious liability on Trans Union. [1] As explained in Owsianik, Trans Union remains liable for any damages flowing from its negligence, or from breaches of any contractual, or statutory duties potentially owing to Mr. Obodo and the other class members.

C. The Significance of Arts. 35 and 37 of the Civil Code of Québec, S.Q. 1991, c. 64

[27] The motion judge considered arts. 35 and 37 of the Civil Code of Québec, S.Q. 1991, c. 64 in the context of determining whether a claim based expressly on those provisions should be certified. The motion judge held that the claim could be certified. That ruling is not appealed: Obodo, at paras. 226-32.

[28] I see no connection between the terms of arts. 35 and 37 of the Civil Code of Québec and the question whether the intentional common law tort of intrusion upon seclusion should be extended to Database Defendants based on their failure to adequately protect against third-party hackers accessing information held by the Database Defendants. As I read the relevant provisions in the Civil Code of Québec, they refer to the database operators’ obligations to persons whose private information they receive and hold. These obligations seem akin to the obligations placed on database holders by the common law of negligence, contract law, and, in some cases, statutory provisions.

[29] The terms of arts. 35 and 37 of the Civil Code of Québec do not assist. Furthermore, the appellant’s plea for “consistency among the provinces” seems more properly directed at the provincial legislatures.

IV. Conclusion

[30] I would dismiss the appeal. The parties agree that costs of the appeal should be fixed at $20,000 to the victor in the cause. This amount includes all disbursements and applicable taxes.

Released: November 25, 2022 Doherty J.A. I agree. M. Tulloch J.A. I agree. B.W. Miller J.A.

[1] There are other relationships that can render one party vicariously liable for the misconduct of another. None are in play here: see Lewis N. Klar & Cameron Jefferies, Tort Law, 6th ed. (Toronto: Carswell, 2017), at pp. 774-76.