CITATION: Simpson v. Facebook, Inc., 2022 ONSC 1284
DIVISIONAL COURT FILE NO.: 227/21
DATE: 2022/03/01
ONTARIO
SUPERIOR COURT OF JUSTICE
DIVISIONAL COURT
Matheson, Ryan Bell, and Favreau JJ.
BETWEEN:
JESSICA SIMPSON
Appellant (Plaintiff)
– and –
FACEBOOK, INC. and FACEBOOK CANADA LTD.
Respondents (Defendants)
Daniel E.H. Bach and Stefani Cuberovic, for the Appellant (Plaintiff)
Mark A. Gelowitz, Robert Carson, and Lauren Harper, for the Respondents (Defendants)
HEARD at Toronto (by videoconference): December 22, 2021
REASONS FOR JUDGMENT
Ryan Bell J.
Overview
[1] Jessica Simpson appeals from the order of Belobaba J. dated February 16, 2021[^1] dismissing her motion for certification of a class proceeding. The proposed class proceeding arises from a high-profile personal data breach that involved Facebook, Cambridge Analytica Group (“Cambridge Analytica”), and Aleksandr Kogan (a British academic). The claim alleges that the personal data of Canadian Facebook users was improperly shared with Cambridge Analytica.
[2] The motion judge denied the motion for certification on the basis that the appellant failed to satisfy the common issues requirement of the Class Proceedings Act, 1992[^2] and, in particular, the requirement to provide “some evidence” that Canadian users’ data had actually been shared with Cambridge Analytica. The appellant argues that the motion judge erred in his application of the certification test under the CPA and, improperly, required her to prove loss at the certification stage. The appellant also argues that the motion judge erred in assessing the merits of the action and incorrectly interpreted his carriage orders.
[3] For the reasons that follow, I would dismiss the appeal. The motion judge did not err in law, nor did he make any palpable and overriding error in his treatment of the evidence.
The Factual Background
[4] During the 2016 general election campaign in the United States, millions of American voters were targeted with messages tailored to influence their votes. It was discovered that the targeting was achieved, in large part, using personal information obtained from Facebook users. The personal data was allegedly accessed without the Facebook users’ knowledge or consent, through a third-party application or “app”, created by Dr. Kogan.
[5] Dr. Kogan’s app, “thisisyourdigitallife”, was presented to Facebook users as a personality quiz to collect information for academic research; in reality, the app was used to collect personal data for commercial purposes. Dr. Kogan sold the personal information to Cambridge Analytica, which then used it to target American voters.
[6] According to Facebook’s estimates, the personal data of 87 million users may have been accessed and shared with Cambridge Analytica. This estimate included 622,161 Facebook users living in Canada, 272 of whom installed Dr. Kogan’s app and 621,889 “friends” whose personal data was obtained because the app gained “cascading access” to this information.
[7] Facebook notified its users of the data breach. The version of the notification received by most of the potentially affected Canadian users, including the appellant, advised:
We have banned the app “This Is Your Digital Life,” which one of your friends used Facebook to log into. We did this because the app may have misused some of your Facebook Information by sharing it with a company called Cambridge Analytica...
[8] Three proposed class actions were filed in Ontario: the Chamberlain action[^3], the Donegani action[^4], and the appellant’s action. Ultimately, the carriage issue was resolved on consent: the Chamberlain action was stayed, and the Donegani action and the appellant’s action were to proceed on the basis delineated in the carriage orders made by the motion judge.
[9] Mr. Donegani was granted carriage of a proposed class action on behalf of Facebook users worldwide whose personal information was improperly obtained “either directly or indirectly” by third parties. Facebook users who voluntarily downloaded a third party app were excluded from the class. The class included all others with the exception of “Canadian residents whose Facebook Information was shared with Cambridge Analytica Group.”
[10] The appellant was granted carriage of a proposed class action on behalf of “Canadian residents whose Facebook Information was shared with Cambridge Analytica Group.”
[11] As the motion judge stated at para. 10 of his reasons on the motion for certification:
The upshot of the two Carriage Orders was that Donegani would advance the worldwide claims of Facebook “friends” whose personal information had been improperly obtained by third parties, including the Kogan app. Simpson would advance the claims of Canadian residents whose Facebook information was actually shared with Cambridge Analytica Group.
[12] Both carriage orders provide that “no other class proceeding may be commenced in Ontario without leave of this Court in respect of the subject matter of the within action.”
The Certification Decision
[13] Consistent with the terms of the carriage orders, the appellant advanced the allegation in her pleading[^5] that Canadian Facebook users’ personal data was improperly shared with Cambridge Analytica. The appellant alleged that by allowing this to happen, the respondents breached their own terms of use and invaded the privacy of the Canadian class members. The appellant relied on the tort of intrusion upon seclusion and asked that the proposed class action be certified so that the respondents could be held accountable and pay “symbolic or moral damages” and punitive damages to the class members.
[14] The motion judge found that, “on any fair reading of the plaintiff’s pleading”, the core allegation is that the alleged invasion of privacy is the actual sharing of Canadian Facebook users’ personal data with Cambridge Analytica. At paras. 25-26 of his reasons, the motion judge explained the relationship between the core allegation and the proposed common issues:
It is this core allegation that drives the plaintiff’s pleading and provides the requisite backdrop for the proposed common issues. Here, the primary PCI [proposed common issue] asks whether the Facebook defendants “invaded the private affairs or concerns of the class members”. In other words, did the sharing of Canadians’ personal data with Cambridge Analytica constitute an invasion of their privacy or an intrusion upon their seclusion?
If there is no evidence that any such personal data was actually shared with Cambridge Analytica, then none of the PCIs that deal with invasion of privacy, whether at common law or under the specified provincial privacy statutes, can be certified. And if none of these PCIs can be certified, it follows that the proposed class action itself cannot be certified.
[15] The motion judge considered the evidence proffered and found that there was no evidence in the record that any Canadian user’s personal data was shared with Cambridge Analytica. He concluded at para. 45:
It follows that there is no basis in fact for any of the proposed common issues that ask whether the defendants invaded any class member’s privacy, whether at common law under the tort of intrusion upon seclusion or in breach of provincial privacy statutes. None of these PCIs can be certified. Absent common issues, there is no justification for a class proceeding.
[16] The motion judge also considered and rejected two additional arguments raised by class counsel. In advancing the so-called “peephole” argument,[^6] class counsel argued that Facebook violated users’ privacy by wilfully or recklessly providing Dr. Kogan’s app with unauthorized access to Facebook users’ personal information, whether or not such information was actually used. The motion judge noted that but for the carriage orders, he would have adjourned the hearing to permit the plaintiff to amend her pleading to accommodate this argument. However, the motion judge observed that no such amendments could have been made because the Donegani action was granted carriage of all claims relating to personal information obtained by third party apps, including Dr. Kogan’s app. Therefore, the peephole argument could not be pursued.
[17] The second additional argument raised by class counsel was an attempt to characterize Dr. Kogan and his company, Global Science Research (“GSR”), as “affiliates” of Cambridge Analytica. The motion judge rejected this argument at para. 37 of his reasons:
The “affiliate” submission is contrary to any fair reading of the two Carriage Orders, the respective statements of claim and the careful definitions of the various corporate entities referred to therein. In any event, there is no evidence that Dr. Kogan or his company were affiliates of Cambridge Analytica Group. Simply alleging in paragraph 71(1) of the Statement of Claim that Cambridge Analytica’s affiliates included “Kogan and GSR” is a bald allegation that has zero support in the evidence.
The Standard of Review
[18] The Divisional Court has jurisdiction to hear this appeal pursuant to s. 30(1) of the CPA as it read prior to the coming into force of s. 35 of Schedule 4 to the Stronger and Smarter Justice Act, 2020[^7] (that is, as the CPA read on September 30, 2020).
[19] The standard of review for judicial appeals is set out in Housen v. Nikolaisen.[^8] On questions of law, the standard is correctness. On questions of fact, the standard is palpable and overriding error. On questions of mixed fact and law, where there is an extricable legal principle, the standard of review is correctness; however, with respect to the application of the correct legal principles to the evidence, the standard is palpable and overriding error.
[20] The decision of the motion judge on a certification motion is entitled to substantial deference.[^9] An appellate court should only intervene if there is an error in principle or a palpable and overriding error of fact.
Issues on Appeal
[21] The appellant argues that the motion judge committed an error of general principle central to the proper application of s. 5 of the CPA by failing to apply the statutory five-part test and instead by determining certification on a threshold evaluation of the merits. The appellant submits that she is not required to prove a “core allegation” at certification and that the motion judge erred in assessing the core allegation under the s. 5(1)(c) “some basis in fact” standard. The appellant further submits that the motion judge made errors in his review of the evidence.
[22] The appellant also argues that the motion judge’s interpretation of the carriage orders discloses an extricable error of law on the basis that the motion judge failed to apply appellate authority regarding the interpretation of consent orders.
[23] The respondents submit that the motion judge made no error in law, that his decision was consistent with the jurisprudence, and that the appellant has failed to show any palpable and overriding error.
Analysis
The motion judge did not err in his application of the certification test
[24] The motion judge properly applied the certification test. He focused on one certification criterion – the s. 5(1)(c) common issues requirement. It was not an error in principle for him to do so. As this court confirmed in Maginnis v. FCA Canada Inc.,[^10] to obtain certification, the plaintiff must meet all the requirements in s. 5(1) of the CPA; failure to meet any one of the requirements is fatal.
[25] To show the existence of the common issues, the plaintiff must show a factual basis for her claim and the allegations to which the common issues relate. As Strathy J., as he then was, stated in Singer v. Schering-Plough Canada Inc.[^11]:
[T]he plaintiff is required to establish “a sufficient evidential basis for the existence of the common issues” in the sense that there is some factual basis for the claims made by the plaintiff and to which the common issues relate.
[26] As the motion judge stated at para. 43 of his reasons, there must be some evidentiary basis indicating that a common issue exists beyond a bare assertion in the pleadings: Fulawka v. Bank of Nova Scotia.[^12] This relates to evidence of there being a common issue and not evidence that the issue has merit or is likely to be resolved in the plaintiff’s favour: Crosslink v. BASF Canada.[^13]
[27] In Williams v. Canon Canada Inc.,[^14] this court explained the plaintiff’s evidentiary burden in relation to the court’s gatekeeping function:
The test under s. 5(1)(c), while low, must be sufficiently robust to screen out abusive or unmeritorious fishing expeditions. The gatekeeping function of the court would be effectively neutered if a plaintiff could satisfy its evidentiary burden based merely on a speculative assertion. Counsel for the plaintiffs submitted that the burden imposed by under [sic] s. 5(1)(c) is merely to present a basis for asking a question. That, in our view, cannot be enough. It is true that common issues are often expressed as questions. However, in order to justify certification, the plaintiffs must raise a legitimate possibility that the question or questions could be answered in their favour. This does not involve an examination of the merits of the claim (see Hollick v. Toronto (City of), 2001 SCC 68, [2001] 3 S.C.R. 158, at paras. 16, 25). It simply requires that there be some factual basis — in the form of admissible evidence — to support the allegation.
[28] In this case, the motion judge identified the core allegation in the statement of claim: that the alleged breach or invasion of privacy is the actual sharing of Canadian Facebook users’ personal data with Cambridge Analytica. At para. 25 of his reasons, the motion judge emphasized that this core allegation provides the “requisite backdrop” for the proposed common issues. Given this core allegation, the motion judge properly considered whether the appellant had adduced some basis in fact – some evidence – for her core allegation. The motion judge concluded that there was no evidence in the record that any Canadian Facebook user’s personal data was shared with Cambridge Analytica.
[29] The motion judge applied the governing legal principles and his approach was consistent with the case law respecting certification motions. He did not require the appellant to prove the core allegation at the certification stage. He did not require the appellant to demonstrate harm. He did not enter into an assessment of the merits of the case.
[30] Nor did the motion judge require the appellant to show an actual breach of privacy. As the motion judge observed, the core allegation about sharing users’ personal data with Cambridge Analytica, “permeates” the key definitions (including the definition of Privacy Breach) and paragraphs in the statement of claim.[^15] A proposed common issue must be a substantial ingredient of each class member’s claim and its resolution must be necessary to the resolution of that claim: Hollick.[^16] The claim and the principal proposed common issue are premised on the allegation that Canadian users’ data was shared with Cambridge Analytica. The motion judge dismissed the motion for certification because he found there was no basis in fact for the core allegation on which the claim and the proposed common issues depend. And, as the motion judge explained, class counsel’s belated peephole argument could not be accommodated by an amendment to the pleading given the carriage order in the Donegani action.
[31] The motion judge did not err in law in his application of the certification test.
The motion judge did not make a palpable and overriding error
[32] The appellant also argues that the motion judge erred in finding that there was no evidence that any Canadian Facebook user’s personal data was shared with Cambridge Analytica. The appellant is challenging a finding of fact. To succeed, she must show a palpable and overriding error.
[33] The motion judge made no palpable and overriding error in his review of the evidentiary record. The motion judge correctly observed that the onus is on the plaintiff to adduce some basis in fact for her core allegation that Canadian users’ personal data was shared with Cambridge Analytica.[^17]
[34] The appellant advances three arguments in support of her position that the motion judge erred in finding that there was no evidence of the core allegation. First, she submits that the motion judge relied on a “hole” in the evidence of his own creation to decide the motion: the Facebook defendants refused certain questions on cross-examination on the basis that such requests were irrelevant to certification. The motion judge upheld the refusals. The appellant did not seek to appeal his decision. I agree with the respondents that this ruling does not excuse the appellant from her evidentiary obligation to show some basis in fact for the core allegation.
[35] Second, the appellant argues that the motion judge discounted and impermissibly weighed her evidence against “directly contradictory evidence from the defence.” There is no merit to this submission. The motion judge recognized the respondents’ position on public statements by Dr. Kogan and the U.K. Information Commissioner, but he did not rely on these statements in arriving at his decision. At para. 27 of his reasons, the motion judge explained why none of the documents relied on by the appellant provide “some evidence” that Canadian users’ personal data was shared with Cambridge Analytica.
[36] Third, the appellant argues that the motion judge’s holding that the “affiliate” pleading was “a bald allegation that has zero support in the evidence” is a “glaring example of [an] error.” It is not. The motion judge’s rejection of the appellant’s affiliate argument was based on his assessment of the carriage orders, the respective statements of claim, and the definitions of the various corporate entities referred to in the pleadings.
[37] The motion judge rejected class counsel’s argument that Dr. Kogan and GSR were affiliates of Cambridge Analytica for purposes of the pleading in this action. On appeal, class counsel argues that the motion judge “fundamentally misinterpreted the meaning of the defined terms in the statement of claim” because he “selectively [read] the pleadings and their terms in isolation.”
[38] I disagree. The motion judge’s reasons reflect that he considered the respective statements of claim, and “the careful definitions of the various corporate entities” referred to in the pleadings, and the necessary context of the carriage orders.
[39] The appellant has not shown any palpable and overriding error in the motion judge’s findings of fact.
The motion judge did not misinterpret the carriage orders
[40] The appellant submits that, as consent orders, the carriage orders should be interpreted using ordinary principles of contract interpretation. In turn, the appellant submits that the motion judge ought to have considered the pleadings and surrounding circumstances when interpreting those orders.
[41] Regardless of how the interpretative principles are described, the appellant has not shown an error of law in the approach taken by the motion judge. He did consider the pleadings and surrounding circumstances in interpreting the carriage orders. There must therefore be a palpable and overriding error and none has been shown. As found by the motion judge, the proposed interpretation of “affiliate” is contrary to any fair reading of the two carriage orders, as well as the statements of claim. There was no ambiguity.
[42] Contrary to the appellant’s assertion, the proposed class will not be left without recourse as a result of the motion judge’s conclusion. As the motion judge observed at para. 46 of his reasons,
Class counsel, however, can take comfort in knowing that the Donegani action, if certified, will advance the very claims that cannot be advanced here. Ms. Simpson and the class members she had hoped to represent remain class members in the Donegani action and will still have their day in court.
[43] The motion judge’s interpretation of the carriage orders and the pleading is entitled to substantial deference. The appellant has failed to demonstrate an error in principle or a palpable and overriding error of fact in the motion judge’s conclusion.
Conclusion
[44] Accordingly, I would dismiss the appeal.
[45] The parties have agreed on costs. The appellant shall pay costs to the respondents in the amount of $40,000, all inclusive.
Ryan Bell J.
I agree
Matheson J.
I agree
Favreau J.
Released: March 1, 2022
CITATION: Simpson v. Facebook, Inc., 2022 ONSC 1284
DIVISIONAL COURT FILE NO.: 227/21
DATE: 2022/03/01
ONTARIO
SUPERIOR COURT OF JUSTICE
DIVISIONAL COURT
Matheson, Ryan Bell, and Favreau JJ.
BETWEEN:
Jessica Simpson
Appellant
- and -
Facebook Inc. and Facebook Canada Ltd.
Respondents
REASONS FOR JUDGMENT
Ryan Bell J.
Released: March 1, 2022
[^1]: Simpson v. Facebook, 2021 ONSC 968.
[^2]: S.O. 1992, c. 6 (“CPA”).
[^3]: Chamberlain v. Facebook Inc. et al, Court File No. CV-18-598747-CP.
[^4]: Donegani v. Facebook Inc., Court File No. CV-18-596626-CP.
[^5]: The motion judge observed at paras. 15 and 17 of his reasons that, in her Amended Notice of Motion, Ms. Simpson de facto amended the class definition to focus on the receipt of the notification from Facebook; however, the amended class definition did not detract from the allegation that Canadian users’ personal data was improperly shared with Cambridge Analytica.
[^6]: See Bennett v. Lenovo, 2017 ONSC 1082, at para. 27, where the court observed that the risk of unauthorized access to private information is itself a concern even without any removal or actual theft and, arguably, may be sufficient to satisfy the cause of action requirement for the tort of intrusion upon seclusion: “if a landlord installs a peephole allowing him to look into a tenant’s bathroom, the tenant would undoubtedly feel that her privacy had been invaded even if the peephole was not being used at any particular time.” See also Agnew-Americano v. Equifax, 2018 ONSC 275, at para. 151.
[^7]: S.O. 2020, c. 11.
[^8]: 2002 SCC 33.
[^9]: AIC Limited v. Fischer, 2013 SCC 69, [2013] 3 S.C.R. 949, at para. 65, citing Pearson v. Inco Ltd. (2006), 2006 913 (ON CA), 78 O.R. (3d) 641 (Ont. C.A.), at para. 43.
[^10]: 2021 ONSC 3897 (Div. Ct.), at para. 33.
[^11]: 2010 ONSC 42, at para. 140, citing Dumoulin v. Ontario, [2005] O.J. No. 3961, at para. 27.
[^12]: 2012 ONCA 443, at para. 79.
[^13]: 2014 ONSC 4529, at para. 35.
[^14]: 2012 ONSC 3692 (Div. Ct.), at para. 23.
[^15]: Reasons, at para. 33.
[^16]: 2001 SCC 68, at para. 18.
[^17]: Reasons, at para. 24.