COURT FILE NO.: CV-14-507026

COURT FILE NO.: CV-17-567522

DATE: 2018/10/25

ONTARIO

SUPERIOR COURT OF JUSTICE

BETWEEN:

Elia Broutzas and Meagan Ware

Plaintiffs

– and –

Rouge Valley Health System, C.S.T. Consultants Inc., Knowledge First Financial Inc., Global RESP Corporation, Nellie Acar, Shaida Bandali, Esther Cruz, Gavriel Edry, Polina Edry, Munish Sethi, Subramaniam Sulur, Jane Doe “A”, Jane Doe “B”, John Doe, Registered Education Savings Plan Corporation, and Jane Doe “C”

Defendants

AND BETWEEN:

Anne Kouvas

Plaintiff

• and –

Scarborough and Rouge Hospital, Global RESP Corporation, Esther Cruz and Nellie Acar

Defendants

Norman T. Mizobuchi and Nicholas Habets for the Plaintiffs

Patrick J. Hawkins, Markus Kremer, and Daniel Girlando for the Defendants Rouge Valley Health System and Scarborough and Rouge Hospital

David S. Young for the Defendant C.S.T. Consultants Inc.

Michael Arbutina for the Defendant Global RESP Corporation

Catherine Beagan Flood and Nicole Henderson for the Defendant Knowledge First Financial Inc.

Saba Ahmad for the Defendant Nellie Acar

Brian N. Radnoff for the Defendants Gavriel Edry and Polina Edry

Timon Sisic for the Defendant Esther Cruz

Proceeding under the Class Proceedings Act, 1992

HEARD: October 1-5, 2018

PERELL, J.

REASONS FOR DECISION

A. Introduction

[1] These certification motions consider the scope of the burgeoning tort of intrusion on seclusion where there is intrusion but little, if any, seclusion.

[2] Hospital records are governed by PHIPA, the Personal Health Information Protection Act, 2004.[^1]Acting in violation of PHIPA and in contravention of their respective employment contracts, three employees of two public hospitals (subsequently merged into one hospital) independently accessed hospital records about patients who had given birth at the hospitals. Then, one of the rogue employees used the contact information to sell Registered Education Savings Plans[^2] (“RESPs”) for the newborns, and two of the rogue employees sold the names and contact information to sales representatives of three RESP investment dealers registered under the Ontario Securities Act,[^3] who, in turn, used the contact information to sell RESPs for the newborns. Among the patients contacted by the RESP sales representatives were women that allegedly were emotionally upset by the RESP solicitation. Some of these women hired lawyers and commenced two proposed class actions. The Plaintiffs claim damages in excess of $450 million in the two class actions.

[3] The rouge hospital employees did not sell or disclose confidential medical information about the patients; only contact information was disclosed. The RESP sales representatives paid only for the contact information, which they used for client prospect leads. The activity of the RESP sales representatives was a contravention of their respective contracts with their respective RESP investment dealers. The RESP sales representatives’ activity was also a violation of the provisions of the Ontario Securities Act that govern referral agreements, which are not prohibited, but which must not be clandestine.

[4] Before the court are two motions to certify the actions pursuant to the Class Proceedings Act, 1992.[^4] There is also a third motion in which the Plaintiffs bring a motion under Rule 21 of the Rules of Civil Procedure for the determination of a question of law as against Rouge Valley Health System, one of the Defendants.

B. Overview

[5] In the first proposed class action, Broutzas v. Rouge Valley Health System, which was commenced on on June 24, 2014, the Plaintiffs, Elia Broutzas and Meagan Ware, allege the Defendants Shaida Bandali, Esther Cruz, and Munish Sethi, three former employees of the Defendant Rouge Valley Health System (“Rouge Valley”), retrieved patient contact information about mothers of newborns.

[6] In Broutzas v. Rouge Valley Health System, it is alleged: (a) that Mr. Sethi, who, in addition to being a Rouge Valley hospital employee, was a sales representative of an RESP investment dealer, used the contact information to sell RESPs; (b) that Nurse Cruz, a hospital employee, sold contact information to Ms. Acar, an RESP sales representative of Global RESP Corporation (“Global”), who used the contact information to sell RESPs; (c) that Ms. Bandali, another hospital employee, sold contact information to Polina Edry and Gavriel Edry, who were RESP sales representatives of Knowledge First Financial Inc., (“Knowledge First”), who used the contact information to sell RESPs; and (d) that Ms. Bandali also sold contact information to Subramaniam Sulur, who was an RESP sales representative of C.S.T. Consultants Inc., (“CST”), who used the contact information to sell RESPs.

[7] In Broutzas v. Rouge Valley Health System, the Plaintiffs claim damages of $332 million, plus special damages and punitive damages of $80 million. They advance causes of action of: (a) intrusion on seclusion; (b) breach of PHIPA; (c) negligence; (d) breach of contract and warranty; and (e) vicarious liability. (They are abandoning a conspiracy claim and the remedy of waiver of tort.) The proposed class action is brought on behalf of:

All persons who gave birth at Rouge Valley Health System between January 2009 and October 17, 2014.

[8] In the second proposed class action, Kouvas v. Scarborough and Rouge Hospital, which was commenced on January 12, 2017, the Plaintiff, Anne Kouvas, alleges that Ms. Cruz, a nurse employed both by Rouge Valley and also The Scarborough Hospital, retrieved patient information of mothers of newborns at The Scarborough Hospital. It is alleged that Nurse Cruz sold the information to Ms. Acar, who, as noted above, was a representative of Global.

[9] In Kouvas v. Scarborough and Rouge Hospital, Ms. Kouvas claims damages of $36 million, plus special damages and punitive damages of $5 million. She advances causes of action of: (a) intrusion on seclusion; (b) negligence; (c) breach of contract and warranty; and (d) vicarious liability. The proposed class action is brought on behalf of:

All persons who gave birth at the Birchmount site of The Scarborough Hospital between January 1, 2012 to September 30, 2013.

[10] The following chart summarizes the stream of the contact information in the two proposed class actions:

Patients of Rouge Valley

Mr. Sethi

Mr. Sethi

(of Children’s Education Funds Inc.)

Patients of Rouge Valley contacted by Mr. Sethi

Ms. Bandali

Mrs. & Mr. Edry

(of Knowledge First)

Patients of Rouge Valley contacted by Knowledge First

Mr. Sulur

(of CST)

Patients of Rouge Valley contacted by CST

Nurse Cruz

Ms. Acar

(of Global)

Patients of Rouge Valley contacted by Ms. Acar.

Patients of The Scarborough Hospital

Nurse Cruz

Ms. Acar

(of Global)

Patients of The Scarborough Hospital contacted by Ms. Acar.

[11] The following chart sets out the various claims and causes of action against the Defendants in Broutzas v. Rouge Valley Health System:

Intrusion on Seclusion

PHIPA s. 65

Negligence

Breach of Contract

Vicarious Liability

Rouge Valley

X

X

X

X

Ms. Bandali

X

X

X

Nurse Cruz

X

X

X

Mr. Sethi

X

X

Ms. Acar

X

X

Mr. Edry

X

X

Mrs. Edry

X

X

Mr. Sulur

X

X

CST

X

X

Global

X

X

Knowledge First

X

X

[12] The Rule 21 motion is brought in the Broutzas v. Rouge Valley Health System action, and the Plaintiffs seek a declaration that because of an Order of the Information and Privacy Commissioner (PHIPA Order HO-013), Rouge Valley is estopped from denying that it is liable for the various statutory and common law causes of action advanced against it.

[13] The following chart sets out the various claims and causes of action against the Defendants in Kouvas v. Scarborough and Rouge Hospital:

Intrusion on Seclusion

Negligence

Breach of Contract

Vicarious Liability

The Scarborough Hospital

X

X

X

Nurse Cruz

X

X

Ms. Acar

X

X

Global

X

X

[14] For the reasons that follow, I dismiss the certification motion. For Reasons for Decision being released simultaneously, I dismiss the Rule 21 motion.[^5]

C. The Amendment to the Statement of Claim

[15] As part of their certification motion in Broutzas v. Rouge Valley Health System, Ms. Broutzas and Ms. Ware seek leave to deliver a Second Fresh as Amended Consolidated Statement of Claim. The proposed pleading seeks to remove Ms. Ware as a Representative Plaintiff and to add Melany Marcinkowski and Chantel Drummond as Representative Plaintiffs. However, Ms. Drummond has withdrawn her instructions to be a Plaintiff, and thus, the Plaintiffs propose that Ana-Luiza Leibner-Peixoto be added instead of Ms. Drummond as a Representative Plaintiff.

[16] The Defendants do not oppose the amendment to the Statement of Claim. Therefore, leave is granted to deliver the new pleading.

[17] For the purposes of the certification motion, I shall treat the Broutzas v. Rouge Valley Health System Statement of Claim as having been amended as set out in the Second Fresh as Amended Consolidated Statement of Claim with the further amendment of substituting Ms. Leibner-Peixoto for Ms. Drummond.

D. The Facts

[18] While it involves some repetition, the background facts are best understood by recounting the facts from the perspective of the parties beginning with the hospitals, then continuing with groupings of defendants, and finally from the perspective of Ms. Drummond and of the proposed Representative Plaintiffs.

1. Rouge Valley Health System (now Scarborough and Rouge Hospital)

[19] Rouge Valley Health System (a Defendant in Broutzas v. Rouge Valley Health System) was a public hospital that after the events in issue amalgamated with The Scarborough Hospital (a Defendant in Kouvas v. Scarborough and Rouge Hospital) to become The Scarborough and Rouge Hospital.

[20] Before the amalgamation, Rouge Valley operated at several campuses including Centenary (in East Toronto) and Ajax and Pickering (in Durham). It employed a staff of approximately three thousand persons. There were five hundred physicians with privileges. It was governed by the Public Hospital Act[^6] and PHIPA.

[21] Rouge Valley employed Ms. Bandali, Nurse Cruz, and Mr. Sethi. Rouge Valley required every staff member: (a) to sign a “Statement of Confidentiality”; and (b) to comply with its “Privacy Statement and Policy.” Rouge Valley published a “Privacy and Personal Health Information” brochure to assist all staff to understand their obligations. When patients were admitted to the hospital, the hospital provided them with information about its privacy policies and procedures.

[22] To manage its electronic health records, Rouge Valley installed “Meditech” software from Medical Information Technology Inc., the largest software provider to Ontario hospitals. The software has a privacy advisory screen every time a staff member accessed the system.

[23] In July 2009, Mr. Sethi advised Rouge Valley that he had applied for a part-time position as a sales representative for Children’s Education Funds Inc., an RESP investment dealer. By letter on July 9, 2009, Rouge Valley advised Mr. Sethi that employees were prohibited from soliciting any business from patients to support outside employment.

[24] On July 22, 2013, Mr. Sethi was transferred to a different position at the hospital, and Rouge Valley removed his access to all Meditech modules that contained patient information.

[25] On September 13, 2013, Mr. Sethi asked his manager to reinstate his access to Meditech’s Scheduling Module, stating that he was seeking access to phone numbers of patients who had recently given birth, in order to sell them RESPs. Rouge Valley immediately reported the matter to the Information Privacy Commissioner and to the Ontario Securities Commission.

[26] Rouge Valley also launched an internal investigation. It suspended Mr. Sethi pending the outcome of the investigation. On September 24, 2013, Rouge Valley interviewed Mr. Sethi. He denied that he had inappropriately accessed patients’ information. Rouge Valley was unable from its internal investigation to determine whether Mr. Sethi had accessed the patients’ contact information because the Meditech software only maintained logs of employee access for a two-week rolling period. It, however, was able to satisfy itself that Mr. Sethi had not accessed patients’ electronic health records. Not satisfied with Mr. Sethi’s answers, on October 2, 2013, Rouge Valley terminated him employment.

[27] As a result of the investigation of Mr. Sethi, in December 2013, Rouge Valley notified the 7,613 patients who gave birth at the Centenary site with a discharge date between July 9, 2009 and August 30, 2013 about a security breach of patient information.

[28] On April 3, 2014, a Rouge Valley employee found twenty printed computer screen shots that Ms. Bandali had left on a photocopier. The employee reported the matter to the administration. The information appearing on screen shot was: (a) a list of newborns with hospital unit number; (b) date of birth; (c) sex; (d) mother’s first name; (e) date and type of last hospital visit (i.e. inpatient or clinic visit); (g) hospital location; (f) date of last discharge; (g) the pneumonic (i.e. the initials) of the attending physician; (h) partial health card numbers; and (i) the mothers’ addresses, phone numbers.

[29] It appeared to Rouge Valley that Ms. Bandali was conducting searches in the Scheduling Module using the “Patient Index”, a searchable electronic list of patients, to obtain information on new mothers.

[30] Again, Rouge Valley reported the matter to the Information Privacy Commissioner and to the Ontario Securities Commission. Rouge Valley also launched an internal investigation. It suspended Ms. Bandali pending the outcome of the investigation.

[31] The Ontario Securities Commission, through its Joint Serious Offenses Team (“JSOT”), a partnership between the Ontario Securities Commission, the Ontario Provincial Police Anti-Rackets Branch, and the RCMP Financial Crime Program, conducted an investigation. The investigation began with the allegations against Mr. Sethi and Ms. Bandali. As the investigation progressed, the investigators learned of the activities of the Edrys and Mr. Sulur. The JSOT investigation linked Ms. Bandali to Ms. Edry, who was associated with Knowledge First and to Mr. Sulur, who was associated with CST. The investigators also eventually learned of the separate activities of Nurse Cruz and Ms. Acar who was a RESP sales representative for Global.

[32] Rouge Valley’s internal investigation revealed that Ms. Bandali had generated lists of all patients who gave birth on March 10 or 11, 2014. On April 7, 2014, Ms. Bandali was interviewed. She admitted to having provided information about approximately 600 patients to Ms. Edry of Knowledge First. On April 8, 2014, Ms. Bandali resigned.

[33] In May 2014, Rouge Valley notified the 699 women who had given birth at its Centenary site, with a discharge date between September 1, 2013 and April 5, 2014 that their information might have been inappropriately accessed.

[34] In July 2014, the Information Privacy Commissioner conducted an investigation of Rouge Valley pursuant to s. 58 of PHIPA. The Commissioner summoned Mr. Sethi and Ms. Bandali to provide evidence under oath. Mr. Sethi denied having inappropriately obtained the phone numbers of patients to sell RESPs.

[35] On October 16, 2014, Nurse Cruz’s employment at Rouge Valley ended. At this time, it appears that no one was aware that Nurse Cruz was also obtaining contact information about mothers with newborns.

[36] In December 2014, the Information Privacy Commissioner issued PHIPA Order HO 013. The Commissioner found that Rouge Valley had not taken sufficient measures to protect patients’ personal health information. The Commissioner concluded that the Rouge Valley had breached s.12 (1) of the PHIPA. The Commissioner ordered Rouge Valley, among other things: (a) to implement the necessary measure to be able to audit all instances where staff members had accessed personal health information, including the selection of patient names on the Patient Index (“Order, Provisions 1 and 2a”); (b) to limit the search functionalities of the Meditech system and the Patient Index to prevent staff members from using the type of open-ended searches that Ms. Bandali had performed; and (c) to revise its privacy policies and privacy training (“Order, Provisions 3-6”). Rouge Valley appealed Order Provisions 1 and 2b pursuant to s. 62 of PHIPA.

[37] It should be noted that the focus of the PHIPA Order HO 013 was on upgrading Rouge Valley’s ability to measure the extent of any data breach.

[38] Meanwhile, the JSOT investigation was continuing, and its investigation had from Mr. Sethi and Ms. Bandali to Ms. Acar. On January 14, 2015, JSOT executed a search warrant at Ms. Acar's home. The investigators seized 163 patient labels from Rouge Valley and 151 patient labels from The Scarborough Hospital that Ms. Acar had received from Nurse Cruz. There were approximately 33 original patient sticker labels seized, as well as about 260 photocopies of hospital sticker labels and a further 22 names and contact information that were handwritten on sheets of paper.

[39] With respect to the Rouge Valley labels, there is no evidence that Nurse Cruz accessed Meditech improperly while she was at Rouge Valley. Rather, it appears that she removed some of the hard copies of labels that are affixed to medical charts, test requisitions, and specimen containers for identification purposes. A patient label contains: (a) the patient’s name; (b) gender; (c) date of birth; (d) age, (e) date of admission to the Hospital, (f) health card number; (g) Hospital patient number; (h) name of the treating physician; and (i) patient’s address and phone number. These labels are printed when a patient is admitted.

[40] In January 2015, the JSOT investigators advised Rouge Valley and The Scarborough Hospital that they had recovered printed labels at Ms. Acar’s residence that they believed Nurse Cruz had given to Ms. Acar.

[41] In May 2015, the JSOT provided Rouge Valley with the list of 163 patients whose labels had been found in Ms. Acar’s residence. These 163 patients had given birth at the Centenary site of hospital between February 16, 2012 and September 14, 2013. Rouge Valley notified these patients about the data breach.

[42] Rouge Valley reported Nurse Cruz, whom as noted above, no longer worked at the hospital, to the College of Nurses of Ontario, which referred the matter to its Discipline Committee.

[43] On April 15, 2016, the Hospital and the Information Privacy Commissioner agreed to resolve the appeal of Order HO 013. Rouge Valley prepared and the Commission approved a work plan to implement Order Provisions 1 and 2b. The Work Plan included: (a) the purchase and implementation of new auditing software at an estimated initial cost of $300,000; the purchase and implementation of location and role-based access controls on Meditech users at an estimated cost of $50,000; and (c) conducting weekly audits using existing auditing capabilities in the Patient Care Index module of Meditech; expanding the use of health card sweep devices and self-registration kiosks at registration areas, to limit the searches required by clerical staff, at an estimated one time cost of $40,000.

[44] On July 5, 2016, the PHIPA Order was filed with the Superior Court of Justice bearing Court File No. CV-16-556054. The Order became enforceable as an order of the Superior Court of Justice.

[45] In September 2017, the Information Privacy Commissioner confirmed that it was satisfied with the Hospital’s implementation of the Work Plan.

2. The Scarborough Hospital (now Scarborough and Rouge Hospital)

[46] The Scarborough Hospital was a public hospital that after the events in issue amalgamated with The Rouge Valley Health System to form The Scarborough and Rouge Hospital. It was governed by the Public Hospital Act and PHIPA.

[47] In the "Patient Privacy" section of its website, The Scarborough Hospital advises patients that the hospital will keep personal information confidential; use the information for certain purposes; and not to sell or share any of its patients' personal health information to outside organizations. Similar information and directives are found in the hospital’s Policy & Procedure Manual and in a Privacy of Personal Health Information brochure. The hospital had policies similar to those described above for Rouge Valley.

[48] The Scarborough Hospital employed Nurse Cruz, who, as noted above, was also employed by Rouge Valley. Nurse Cruz was employed by The Scarborough Hospital from April 1989 until September 16, 2013, when her employment came to an end.

[49] As was the case with Rouge Valley, The Scarborough Hospital was unaware of any improper activities at the time when Nurse Cruz’s employment came to an end.

[50] In 2014, after the media reported the breach of patient privacy at Rouge Valley, The Scarborough Hospital investigated the state of patient privacy in its pediatric department and did not find any problems. The Scarborough Hospitals’ President and CEO made a statement that the Rouge Valley incident emphasized the importance of ensuring the confidentiality of patient information that was enshrined in codes of conduct and privacy legislation.

[51] In January 2015, as noted above, the JSOT investigators advised Rouge Valley and The Scarborough Hospital that it had recovered printed labels that it believed Nurse Cruz had given to Ms. Acar of Global. Before JSOT advised the hospitals, The Scarborough Hospital had no knowledge of Nurse Cruz’s activities. Apart from the labels, it had no way of determining whether Nurse Cruz had improperly disclosed patient information while she was at the hospital.

[52] Between May and July 2015, The Scarborough General Hospital notified the 151 patients whose labels had been located at Nurse Cruz’s home. The hospital did not give notice to the 3,529 mothers who had given birth during the time that Nurse Cruz was working at the hospital.

3. Munish Sethi

[53] Mr. Sethi joined Rouge Valley in November 2003. He signed confidentiality agreements and undertook to protect the confidential nature of patient information.

[54] From July 14, 2009 until and not after June 20, 2011, Mr. Sethi was registered with Children’s Education Funds Inc. as a salesperson and later as a dealing representative. In July 2009, Mr. Sethi advised Rouge Valley that he had applied for a part-time position as a sales representative for Children’s Education Funds Inc., an RESP investment dealer. By letter on July 9, 2009, Rouge Valley advised Mr. Sethi that employees were prohibited from soliciting any business from patients to support outside employment.

[55] On July 22, 2013, Mr. Sethi was transferred to a different position at the hospital, and Rouge Valley removed his access to all Meditech modules that contained patient information.

[56] On September 13, 2013, Mr. Sethi asked his manager to reinstate his access to Meditech’s Scheduling Module, stating that he was seeking access to phone numbers of patients who had recently given birth, in order to sell them RESPs. Rouge Valley immediately reported the matter to the Information Privacy Commissioner and to the Ontario Securities Commission.

[57] Rouge Valley also launched an internal investigation. It suspended Mr. Sethi pending the outcome of the investigation. On September 24, 2013, Rouge Valley interviewed Mr. Sethi. He denied that he had inappropriately accessed patients’ information. Rouge Valley was unable from its internal investigation to determine whether Mr. Sethi had accessed the patients’ contact information because the Meditech software only maintained logs of employee access for a two-week rolling period. It, however, was able to satisfy itself that Mr. Sethi had not accessed patients’ electronic health records. Not satisfied with Mr. Sethi’s answers, on October 2, 2013, Rouge Valley terminated his employment.

[58] By November 2014, JSOT completed its investigation into Mr. Sethi. JSOT decided not to lay any charges in relation to Mr. Sethi’s conduct. While there was evidence that Mr. Sethi had from time to time access to hospital records, there is no evidence that he improperly accessed hospital records.

[59] I pause to note that the Plaintiffs have not moved to add Children’s Education Funds Inc. as a party defendant.

4. Knowledge First, the Edrys, CST, Mr. Sulur, and Ms. Bandali

[60] Knowledge First is an investment firm that specializes in RESPs. It is registered with the Ontario Securities Commission. It sells RESPs through a network of branches located across Canada. Each branch has a Branch Director, a Branch Manager, and sales representatives, all of whom are retained as independent contractors. The Branch Director hires and manages sales representatives. The sales representatives are registered with applicable securities regulators, in Ontario, the Ontario Securities Commission. The Branch Manager is responsible for supervising the RESP sales representatives within the branch.

[61] Knowledge First obtains information about prospective clients (“leads”) from a variety of sources including direct inquiries and also referral arrangements with organizations that provide names and contact information with the consent of the person being referred. It sells lead information to Branch Directors. Branch Directors, Branch Managers, and sales representatives may also generate their own leads.

[62] Under a Scholarship Distributor Agreement, Knowledge First appointed Mrs. Edry, who is the spouse of Gavriel Edry, as an independent contractor with a non-exclusive right to RESPs within her territory and to hire salespeople for her branch. Under a Sales Representative Agreement, she was appointed as a non-exclusive sales representative within the province of Ontario.Under the Branch Manager Addendum, Mrs. Edry was appointed Branch Manager. The agreements between Mrs. Edry and Knowledge First required her to comply with all applicable laws and also Knowledge First’s policies. Knowledge First provided Mrs. Edry with training on leads and referral arrangements. Knowledge First’s policies prohibited sales representatives purchasing unlawfully-obtained leads.

[63] Mrs. Edry employed Mr. Edry as an office assistant and not as an RESP sales representative.

[64] Between 1997 and 2014, Mrs. Edry was the Branch Director of a Knowledge First at its branch in Thornhill, Ontario. During this period, Mrs. Edry made the acquaintance of Ms. Bandali and sold her an RESP. After the purchase of the RESP, Ms. Bandali approached Mrs. Edry and offered to refer RESP clients to the Edrys for a small fee. Ms. Bandali provided Mrs. Edry with handwritten lists of names. It was the Edrys’ evidence that they did not know that Ms. Bandali was an employee of Rouge Valley, and that they did not know that Ms. Bandali was obtaining contact information from patient records.

[65] Ms. Bandali also approached Mr. Sulur of CST, which is another RESP investment dealer. Mr. Sulur’s business relationship with CST was similar to Mrs. Edry’s business relationship with Knowledge First. He was an independent contractor whose registration with the Ontario Securities Commission was sponsored by CST. Mr. Sulur signed an agreement with CST that indicated that he was not a joint venturer, partner, or employee or in association with CST. His authority was limited to binding CST to contracts for the sale of securities. Between November 2012 and September 2013, Mr. Sulur purchased contact information from Ms. Bandali.

[66] As noted above, by 2014, JSOT was investigating Ms. Bandali. During the investigation, Ms. Bandali admitted to the investigators that she had sold patient contact information to Ms. Edry, who worked at a Knowledge First branch in Thornhill, and October 28, 2014, JSOT attended at Mrs. Edry’s branch to execute a search warrant to seize records. The same day the search warrant was executed, Knowledge First suspended Ms. Edry.

[67] Meanwhile, on October 31, 2014, Mr. Sulur gave a voluntary statement to the JSOT investigations. He confessed to purchasing names from Ms. Bandali. Between November 2012 and September 2013, Mr. Sulur wrote four cheques to Ms. Bandali, one of which had the notation “193 names.” The cheques totalled $2,082.50. Mr. Sulur admitted that he called some of the names provided by Ms. Bandali. Mr. Sulur said that he made no sales. Mr. Sulur later admitted that he had purchased 1,189 names from Ms. Bandali.

[68] When CST learned about Mr. Sulur’s statement, it commenced its own investigation. It learned that Mr. Sulur had used contact information received from Ms. Bandali. CST terminated its relationship with Mr. Sulur. Mr. Sulur later pleaded guilty to participating in a referral agreement contrary to National Instrument 31-104 of the Ontario Securities Act.

[69] CST submits that Mr. Sulur’s activities were unknown to it, outside the scope of his relationship with CST and not authorized.

[70] Knowledge First undertook an internal investigation of the Edrys. Mrs. Edry admitted to Knowledge First that: (a) she knowingly violated Knowledge First policies and procedures by entering into an unauthorized and unapproved arrangement with Ms. Bandali to purchase leads; (b) she had not advised Knowledge First that she had purchased leads from Ms. Bandali and distributed them to her sales representatives.

[71] On November 13, 2014, Knowledge First terminated its relationship with Mrs. Edry. Its evidence was that it was not aware of her activities with Ms. Bandali until appraised by the JSOT investigation.

[72] In November 2014, Ms. Bandali was charged with trading without a registration contrary to s. 25 (1) of the Ontario Securities Act.

[73] In June 2015, the Ontario Securities Commission laid charges against Mrs. Edry for failing to act fairly, honestly and in good faith with clients, and participating in an unlawful referral arrangement. Mr. Edry was also charged with one count of unregistered trading under the Ontario Securities Act for gathering the confidential information.

[74] On October 13, 2015, Ms. Bandali pleaded guilty to acting contrary to s 25(1) and s.122(1)(c) of the Ontario Securities Act between January 1, 2010 and March 31, 2014. She admitted that she provided Ms. Edry patient names unit March 31, 2014. She was ordered to pay a fine totalling $45,000 and to serve a two-year probationary period with 300 hours of community service.[^7]

[75] On May 24, 2016, Mrs. Edry and Mr. Sulur each pleaded guilty to one count of participating in an improper referral arrangement contrary to National Instrument 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations, and contrary to s.122(1) of the Securities Act. Mr. Sulur admitted purchasing names from Ms. Bandali until May 1, 2014.

[76] Mrs. Edry was sentenced to two years of probation, with three hundred hours of community service; to pay a fine of $45,000; and banned from engaging in any securities-related business until the completion of her community service hours.

[77] Mr. Sulur was sentenced to two years of probation, with one hundred and fifty hours of community service; to pay a $3,750 fine; and banned from engaging in any securities-related business until the completion of his community service hours.

[78] The charges against Mr. Edry were withdrawn.

5. Global, Ms. Acar, and Nurse Cruz

[79] Global RESP Corporation (formerly Global Educational Marketing Corporation) is an investment firm that specializes in RESPs. It is a member of the RESP Dealers Association of Canada and is registered with the Ontario Securities Commission.

[80] Between July 11, 2007 and January 14, 2015, Ms. Acar was a self-employed RESP sales representative of Global. She was licensed and registered with the Ontario Securities Commission. On July 11, 2007, Ms. Acar entered into an agreement with Global. Under the agreement, Ms. Acar was required: (a) to comply with all applicable laws and regulations; (b) to comply with all Global's policies and procedures; (c) to not enter into any secret or unauthorized referral arrangements; and (d) to respect the privacy of prospects and clients.

[81] Ms. Acar was not paid a salary and did not receive any employee benefits. She reported her income annually as self-employed income. She received commission payments based on the number of RESP units sold. She paid for her own cell phone. She operated a home office, and almost of her sales activity occurred outside of Global’s offices. Ms. Acar stored the labels she had received from Nurse Cruz at her home office and not at Global’s offices.

[82] Ms. Acar met Nurse Cruz in January 2012. As noted above, Nurse Cruz worked at Rouge Valley and also at The Scarborough Hospital. In the years that followed, Nurse Cruz sold Ms. Acar at least 315 patients labels that Nurse Cruz had copied from hospital records.

[83] As noted above as a result of the execution of a search warrant, there is physical evidence of the labels from the hospitals, but the Plaintiffs allege that Nurse Cruz actually sold 3,896 labels to Ms. Acar. It is estimated that 3,529 mothers gave birth at the Birchmount site of The Scarborough Hospital between January 1, 2012 and September 30, 2013 when Nurse Cruz’s employment at that hospital ended.

[84] Global says that Ms. Acar’s business dealings with Nurse Cruz were carried out without Global’s knowledge, consent or authorization and were contrary to Global’s policies and procedures.

[85] In June 2014, when the privacy breach at Rouge Valley was reported in the media, Allan Belgraves, a Branch Manager at Global spoke to all RESP sales representatives about the breach. Ms. Acar and the others advised him that they had no knowledge or involvement with the security breach at the hospital.

[86] On July 16, 2014, a complaint against Global was filed with the Office of the Privacy Commissioner of Canada under PIPEDA (the Personal Information Protection and Electronic Documents Act.[^8] The complainant alleged that she had been contacted by Ms. Acar and that Ms. Acar had used information from Rouge Valley to make the contact. In response to the complaint, Mr. Belgraves and Frank Gataveckas, Global's Vice-President of Product Development and Privacy Officer, spoke to Ms. Acar, who again denied any involvement. Ms. Acar did not disclose her relationship with Nurse Cruz.

[87] Meanwhile, in October 2014, Mr. Belgraves of Global met with Ms. Acar once again about the complaint that had been made against Global, and she, once again, denied any involvement with the security breach at Rouge Valley.

[88] On January 14, 2015, JSOT executed a search warrant at Ms. Acar's home. The investigators seized 163 patient labels from Rouge Valley and 151 patient labels from The Scarborough Hospital that Ms. Acar had received from Nurse Cruz. JSOT also sized Ms. Acar’s banking records. The seized banking records revealed that Ms. Acar paid Nurse Cruz $9,740 from between May 2012 to August 2014. Ms. Acar was interviewed and said that she had bought the contact information from Nurse Cruz.

[89] Later in the day on January 14, 2015, Ms. Acar met with Kathleen Strachan, Global’s General Counsel, at Global's head office. Ms. Acar admitted having purchased lists from Nurse Cruz. Global immediately terminated its business relationship with Ms. Acar.

[90] On October 19, 2015, the Privacy Commissioner released its Report of Findings #2015-016 in respect of the complaint against Global entitled "Global RESP Corporation accountable for actions of sales representative for the use of patients' personal information purchased from a Rouge Valley Hospital employee". The PCC concluded that Global had fallen below the applicable standards required by PIPEDA. Global implemented the Report's recommendations.

[91] In May 2016, the College of Nurses of Ontario commenced disciplinary proceedings against Nurse Cruz.

[92] On May 31, 2016, Nurse Cruz pleaded guilty to two counts of receiving secret commissions contrary to s. 426(1)(a) of the Criminal Code. She was sentenced to a six-month conditional sentence (the first three months being house arrest); two years’ probation with conditions; and three hundred and forty hours of community service.

[93] On May 31, 2016, Ms. Acar pleaded guilty to one count of receiving secret commissions contrary to section 426(1) of the Criminal Code and one count of uttering a forged document contrary to section 368(1)(b) of the Criminal Code. She admitted purchasing names from Nurse Cruz between January 1, 2012 and August 30, 2014. She was sentenced to a six-month conditional sentence (the first three months being house arrest); two years’ probation with conditions; and three hundred and forty hours of community service.

[94] On November 8, 2016, Nurse Cruz resigned from the College of Nurses of Ontario.

6. Elia Broutzas

[95] On July 1, 2013, Ms. Broutzas, who resides in Oshawa, Ontario, was admitted to Rouge Valley. She gave birth to her son. After her discharge from the hospital, Ms. Broutzas received telephone calls from Ms. Acar of Global regarding RESP investments. For the following ten months, until she changed her phone number, Ms. Broutzas received numerous calls from RESP sales representatives. Ms. Broutzas did not purchase an RESP. In December 2013, Ms. Broutzas received a letter from Rouge Valley advising of a privacy breach. In her Statement of Claim, Ms. Broutzas alleges that as a result of the privacy breach, she suffered distress, humiliation, and anguish. During her cross-examination, she said that she did not think much of the calls.

[96] Knowledge First's records indicate that it had received Ms. Broutzas's contact information from an authorized referral source. Knowledge First, however, did not use the information, and did not contact Ms. Broutzas because she was registered on the National Do Not Call List, and the referral source did not have her consent that she could be contacted despite the Do Not Call List.

7. Chantel Drummond

[97] On June 11, 2011, Ms. Drummond, who resides in Scarborough, Ontario, was admitted to Rouge Valley at the Centenary campus, where she gave birth to her son. Ms. Drummond announced her son’s birth on social media posting photos and information about his date of birth and name. During her hospital stay and after her discharge from the hospital, Ms. Drummond received telephone calls from a Knowledge First salesperson regarding RESP investments. The representative was a Lorraine Balshin, who is not associated with the Edrys. Ms. Balshin did not receive the contact information for Ms. Drummond from the Edrys or Ms. Bandali. Rather, the contact information was obtained from three legitimate sources and from authorized referral arrangements. Ms. Drummond had consented to the release of her personal information from these sources.

[98] Ms. Drummond purchased an RESP in June 2011. After March 2012, Ms. Drummond stopped making contributions to the RESP. In December 2013, Ms. Drummond received a letter from Rouge Valley advising of a privacy breach. Ms. Drummond alleges that as a result of the privacy breach, she suffered distress, humiliation, and anguish. Three years later in November 2015, Ms. Drummond advised Knowledge First that she wished to cancel her RESP, but she did not do so when she learned that she would not be eligible to have any funds returned to her.

8. Anne Kouvas

[99] On July 9, 2012, Ms. Kouvas, who resides in Pickering, Ontario, was admitted to The Scarborough Hospital, where she gave birth to a son. Ms. Kouvas received numerous telephone calls from RESP sales representatives, including Mr. Acar of Global regarding RESP investments. Ms. Kouvas did not purchase an RESP. In May 2015, Ms. Kouvas was one of the recipients of the letter written by The Scarborough Hospital about the Nurse Cruz matter. In her Statement of Claim, Ms. Kouvas alleges that as a result of the privacy breach, she suffered disbelief, distress, humiliation, and anguish. During cross-examination, Ms. Kouvas stated that she was not overly concerned about the sales calls she received.

9. Ana-Luiza Leibner-Peixoto.

[100] In August 2013, Ms. Leibner-Peixoto, who resides in Ajax, Ontario, was admitted to Rouge Valley where she gave birth to her second child. A few weeks later, Wioletta Falcone, a Knowledge First sales representative, phoned and asked Ms. Leibner-Peixoto if she was interested in purchasing an RESP. Ms. Leibner-Peixoto said she wanted to speak with her husband first. Subsequently, a meeting was arranged in September 2013 at the Leibner-Peixoto home. The Leibner-Peixotos said that they would contact Ms. Falcone if they decided to purchase an RESP. They decided against making a purchase. In late 2013, Ms. Leibner-Peixoto received a notice from Rouge Valley about the privacy breach at Rouge Valley. She alleges that as a result of the privacy breach, she suffered distress, humiliation, and anguish.

10. Melany Marcinkowski

[101] On February 27, 2013, Melany Marcinkowski, who resides in Lakeshore, Ontario, was admitted to Rouge Valley’s Ajax-Pickering site where she gave birth to her first child. Some months earlier, a family friend had referred Ms. Marcinkowskis to Charles Garvey, a RESP sales representative for CST, and on March 5, 2013, the Marcinkowskis purchased an RESP from Mr. Garvey. From time to time, thereafter, there were communications with CST about the administration of the investment. In the months following the birth of her child, and up until May 2014, Ms. Marcinkowski received three or four telephone calls from RESP sales representatives. She advised the callers that she had already purchased an RESP.

[102] On January 29, 2014, Mr. Marcinkowski submitted a ballot as part of a national contest in which he consented to receiving additional communications from CST regarding its products and upcoming contests and promotions.

[103] In August 2014, Mrs. Marcinkowski received a letter from Rouge Valley advising of a privacy breach. Mrs. Marcinkowski alleges that as a result of the privacy breach, she suffered distress, humiliation, and anguish.

[104] On October 28, 2014, Mr. Marcinkowski completed a further application to arrange another RESP account. In the application, the Marcinkowskis asked to receive ongoing communication from CST regarding special offers and promotions. The Marcinkowskis purchased a second RESP in November 2014 and began making contributions in December 2014. From time to time, thereafter, there were communications with CST about the administration of the investment. During her cross-examination, Mrs. Marcinkowski said that she was pleased with the RESP investments for her children.

11. Miscellaneous Facts

[105] Mr. Sethi, Ms. Bandali, and Nurse Cruz did not collaborate and the methodologies of their alleged intrusions on patient information were different; visualize Nurse Cruz’s taking of patient labels had no connection with the methods of Ms. Bandali, and there is no proof that Mr. Sethi wrongfully accessed or used patient records.

[106] All the proposed Representative Plaintiffs announced the news of their pregnancy and of the birth of their children to family, friends, and colleagues, and some notified numerous “friends” on Facebook.

[107] Before the alleged intrusions on Rouge Valley’s of The Scarborough Hospital’s records, all of the proposed Representative Plaintiffs in various ways had consented to being contracted by RESP investment dealers or RESP sales representatives.

[108] There is no evidence that CST knew about the misconduct of Mr. Sulur before the discoveries made by Rouge Valley and the regulators.

[109] There is no evidence that Global knew about the misconduct of Ms. Acar before the discoveries made by Rouge Valley and the regulators.

[110] There is no evidence that Knowledge First knew about the misconduct of Mrs. Edry and Mr. Edry before the discoveries made by Rouge Valley and the regulators.

[111] At no time has the Ontario Securities Commission sanctioned or charged CST, Global, or Knowledge First. Global was investigated by the Privacy and Information Commissioner.

[112] Proposed class counsel are Spiteri & Ursulak, LLP.

[113] Five hundred and thirty-three persons contacted proposed Class Counsel with respect to the Broutzas v. Rouge Valley Health System action, and four persons contacted proposed Class Counsel for the Kouvas v. Scarborough and Rouge Hospital action.

[114] The Plaintiffs estimate the class size to be approximately 14,000 persons for the Broutzas v. Rouge Valley Health System action and approximately 12,000 for the Kouvas v. Scarborough and Rouge Hospital action.

[115] There is no evidence that any health records such as clinical notes or examination reports were disclosed as a result of any privacy breach. There is evidence that patient contact information was given to Ms. Acar, the Edrys, and Mr. Sulur but no evidence that the contact information was given to any others. There is no evidence that the Plaintiffs in both actions or any putative class member have suffered any identify theft, any financial loses, or any serious or prolonged mental injury that rises above the ordinary annoyances, anxieties and fears that people living in society routinely experience.

E. Certification: General Principles

[116] The court has no discretion and is required to certify an action as a class proceeding when the following five-part test in s. 5 of the Class Proceedings Act, 1992 is met: (1) the pleadings disclose a cause of action; (2) there is an identifiable class of two or more persons that would be represented by the representative plaintiff; (3) the claims of the class members raise common issues; (4) a class proceeding would be the preferable procedure for the resolution of the common issues; and (5) there is a representative plaintiff who: (a) would fairly and adequately represent the interests of the class; (b) has produced a plan for the proceeding that sets out a workable method of advancing the proceeding on behalf of the class and of notifying class members of the proceeding, and (c) does not have, on the common issues for the class, an interest in conflict with the interests of other class members.

[117] For an action to be certified as a class proceeding, there must be a cause of action shared by an identifiable class from which common issues arise that can be resolved in a fair, efficient, and manageable way that will advance the proceeding and achieve access to justice, judicial economy, and the modification of behaviour of wrongdoers.[^9] On a certification motion, the question is not whether the plaintiff's claims are likely to succeed on the merits, but whether the claims can appropriately be prosecuted as a class proceeding.[^10] The test for certification is to be applied in a purposive and generous manner, to give effect to the goals of class actions; namely: (1) providing access to justice for litigants; (2) encouraging behaviour modification; and (3) promoting the efficient use of judicial resources.[^11]

[118] The purpose of a certification motion is to determine how the litigation is to proceed and not to address the merits of the plaintiff's claim; there is to be no preliminary review of the merits of the claim.[^12] However, the plaintiff must show “some basis in fact” for each of the certification criteria other than the requirement that the pleadings disclose a cause of action.[^13] In the context of the common issues criterion, the "some basis in fact" standard involves a two-step requirement that: (1) the proposed common issue actually exists; and (2) the proposed issue can be answered in common across the entire class.[^14]

[119] The “some basis in fact” test sets a low evidentiary standard for plaintiffs, and a court should not resolve conflicting facts and evidence at the certification stage or opine on the strengths of the plaintiff’s case.[^15] In particular, there must be a basis in the evidence to establish the existence of common issues.[^16] To establish commonality, evidence that the alleged misconduct actually occurred is not required; rather, the necessary evidence goes only to establishing whether the questions are common to all the class members.[^17]

[120] The representative plaintiff must come forward with sufficient evidence to support certification, and the opposing party may respond with evidence of its own to challenge certification.[^18] Certification will be denied if there is an insufficient evidentiary basis for the facts on which the claims of the class members depend.[^19]

[121] On a certification motion, evidence directed at the merits may be admissible, if it also bears on the requirements for certification but, in such cases, the issues are not decided on the basis of a balance of probabilities, but rather on the much less stringent test of some basis in fact.[^20] The evidence on a motion for certification must meet the usual standards for admissibility.[^21] While evidence on a certification motion must meet the usual standards for admissibility, the weighing and testing of the evidence is not meant to be extensive, and if the expert evidence is admissible, the scrutiny of it is modest.[^22]

F. Cause of Action Criterion

1. General Principles: Cause of Action Criterion

[122] The first criterion for certification is that the plaintiff's pleading discloses a cause of action. The "plain and obvious" test for disclosing a cause of action from Hunt v. Carey Canada,[^23] is used to determine whether a proposed class proceeding discloses a cause of action for the purposes of s. 5(1)(a) of the Class Proceedings Act, 1992. To satisfy the first criterion for certification, a claim will be satisfactory, unless it has a radical defect, or it is plain and obvious that it could not succeed.[^24]

[123] In a proposed class proceeding, in determining whether the pleading discloses a cause of action, no evidence is admissible, and the material facts pleaded are accepted as true, unless patently ridiculous or incapable of proof. The pleading is read generously, and it will be unsatisfactory only if it is plain, obvious, and beyond a reasonable doubt that the plaintiff cannot succeed.[^25]

2. Analysis: Cause of Action Criterion

(a) Intrusion upon Seclusion

[124] In this section of my Reasons for Decision, I conclude that the Plaintiffs’ claim for intrusion on seclusion – as pleaded - satisfies the cause of action criterion as against Ms. Bandali, Nurse Cruz, and Mr. Sethi, but the Plaintiffs’ claim for intrusion on seclusion – as pleaded - does not satisfy the cause of action criterion as against Ms. Acar, the Edrys, and Mr. Sulur. In this section, of my Reasons for Decision, I also conclude that in the actual factual circumstances of the immediate case, it is plain and obvious that the Plaintiffs do not have a reasonable cause of action for intrusion on seclusion.

[125] The reason that the claim for intrusion on seclusion – as pleaded - passes muster as against Ms. Bandali, Nurse Cruz, and Mr. Sethi is that for the purposes of the cause of action criterion, I am obliged to assume that the pleaded facts in the Statement of Claim are true and capable of proof. In my opinion, those assumed to be true material facts constitute a reasonable cause of action for intrusion on seclusion as against Ms. Bandali, Nurse Cruz, and Mr. Sethi (but not as against Ms. Acar, the Edrys and Mr. Sulur). Thus, contrary to what everybody acknowledges to be the case that no medical information was intruded upon, I assume that highly personal or confidential information was disclosed by Ms. Bandali, Nurse Cruz, and Mr. Sethi, and I, therefore, conclude that the cause of action criterion for intrusion on seclusion has been satisfied as against them.

[126] I cannot under the rubric of the cause of action criterion, however, address the circumstance that in the immediate case although there are assumed facts, there is actually no basis in fact for a reasonable cause of action for intrusion on seclusion. Technically speaking, in the immediate case, under the rubric of the cause of action criterion, I cannot address whether there is a reasonable cause of action for intrusion on seclusion, based on the true and acknowledged facts that only patient contact information was intruded upon and that there was no intrusion on the medical records of the patients. Technically speaking, the some-basis-in-fact analysis comes later under the rubric of the other certification criterion.

[127] It is under the rubric of the other certification criteria, most particularly the common issues criterion, where the court can screen the case for a cause of action that actually exists that is shared by an identifiable class that actually exists. Notwithstanding these technicalities of the analysis of the certification criteria, I shall not postpone the analysis of the tenable causes of action until the discussion of the common issues criterion; rather, I shall address in this part of my Reasons for Decision, the issue of whether the Plaintiffs actually have some basis in fact for a cause of action for intrusion on seclusion.

[128] In this last regard, I conclude that in the factual circumstances of the immediate case, it is plain and obvious that the Plaintiffs do not have a reasonable cause of action for intrusion on seclusion. Put simply, there is intrusion but not an intrusion on seclusion.

[129] Turning to the analysis that leads me to the above conclusions, the discussion must begin with the decision of the Ontario Court of Appeal in Jones v. Tsige.[^26]

[130] The facts were that although both were employed by the Bank of Montreal, Ms. Tsige and Ms. Jones were strangers one to another. There was, however, a connection between them. Ms. Tsige had had a common law relationship with Ms. Jones’ former husband. Contrary to Bank of Montreal policy, Ms. Tsige scrutinized Ms. Jones’ banking records at least 174 times. The banking records included Ms. Jones’ date of birth, marital status, address, and transaction details. Ms. Tsige did not publish, distribute, or record the information she scrutinized. She said in accessing the records that she was confirming whether her common law husband, with whom she had a financial dispute, was paying his ex-wife, Ms. Jones, child support.

[131] Based on these facts, reversing the motion court judge, who on a summary judgment motion had held that Ontario law does not recognize the tort of breach of privacy and who had dismissed Mr. Jones’ action, the Ontario Court of Appeal held that Ontario law does recognize a right to bring a civil action for damages for invasion of personal privacy.

[132] Justice Sharpe (Chief Justice Winkler and Associate Chief Justice Cunningham of the Superior Court, sitting ad hoc, concurring) wrote the judgment of the Court of Appeal. It was a ground-breaking decision, because apart from statutes that provide a statutory cause of action for breach of privacy, it was unclear whether Canadian law recognized a common law cause of action for damages for the invasion of privacy.

[133] Although the matter of a privacy tort had been debated for decades and was the subject of significant development in the United States, the consensus in Canada was that there was no free-standing common law claim for invasion of privacy, save perhaps for misappropriation of personality.[^27]

[134] In the United States, the seminal works about privacy in the civil law sphere were S.D. Warren & L.D. Brandeis, "The Right to Privacy" (1890)[^28] and William L. Prosser, "Privacy" (1960).[^29] In the United States, most state jurisdictions accepted Prosser's classification of a four-tort catalogue of privacy torts. This classification scheme was adopted by the American Restatement (Second) of Torts (2010); namely; (1) intrusion upon seclusion, solitude, or private affairs; (2) public disclosure of embarrassing private facts; (3) publicity that places the plaintiff in a false light in the public eye; and (4) appropriation for the defendant's advantage, of the plaintiff's name or likeness.

[135] Justice Sharpe essentially adopted the American classification scheme, and he said that the tort that was relevant to Ms. Jones’ case was intrusion upon seclusion, which was described by the Restatement as: “one who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person.”

[136] Justice Sharpe went on to accept intrusion on seclusion as part of the law of Ontario.[^30] For present purposes, the constituent elements of the tort of inclusion on seclusion are explained by Justice Sharpe in paragraphs 70 to 73 of his judgment. In paragraphs 74-88, he addresses the matter of damages, the proof of which he held was not an element of the cause of action. For the present purposes of analyzing the cause of action criterion, I need only to set out paragraphs 70 to 73 of Justice Sharpe’s judgment, which state:

Elements

70. I would essentially adopt as the elements of the action for intrusion upon seclusion the Restatement (Second) of Torts (2010) formulation which, for the sake of convenience, I repeat here:

One who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person.

71. The key features of this cause of action are, first, that the defendant's conduct must be intentional, within which I would include reckless; second that the defendant must have invaded, without lawful justification, the plaintiff's private affairs or concerns; and third, that a reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish. However, proof of harm to a recognized economic interest is not an element of the cause of action. I return below to the question of damages, but state here that I believe it important to emphasize that given the intangible nature of the interest protected, damages for intrusion upon seclusion will ordinarily be measured by a modest conventional sum.

Limitations

72. These elements make it clear that recognizing this cause of action will not open the floodgates. A claim for intrusion upon seclusion will arise only for deliberate and significant invasions of personal privacy. Claims from individuals who are sensitive or unusually concerned about their privacy are excluded: it is only intrusions into matters such as one's financial or health records, sexual practices and orientation, employment, diary or private correspondence that, viewed objectively on the reasonable person standard, can be described as highly offensive.

73. Finally, claims for the protection of privacy may give rise to competing claims. Foremost are claims for the protection of freedom of expression and freedom of the press. As we are not confronted with such a competing claim here, I need not consider the issue in detail. Suffice it to say, no right to privacy can be absolute and many claims for the protection of privacy will have to be reconciled with, and even yield to, such competing claims. A useful analogy may be found in the Supreme Court of Canada's elaboration of the common law of defamation in Grant v. Torstar where the court held, at para. 65, that "[w]hen proper weight is given to the constitutional value of free expression on matters of public interest, the balance tips in favour of broadening the defences available to those who communicate facts it is in the public's interest to know."

[137] From these passages from Jones v. Tsige, it may be seen that the main elements of the tort of intrusion on seclusion are: (1) intentional or reckless conduct by the defendant; (2) that the defendant invaded, without lawful justification, the plaintiff's private affairs or concerns; and, (3) that a reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish.[^31]

[138] It may also be seen that the tort of intrusion on seclusion is only for significant invasions of personal privacy. The tort is concerned only with significant information such as financial records, health records, sexual practices, sexual orientation, employment, diary, or private sensitive correspondence or records. The tort is only for intrusions that, viewed objectively, a reasonable person would regard as highly offensive. The Court of Appeal was at pains to make it clear that recognizing intrusion on seclusion as a cause of action would not open the floodgates of claims based on invasion of privacy.

[139] These passages from Justice Sharpe’s decision also reveal several matters that in addition to the matter of damages and its calculation may raise defences and matters relevant to the class definition, common issues, and preferable procedure criterion. Of these matters, I highlight that Justice Sharpe indicated that claims from individuals who are sensitive or unusually concerned about their privacy are excluded. In other words, a subjective concern about privacy that does not meet the reasonable person standard is not actionable.

[140] With the background to intrusion on seclusion, I return to the case at bar and the Plaintiffs’ Statement of Claim. In the immediate case, after a recitation of some of the facts described above in the facts portion of these Reasons for Decision about the movement of personal information from Ms. Bandali, Nurse Cruz, and Mr. Sethi to Ms. Acar, the Edrys and Mr. Sulur, the Second Fresh as Amended Consolidated Statement of Claim in the Broutzas v. Rouge Valley Health System action sets out the Plaintiffs’ claim for intrusion upon seclusion in paragraphs 55 to 57 as follows:

INTRUSION UPON SECLUSION

55. The actions of the Rouge Valley Employees and the RESP Company Employees constitute intentional or reckless intrusions upon seclusion that would be highly offensive to a reasonable person, and for which all Defendants are liable, either vicariously or based on their own acts.

56. The Defendants invaded, with no lawful justification, the Plaintiffs’ and other Class Members’ private affairs or concerns.

57. The Defendants’ invasion was highly offensive, causing distress, humiliation, and anguish to the Plaintiffs and other Class Members.

[141] As noted above, I conclude that that the Plaintiffs’ claim for intrusion on seclusion – as pleaded - satisfies the cause of action criterion as against Ms. Bandali, Nurse Cruz, and Mr. Sethi but the pleading does not satisfy the cause of action criterion as against Ms. Acar, the Edrys, and Mr. Sulur.

[142] Recalling that there is no allegation of conspiracy, the intrusion on seclusion claim against Ms. Acar, the Edrys, and Mr. Sulur is doomed to failure because they did not intrude or invade the hospital records containing personal medical information recklessly or willfully- that was what Ms. Bandali, Nurse Cruz, and Mr. Sethi did before the involvement of the RESP sales representatives. Ms. Acar, the Edrys, and Mr. Sulur were neither joint nor several tortfeasors with respect to the intrusion on the hospitals’ data about hospital patients. Ms. Acar’s, the Edrys’, and Mr. Sulur’s did not use medical or financial information, and their phoning of the putative Class Members to sell RESPs cannot be viewed as an invasion. Moreover, if accepting just contact information without screening its source is an intrusion, it is not one that a reasonable person would regard as offensive.

[143] I, therefore, conclude that, technically speaking, the Plaintiffs in the Broutzas action satisfy the cause of action criterion for intrusion on seclusion but only as against Ms. Bandali, Nurse Cruz, and Mr. Sethi and that Ms. Kouvas satisfies the cause of action criterion for intrusion on seclusion only as against Nurse Cruz.

[144] I turn now to the question of whether there is some basis in fact for a reasonable cause of action for inclusion on seclusion based on the circumstances for which there is actually some basis in fact. This brings me to the arguments of Rouge Valley and The Scarborough Hospital, CST, Global, and Knowledge First that there is no basis in fact for a viable intrusion on seclusion cause of action based just on contact information.

[145] Rouge Valley argues that the privacy torts recognized by the Court of Appeal in Jones v. Tsige, were designed to be narrow and circumscribed by privacy factors that are not satisfied in the circumstances of the immediate case.

[146] Rouge Valley submits that the evidence for the certification motions reveals that the Plaintiffs do not have provable material facts that would constitute the tort of intrusion on seclusion.

[147] Rouge Valley and The Scarborough Hospital concede that there was a wrongful intrusion by its employees, but all the Defendants submit that the disclosure of just contact information about women who recently gave birth is not a culpable invasion of personal privacy.

[148] Rouge Valley submits that there may have been intrusion, but that there was no seclusion. In arguments that are adopted and reiterated in whole or in part by CST, Global, and Knowledge First, Ms. Acar, and the Edrys, Rouge Valley submits that in the case at bar, there was no intrusion about the private affairs of the proposed class members because contact information is not private information about which the Class Members would either subjectively or objectively have an expectation of privacy.

[149] Further, Rouge Valley and The Scarborough Hospital submit that the invasion and disclosure of contact information in the circumstances of the immediate case is neither highly offensive nor a significant invasion of personal privacy. Rouge Valley points out that contact information is publicly available and routinely disclosed by people who need and want to be known and to be located. Contact information is routinely disclosed and used and in the course of the everyday activities of giving or getting goods and services and in living in a civil society.

[150] Further, all the Defendants argue that the cross-examinations of the proposed Representative Plaintiffs in the immediate case are illustrative that the circumstances of the immediate case do not fall within the ambit of the tort of intrusion on seclusion. The Defendants point out that while it was easy enough for the Representative Plaintiffs to depose in their affidavits that they were upset by notice of what had happened at the hospitals, they were all honest to admit that the sales calls from the RESP sales representatives were a very minor nuisance and not offensive or hard to take, if the calls caused any bother at all.

[151] I generally agree with the Defendants’ arguments. It is plain and obvious in the case at bar that there is no tenable cause of action for intrusion on seclusion because there was no significant invasion of personal privacy and a reasonable person would not find the disclosure of contact information without the disclosure of medical, financial, or sensitive information, offensive or a cause for distress humiliation and anguish. The contact information that was the objective of the intrusion in the immediate case was not private, there was not a significant invasion of privacy, and the invasion of privacy was not highly offensive to an objective person.

[152] In other words, in the immediate case, it is not the case that the disclosure of just contact information intrudes on the class members’ significant private affairs and concerns, and in the immediate case, it is not the case that the disclosure of contact information would be highly offensive to a reasonable person and cause her distress, humiliation, and anguish.

[153] Generally speaking, there is no privacy in information in the public domain, and there is no reasonable expectation in contact information, which is in the public domain, being a private matter. Contact information is publicly available and is routinely and readily disclosed to strangers to confirm one’s identification, age, or address. People readily disclose their address and phone number to bank and store clerks, when booking train or plane tickets or when ordering a taxi or food delivery. Many people use their health cards for identification purposes. Save during the first trimester, the state of pregnancy, and the birth of child is rarely a purely private matter. The news of an anticipated birth and of a birth is typically shared and celebrated with family, friends, and colleagues and is often publicized. The case at bar is illustrative. All the proposed representative plaintiffs were not shy about sharing the news of the newborns.

[154] The above conclusions that there is no viable cause of action for intrusion on seclusion in the immediate case is supported by the case law.

[155] In Powell v Shirley,[^32] the Powells entered into an agreement to purchase a property owned by the Shirleys. Before the scheduled closing of the transaction, the Powells entered into possession of the Shirley’s property, and after a series of failed closing, the transaction did not close, and the Powells were evicted from the property. The Powells sued the Shirleys and also the lawyers who acted for the Shirleys. The lawyers moved to have a plethora of claims dismissed for not showing a cause of action, and they also moved for summary judgment. Amongst the claims against the lawyers was a claim for intrusion upon seclusion, because the lawyers had obtained a credit report about the Powells and the Powells pleaded that there thus had been a harmful intrusion on their privacy.

[156] Justice Leach concluded that the Powells had pleaded a reasonable cause of action for intrusion for seclusion, but he summarily dismissed the claim on a motion for summary judgment. Justice Leach held that although the information contained in a credit report was financial information, it was not information in respect of which the Powells had a privacy interest. Information in credit reports about whether the Powells were judgment debtors was a matter of public record and non-private and there was no reasonable expectation of privacy. Further, Justice Leach held that a reasonable person knowing all the circumstances would not regard the obtaining of a credit report as highly offensive. Moreover, the lawyers had done nothing with the credit report other than put it their file, and, thus, Justice Leach concluded that any invasion of the Powell’s privacy interest was not significant. Justice Leach also held the lawyers had a lawful justification for obtaining a credit report to which the Powells’ privacy interest, if any, must yield. At the time when the lawyers sought the credit report there were serious doubts about whether the Powells had the resources to complete the real estate transaction and had commenced litigation against the Shirleys and against the lawyers with respect to the transaction.

[157] Although the facts of the Powell v Shirley are obviously far different than the facts of the immediate case, Justice Leach’s application of the law from Jones v. Tsige is informative for the immediate case. In the case at bar, it similarly may be said that the Class Members have no reasonable expectation in privacy in contact information and that a reasonable person knowing all the circumstances would not regard the obtaining of contact information as highly offensive and that using the contact information to offer to sell RESPs was not a significant invasion of privacy. While it is undoubtedly the case that medical records about a person’s physical and mental health are highly sensitive and highly confidential,[^33] in the case at bar, no medical information was disclosed and what was disclosed to the RESP investment dealers was contact information that many of the Class Members would have already disclosed at maternity, baby, and kid clothing stores or at trade shows.

[158] Powell v. Shirley, was followed in Larizza v. Royal Bank of Canada,[^34] where a claim for intrusion on seclusion against a landlord for making a credit check of an occupant of an apartment without her consent was dismissed. Although the landlord’s conduct was intentional and potentially unlawful under PIPEDA, the information in the credit report was not information about the plaintiff’s private affairs or concerns and a reasonable person would not regard the landlord’s actions as highly offensive, causing humiliation or anguish.

[159] In Rancourt Cairns v. Saint Croix Printing and Publishing Company Ltd.,[^35] the New Brunswick Court of Queen’s Bench ruled that there is no expectation of privacy with respect to a public posting on Facebook, and the court declined to find that the plaintiff’s employer had invaded her private affairs by accessing her Facebook page.

[160] In the American case, Busse v. Motorola, Inc.,[^36] a cell phone service provided customer data to a third party studying cell phone safety. The service disclosed the customers’ names, street addresses, cities, states, zip codes, dates of birth, social security numbers, wireless phone numbers, account numbers, start of service dates, and the electronic serial numbers of the customers’ phones. The Appellate Court of Illinois held that matters of public record such as a person’s name, address, date of birth and fact of marriage are not private facts for the purposes of intrusion upon seclusion.

[161] In the American case, Nelson v Jesson,[^37] a government employee accessed driver’s licence information of approximately 1,100 individuals. The license information included a person’s full name, address, birthdate, driver’s license number, driver’s license status, height, weight, eye color, and driver’s license photo. In a proposed class action, the Minnesota District Court found there could be no reasonable expectation of privacy with respect to a driver’s license since it is routinely shown to strangers upon request to confirm identification or age to bartenders, store or bank clerks, employers, security guards, police, etc. and the court noted that similar information is publicly available. The court dismissed the action.

[162] In the American case, Cooney v. Chicago Public Schools,[^38] the Chicago Public School Board inadvertently mailed a list containing the names of 17,000 former employees along with their addresses, social security numbers, marital status, medical and dental insurers and health insurance plan information. The Appellate Court of Illinois upheld a decision to refuse to certify a class action. The Appellate Court distinguished personal information (e.g. names and social security numbers) from private facts: only the latter are potentially embarrassing and highly offensive if disclosed. The Court denied certification because, without an intrusion on private facts, there can be no viable claim for intrusion upon seclusion.

[163] Several cases that my own legal research extracted and the cases relied on by the Plaintiffs to support their claims for intrusion on seclusion are distinguishable from the immediate case, and these cases generally support rather than weaken the Defendants’ arguments that the intrusion on privacy in the immediate case does not support a tenable cause of action for intrusion on seclusion.

[164] The certification cases relied upon by the Plaintiffs concern information that is objectively private and none of these cases support certification where only contact information is the privacy interest intruded upon.

[165] Daniells v. McLellan,[^39] Hynes v. Western Regional Integrated Health Authority[^40] and Hemeon v. South West Nova District Health Authority[^41] are all health care cases where there was an intrusion into the plaintiffs’ health records. Jones v. Tsige, described above, and Evans v. Bank of Nova Scotia[^42] involved access to banking records and the disclosure of private financial information. See also Drew v. Walmart Canada Inc.,[^43] M.M. v. Family and Children's Services of Lanark Leeds and Grenville,[^44] and Doucet v. Royal Winnipeg Ballet (c.o.b. Royal Winnipeg Ballet School),[^45] where the intrusion on seclusion were serious invasions of the class members’ private matters and involved more than just contact information.

[166] In Hopkins v. Kay,[^46] Justice Edwards dismissed a motion to strike a claim for intrusion on seclusion. At first blush, the facts of Hopkins v. Kay are similar to the case at bar because the case involved a disclosure of contact information. In Hopkins v. Kay, persons from Sir Sanford College and seven employees of the Peterborough Regional Health Centre accessed 280 patient records at the Health Centre and disclosed the information to unknown third parties without the consent of the patients of the Health Centre. One of the plaintiffs who feared suffering harm at the hands of her ex-husband, alleged that he paid someone to access her patient records to hunt her down.

[167] In Hopkins v. Kay, the Health Centre argued PHIPA exclusively occupied the field for civil breach of privacy claims and that the intrusion on seclusion claim was precluded by PHIPA. The Health Centre submitted that this point had not been argued in Jones v. Tsige. Justice Edwards, however, held that it was not plain and obvious that the inclusion on seclusion was precluded by the statute. The Health Centre appealed, and in another decision written by Justice Sharpe (Justices van Rensburg and Pardu concurring), the Court of Appeal upheld Justice Edward’s decision.

[168] Hopkins v. Kay is only superficially of assistance to the Plaintiffs in the immediate case. As explained above, the Plaintiffs satisfy the cause of action criterion for the pleaded claim for intrusion on seclusion, which as pleaded is very similar to the pleaded claim in Hopkins v. Kay. However, the problem for the Plaintiffs is that it is plain and obvious that the actual circumstances of the immediate case do not satisfy the constituent elements of the tort of intrusion on seclusion. In the case at bar, contact information was disclosed to RESP sales representatives who posed no threat to the physical security of the Class Members and there was no disclosure of sensitive medical or financial information.

[169] In Condon v. Canada,[^47] the federal Ministry of Human Resources and Skills Development that administered the Canada Student Loan Program lost an unencrypted hard drive that included the names, dates of birth, addresses, Social Insurance Numbers (“SINs”) and student loan balances of 583,000 persons. The plaintiffs in a proposed class action alleged: (a) breach of contract; (b) intrusion upon seclusion; (c) negligence; (d) breach of confidence; and (e) violation of Quebec law. Justice Gagné certified the claims for breach of contract, and intrusion on seclusion and the Federal Court of Appeal added the claims for negligence and breach of confidence. With respect to the claim for intrusion on seclusion, at para. 59, Justice Gagné rejected Canada’s argument that the information was not private and involved only basic biographical information. Justice Gagné said that the information was not just basic biographical information but rather was financial records about the existence of a debt obligation. In the case at bar, the contact information is just contact information and no medical information or financial information or embarrassing information is implicated.

[170] In Tucci v. Peoples Trust Co.,[^48] Peoples Trust, a federally incorporated trust company, offered its customers an online application form to obtain a savings account. The database was compromised by hackers located in China. After the intrusion, People Trust notified 13,000 customers that they were at risk of identify theft. The plaintiffs brought a proposed class action for breach of contract, negligence, breach of confidence, breach of privacy, and intrusion on seclusion. Justice Masuhara of the British Columbia Supreme Court certified all of the claims, except the claims for breach of confidence, which had not been properly pleaded, and the claim for inclusion on seclusion based on British Columbia common law. Justice Masuhara held that juridically, it was plain and obvious that there was no reasonable cause of action under British Columbia common law because of binding precedents holding against the existence of the cause of action. However, it was not plain and obvious that there was no federal common law tort of intrusion upon seclusion. Of the tort based on federal law, Justice Masuhara stated at para. 152:

152. Further, if the federal common law recognizes the tort of intrusion upon seclusion, the plaintiff has pleaded all the required elements. While it may be a stretch to call the disclosure here reckless, it is not plain and obvious that this must fail. It is also a stretch to say that the defendant invaded the plaintiff's private affairs, as that was done by a third party. However, it does not appear plain and obvious to me at this stage that being sufficiently reckless may not result in that conduct in effect being attributed to the defendant. This is a relatively new tort and it should be allowed to develop through full decisions. The information concerned here is also the type of information identified in Jones the disclosure of which might be regarded by the reasonable person as highly offensive.

[171] For present purposes, the feature of the Tucci v. Peoples Trust Co.,[^49] case that distinguishes it from the case at bar is that the leaked information in the Tucci case exposed the Class Members to identify theft and financial loss. Thus, the intrusion was a significant invasion of personal privacy that would be highly offensive to a reasonable person and cause him or her distress. In the immediate case, there is no actual threat of identify theft, and the Class Members were exposed only to RESP sales pitches and they retained the autonomy to make their own financial decisions about whether to invest in the RESPs.

[172] In Bennett v. Lenova (Canada Inc.),[^50] a computer manufacturer bundled a software program ancillary to the computer’s operating system software. One version of the software had a security defect that would permit a hacker to obtain the computer user’s private information. A second version of the software sent private information to the software developer’s computers. The certification motion began before Justice Belobaba. He held that among other causes of action, an action for intrusion on seclusion satisfied the cause of action criterion for certification. I completed the certification motion and concluded that the other certification criterion were satisfied. Bennett v. Lenova (Canada Inc.) is similar to Tucci v. Peoples Trust Co. in that the class members were exposed to a significant intrusion on the seclusion of their personal information of all types including financial, medical, and intimate thoughts stored on their personal computers about their personal interests and habits.

[173] I, therefore, conclude, that while, technically speaking, the Plaintiffs satisfy the cause of action criterion for intrusion on seclusion there is no basis in fact for a common issue for intrusion on seclusion.

[174] This conclusion is not to condone the confessed misconduct of Ms. Bandali and Nurse Cruz or the misconduct of Mr. Sethi, if any. Nor is it to condone any breaches of PHIPA, PIPEDA, or the Ontario Securities Act, or the Criminal Code. Although some of the Defendants may have been liable for professional misconduct or other civil, criminal, or statutory wrongs associated with personal privacy, nevertheless, the parameters of intrusion on seclusion are tight and narrow and this tort is not established by some sort of guilt by association. Intrusion on seclusion has its own constituent elements and its own legal parameters that in my opinion are not satisfied in the case at bar.

(b) Cause of Action under PHIPA

[175] The Plaintiffs plead a cause of action based on s. 65 of PHIPA as against only three of the twelve Defendants to the two proposed class actions; namely, Rouge Valley, Ms. Bandali and Mr. Sethi, which are the parties implicated by PHIPA Order HO 013.

[176] Section 65 of PHIPA states:

Damages for breach of privacy

65 (1) If the Commissioner has made an order under this Act that has become final as the result of there being no further right of appeal, a person affected by the order may commence a proceeding in the Superior Court of Justice for damages for actual harm that the person has suffered as a result of a contravention of this Act or its regulations.

Same

(2) If a person has been convicted of an offence under this Act and the conviction has become final as a result of there being no further right of appeal, a person affected by the conduct that gave rise to the offence may commence a proceeding in the Superior Court of Justice for damages for actual harm that the person has suffered as a result of the conduct.

Damages for mental anguish

(3) If, in a proceeding described in subsection (1) or (2), the Superior Court of Justice determines that the harm suffered by the plaintiff was caused by a contravention or offence, as the case may be, that the defendants engaged in wilfully or recklessly, the court may include in its award of damages an award, not exceeding $10,000, for mental anguish.

[177] The Second Fresh as Amended Consolidated Statement of Claim in the Broutzas v. Rouge Valley Health System action sets out the Plaintiffs’ cause of action under PHIPA in paragraphs 58 to 60 as follows:

CAUSE OF ACTION UNDER THE PHIPA

58. The Plaintiffs plead and rely on section 65 of PHIPA.

59. The IPC issued the PHIPA Order, now filed and enforceable as a judgment or order of this Honourable Court, which concluded that Rouge Valley, Sethi, and Bandali contravened provisions of PHIPA. The IPC found, inter alia, that Rouge Valley failed to put in place reasonable technical and administrative safeguards and information practices to protect patient personal health information. The IPC also found that Sethi and Bandali used and/or disclosed personal health information of Rouge Valley patients, in contravention of PHIPA, for the purposes of selling it to RESP sales agents who in turn were selling or marketing RESP investments.

60. The Plaintiffs and other Class Members suffered damages as a result of the contravention of PHIPA, as particularized below, for which Rouge Valley, Sethi, and Bandali are liable.

[178] Rouge Valley does not dispute that the Plaintiffs satisfy the cause of action criterion for a statutory claim pursuant to s. 65 of PHIPA. I agree.

[179] Rouge Valley, however, does dispute that a class action is the preferable procedure for the resolution of the common issues associated with the PHIPA claim. Rouge Valley’s argument is based on the argument that individual issues trials are inevitable to resolve the s. 65 claim which depends upon a Class Member proving that he or she suffered harm. I foreshadow to say that I agree that the s. 65 of PHIPA claim does not satisfy the preferable procedure criterion.

[180] Nevertheless, I conclude that the Plaintiffs satisfy the cause of action criterion for a claim based on s. 65 of PHIPA.

(c) Negligence

[181] For the reasons that follow, I conclude that the Plaintiffs satisfy the reasonable cause of action criterion for negligence claims against Rouge Valley, The Scarborough Hospital, Ms. Bandali, Nurse Cruz, and Mr. Sethi for failing to prevent an invasion of privacy, but the Plaintiffs do not have a viable negligence claim against Ms. Acar, the Edrys, Mr. Sulur, CST, Global, and Knowledge First.

[182] The Second Fresh as Amended Consolidated Statement of Claim in the Broutzas v. Rouge Valley Health System action sets out the Plaintiffs’ negligence claims against all the Defendants in paragraphs 68 to 83 as follows:

Negligence of Rouge Valley and the Rouge Valley Employees

68. At all material times, Rouge Valley and the Rouge Valley Employees owed a duty of care to the Plaintiffs and to each Class Member in the collection, retention, use, and disclosure of their Personal Information, and to safeguard the confidentiality of their Personal Information.

69. Furthermore, Rouge Valley and its employees and agents had a statutory duty under section 12 of PHIPA to ensure that personal health information in its custody or control was protected against theft, loss, use, and disclosure and to ensure that the records containing the information were protected against copying, modification, or disposal.

70. Rouge Valley and its employees and agents also had a statutory duty under section 33 of PHIPA not to collect, use, or disclose personal health information about an individual for the purpose of marketing anything unless the individual expressly consented.

71. Rouge Valley breached the standard of care expected in the circumstances. Particulars of Rouge Valley’s breach include, but are not limited to, the fact that it:

(a) Failed to meet its statutory duties and/or internal policies in the collection, retention, security, use, and disclosure of Personal Information;

(b) Failed to establish policies for the effective, well-coordinated, and proactive management of Personal Information;

(c) Failed to detect privacy breaches, even though it had known since 2009 that Sethi was employed in a part-time position by an RESP company and that his role involved selling RESP investments;

(d) Failed to take reasonable steps to ensure Personal Information was safeguarded despite knowing there was a heightened risk of inappropriate accessing of Personal Information by employees involved in selling RESP investments;

(e) Failed to keep Personal Information secure and confidential;

(f) Failed to properly, if at all, inform its staff of and provide adequate training in regard to the policies, procedures, and guidelines of the hospital with respect to maintaining strict patient privacy and confidentiality, as outlined in PHIPA;

(g) Failed to properly supervise and monitor its staff with respect to accessing Personal Information;

(h) Failed to have the proper computer programs and/or security systems in place in order to prevent wrongful accessing of Personal Information. These failures included but are not limited to the fact that it:

(i) Failed to take steps to limit open-ended search results that revealed multiple patient names;

(ii) Failed to realize in a timely way that searches could be performed and Personal Information reviewed without creating an audit trail; and

(iii) Knew or ought to have known that storing only two weeks of user history was inadequate for auditing, monitoring and compliance purposes when an adequate solution existed, and failed to take reasonable remedial steps in this regard;

(i) Failed to implement measures necessary to ensure it was able to conduct audits in all instances where employees or agents accessed Personal Information on the Meditech system;

(j) Failed to conduct proper and timely audits of the Meditech system;

(k) Failed to train its staff with respect to the regulations pertaining to the privacy, confidentiality and sanctity of Personal Information;

(l) Disclosed Personal Information to others without the consent of the Plaintiffs and other Class Members;

(m) Failed to take appropriate steps to prevent further breaches when it was known, or ought to have been known, that this wrongful and unlawful activity had taken place; and

(n) Failed to advise the Plaintiffs and other Class Members of the privacy breaches in a timely manner.

72. Further or in the alternative, the Rouge Valley Employees breached the standard of care in the circumstances. The Rouge Valley Employees’ breaches include, but are not limited to, the fact that that they:

(a) Breached the confidentiality agreement which they signed upon their time of hire with Rouge Valley;

(b) Breached their contract with Rouge Valley;

(c) Failed to comply with PHIPA and the Public Hospitals Act;

(d) Failed to follow and abide by regulations and policies pertaining to the confidentiality and sanctity of patient medical records;

(e) Failed to use the Meditech system in a reasonable and lawful manner and instead used the Meditech system for personal gain;

(f) Disclosed Personal Information to others without the consent of the Plaintiffs and other Class Members; and

(g) Disclosed Personal Information for marketing and profit without express consent.

73. At all material times, the breaches of patient privacy were within the knowledge and control of Rouge Valley and the Rouge Valley Employees. The breaches of patient privacy were not known and could not have been known to the Plaintiffs and other Class Members.

74. As a result of Rouge Valley’s and the Rouge Valley Employees’ acts and omissions described above, the Plaintiffs and other Class Members suffered reasonably foreseeable damages and losses, which are particularized below and for which Rouge Valley and the Rouge Valley Employees are liable. The Plaintiffs and other Class Members’ damages and losses were caused by the negligence Rouge Valley and the Rouge Valley Employees.

Negligence of the RESP Companies and the RESP Company Employees

75. At all material times, the RESP Companies and the RESP Company Employees owed a duty of care to the Plaintiffs and to each Class Member, as clients or prospective clients in referral arrangements, in the collection, retention, and use of their Personal Information, and to safeguard the confidentiality of their Personal Information.

76. The RESP Companies knew or ought to have known that their employees, agents and representatives (including the RESP Company Employees) obtained leads on parents of newborn babies. The RESP Companies knew that sales leads should only be obtained through legitimate means and there were risks of leads obtained through illegitimate methods. The RESP Companies knew the risk and potential for employees, agents, and representatives to obtain leads about parents through illegitimate methods and failed to take steps to supervise employees to prevent this. The RESP Companies knew or ought to have known that confidential and private hospital records were valuable potential sources of leads.

77. Furthermore, the RESP Companies and the RESP Company Employees had a duty to comply with their obligations under Ontario securities law, including the Securities Act, National Instrument NI 31-103: Registration Requirements and Exemptions (“NI 31-103”), and the applicable policies, rules, and regulations governing proficiency standards, business conduct, and referral arrangements.

78. The RESP Companies and the RESP Company Employees also had a duty to comply with section 32 of the Securities Act to comply with Ontario securities law and regulations, and to establish and maintain systems of control and supervision for controlling their activities and supervising their representatives.

79. Moreover, the RESP Companies and the RESP Company Employees also had a duty to comply with sections 13.7 to 13.11 of NI 31-103 to ensure only legitimate referral arrangements are entered into by the RESP Companies and the RESP Company Employees, which satisfy the disclosure and other requirements for referral arrangements.

80. The RESP Companies breached the standard of care expected in the circumstances. Particulars of the RESP Companies’ breaches include, but are not limited to, the fact that they:

(a) Failed to train, supervise, and monitor their employees, agents, and representatives with respect to ensuring protection of Personal Information of prospective clients;

(b) Failed to comply with their obligations under Ontario securities law;

(c) Failed to comply with regulations, policies, and guidelines pertaining to proficiency standards, business conduct, and referral arrangements;

(d) Failed to establish and maintain adequate policies, guidelines, and procedures pertaining to proficiency standards, business conduct, and referral arrangements;

(e) Failed to establish and maintain systems of controls and supervision sufficient to provide reasonable assurance that their employees, agents, and representatives acting on their behalf complied with securities legislation and manage the risks associated with their business in accordance with prudent business practices;

(f) Failed to provide adequate training to their ultimate designated person, chief compliance officer, employees, agents, and representatives pertaining to their obligations under Ontario securities law and regulations, policies, procedures, and guidelines relating to proficiency standards, business conduct, and referral arrangements;

(g) Failed to monitor and assess their compliance and the compliance of employees, agents, and representatives acting on their behalf with securities legislation;

(h) Failed to ensure that referral agreements entered into by their employees, agents, and representatives acting on their behalf complied with the requirements of sections 13.8 and 13.10 of NI 31-103; and

(i) Failed to establish, maintain, and/or apply systems to monitor, identify, investigate, and appropriately address the fact that employees, agents, and representatives acting on their behalf were entering into referral arrangements that did not comply with the requirements of sections 13.8 and 13.10 of NI 31-103, despite the fact that problems had been identified with “personally developed leads”.

81. Further or in the alternative, the RESP Company Employees breached the standard of care expected in the circumstances. Particulars of the RESP Company Employees’ breaches include, but are not limited to, the fact that they:

(a) Failed to comply with their obligations under Ontario securities law;

(b) Failed to comply with regulations, policies, and guidelines pertaining to proficiency standards, business conduct, and referral arrangements; and

(c) Entered into referral arrangements that did not comply with the requirements of sections 13.7 to 13.11 of NI 31-103.

82. At all material times, the breaches committed by the RESP Companies and the RESP Company Employees were within the knowledge and control of the RESP Companies and the RESP Company Employees. These breaches were not known and could not have been known to the Plaintiffs and other Class Members.

83. As a result of these Defendants’ acts and omissions described above, the Plaintiffs and other Class Members suffered reasonably foreseeable damages and losses, which are particularized below and for which the RESP Companies and the RESP Company Employees are liable. The Plaintiffs and other Class Members’ damages and losses were caused by the negligence of these Defendants.

[183] Rouge Valley and The Scarborough Hospital do not dispute that the Plaintiffs satisfy the cause of action criterion for a negligence claim against them and their employees, and I note that negligence claims associated with breach of privacy claims have been certified in several class actions.[^51]

[184] While, as discussed below, I believe that there is a policy argument that stands against a negligence claim as a backstop to an intrusion on seclusion claim, given that the point is not disputed and given that there is a proximate relationship between Rouge Valley and its patients, I conclude that the Plaintiffs satisfy the cause of action criterion for a negligence claim against Rouge Valley and The Scarborough Hospital and their rogue employees.

[185] For their part, Ms. Acar, the Edrys, CST, Global, and First Knowledge dispute that the Plaintiffs satisfy the cause of action criterion for a negligence claim against them.

[186] The elements of a claim in negligence are: (1) the defendant owes the plaintiff a duty of care; (2) the defendant's behaviour breached the standard of care; (3) the plaintiff suffered compensable damages; (4) the damages were caused in fact by the defendant's breach; and, (5) the damages are not too remote in law.[^52]

[187] The law does not recognize the following as compensable damages: upset, disgust, anxiety, agitation or mere psychological upset that does not cause a serious and prolonged injury and that does do not rise above the ordinary annoyances, anxieties and fears that people living in society routinely experience.[^53] Recently, in Saadati v. Moorhead,[^54] the Supreme Court of Canada reiterated that there is a threshold for compensable damages from an injury to one’s mental health; the Court stated at para. 37:

37. Further, and as Mustapha makes clear, mental injury is not proven by the existence of mere psychological upset. While, therefore, tort law protects persons from negligent interference with their mental health, there is no legally cognizable right to happiness. Claimants must, therefore, show much more - that the disturbance suffered by the claimant is "serious and prolonged and rise[s] above the ordinary annoyances, anxieties and fears" that come with living in civil society (Mustapha, at para. 9).

[188] As a matter of pleading, while the Plaintiffs may have pleaded an entitlement to moral or symbolic damages for the alleged cause of action for intrusion on seclusion, the Plaintiffs have not pleaded compensable damages that would be actionable for a negligence claim. On the pleaded facts, the Class Members may have been aggravated by the RESP sales representatives’ communications, but there are no material facts that would satisfy the compensable damages element of a negligence claim. I will, however, for the purposes of the cause of action analysis that follows, assume that the Class Members suffered compensable damages. Thus, the analysis that follows focusses on the duty of care element of the negligence claim.

[189] Ms. Acar, the Edrys, CST, Global, and First Knowledge submit that they have no duty of care to protect Rouge Valley or The Scarborough Hospital patients from an intrusion on seclusion perpetrated by the staff of the hospitals. I agree with this submission.

[190] The Canadian approach to determining whether there is a duty of care has been developed in a series of Supreme Court of Canada decisions[^55] adapting and explaining the House of Lord's decision in Anns v. Merton London Borough Council,[^56] and derived from the seminal cases of Donoghue v. Stevenson[^57] and Hedley Byrne & Co. Ltd. v. Heller & Partners Ltd.[^58]

[191] The claim against Ms. Acar, the Edrys, CST, Global, and First Knowledge is a novel claim and does not fall within an establish category. If a negligence case does not come within an established category, it is necessary to undertake a duty of care analysis. If the relationship between the plaintiff and the defendant does not fall within a recognized class of negligence cases where the defendants have a duty of care to others, then whether a duty of care to another exists involves satisfying a three-step analysis; i.e. (1) foreseeability, in the sense that the defendant ought to have contemplated that the plaintiff would be affected by the defendant's conduct; (2) sufficient proximity, in the sense that the relationship between the plaintiff and the defendant is sufficiently close prima facie to give rise to a duty of care; and (3) the absence of overriding policy considerations that would negate any prima facie duty established by foreseeabilty and proximity. Thus, in a new category of case whether a relationship giving rise to a duty of care exists depends on foreseeability, moderated by policy concerns.[^59]

[192] To determine the foreseeability element, the court asks whether the harm that occurred was the reasonably foreseeable consequence of the defendant's act.[^60] A reasonable foreseeability analysis requires only that the general harm, not its manner of incidence, be reasonably foreseeable.[^61]

[193] The foreseeability element was examined by the Supreme Court of Canada in the recent case of Rankin (Rankin's Garage & Sales) v. J.J.,[^62] where the Court reversed the conclusion of the lower courts that a garage owner had a duty of care to a person injured following the theft of the vehicle from the garage. Justice Karakatsanis (Chief Justice McLachlin, Justices Abella, Moldaver, Wagner, Côté and Rowe concurring; Justices Brown and Gascon dissenting) concluded that for liability, the defendant ought to have foreseen the type of harm that harm actually suffered. Justice Karakatsanis said that the proper question to ask is whether the plaintiff has offered facts to persuade the court that the risk of they of damage that occurred was reasonably foreseeable to the class of plaintiff that was damaged.[^63] She said that there must be a connection between the wrong and the injury suffered by the plaintiff. At para. 25 and 26 of her judgment, she stated:

25. The facts of this case highlight the importance of framing the question of whether harm is foreseeable with sufficient analytical rigour to connect the failure to take care to the type of harm caused to persons in the plaintiff's situation. Here, the claim is brought by an individual who was physically injured following the theft of the car from Rankin's Garage. The foreseeability question must therefore be framed in a way that links the impugned act (leaving the vehicle unsecured) to the harm suffered by the plaintiff (physical injury).

26. Thus, in this context, it is not enough to determine simply whether the theft of the vehicle was reasonably foreseeable. The claim is not brought by the owner of the car for the loss of the property interest in the car; if that were the case, a risk of theft in general would suffice. Characterizing the nature of the risk-taking as the risk of theft does not illuminate why the impugned act is wrongful in this case since creating a risk of theft would not necessarily expose the plaintiff to a risk of physical injury. Instead, further evidence is needed to create a connection between the theft and the unsafe operation of the stolen vehicle. The proper question to be asked in this context is whether the type of harm suffered -- personal injury -- was reasonably foreseeable to someone in the position of the defendant when considering the security of the vehicles stored at the garage.

[194] Moving from foreseeability to proximity, proximity focuses on the type of relationship between the plaintiff and defendant and asks whether this relationship is sufficiently close that the defendant may reasonably be said to owe the plaintiff a duty to take care not to injure him or her.[^64] Proximate relationships giving rise to a duty of care are of such a nature as the defendant in conducting his or her affairs may be said to be under an obligation to be mindful of the plaintiff's legitimate interests.[^65] The proximity inquiry probes whether it would be unjust or unfair to hold the defendant subject to a duty of care having regard to the nature of the relationship between the defendant and the plaintiff.[^66] The focus of the probe is on the nature of the relationship between victim and alleged wrongdoer and the question is whether the relationship is one where the imposition of legal liability for the wrongdoer's actions would be appropriate.[^67] Proximity focuses on the connection between the defendant's undertaking, the breach of which is the wrongful act, and the loss claimed.[^68]

[195] The proximity analysis involves considering factors such as expectations, representations, reliance, and property or other interests involved.[^69] Proximity is not concerned with how intimate the plaintiff and defendant were or with their physical proximity, so much as with whether the actions of the alleged wrongdoer have a close or direct effect on the victim, such that the wrongdoer ought to have had the victim in mind as a person potentially harmed.[^70] The proximity analysis is intended to be sufficiently flexible to capture all relevant circumstances that might in any given case go to seeking out the close and direct relationship that is the hallmark of the common law duty of care.[^71]

[196] It needs to be emphasized that the proximity analysis of the first stage of the duty of care test involves policy issues because it asks the normative question of whether the relationship is sufficiently close to give rise to a legal duty.[^72]

[197] The proximity inquiry recognizes a distinction between misfeasance, which is an overt act that may be foreseen to cause harm to another, and nonfeasance which is the failure to act to prevent foreseeable harm to another. Where the conduct alleged against the defendant is a failure to act, foreseeability alone may not establish a duty of care.[^73] Where the allegation is that the defendant failed to prevent harm, the law requires close examination of the question of proximity and is concerned whether the case discloses factors that show that the relationship between the plaintiff and the defendant is sufficiently close and direct to give rise to a legal duty of care.[^74]

[198] The proximity aspect of the formulation of a duty of care was examined in Childs v. Desormeaux,[^75] which was the case that examined whether a social host has a duty of care to a stranger who is injured by an inebriated guest who drives away from the social host's party and causes a motor vehicle accident. In this case, Chief Justice McLachlin noted at para. 31 that: "[W]here the conduct alleged against the defendant is a failure to act, foreseeability alone may not establish a duty of care." This qualification recognizes that action that causes harm to another and inaction that fails to prevent harm being caused to another have different qualities of moral and legal culpability. Thus, in Childs v. Desormeaux, Chief Justice McLachlin stated:

31. Foreseeability without more may establish a duty of care. This is usually the case, for example, where an overt act of the defendant has directly caused foreseeable, physical harm to the plaintiff. ... However, where the conduct alleged against the defendant is a failure to act, foreseeability alone may not establish a duty of care. In the absence of an overt act on the part of the defendant, the nature of the relationship must be examined to determine whether there is a nexus between the parties. Although there is no doubt that an omission may be negligent, as a general principle, the common law is a jealous guardian of individual autonomy. Duties to take positive action in the face of risk or danger are not free-standing. Generally, the mere fact that a person faces danger or has become a danger to others does not itself impose any kind of duty on those in a position to become involved.

[199] At paras. 38-40, Chief Justice McLachlin identified several recurrent themes running through the situations where the law will impose a duty of care and liability for failure to act to prevent the harm suffered by the plaintiff; namely: (1) the defendant's involvement in the creation of a risk or in controlling a risk to which others have been invited may justify imposing an obligation to minimize the risk; (2) respect for the plaintiff's autonomy may justify a defendant standing by and not intervening to prevent or minimize the risk to the plaintiff because the law accepts that competent people have a right to engage in risky activities; and (3) where the defendant creates or invites others into a dangerous situation, the defendant may reasonably expect that the persons invited can rely on the defendant to ensure that the risk is a reasonable one or to take appropriate rescue action if the risk materializes. In Childs v. Desormeaux, the Chief Justice explained (para. 39) that: “the law does not impose a duty to eliminate risk. It accepts that competent people have the right to engage in risky activities. Conversely, it permits third parties witnessing risk to decide not to become rescuers or otherwise intervene.”

[200] Moving on to the final stage of the duty of care analysis, if the plaintiff establishes a prima facie duty of care, the evidentiary burden of showing countervailing policy considerations shifts to the defendant, following the general rule that the party asserting a point should be required to establish it.[^76] Policy concerns raised against imposing a duty of care must be more than speculative, and a real potential for negative consequences must be apparent.[^77]

[201] The final stage of the analysis is not concerned with the type of relationship between the plaintiff and the defendant. At this stage of the analysis, the question to be asked is whether there exist broad policy considerations that would make the imposition of a duty of care unwise, despite the fact that harm was a reasonably foreseeable consequence of the conduct in question and there was a sufficient degree of proximity between the plaintiff and the defendant such that the imposition of a duty would be fair.[^78] The final stage of the analysis is about the effect of recognizing a duty of care on other legal obligations, the legal system and society more generally.[^79]

[202] Applying a duty of care analysis to the negligence claims against Ms. Acar, the Edrys, CST, Global, and First Knowledge, in my opinion, it is plain and obvious that there is no duty of care.

[203] The class members’ negligence claim fails the foreseeability test of the first stage of the duty of care test. The essential misconduct of the RESP investment dealers was the failure to have their sales representatives properly document referral agreements and the failure to have their sales representatives screen the conduct of their referral sources, which conduct had already occurred. The injury suffered by the Class Members was that they were offended to be contacted by RESP sales representatives who had obtained contact information from Rouge Valley employees breaching PHIPA and their employment contracts. In my opinion, as a matter of foreseeability, the RESP investment dealers and salesperson’s misconduct of not complying with obligations under the Ontario Securities Act does not connect to the injury of Rouge Valley employees breaching PHIPA and their employment contracts.

[204] As a matter of foreseeability, it makes no sense to suggest that there was some way that the RESP investment dealers could protect the personal information of patients of Rouge Valley from misappropriation by employees of the hospital. The risk that the RESP sales representatives were not properly trained about documenting referral agreements, which are not themselves illegal, does not connect to the harm of hospital employees invading the privacy of the patients of the hospital.

[205] Put somewhat differently, there was nothing that the sales representatives did or did not do that makes the injury caused by the hospital employees invading the privacy of hospital patients a foreseeable consequence of the acts or omissions of the sales representatives. The conduct of the sales representatives comes after the misconduct of the hospital employees. The type of injury – an invasion of privacy by hospital employees – was not reasonably foreseeable to the RESP investment dealers. Enforcing the requirements of the Ontario Securities Act about documenting referral agreements would not have prevented the misconduct of the hospital’s employees invading the patients’ privacy.

[206] Since there is no allegation of conspiracy, the wrongdoings of the RESP sales representatives and of the RESP investment dealers comes after the wrongdoing of the hospital employees who had already hacked the patients’ information and who then hawked the information. The harm caused by hospital employees’ hacking and hawking information from the hospital was not a foreseeable consequence of the RESP sales representatives and RESP investment dealers’ non-compliance with the Ontario Securities Act and their own business contracts and arrangements.

[207] The Class Members’ negligence claim also fails the second stage of the duty of care analysis. With respect to proximity, it should be noted that the essence of the allegations against the RESP sales representatives and the RESP investment dealers is an allegiance of nonfeasance; i.e., that they did not take steps to prevent an invasion of the privacy of the personal information under the control of Rouge Valley or The Scarborough Hospital or their employees by screening their sources. Here, it should be noted that the RESP sales representatives are at the second degree of proximity and the RESP investment dealers are at the third degree of proximity in relation to the privacy of the hospital records that are the subject matter of the class action.

[208] In my opinion, it is plain and obvious that the RESP sales representatives and the RESP investment dealers do not have a sufficiently proximate relationship with the Class Member patients of Rouge Valley or The Scarborough Hospital to have a duty of care to ensure that the source of the contact information was not tainted by an invasion of privacy that might occur at the hospital.

[209] While it is fair to impose a liability on the RESP sales representatives and the RESP investment dealers to ensure that there are no invasion of privacy of the personal information that is under their control and under the regulation of PIPEDA, it is not fair to impose liability on them for what happens to personal information for which Rouge Valley is responsible under PHIPA. The RESP investment dealers and the RESP sales representatives do not have control over Rouge Valley’s or The Scarborough Hospital’s employees nor over the hospitals’ records, and the law ought not to impose a duty of care on them to protect the Class Members from the harm, such as it was, caused by the hospitals’ employees or by the hospitals’ failures in supervising the employees.

[210] In my opinion, it is also plain and obvious that there are legal policy reasons that stand against any duty of care by the RESP sales representatives and the RESP investment dealers to the hospitals’ patients.

[211] Contrary to the submission of these Defendants, I do not regard indeterminate liability as a policy factor in the immediate case. However, as a matter of legal policy, courts should be hesitant to introduce or impose new liabilities particularly ones that would yield a flood of claims and undermine the law’s careful regulation of liablity. For example, in Martel Building Ltd. v. Canada,[^80] the Supreme Court declined to introduce a duty of care in contract bargaining, among other reasons, because to extend negligence law into the conduct of negotiations would encourage a multiplicity of needless lawsuits given the number of negotiations that do not culminate in a contract. Similarly, as a matter of legal policy, the introduction of a backstop negligence action for intrusion on seclusion against defendants at second and third degrees of proximity would undermine the careful work of the Court of Appeal in Jones v. Tsige to not open the floodgates of liability for intrusion on seclusion.

[212] I, therefore, conclude that the Plaintiffs satisfy the reasonable cause of action criterion for negligence claims against Rouge Valley, The Scarborough Hospital, Ms. Bandali, Nurse Cruz, and Mr. Sethi for failing to prevent an invasion of privacy, but the Plaintiffs do not have a negligence claim against Ms. Acar, the Edrys, Mr. Sulur, CST, Global, and Knowledge First.

(d) Breach of Contract and Warranty

[213] In this part of my Reasons for Decision, I conclude that it is plain and obvious that the Plaintiffs do not have a breach of contract and warranty claim against Rouge Valley or the Scarborough Hospital.

[214] The Second Fresh as Amended Consolidated Statement of Claim in the Broutzas v. Rouge Valley Health System action alleges that the Class Members had a contractual relationship with Rouge Valley. Paragraphs 60 to 67 of the Statement of Claim set out the claim for breach of contract and warranty, as follows:

[215] BREACH OF CONTRACT AND WARRANTY

61. The Plaintiffs and the Class Members entered into contracts with Rouge Valley that were similar or identical with respect to the collection, retention, use, and disclosure of Personal Information. As part of the contract, each Class Member completed, or had someone complete on their behalf, various documents to obtain medical services which required that the Class Members provide Personal Information to Rouge Valley. The terms of medical services and the documents together form the agreement (the “Contract”).

62. The express or implied terms of the Contract provided that Rouge Valley and its employees and agents were committed to individual privacy and to protecting Personal Information, and that any Personal Information provided by or on behalf of the Class Members in connection with obtaining medical services would not be publicly disclosed and would only be collected, used, and shared by Rouge Valley and its employees or agents for the following limited purposes:

(a) To provide the Class Member with health care;

(b) To communicate with or consult with other health care providers;

(c) For payment-related purposes (including OHIP, WSIB, private insurance companies and others);

(d) To plan, manage and administer Rouge Valley programs and services;

(e) For research (with Research Ethics Board approval);

(f) For teaching;

(g) For statistical and other kinds of reporting obligations;

(h) For fundraising activities; and

(i) For other purposes as permitted or required by law.

63. The Contract included the following express or implied terms:

(a) Rouge Valley and its employees and agents would comply with all relevant statutory obligations and policies concerning the collection, retention, use, and disclosure of the Plaintiffs’ and other Class Members’ Personal Information, including the obligations set out in Rouge Valley’s policies, including its privacy policy, and PHIPA;

(b) Rouge Valley and its employees and agents would not collect, retain, use, or disclose Personal Information except in the manner and for the purposes expressly authorized by the Contract;

(c) Rouge Valley and its employees and agents would keep the Personal Information secure and confidential;

(d) Rouge Valley and its employees and agents would take steps to keep the Personal Information from being lost, disseminated, used, or disclosed to unauthorized persons, including by having sufficient investigative and audit tools in its Meditech system;

(e) Rouge Valley and its employees and agents would not disclose the Personal Information without the patient’s consent; and

(f) Rouge Valley and its employees and agents would protect the Personal Information from compromise or disclosure.

64. The Contract promised peace of mind to the Plaintiffs and other Class Members that in exchange for providing the Personal Information required to obtain medical services, the Personal Information would be used by Rouge Valley and its employees and agents for limited, specific and necessary purposes and would otherwise be kept secure and not be disseminated or disclosed to unauthorized persons or entities.

65. Rouge Valley warranted that it and its employees and agents would keep the Personal Information secure and confidential, comply with the obligations in Rouge Valley’s policies, including its privacy policy and PHIPA, and take steps to prevent the Personal Information from being accessed by, or disseminated or disclosed to, unauthorized persons.

66. Rouge Valley breached the express or implied terms of the Contract and warranty by failing to reasonably safeguard, and improperly using, losing, disseminating, or disclosing, the Personal Information and failing to comply with the obligations set out in its policies and PHIPA.

67. Rouge Valley’s breach has caused the Plaintiffs and each Class Member to suffer damages, as particularized below, for which Rouge Valley is liable.

[216] It is plain and obvious that the putative Class Members do not have a claim for breach of contract and warranty. Breach of contract claims in medical negligence cases against hospitals have been repeatedly rejected by Canadian courts.[^81] I agree with Rouge Valley’s submission that this claim of an implied contract of implied terms to that contract is an artifice. There was no express contract, and the relationship for the provision of medical services is not regarded as contractual in nature but rather governed by statutory obligations, professional and fiduciary obligations, and by the law of negligence. The admission forms and the information forms provided to incoming patients are not contractual in nature, and there was no bargaining between the patients and the hospital about preserving the confidentiality and privacy of patient information, which the hospitals were statutorily obliged to do.

[217] The alleged implied contractual terms between Rouge Valley and its patients mirror statutory obligations imposed by PHIPA. There is no contractual relationship on the basis of a policy that Rouge Valley or The Scarborough Hospital was required by statute to adopt and comply with. Contract law generally does not recognize or enforce implied terms of a contract that simply reflect pre-existing statutory duties and nothing more.[^82] To hold otherwise would allow the Plaintiffs to do indirectly what they cannot achieve directly - that is to sue for breach of statute; Canadian law does not recognize a separate tort of breach of statutory duty, unless the legislation creates such a remedy.[^83]

[218] In Canada v. John Doe,[^84] Health Canada offered a program to authorize persons who needed marihuana for medical reasons to possess marihuana notwithstanding that possession was a criminal offense at the time. Heath Canada’s program granted access to marihuana for medical use to persons receiving treatment for compassionate end-of-life care or for serious debilitating medical conditions such as multiple sclerosis, cancer, HIV/AIDS, arthritis, and epilepsy. In administering the program, Health Canada sent a letter to the 40,000 participants using the mailing address that the participants had provided. Contrary to its prior practice, the mailing to the participants was in an envelope that identified the Marihuana Medical Access Program and not just Health Canada. The plaintiffs submitted that Health Canada's manner of labeling the envelopes was an intrusion on seclusion and would disclose highly personal and sensitive information. The plaintiffs submitted that the participants in the program were entitled to damages for intrusion upon seclusion, negligence, breach of confidence, privacy-related Charter breaches, and breach of contract.

[219] In Canada v. John Doe, varying the judge at first instance, the Federal Court of Appeal certified a class action only for negligence and breach of confidence. The Federal Court of Appeal held that the proposed representative plaintiffs had not pleaded any material facts in support of the necessary elements of the claim for intrusion on seclusion. The Federal Court of Appeal held that there was no claim for breach of contract. With respect to the claim in contract, Justice de Montigny stated at paras. 45 and 46:

45. In my view, the motions judge erred in accepting, without much discussion, that this pleading was sufficient to ground the cause of action. First of all, there is a total lack of any material facts to support this pleading, and that is in and of itself a sufficient basis to dismiss that cause of action.

46. More importantly, I agree with the Crown that the terms of the alleged agreement were entirely determined by statute and regulations, since the plaintiffs filed applications as required by the Regulations and Health Canada promised no more than that which it was already bound to do under those Regulations and other applicable legislation. For there to be a contract, there has to be an ex-change of promises backed by valuable consideration. Here, there was no exchange of consideration, no bargaining or meeting of the minds. The terms of the arrangement were entirely imposed by statute. This is why there is a tendency in contract law to refuse to enforce agreements that simply reflect a pre-existing statutory duty, and nothing more: see S.M. Waddams, The Law of Contracts, 6th ed. (Toronto: Canada Law Book, 2010), at s. 135, p. 98. […]

[220] I agree with and adopt the reasoning in Canada v. John Doe, and there are other reasons for concluding that it is plain and obvious that there is no claim for breach of contract. Damages are not a constituent element of a claim in contract, and to allow the Plaintiffs to frame their action in breach of implied terms of contract that merely adopt PHIPA obligations would allow them to circumvent the statutory conditions and limitations that the Legislature placed on the statutory cause of action, including the requirement that there be actual harm. It would also allow the Class Members to circumvent the limitations of the tort of inclusion on seclusion.

[221] I conclude, therefore, that the Plaintiffs do not satisfy the cause of action criterion for a claim for breach of contract or warranty.

(e) Vicarious Liability

[222] The Plaintiffs make a vicarious liability claim against Rouge Valley and The Scarborough Hospital based on the misconduct of the hospitals’ employees. The Plaintiffs make a vicarious liability claim against CST, Global, and Knowledge First based on the misconduct of the RESP investment dealers RESP sales representatives, who are alleged to be employees, which is denied by the RESP investment dealers and the RESP sales representatives.

[223] In this part of my Reasons for Decision, I conclude that the vicarious liability claims – as pleaded – satisfy the cause of action criterion. However, since there is actually is no legally viable intrusion on seclusion claim, there is no basis for vicarious liability for intrusion on seclusion as against the hospitals or the RESP investment dealers. And, since there is actually no legally viable negligence claim as against the RESP investment dealers, there is no basis for vicarious liability at all as against the RESP investment dealers.

[224] Further, with respect to the vicarious liability claim against the RESP investment dealers based on negligence, assuming that such claims were legally viable, once again, transposing or integrating the common issues criterion into the analysis, as it did for the claim for intrusion on seclusion, I conclude that there is no basis in fact for a vicarious liability claim even assuming one was legally viable. In other words, assuming that in some circumstances the RESP investment dealers could be vicariously liable for the misconduct of the RESP sales representatives, those circumstances do not exist in the case at bar.

[225] The Second Fresh as Amended Consolidated Statement of Claim in the Broutzas v. Rouge Valley Health System action sets out the Plaintiffs’ cause of action for vicarious liability against Rouge Valley and as against CST, Global, and Knowledge First as follows:

Vicarious liability of Rouge Valley

84. Rouge Valley is vicariously liable for its employees’, agents’ and representatives’ actions, including privacy breaches, torts, errors, and omissions. Rouge Valley gave its employees unsupervised access to Personal Information without adequate training, auditing or monitoring controls. Particulars of Rouge Valley’s vicarious liability include the following:

(a) Rouge Valley knew or ought to have known of the serious risks of employees accessing personal health information without authorization for the purposes of selling or marketing RESPs to former patients, directly or indirectly, and the serious limitations of its Meditech system’s auditing and monitoring capabilities, which could be overcome using simple queries, “screenshots” or other similar actions;

(b) Rouge Valley failed to implement necessary measures in a timely way to ensure that it was able to audit instances where agents access personal health information in its electronic systems, including the selection of patient names on the patient index of its Meditech system;

(c) Rouge Valley failed to clarify responsibility in a timely way for the creation, maintenance and archiving of user activity logs generated by Rouge Valley’s use of its Meditech system, including ensuring that user activity logs were available to Rouge Valley for audit purposes;

(d) Rouge Valley’s failure to implement full audit functionality in its Meditech system meant that it could not comply with its own policies and that it did not comply with the requirements of PHIPA;

(e) Rouge Valley’s privacy policies, procedures, practices as well as privacy training and awareness programs, which are critical in protecting personal health information, were insufficient and not in compliance with PHIPA; and

(f) Rouge Valley failed to work with its software provider in a timely way to develop a solution to limit search capabilities and search functionalities of Rouge Valley’s Meditech system to prevent employees from performing open-ended searches for personal health information about patients.

Vicarious liability of the RESP Companies

84. The RESP Companies are vicariously liable for their employees’, agents’ and representatives’ actions, including their privacy breaches, torts, errors, and omissions. They created opportunities for their employees, including the RESP Company Employees, to wrongfully and illegally obtain and misuse Personal Information by failing to properly train and supervise their employees to ensure they obtained sales leads through legitimate and lawful means. The RESP Companies failed to have adequate auditing or monitoring controls to ensure employees, including the RESP Company Employees, had not obtained leads through illegitimate and unlawful means. Class Members were entirely vulnerable to the wrongful and illegal misuse and access of Personal Information by the RESP Company Employees. Particulars of the RESP Companies’ liability include:

(a) They failed to train and supervise employees in respect of relevant patient privacy rights under PHIPA and at common law;

(b) They failed to take appropriate or sufficient steps to confirm that sales leads were obtained in a manner that did not violate privacy interests of Class Members;

(c) They failed to adequately and reasonably verify, audit or confirm sales leads generated by employees;

(d) They failed to adequately and reasonably question employees about the source of sales leads;

(e) They failed to verify the origins of sales identified as “personally developed leads” or “PDL” sales; and

(f) Even after problems were identified with “personally developed leads”, they failed to follow up to confirm whether problems were resolved and to confirm that no wrongful, illegitimate or illegal activity had occurred.

[226] Vicarious liability is imposed in specified circumstances, including liability for the wrongdoing of employees, but subject to rare exceptions, vicarious liability is not imposed on defendants for the conduct of their independent contractors.

[227] The leading Canadian case about the vicarious liability of employees and of independent contractors is 671122 Ontario Ltd. v. Sagaz Industries Canada Inc.[^85] The facts of this case were that for over 30 years, Canadian Tire purchased seat covers from Design Dynamics, but the transactions stopped when Sagaz Industries hired Stewart Landow of American Independent Marketing Inc. to market its competing seat covers. Mr. Landow bribed an employee of Canadian Tire who switched suppliers to Sagaz. This put Design Dynamics out of business, and it sued Sagaz, among others. The case against Sagaz was that it was vicariously liable for Mr. Landow bribery. Reversing the Ontario Court of Appeal, the Supreme Court dismissed the claim for vicarious liability.

[228] Justice Major delivered the judgment for the Supreme Court (Chief Justice McLachlin, Justices Bastarache, Binnie, Arbour, and Lebel concurring). Justice Major explained that vicarious liability is a theory of strict liability that makes a person, who may be innocent of wrongdoing, responsible for the misconduct of another. This liability is imposed for legal policy reasons based on the relationship between the wrongdoing and the person vicariously liable being such as to justify imposing liability on one person for the wrongs of another. The paradigm relationship for which the law imposes vicarious liability is the relationship between an employer and its employee and liability is imposed for the employee’s activities performed during the course of his or her employment.

[229] Justice Major explained that the rationale for vicarious liability is that the employer puts in the community an enterprise that carries with it risks and it should bear the responsibility for the loss when the risk ripens into harm. Subject to certain exceptional cases, a person is, however, not responsible for the acts of an independent contractor who provides services that an employee could have provided. The explanation is that since the person who engages an independent contractor does not control the activities of the independent contractor, it would, therefore, not be just and fair to impose a strict liability for somebody else’s wrongdoing.

[230] According to Justice Major, in cases about vicarious liability, it will be necessary to determine whether the wrongdoer is an employee acting during the course of his or employment or an independent contractor for services. Various tests are designed to differentiate employees from independent contractors but no one test is definitive. Ultimately, a key determination is whether or not the wrongdoer is engaged to perform services in business on his or her own account. In making that determination, the level of control the employer has over the worker's activities will always be a factor. However, other factors to consider include whether the worker provides his or her own equipment, whether the worker hires his or her own helpers, the degree of financial risk taken by the worker, the degree of responsibility for investment and management held by the worker, and the worker's opportunity for profit in the performance of his or her tasks.

[231] Justice Major explained the policy rationale behind vicarious liability at para. 35 of his judgment, where he stated:

35. Explained another way, the main policy concerns justifying vicarious liability are to provide a just and practical remedy for the plaintiff's harm and to encourage the deterrence of future harms (B. (P.A.), supra, at para. 29). Vicarious liability is fair in principle because the hazards of the business should be borne by the business itself; thus, it does not make sense to anchor liability on an employer for acts of an independent contractor, someone who was in business on his or her own account. In addition, the employer does not have the same control over an independent contractor as an employee to reduce accidents and intentional wrongs by efficient organization and supervision. Each of these policy justifications are relevant to the ability of the employer to control the activities of the employee, justifications which are generally deficient or missing in the case of an independent contractor. As discussed above, the policy justifications for imposing vicarious liability are relevant where the employer is able to control the activities of the employee but may be deficient in the case of an independent contractor over whom the employer has little control. However, control is not the only factor to consider in determining if a worker is an employee or an independent contractor. For the reasons discussed below, a reliance on control alone can be misleading, and there are other relevant factors which should be considered in making this determination.

[232] In 671122 Ontario Ltd. v. Sagaz Industries Canada Inc., the Supreme Court decided that American Independent Marketing was an independent contractor in business on its own account. It followed that Sagaz was not vicariously liable for the misdeeds of its independent contractor because the case did not fall into the rare category of cases where there is vicarious liability for an independent contractor.

[233] In Bazley v. Curry,[^86] the Supreme Court of Canada held that the fundamental question of vicarious liability is whether the wrongful intentional act by an employee was sufficiently related to conduct authorized by the employer to justify the imposition of liability. In considering whether there is a sufficient connection between the wrongful conduct and the conduct authorized by the employer, the following five factors are relevant: (a) the opportunity that the enterprise afforded to the employee to abuse his or her power; (b) the extent to which the wrongful act may have furthered the employer’s aims (and hence be more likely to have been committed by the employee); (c) the extent to which the wrong was related to friction, confrontation or intimacy inherent in the employer’s enterprise; (d) the extent of power conferred on the employee in relation to the victim; and (e) the vulnerability of potential victims to wrongful exercise of the employee’s power.

[234] In Bazley v. Curry, the Court stated that there must be a strong connection between what the employer was asking the employee to do and the wrongful act. It must be possible to say that the employer significantly increased the risk of the harm by putting the employee in his or her position and requiring him to perform the assigned tasks. In the companion case of KLB v British Columbia,[^87] Court stated that a mere opportunity to commit a tort created by virtue of employment does not suffice to impose vicarious liability.

[235] With this legal background, I return to the immediate case and the vicarious liability claims against Rouge Valley and as against the RESP investment dealers.

[236] Rouge Valley (and the Scarborough Hospital) concedes for the purposes of the certification motion that the vicarious liability claim satisfies the cause of action criterion. This follows as a matter of pleading that Ms. Bandali, Nurse Cruz, and Mr. Setti are employees. Rouge Valley, however, reserves the right to move for a summary judgment because it asserts that the actual facts will show that the activities of its employees were outside of the ambit of vicariously liability for an employer.

[237] Based on Rouge Valley’s concession, I conclude that the vicarious liability claims – as pleaded – satisfy the cause of action criterion. However, since I have also concluded that there are no legally viable intrusions on seclusion claims, I restrict the vicarious liability claims against Rouge Valley and The Scarborough Hospital to vicarious liability for the negligence of its employees, Mr. Sethi, Ms. Bandali, and Nurse Cruz.

[238] The RESP investment dealers make no concession with respect to vicarious liability. They assert that the Plaintiffs have not pleaded: (a) the material facts necessary to refute that the RESP sales representatives are not employees but independent contractors; nor (b) the material facts necessary to establish that they should be vicariously liable for an independent contractor’s misconduct.

[239] It is certainly arguable that the Statement of Claim is deficient in pleading material facts but reading the pleading generously – as the court is required to do – I conclude that it is not plain and obvious that there is no tenable vicarious liability claim – as pleaded. However, since there is no legally viable intrusion on seclusion claim and also no viable negligence claim against the RESP investment dealers, I conclude that the cause of action criterion for vicarious liability is not satisfied as against the RESP investment dealers.

[240] Assuming, however, that the above conclusions are incorrect and there are viable claims for intrusion on seclusion or for negligence against the RESP sales representatives, then I find that the Plaintiffs do not satisfy the evidentiary burden of showing some basis in fact that the RESP sales representatives are employees or of showing that the wrongdoing of the RESP sales representatives as independent contractors is attributable vicariously to the RESP investment dealers.

[241] It is easy enough to plead that the RESP sales representatives in the immediate case are employees, but the evidence does not show some basis in fact to support the allegation. All of the RESP sales representatives contracted to be independent contractors. They all were in business on their own account. The provided their own premises and hired their own employees. The risk of loses was on their account and they were not ensured any income. There is not some basis in fact to conclude that the RESP sales representatives are employees.

[242] Further, even if the RESP sales representatives were employees, the Plaintiffs have not shown some basis in fact for why the RESP investment dealers should be vicarious liable for the risk that hospital employees will pass on contact information to RESP sales representatives. There was nothing that the RESP investment dealers did that increased the risk that hospital employees would invade the privacy of hospital patients. Even if the RESP sales representatives were employees of the RESP investment dealers, their conduct of receiving referrals from third parties was not improper and cannot be said to have provided the third party with an opportunity to commit a wrong. As noted several times above, there is no evidence that the RESP sales representatives conspired with Mr. Sethi, Ms. Bandali, and Mr. Sulur to invade the privacy of the hospital patients. There is no strong connection between what the investment dealers asked their employees or independent contractors to do and the commission of a wrongdoing by a third party.

[243] In short, there is no factual underpinning for a vicarious liability claim against the RESP investment dealers because their enterprise did not create the risk that arose in the immediate case.

[244] I, therefore, conclude that the Plaintiffs have not satisfied the cause of action criterion for any claims based on vicarious liability as against the RESP investment dealers and the RESP sales representatives.

G. Identifiable Class Criterion

1. General Principles: Identifiable Class Criterion

[245] The second certification criterion is the identifiable class criterion. The definition of an identifiable class serves three purposes: (1) it identifies the persons who have a potential claim against the defendant; (2) it defines the parameters of the lawsuit so as to identify those persons bound by the result of the action; and (3) it describes who is entitled to notice.[^88]

[246] In Western Canadian Shopping Centres v. Dutton,[^89] the Supreme Court of Canada explained the importance of and rationale for the requirement that there be an identifiable class:

First, the class must be capable of clear definition. Class definition is critical because it identifies the individuals entitled to notice, entitled to relief (if relief is awarded), and bound by the judgment. It is essential, therefore, that the class be defined clearly at the outset of the litigation. The definition should state objective criteria by which members of the class can be identified. While the criteria should bear a rational relationship to the common issues asserted by all class members, the criteria should not depend on the outcome of the litigation. It is not necessary that every class member be named or known. It is necessary, however, that any particular person’s claim to membership in the class be determinable by stated, objective criteria.

[247] In identifying the persons who have a potential claim against the defendant, the definition cannot be merits-based.[^90] In Frohlinger v. Nortel Networks Corporation[^91] at para. 21, Justice Winkler, as he then was, explained why merits-based definitions are prohibited; he stated:

21. The underlying reason for each of these prohibitions is readily apparent. Merits-based class definitions require a determination of each class member's claim as a pre-condition of ascertaining class membership. Carrying that concept to its logical conclusion, it would mean that at the conclusion of a class proceeding only those individuals who were successful in their claims would be members of the class and, therefore, bound by the result. Theoretically, unsuccessful claimants would not be "class members" and would be free to commence further litigation because s. 27(3) of the CPA, which states in part:

A judgment on common issues of a class or subclass binds every class member who has not opted out of the class proceeding [....]

would not bind them or bar them from commencing further actions.

[248] In defining the persons who have a potential claim against the defendant, there must be a rational relationship between the class, the cause of action, and the common issues, and the class must not be unnecessarily broad or over-inclusive.[^92] An over-inclusive class definition binds persons who ought not to be bound by judgment or by settlement, be that judgment or settlement favourable or unfavourable.[^93] The rationale for avoiding over-inclusiveness is to ensure that litigation is confined to the parties joined by the claims and the common issues that arise.[^94] The class should not be defined wider than necessary, and where the class could be defined more narrowly, the court should either disallow certification or allow certification on condition that the definition of the class be amended.[^95]

[249] A proposed class definition, however, is not overbroad because it may include persons who ultimately will not have a claim against the defendants.[^96]

2. Analysis: Identifiable Class Criterion

[250] In Broutzas v. Rouge Valley Health System, the Plaintiffs propose the following class definition:

All persons who gave birth at Rouge Valley Health System between January 2009 [the date that Mrs. Edry began purchasing information from Ms. Bandali] and October 17, 2014 [the date when Nurse Cruz’s employment at Rouge Valley was terminated].

[251] For reasons that will become clear momentarily, this definition should be amended to read:

All persons who gave birth at Rouge Valley Health System between January 2009 and October 17, 2014 who were contacted by one or more of the following RESP investment dealers: i.e., Children’s Education Funds, C.S.T. Consultants Inc., Global RESP Corporation, and Knowledge First Financial Inc.

[252] In Kouvas v. Scarborough and Rouge Hospital, Ms. Kouvas proposes the following class definition:

All persons who gave birth at the Birchmount site of The Scarborough Hospital between January 1, 2012 [the date that Ms. Acar began to purchase information from Nurse Cruz] to September 30, 2013 [the date when Nurse Cruz’s employment ended].

[253] For reasons that will become clear momentarily, this definition should be amended to read:

All persons who gave birth at the Birchmount site of The Scarborough Hospital between January 1, 2012 to September 30, 2013 who were contacted by Global RESP Corporation.

[254] The proposed revisions to the class definitions align the class definitions with the claims for which there is some basis in fact and the revised definitions neuter the Defendants’ objections to the class definitions, which objections are discussed below.

[255] The Defendants advance several different types of arguments that the Plaintiffs in either action do not satisfy the identifiable class criterion for certification. I disagree with their objections.

[256] For the reasons that follow, I am satisfied that the class definitions for both actions as revised do satisfy the identifiable class criterion. The constitution of the class may, however, manifest problems about the common issues and the preferable procedure criteria, but those are different matters that I will discuss further below.

[257] The rationale of the class definitions proposed by the Representative Plaintiffs essentially borrows the criterion used by Rouge Valley and The Scarborough Hospital when they gave notice to their patients about the privacy breach and focusses on the wrongdoing of Ms. Bandali, Nurse Cruz, and Mr. Sethi. In other words, the definition of the class period begins with the earliest date when the hospital’s employees could and might have wrongfully extracted information from the hospitals’ data base of patient information, and the class period ends with the latest date when there might have been wrongfully extracted information.

[258] At the time of the discovery of the privacy breach, Rouge Valley’s approach to giving notice was overbroad, because the hospital could not identify precisely whose information had been captured by Mr. Sethi or Ms. Bandali. At the time of the notices, it was not known how the information was being used. However, the overbreadth in the notice may now be overcome by adding the qualifier “who were contacted by one or more of the following RESP investment dealers; i.e., Children’s Education Funds, C.S.T. Consultants Inc., Global RESP Corporation, and Knowledge First Financial Inc.”

[259] In comparison, The Scarborough Hospital’s approach to notice was not overbroad but might have been under-inclusive. The appropriate definition that is neither under or over inclusive is the revised version set out above.

[260] From their own self-centered perspective, some of the Defendants argued that the class definition is overbroad because while Rouge Valley may be connected to the wrongdoing of Ms. Bandali, Nurse Cruz, and Mr. Sethi, other defendants are not similarly connected and thus there are times during the class period that are of no concern to them; hence the class definition is from their perspective overbroad.

[261] Put somewhat differently, each Defendant specifies that there should be an idiosyncratic definition matching its period of exposure. In my opinion, while this argument may reveal problems about the management of what is a composite of class claims and while this argument may be relevant to the common issues and preferable procedure criterion, the argument does not detract from what is a technically satisfactory class definition.

[262] There is a sufficient connection between the various strands of class actions and causes of action and sufficient links of facts and law to combine all of the actions into one class action at least for the purposes of defining the class. The certification motion itself demonstrated the efficiencies of combining all of the causes of actions, defendants, plaintiffs, and common facts, and common issues of law for the purposes of determining whether there were actions that should be certified under the Class Proceedings Act, 1992.

[263] Turning to a different objection with respect to the class definition, Rouge Hospital submits that there is a Sun‑Rype v. Archer Daniels Midland[^97] problem in the immediate case. In the Sun‑Rype case, a proposed price-fixing class action, the plaintiffs alleged that the defendants had conspired to fix the prices of high-fructose corn syrup used in beverages. The problem for the putative consumer class members was that manufacturers used high-fructose corn syrup and cane sugar interchangeably and the product labels on the consumer goods just described the ingredients as “sugar.” As a result, there was no way for purchasers of the products to know whether or not the products contained a price-fixed ingredient, and thus they did not know whether they qualified to be a class member of the proposed class of indirect purchasers of high‑fructose corn syrup.

[264] Rouge Valley submits that a similar problem exists in the immediate case because with the exception of labels and the recovered screen shots, it is not possible to know which of the almost 15,000 patients that gave birth during the class period had information hacked and hawked. This is said to be impossible because of the deficiencies in the auditing of the use of the hospitals computer system because the Meditech software did not identify whose contact information had been accessed improperly by Ms. Bandali, Nurse Cruz, or Mr. Sethi.

[265] With the revised definitions, this alleged problem does not exist. The Class Members can self-identify by knowing when they were a patient of the hospital and by remembering whether they were contacted by Children’s Education Funds, CST, Global or Knowledge First. A subset of the Class Members already has some corroboration of their memory in the labels and the screen shots and the other evidence gathered from Ms. Bandali and Nurse Cruz. Additional information to corroborate that a person is a Class Member may be forthcoming from the discovery process depending on the records of the defendants.

[266] I conclude that the Plaintiffs in both actions satisfy the identifiable class criterion for certification.

H. Common Issues Criterion

1. General Principles: Common Issues

[267] The third criterion for certification is the common issues criterion. For an issue to be a common issue, it must be a substantial ingredient of each class member's claim and its resolution must be necessary to the resolution of each class member's claim.[^98] The underlying foundation of a common issue is whether its resolution will avoid duplication of fact-finding or legal analysis of an issue that is a substantial ingredient of each class member’s claim and thereby facilitate judicial economy and access to justice.[^99] In Pro-Sys Consultants Ltd. v. Microsoft Corporation,[^100] the Supreme Court of Canada describes the commonality requirement as the central notion of a class proceeding which is that individuals who have litigation concerns in common ought to be able to resolve those common concerns in one central proceeding rather than through an inefficient multitude of repetitive proceedings.

[268] All members of the class must benefit from the successful prosecution of the action, although not necessarily to the same extent. The answer to a question raised by a common issue for the plaintiff must be capable of extrapolation, in the same manner, to each member of the class.[^101]

[269] An issue is not a common issue if its resolution is dependent upon individual findings of fact that would have to be made for each class member.[^102] Common issues cannot be dependent upon findings which will have to be made at individual trials, nor can they be based on assumptions that circumvent the necessity for individual inquiries.[^103]

[270] Commonality is a substantive fact that exists on the evidentiary record or it does not, and commonality is not to be semantically manufactured by overgeneralizing; i.e., by framing the issue in general terms that will ultimately break down into issues to be resolved by individual inquiries for each class member.[^104] In Rumley v. British Columbia,[^105] Chief Justice McLachlin stated that an issue would not satisfy the common issues test if it was framed in overly broad terms; she stated:

[…] It would not serve the ends of either fairness or efficiency to certify an action on the basis of issues that are common only when stated in the most general terms. Inevitably such an action would ultimately break down into individual proceedings. That the suit had initially been certified as a class action could only make the proceeding less fair and less efficient.

[271] However, the commonality requirement does not mean that an identical answer is necessary for all the members of the class, or even that the answer must benefit each of them to the same extent; it is enough that the answer to the question does not give rise to conflicting interests among the members; success for one member must not result in failure for another.[^106]

[272] The common issue criterion presents a low bar.[^107] An issue can be a common issue even if it makes up a very limited aspect of the liability question and even though many individual issues remain to be decided after its resolution.[^108] Even a significant level of individuality does not preclude a finding of commonality.[^109]A common issue need not dispose of the litigation; it is sufficient if it is an issue of fact or law common to all claims and its resolution will advance the litigation.[^110]

[273] As already noted above, in the context of the common issues criterion, the some-basis-in-fact standard involves a two-step requirement that: (1) the proposed common issue actually exists; and (2) the proposed issue can be answered in common across the entire class.

2. Proposed Common Issues

[274] In the Broutzas v. Rouge Valley Health System action, in their reply factum, the Plaintiffs proposed the following revised list common issues:

Intrusion Upon Seclusion

1. Did the other individual defendants knowingly or recklessly invade the privacy of Class Members without lawful justification?

2. If so, would a reasonable person regard the invasions as highly offensive, causing distress, humiliation, or anguish?

Vicarious liability

3. Is Rouge Valley vicariously liable for the actions of Sethi, Bandali, and Cruz, in relation to personal health information of Class Members?

4. Is Knowledge First vicariously liable for the actions of Polina Edry and Gavriel Edry?

5. Is CST vicariously liable for the actions of Sulur?

6. Is Global Corporation vicariously liable for the actions of Acar?

7. Are Rouge Valley and Knowledge First, CST, Global, Rouge Valley Employees, and RESP Company Employees liable to the class on a joint and several basis?

Section 65 of the Personal Health Information Protection Act

8. Are Class Members who were affected by Sethi's and Bandali's actions entitled to an award for damages suffered pursuant to section 65 of the PHIPA?

Negligence

9. Did Rouge Valley owe a duty of care to Class Members regarding their personal health information? Further or in the alternative, did the Rouge Valley Employees owe a duty of care to Class Members regarding their personal health information?

10. If so, did Rouge Valley breach its duty of care? Further or in the alternative, did the Rouge Valley Employees breach their duty of care?

11. Did Knowledge First, CST, and Global owe a duty of care to Class Members? Further or in the alternative, did the RESP Company Employees owe a duty of care to Class Members regarding their personal health information?

12. If so, did Knowledge First breach its duty of care? Further or in the alternative, did the Edrys breach their duty of care?

13. If so, did CST breach its duty of care? Further or in the alternative, did Sulur breach his duty of care?

14. If so, did Global breach its duty of care? Further or in the alternative, did Acar breach her duty of care?

Breach of Contract and Warranty

15. Did Rouge Valley have a contractual obligation to properly collect, store, and secure the personal health information of the class members?

16. If so, did Rouge Valley breach that contractual obligation?

Damages

17. What damages can the class members claim on the basis of intrusion upon seclusion, breach of contract and warranty, and section 65 of the PHIPA?

18. Can damages be measured on an aggregate basis, and if so, what are the aggregate damages for the class?

[275] In Kouvas v. Scarborough and Rouge Hospital, Ms. Kouvas proposes the following common issues:

Intrusion Upon Seclusion

1. Did Nurse Cruz and Nellie Acar willfully or recklessly invade the privacy of Class Members without lawful justification?

2. If so, would a reasonable person regard the invasions as highly offensive, causing distress, humiliation, or anguish?

Vicarious Liability

3. Is TSH vicariously liable for the actions of Nurse Cruz, in relation to personal health information of Class Members?

4.. Is Global vicariously liable for the actions of Acar?

5. Are TSH, Global, Nurse Cruz, and Acar liable to the class on a joint and several basis?

Negligence

6. Did TSH owe a duty of care to Class Members regarding their personal health information? Further or in the alternative, did Nurse Cruz owe a duty of care to Class Members regarding their personal health information?

7.If so, did TSH breach its duty of care? Further or in the alternative, did Nurse Cruz breach her duty of care?

8. Did Global owe a duty of care to Class Members? Further or in the alternative, did Nellie Acar owe a duty of care to Class Members regarding their personal health information?

9. If so, did Global breach its duty of care? Further or in the alternative, did Nellie Acar breach her duty of care?

Breach of Contract and Warranty

10. Did Class Members enter into a contract with TSH with respect to the collection, retention, use, and disclosure of personal health information?

11. If so, did the express or implied terms of the contract include terms and/or warrant that TSH would:

(a) Comply with all relevant statutory obligations and policies concerning the collection, retention, use, and disclosure of the Plaintiff’s and other Class Members' Personal Information, including the obligations set out in TSH's policies, including its privacy policy and PHIPA?

(b) Keep personal health information secure and confidential?

(c) Take steps to secure the Personal Information and prevent it from being lost, stolen, disseminated, used, or disclosed except as provided by the Contract or applicable statutes?

(d) Not disclose the Personal Information except as provided by the Contract and applicable statutes?

(e) Ensure employees given access to the Personal Information also secured the Personal Information and ensured that it would not be lost, stolen, disseminated, used, or disclosed except as provided by the Contract and applicable statutes, including by having adequate systems in place to track and audit the identity of employees that accessed personal health information of patients?

12. Did TSH breach its contract or warranties with Class Members?

Damages

13. What damages can the Class Members claim on the basis of intrusion upon seclusion, breach of contract and warranty, and negligence?

14. Can damages be measured on an aggregate basis, and if so, what are the aggregate damages for the Class?

3. Common Issues: Discussion and Analysis

[276] In light of the cause of action analysis set out above, which analysis included an appraisal of whether there is some basis in fact for the proposed common issues, including whether the proposed common issue actually exists, in the Broutzas v. Rouge Valley Health System action, I conclude that Questions 1-2, 4-7 and 11-18 do not satisfy the common issues criterion.

[277] While perhaps some aspects within Question 8 in the Broutzas v. Rouge Valley Health System action could raise a common issue for a subset of the Class, ultimately Question 8 depends upon individual determinations and the preferable procedure for the resolution of the common aspects of Question 8 is a Small Claims Court action or PHIPA proceedings. Thus, Question 8 does not satisfy the common issues criterion. Standing alone, Question 8 does not satisfy the preferable procedure criterion.

[278] Questions 3, 9 and 10 in the Broutzas v. Rouge Valley Health System action with respect to negligence and vicarious negligence of Rouge Valley and its employees are theoretically common questions across the class; however, the questions do not satisfy the common issues test because there is no basis in fact for the existence of a negligence action given that there is no evidence that the Representative Plaintiffs or any Class Member suffered compensable damages under the tort of negligence, which sets a much higher bar for damages than the tort of intrusion on seclusion.

[279] Further, while confirming that a hospital and its employees has a duty of care to protect patients’ privacy and that a hospital could be vicariously liable for its employees would advance the action, it is not much of an advance, since these elements of the claim are essentially uncontestable.

[280] While answering the question of whether the hospital breached its duty of care to protect patient information would advance the litigation for the class, weighing the common issues against the individuals issues that would remain for the small portion of the class, if any, that had compensable damages, and factoring in that there are no other common issues, a common issues trial of the breach of duty question is not justified and does not satisfy the common issues criterion.

[281] Further still, as explained in the next section of these Reasons for Decision, a class action is not the preferable procedure for the resolution of the common issues.

[282] The outcome is that there are no common issues for the Broutzas v. Rouge Valley Health System action and the Plaintiffs do not satisfy the common issues criterion.

[283] For similar reasons, there are no common issues for the Kouvas v. Scarborough and Rouge Hospital action and Ms. Kouvas does not satisfy the common issues criterion.

I. Preferable Procedure Criterion

1. General Principles: Preferable Procedure

[284] Under the Class Proceedings Act, 1992, the fourth criterion for certification is the preferable procedure criterion. Preferability captures the ideas of: (a) whether a class proceeding would be an appropriate method of advancing the claims of the class members; and (b) whether a class proceeding would be better than other methods such as joinder, test cases, consolidation, and any other means of resolving the dispute.[^111]

[285] In AIC Limited v. Fischer,[^112] the Supreme Court of Canada emphasized that the preferability analysis must be conducted through the lens of judicial economy, behaviour modification, and access to justice. Justice Cromwell for the Court stated that access to justice has both a procedural and substantive dimension. The procedural aspect focuses on whether the claimants have a fair process to resolve their claims. The substantive aspect focuses on the results to be obtained and is concerned with whether the claimants will receive a just and effective remedy for their claims if established. Thus, for a class proceeding to be the preferable procedure for the resolution of the claims of a given class, it must represent a fair, efficient, and manageable procedure that is preferable to any alternative method of resolving the claims.[^113] Arguments that no litigation is preferable to a class proceeding cannot be given effect.[^114] Whether a class proceeding is the preferable procedure is judged by reference to the purposes of access to justice, behaviour modification, and judicial economy and by taking into account the importance of the common issues to the claims as a whole, including the individual issues.[^115]

[286] Relevant to the preferable procedure analysis are the factors listed in s. 6 of the Class Proceedings Act, 1992, which states:

6. The court shall not refuse to certify a proceeding as a class proceeding solely on any of the following grounds:

7. The relief claimed includes a claim for damages that would require individual assessment after determination of the common issues.

8. The relief claimed relates to separate contracts involving different Class Members.

9. Different remedies are sought for different Class Members.

10. The number of Class Members or the identity of each Class Member is not known.

11. The class includes a subclass whose members have claims or defences that raise common issues not shared by all Class Members.

[287] To satisfy the preferable procedure criterion, the proposed representative plaintiff must show some basis in fact that the proposed class action would: (a) be a fair, efficient and manageable method of advancing the claim; (b) be preferable to any other reasonably available means of resolving the class members' claims; and (c) facilitate the three principal goals of class proceedings; namely: judicial economy, behaviour modification, and access to justice.[^116]

[288] In considering the preferable procedure criterion, the court should consider: (a) the nature of the proposed common issue(s) and their importance in relation to the claim as a whole; (b) the individual issues which would remain after determination of the common issue(s); (c) the factors listed in the Act; (d) the complexity and manageability of the proposed action as a whole; (e) alternative procedures for dealing with the claims asserted; (f) the extent to which certification furthers the objectives underlying the Act; and (g) the rights of the plaintiff(s) and defendant(s).[^117]

[289] The court must identify alternatives to the proposed class proceeding.[^118] The proposed representative plaintiff bears the onus of showing that there is some basis-in-fact that a class proceeding would be preferable to any other reasonably available means of resolving the class members’ claims, but if the defendant relies on a specific non-litigation alternative, the defendant has the evidentiary burden of raising the non-litigation alternative.[^119] It is not enough for the plaintiff to establish that there is no other procedure which is preferable to a class proceeding; he or she must also satisfy the court that a class proceeding would be fair, efficient and manageable.[^120]

[290] In AIC Limited v. Fischer, Justice Cromwell pointed out that when the court is considering alternatives to a class action, the question is whether the alternative has potential to provide effective redress for the substance of the plaintiff’s claims and to do so in a manner that accords suitable procedural rights. He said that there are five questions to be answered when considering whether alternatives to a class action will achieve access to justice: (1) Are there economic, psychological, social, or procedural barriers to access to justice in the case? (2) What is the potential of the class proceeding to address those barriers? (3) What are the alternatives to class proceedings? (4) To what extent do the alternatives address the relevant barriers? and (5) How do the two proceedings compare?[^121]

[291] And in light of the Supreme Court of Canada’s directives in Hryniak v. Mauldin[^122] and Bruno Appliance and Furniture, Inc. v. Hryniak,[^123] one should now add to the preferable procedure factors the factor of the relationship between access to justice, which is the preeminent concern of class proceedings, and proportionality in civil procedures. The proportionality analysis, which addresses how much procedure a litigant actually needs to obtain access to justice, fits nicely with the focus on judicial economy and with the part of the preferable procedure analysis that considers manageability and whether the claimants will receive a just and effective remedy for their claims.

[292] In cases, particularly cases where the individual class members’ respective harm is nominal, or cases where an aggregate assessment of damages in whole or in part is possible, a class action may more readily satisfy the preferable procedure criterion because the common issues trial may be the only viable means for remedying the wrong and for calling the wrongdoer to account because individual litigation may be prohibitively expensive.[^124]

[293] In undertaking a preferable procedure analysis in a case in which individual issue trials are inevitable, it should be appreciated that the Class Proceedings Act, 1992 envisions the prospect of individual claims being litigated and it should be noted that sections 12 and 25 of the Act empower the court with tools to manage and achieve access to justice and judicial economy; thus the inevitability of individual issues trials is not an obstacle to certification. In the context of misrepresentation claims, numerous actions have been certified notwithstanding individual issues of reliance and damages.[^125]

[294] That said, in a given particular case, the inevitability of individual issues trials may obviate any advantages from the common issues trial and make the case unmanageable and thus the particular case will fail the preferable procedure criterion.[^126] Or, in a given case, the inevitability of individual issues may mean that while the action may be manageable, those individual issue trials are the preferable procedure and a class action is not the preferable procedure to achieve access to justice, behaviour modification, and judicial economy. A class action may not be fair, efficient and manageable, having regard to the common issues in the context of the action as a whole and the individual issues that would remain after the common issues are resolved.[^127] A class action will not be preferable if, at the end of the day, claimants remain faced with the same economic and practical hurdles that they faced at the outset of the proposed class action.[^128]

2. Analysis: Preferable Procedure

[295] It is axiomatic that if the common issues criterion is not satisfied, the preferable procedure criterion is not satisfied.[^129] Therefore, in the immediate cases, I can quickly conclude that the preferable procedure criterion is not satisfied for either Broutzas v. Rouge Valley Health System or for Kouvas v. Scarborough and Rouge Hospital.

[296] I would, in any event, have come to the same conclusion that the preferable procedure criterion is not satisfied if there had have been certifiable common issues. In the immediate case, both actions are built on the tort of inclusion on seclusion and assuming that there had have been common issues about this tort, then given the particular circumstances of five scenarios of an intrusion on seclusion; i.e., (1) Mr. Setti’s alleged intrusion; (2) and (3) the intrusion of Nurse Cruz at two different hospitals for Global; and (4) and (5) Ms. Bandali’s intrusion for CST and Knowledge First, individual Small Claims Court actions would be more manageable and preferable to an omnibus and behemoth class action trial.

[297] Viewed through the lens of access to justice, behavior modification, and judicial economy, a class action is not the preferable procedure for either action.

[298] Through the access to justice and behavior modification lens of preferable procedure, the real target of the class action is the hospital, because Ms. Bandali, Nurse Cruz, and Mr. Sethi obviously do not have the multi-millions of dollars claimed, and with the exception of Mr. Sethi, who may have done nothing wrong, they have already been punished for their wrongdoing.

[299] For the hospital, no behavior management is necessary. After training efforts and strong admonitions to protect patient privacy, the hospitals were betrayed by their employees. The Order made by the Privacy and Information Commissioner against Rouge Valley was essentially directed at having the hospital introduce better auditing systems to identify - after an intrusion - the extent of the harm caused.

[300] Rouge Valley complied with the Order of the Privacy and Information Commissioner and no further behavior modification is necessary.

[301] While the number of persons who would be given notice, estimated to be in the range of 15,000 is large, class membership of persons contacted by who were contacted by one or more of Children’s Education Funds, C.S.T. Consultants Inc., Global RESP Corporation, and Knowledge First Financial Inc. is considerably smaller. If any of these Class Members seek access to justice, a Small Claims Court proceeding for intrusion on seclusion is preferable. The case at bar, is one where judicial economy would be best achieved by the Small Claims Court branch of the Superior Court.

[302] I conclude that the preferable procedure criterion is not satisfied in either proposed class action.

J. Representative Plaintiff Criterion

1. General Principles: Representative Plaintiff Criterion

[303] The fifth and final criterion for certification as a class action is that there is a representative plaintiff who would adequately represent the interests of the class without conflict of interest and who has produced a workable litigation plan. The representative plaintiff must be a member of the class asserting claims against the defendant, which is to say that the representative plaintiff must have a claim that is a genuine representation of the claims of the members of the class to be represented or that the representative plaintiff must be capable of asserting a claim on behalf of all of the class members as against the defendant.[^130]

[304] For each defendant there must be a representative plaintiff who has a valid cause of action against that defendant.[^131] Provided that the representative plaintiff has his or her own cause of action, the representative plaintiff can assert a cause of action against a defendant on behalf of other class members that he or she does not assert personally, provided that the causes of action all share a common issue of law or of fact.[^132]

[305] Whether the representative plaintiff can provide adequate representation depends on such factors as: his or her motivation to prosecute the claim; his or her ability to bear the costs of the litigation; and the competence of his or her counsel to prosecute the claim.[^133]

[306] While a litigation plan is a work in progress, it must correspond to the complexity of the particular case and provide enough detail to allow the court to assess whether a class action is: (a) the preferable procedure; and (b) manageable including the resolution of the common issues and any individual issues that remain after the common issues trial.[^134] The litigation plan will not be workable if it fails to address how the individual issues that remain after the determination of the common issues are to be addressed.[^135]

2. Analysis: Representative Plaintiff

[307] Given the findings above with respect to the cause of action, common issues, and preferable procedure criterion, it is not necessary to do a deep analytical dive into the representative plaintiff criterion. In particular, it is otiose to address the Defendants’ arguments about the deficiencies of the Plaintiffs’ litigation plan, which typically, standing alone, is not a reason to reject an otherwise satisfactory class proceeding. Deficient litigation plans can be fixed. A class action that does not satisfy the other certification criterion cannot have a fixable litigation plan.

[308] I, however, shall address, the Defendants’ arguments about whether the proposed Representative Plaintiffs are qualified to be representative plaintiffs.

[309] The Defendants submitted that the Plaintiffs do not qualify to be Representative Plaintiffs because their individual claims are doomed to fail, since each of the proposed Representative Plaintiffs did not subjectively regard the contact information taken from the hospitals’ records as a private matter. The Defendants also submit that the proposed representative plaintiffs demonstrated by their conduct that they subjectively did not actually suffer any damages. The Defendants essentially argue that the proposed Representative Plaintiffs do not have meritorious claims against the Defendants. The Defendants make this argument notwithstanding that a certification motion is not a summary judgment motion nor a test of the merits of the action.

[310] In my opinion, it may be that the Plaintiffs’ individual cases may flounder at individual issues trial or they may fail to be eligible claimants if there was a settlement or a distribution scheme, but that does not disqualify them from being Representative Plaintiffs for the balance of the class with whom there is no conflict of interest in resolving the common issues. The Plaintiffs have individual claims and a certification motion does not decide the merits of those claims. Assuming contrary to my conclusion above that there was a viable cause of action for intrusion on seclusion, the Representative Plaintiffs and the Class Members would be entitled to a decision at the common issues trial at least to the extent of a declaration of an entitled to moral or symbolic damages for the Class Members who could establish later that they qualify for an award.

[311] In the result, I conclude that although the Representative Plaintiffs would qualify as Representative Plaintiffs, the representative plaintiff criterion is not satisfied because other certification criteria have not been satisfied.

K. Conclusion

[312] For the above reasons, I dismiss the certification motions in both actions.

[313] If the parties cannot agree about the matter of costs, they may make submissions in writing beginning with the submissions of the Defendants - Rouge Valley, CST, Global, Knowledge First, the Edrys, and Ms. Acar - within twenty days of the release of these Reasons for Decision followed by the submissions of the Plaintiffs within a further twenty days.

[314] I advise the parties that given the novelty of the issues and the public interest in them, that I am inclined to make no order as to costs.

Perell, J.

Released: October 25, 2018

COURT FILE NO.: CV-14-507026

COURT FILE NO.: CV-17-567522

DATE: 2018/10/25

ONTARIO

SUPERIOR COURT OF JUSTICE

BETWEEN:

Elia Broutzas and Meagan Ware

Plaintiffs

– and –

Rouge Valley Health System, C.S.T. Consultants Inc., Knowledge First Financial Inc., Global RESP Corporation, Nellie Acar, Shaida Bandali, Esther Cruz, Gavriel Edry, Polina Edry, Munish Sethi, Subramaniam Sulur, Jane Doe “A”, Jane Doe “B”, John Doe, Registered Education Savings Plan Corporation, and Jane Doe “C”

Defendants

AND BETWEEN:

Anne Kouvas

Plaintiff

• and -

Scarborough and Rouge Hospital, Global RESP Corporation, Esther Cruz and Nellie Acar

Defendant

REASONS FOR DECISION

PERELL J.

Released: October 25, 2018

[^1]: S.O. 2004, c. 3, Sched. A.

[^2]: An RESP is a tax-deferred investment vehicle used by parents to save money for a child’s post-secondary education. Enrolling in an RESP makes the subscriber eligible to receive government education grants such as the Canada Education Savings Grant and the Canada Learning Bond.

[^3]: R.S.O. 1990, c. S.5.

[^4]: S.O. 1992, c. C.6.

[^5]: Broutzas v. Rouge Valley Health System 2018 ONSC 6317.

[^6]: R.S.O. 1990, c. P.40.

[^7]: R. v. Bandali, 2015 ONCJ 652.

[^8]: S.C. 2000, c.5.

[^9]: Sauer v. Canada (Attorney General), 2008 43774 (ON SC), [2008] O.J. No. 3419 at para. 14 (S.C.J.), leave to appeal to Div. Ct. refused, 2009 2924 (ON SCDC), [2009] O.J. No. 402 (Div. Ct.).

[^10]: Hollick v. Toronto (City), 2001 SCC 68 at para. 16.

[^11]: Hollick v. Toronto (City), 2001 SCC 68 at paras. 15 and 16; Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 at paras. 26 to 29.

[^12]: Hollick v. Toronto (City), 2001 SCC 68 at paras. 28 and 29.

[^13]: Hollick v. Toronto (City), 2001 SCC 68 at paras. 16-26.

[^14]: Batten v. Boehringer Ingelheim (Canada) Ltd., 2017 ONSC 53, aff'd, 2017 ONSC 6098 (Div. Ct.), leave to appeal refused (28 February 2018) (C.A.); Dine v. Biomet, 2015 ONSC 7050, aff'd 2016 ONSC 4039 (Div. Ct.); Good v. Toronto Police Services Board, 2014 ONSC 4583 (Div. Ct.); McCracken v. Canadian National Railway Company, 2012 ONCA 445; Fulawka v. Bank of Nova Scotia, 2012 ONCA 443; Martin v. Astrazeneca Pharmaceuticals PLC, 2012 ONSC 2744; Williams v. Canon Canada Inc., 2011 ONSC 6571, aff'd 2012 ONSC 3992 (Div. Ct.).

[^15]: Pro-Sys Consultants Ltd. v. Microsoft Corporation, 2013 SCC 57; McCracken v. CNR Co., 2012 ONCA 445.

[^16]: Singer v. Schering-Plough Canada Inc., 2010 ONSC 42 at para. 140; Fresco v. Canadian Imperial Bank of Commerce, 2009 31177 (ON SC), [2009] O.J. No. 2531 at para. 21 (S.C.J.); Dumoulin v. Ontario, [2005] O.J. No. 3961 at para. 25 (S.C.J.).

[^17]: Pro-Sys Consultants Ltd. v. Microsoft Corporation, 2013 SCC 57 at para. 110.

[^18]: Hollick v. Toronto (City), 2001 SCC 68 at para. 22.

[^19]: Williams v. Canon Canada Inc., 2011 ONSC 6571, aff’d 2012 ONSC 3992 (Div. Ct.); Ernewein v. General Motors of Canada Ltd., 2005 BCCA 540 (C.A.), leave to appeal to S.C.C. ref’d, [2005] S.C.C.A. No. 545; Chadha v. Bayer Inc.(2003), 2003 35843 (ON CA), 63 O.R. (3d) 22 (C.A.), leave to appeal to S.C.C. ref’d [2003] S.C.C.A. No. 106; Taub v. Manufacturers Life Insurance Co., 1998 14853 (ON SC), 40 O.R. (3d) 379 (Gen. Div.), aff’d (1999), 1999 19922 (ON SC), 42 O.R. (3d) 576 (Div. Ct.).

[^20]: Cloud v. Canada (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 at para. 50 (C.A.), leave to appeal to the S.C.C. ref'd, [2005] S.C.C.A. No. 50, rev'g (2003), 2003 72353 (ON SCDC), 65 O.R. (3d) 492 (Div. Ct.); Hollick v. Toronto (City), 2001 SCC 68 at paras. 16-26.

[^21]: Martin v. Astrazeneca Pharmaceuticals PLC, 2012 ONSC 2744; Williams v. Canon Canada Inc., 2011 ONSC 6571, aff’d 2012 ONSC 3992 (Div. Ct.); Schick v. Boehringer Ingelheim (Canada) Ltd., 2011 ONSC 63 at para.13; Ernewein v. General Motors of Canada Ltd. 2005 BCCA 540 (C.A.), leave to appeal to S.C.C. ref’d, [2005] S.C.C.A. No. 545.

[^22]: Griffin v. Dell Canada Inc., 2009 3557 (ON SC), [2009] O.J. No. 418 at para. 76 (S.C.J.).

[^23]: 1990 90 (SCC), [1990] 2 S.C.R. 959.

[^24]: 176560 Ontario Ltd. v. Great Atlantic & Pacific Co. of Canada Ltd. (2002), 2002 6199 (ON SC), 62 O.R. (3d) 535 at para. 19 (S.C.J.), leave to appeal granted, 2003 36393 (ON SCDC), 64 O.R. (3d) 42 (S.C.J.), aff'd (2004), 2004 16620 (ON SCDC), 70 O.R. (3d) 182 (Div. Ct.); Anderson v. Wilson (1999), 1999 3753 (ON CA), 44 O.R. (3d) 673 at p. 679 (C.A.), leave to appeal to S.C.C. ref'd, [1999] S.C.C.A. No. 476.

[^25]: Cloud v. Canada (Attorney General) (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 at para. 41 (C.A.), leave to appeal to the S.C.C. refused, [2005] S.C.C.A. No. 50, rev'g, (2003), 2003 72353 (ON SCDC), 65 O.R. (3d) 492 (Div. Ct.); Hollick v. Toronto (City), 2001 SCC 68 at para. 25; Abdool v. Anaheim Management Ltd. (1995), 1995 5597 (ON SCDC), 21 O.R. (3d) 453 at p. 469 (Div. Ct.).

[^26]: 2012 ONCA 32.

[^27]: Krouse v. Chrysler (1973), 1973 574 (ON CA), 1 O.R. (2d) 225 (Ont. C.A.); Athans v. Canadian Adventure Camps Ltd. (1977), 1977 1255 (ON SC), 17 O.R. (2d) 425 (H.C.J.).

[^28]: 4 Harv. L. R. 193.

[^29]: 48 Cal. L. R. 383.

[^30]: Subsequently, in Nova Scotia, Manitoba, and Newfoundland and Labrador courts have left the existence of intrusion on seclusion an open issue or held that it is not plain and obvious that intrusion on seclusion does not exist as part of the common law of the province: Trout Point Lodge Ltd. v. Handshoe, 2012 NSC2 245; Doucette v. Nova Scotia, 2016 NSSC 25; Capital District Health Authority (c.o.b. East Coast Forensic Hospital, 2017 NSCA 28; Grant v. Winnipeg Regional Health Authority 2015 MBCA 44; Hynes v. Western Regional Integrated Health Authority, 2014 NLTD(G) 137.

[^31]: Jones v. Tsige, 2012 ONCA 32 at para. 71; Hopkins v. Kay, 2014 ONCA 112 at para. 48.

[^32]: 2016 ONSC 3577.

[^33]: Iovine v. Toronto Sun Wah Trading Inc., 2014 ONSC 655; McInerney v. MacDonald, 1992 57 (SCC), [1992] 2 S.C.R. 138; R. v. Dyment, 1988 10 (SCC), [1988] 2 S.C.R. 417; Halls v. Mitchell, 1928 1 (SCC), [1928] S.C.R. 125.

[^34]: 2017 ONSC 6140, aff’d 2018 ONCA 632.

[^35]: 2018 NBBR 19, leave to appeal to New Brunswick Court of Appeal denied.

[^36]: [2004] 351 Ill App Ct 3d 67, 813 NE (2d) 1013.

[^37]: 2013 US Dist. Lexis 156711.

[^38]: [2010] 407 Ill App Ct 3d 358; 943 NE 2d 23.

[^39]: Daniells v. McLellan, 2016 ONSC 3854 and 2017 ONSC 3466.

[^40]: 2014 NLTD(G) 137.

[^41]: Hemeon v. South West Nova District Health Authority, 2015 NSSC 287.

[^42]: 2014 ONSC 7249.

[^43]: 2016 ONSC 8067.

[^44]: 2017 ONSC 7665.

[^45]: 2018 ONSC 4008.

[^46]: 2014 ONSC 321, aff’d 2014 ONCA 112.

[^47]: 2014 FC 250, var’d 2014 FCA 159.

[^48]: 2017 BCS 1525.

[^49]: 2017 BCS 1525.

[^50]: 2017 ONSC 1082 and 2017 ONSC 5853. The claim for intrusion on seclusion was certified for settlement purposes as against the software developer and the settlement was approved; see Bennett v. Lenovo (Canada) Inc., 2017 ONSC 6578.

[^51]: Evans v. Bank of Nova Scotia 2014 ONSC 7249; Hynes v. Western Regional Integrated Health Authority 2014 NLTD(G) 137; Daniells v. McLellan, 2016 ONSC 3854 and 2017 ONSC 3466.

[^52]: Mustapha v. Culligan of Canada Ltd., 2008 SCC 27 at para. 3.

[^53]: Mustapha v. Culligan of Canada Ltd. 2008 SCC 27; Saadati v. Moorhead, 2017 SCC 28; Healey v. Lakeridge Health Corp., 2011 ONCA 55.

[^54]: 2017 SCC 28 at para. 37.

[^55]: Haig v. Bamford, [1976] 1 S.C.R. 466; Kamloops (City) v. Nielsen, 1984 21 (SCC), [1984] 2 S.C.R. 2; Rothfield v. Manolakos, 1989 17 (SCC), [1989] 2 S.C.R. 1259; Canadian National Railway Co. v. Norsk Pacific Steamship Co., 1992 105 (SCC), [1992] 1 S.C.R. 1021; Hercules Managements Ltd. v. Ernst & Young, 1997 345 (SCC), [1997] 2 S.C.R. 165; Bow Valley Husky (Bermuda) Ltd. v. Saint John Shipbuilding Ltd., 1997 307 (SCC), [1997] 3 S.C.R. 1210; Ingles v. Tutkaluk, 2000 SCC 12; Martel Building Ltd. v. Canada, 2000 SCC 60; Cooper v. Hobart, 2001 SCC 79; Edwards v. Law Society of Upper Canada, 2001 SCC 80; Odhavji Estate v. Woodhouse, 2003 SCC 69; Childs v. Desormeaux, 2006 SCC 18; Syl Apps Secure Treatment Centre v. D. (B.), 2007 SCC 38; Hill v. Hamilton-Wentworth Regional Police Services Board, 2007 SCC 41; Design Services Ltd. v. Canada, 2008 SCC 22; Mustapha v. Culligan of Canada Ltd., 2008 SCC 27; Fullowka v. Pinkerton's of Canada Ltd., 2010 SCC 5; R. v. Imperial Tobacco Canada Ltd., 2011 SCC 42; Saadati v. Moorhead, 2017 SCC 28; Deloitte & Touche v. Livent Inc. (Receiver of), 2017 SCC 63; Rankin (Rankin's Garage & Sales) v. J.J., 2018 SCC 19.

[^56]: [1978] A.C. 728 (H.L.).

[^57]: 1932 536 (FOREP), [1932] A.C. 562 (H.L.).

[^58]: [1964] A.C. 465 (H.L.).

[^59]: Anns v. Merton London Borough Council, [1978] A.C. 728 (H.L.); Mustapha v. Culligan of Canada Ltd. 2008 SCC 27 at para. 4.

[^60]: Cooper v. Hobart, 2001 SCC 79 at para. 30.

[^61]: Bingley v. Morrison Fuels, a Division of 503373 Ontario Ltd., 2009 ONCA 319 at para. 24.

[^62]: 2018 SCC 19.

[^63]: Rankin (Rankin's Garage & Sales) v. J.J., 2018 SCC 19 at para. 24.

[^64]: Donoghue v. Stevenson, 1932 536 (FOREP), [1932] A.C. 562 (H.L.); Eliopoulos v. Ontario (Minister of Health & Long-Term Care) (2006), 2006 37121 (ON CA), 82 OR (3d) 321 (CA), leave to appeal to SCC ref’d [2006] SCCA No 514.

[^65]: Odhavji Estate v. Woodhouse, 2003 SCC 69 at para. 49; Hercules Managements Ltd. v. Ernst & Young, 1997 345 (SCC), [1997] 2 SCR 165 at para. 24.

[^66]: Syl Apps Secure Treatment Centre v. D. (B.), 2007 SCC 38 at para. 26.

[^67]: Hill v. Hamilton-Wentworth Regional Police Services Board, 2007 SCC 41 at para. 23.

[^68]: Deloitte & Touche v. Livent Inc. (Receiver of), 2017 SCC 63.

[^69]: Cooper v. Hobart, 2001 SCC 79 at para. 34; Hill v. Hamilton-Wentworth Regional Police Services Board, 2007 SCC 41 at para. 23; Odhavji Estate v. Woodhouse, 2003 SCC 69 at para. 50.

[^70]: Hill v. Hamilton-Wentworth Regional Police Services Board, 2007 SCC 41 at para. 29.

[^71]: Saadati v. Moorhead, 2017 SCC 28 at para. 24.

[^72]: Cooper v. Hobart, 2001 SCC 79 at paras. 25-30.

[^73]: Design Services Ltd. v. Canada, 2008 SCC 22, [2008] 1 S.C.R. 737; Childs v. Desormeaux, 2006 SCC 18; Kim v. Thammavong, 2007 52791 (ON SC), [2007] O.J. No. 4769 (S.C.J.), leave to appeal ref'd 2008 63230 (ON SCDC), [2008] O.J. No. 4908 (Div. Ct.); Irvine v. Smith, [2008] O.J. No. 547 (S.C.J.).

[^74]: Fullowka v. Pinkerton's of Canada Ltd., 2010 SCC 5 at para. 26.

[^75]: 2006 SCC 18.

[^76]: Childs v. Desormeaux, 2006 SCC 18 at para. 13.

[^77]: Hill v. Hamilton-Wentworth Regional Police Services Board, 2007 SCC 41 at paras. 47-48; Fullowka v. Pinkerton's of Canada Ltd., 2010 SCC 5 at para. 57.

[^78]: Cooper v. Hobart, 2001 SCC 79 at para. 37; Odhavji Estate v. Woodhouse, 2003 SCC 69 at para. 51.

[^79]: Cooper v. Hobart, 2001 SCC 79 at para. 37; Odhavji Estate v. Woodhouse, 2003 SCC 69 at para. 51.

[^80]: 2000 SCC 60 at para. 71.

[^81]: See: Marinou v. Ziesmann, 2006 MBCA 30; Hobbs v Robertson, 2006 BCCA 65; O’Brien v. Ottawa Hospital, 2011 ONSC 231; Comrie v. Eckhaus, 2016 ONSC 1499.

[^82]: R v. John Doe, 2016 FCA 191.

[^83]: R v. Saskatchewan Wheat Pool, 1983 21 (SCC), [1983] 1 SCR 205.

[^84]: 2016 FCA 191, rev’g in part 2015 FC 916.

[^85]: 2011 SCC 59.

[^86]: 1999 692 (SCC), [1999] 2 SCR 534. See also KLB v British Columbia, 2003 SCC 51.

[^87]: 2003 SCC 51.

[^88]: Bywater v. Toronto Transit Commission, [1998] O.J. No. 4913 (Gen. Div.).

[^89]: 2001 SCC 46 at para. 38.

[^90]: Keatley Surveying Ltd. v. Teranet Inc., 2012 ONSC 7120 at paras. 159-167; Frohlinger v. Nortel Networks Corporation, 2007 696 (ON SC), [2007] O.J. No. 148 at para. 21 (S.C.J.); Chadha v. Bayer Inc. (2003), 2003 35843 (ON CA), 63 O.R. (3d) 22 (C.A.), leave to appeal to S.C.C. ref’d [2003] S.C.C.A. No. 106; Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 at para. 38.

[^91]: 2007 696 (ON SC), [2007] O.J. No. 148 (S.C.J.).

[^92]: Pearson v. Inco Ltd. (2006), 2006 913 (ON CA), 78 O.R. (3d) 641 at para. 57 (C.A.), rev'g 2004 34446 (ON SCDC), [2004] O.J. No. 317 (Div. Ct.), which had aff'd [2002] O.J. No. 2764 (S.C.J.).

[^93]: Robinson v. Medtronic Inc., 2009 56746 (ON SC), [2009] O.J. No. 4366 at paras. 121-146 (S.C.J.).

[^94]: Frohlinger v. Nortel Networks Corporation, 2007 696 (ON SC), [2007] O.J. No. 148 at para. 22 (S.C.J.).

[^95]: Fehringer v. Sun Media Corp., [2002] O.J. No. 4110 at paras. 12-13 (S.C.J.), aff’d [2003] O.J. No. 3918 (Div. Ct.); Hollick v. Toronto (City), 2001 SCC 68 at para. 21.

[^96]: Silver v. Imax Corp., 2009 72334 (ON SC), [2009] O.J. No. 5585 at para. 103-107 (S.C.J.) at para. 103-107, leave to appeal to Div. Ct. refused 2011 ONSC 1035 (Div. Ct.); Boulanger v. Johnson & Johnson Corp., 2007 735 (ON SC), [2007] O.J. No. 179 at para. 22 (S.C.J.), leave to appeal ref’d [2007] O.J. No. 1991 (Div. Ct.); Ragoonanan v. Imperial Tobacco Inc. (2005), 2005 40373 (ON SC), 78 O.R. (3d) 98 (S.C.J.), leave to appeal ref’d 2008 19242 (ON SCDC), [2008] O.J. No. 1644 (Div. Ct.); Bywater v. Toronto Transit Commission, [1998] O.J. No. 4913 at para. 10 (Gen. Div.) at para. 10.

[^97]: 2013 SCC 58.

[^98]: Hollick v. Toronto (City), 2001 SCC 68 at para. 18.

[^99]: Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 at paras. 39 and 40.

[^100]: 2013 SCC 57 at para. 106.

[^101]: Batten v. Boehringer Ingelheim (Canada) Ltd., 2017 ONSC 53, aff’d, 2017 ONSC 6098 (Div. Ct.), leave to appeal refused (28 February 2018) (C.A.); Amyotrophic Lateral Sclerosis Society of Essex County v. Windsor (City), 2015 ONCA 572 at para. 48; McCracken v. CNR, 2012 ONCA 445 at para. 183; Merck Frosst Canada Ltd. v. Wuttunee, 2009 SKCA 43 at paras. 145-46 and 160, leave to appeal to S.C.C. refused, [2008] S.C.C.A. No. 512; Ernewein v. General Motors of Canada Ltd., 2005 BCCA 540 (C.A.), leave to appeal to S.C.C. ref’d, [2005] S.C.C.A. No. 545; Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 at para. 40.

[^102]: Fehringer v. Sun Media Corp., [2003] O.J. No. 3918 at paras. 3, 6 (Div. Ct.).

[^103]: McKenna v. Gammon Gold Inc., 2010 ONSC 1591, [2010] O.J. No. 1057 at para. 126 (S.C.J.), leave to appeal granted 2010 ONSC 4068, [2010] O.J. No. 3183 (Div. Ct.), var’d 2011 ONSC 3882 (Div. Ct.); Nadolny v. Peel (Region), [2009] O.J. No. 4006 at paras. 50-52 (S.C.J.); Collette v. Great Pacific Management Co., 2003 BCSC 332, [2003] B.C.J. No. 529 at para. 51 (B.C.S.C.), var’d on other grounds (2004) 2004 BCCA 110, 42 B.L.R. (3d) 161 (B.C.C.A.).

[^104]: McCracken v. Canadian National Railway Company, 2012 ONCA 445 at para. 132; Microcell Communications Inc. v. Frey, 2011 SKCA 136 at para. 48-50, leave to appeal refused, [2012] S.C.C.A. No. 42; 197; Merck Frosst Canada Ltd. v. Wuttunee, 2009 SKCA 43, leave to appeal refused, [2008] S.C.C.A. No. 512; Rumley v. British Columbia, 2001 SCC 69, [2001] 3 S.C.R. 184 at para. 29.

[^105]: 2001 SCC 69, [2001] 3 S.C.R. 184 at para. 29.

[^106]: Vivendi Canada Inc. v. Dell’Aniello, 2014 SCC 1 at paras. 44–46.

[^107]: 203874 Ontario Ltd. v. Quiznos Canada Restaurant Corp., 2009 23374 (ON SCDC), [2009] O.J. No. 1874 (Div. Ct.), aff’d 2010 ONCA 466, [2010] O.J. No. 2683 (C.A.), leave to appeal to S.C.C. refused [2010] S.C.C.A. No. 348; Cloud v. Canada (Attorney General) (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 at para. 52 (C.A.), leave to appeal to the S.C.C. ref'd, [2005] S.C.C.A. No. 50, rev'g (2003), 2003 72353 (ON SCDC), 65 O.R. (3d) 492 (Div. Ct.); Carom v. Bre-X Minerals Ltd. (2000), 2000 16886 (ON CA), 51 O.R. (3d) 236 at para. 42 (C.A.).

[^108]: Cloud v. Canada (Attorney General), (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 (C.A.), leave to appeal to the S.C.C. ref'd, [2005] S.C.C.A. No. 50, rev'g (2003), 2003 72353 (ON SCDC), 65 O.R. (3d) 492 (Div. Ct.).

[^109]: Hodge v. Neinstein, 2017 ONCA 494 at para. 114; Pro-Sys Consultants Ltd. v. Microsoft Corporation, 2013 SCC 57 at para. 112; Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 at para. 54.

[^110]: Harrington v. Dow Corning Corp., 2000 BCCA 605, [2000] B.C.J. No. 2237 (C.A.), leave to appeal to S.C.C. ref’d [2001] S.C.C.A. No. 21.

[^111]: Markson v. MBNA Canada Bank, 2007 ONCA 334 at para. 69, leave to appeal to SCC ref’d [2007] S.C.C.A. No. 346; Hollick v. Toronto (City), 2001 SCC 68.

[^112]: 2013 SCC 69 at paras. 24-38.

[^113]: Cloud v. Canada (Attorney General) (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 at para. 52 (C.A.), leave to appeal to the S.C.C. ref'd, [2005] S.C.C.A. No. 50, rev'g (2003), 2003 72353 (ON SCDC), 65 O.R. (3d) 492 (Div. Ct.).

[^114]: 1176560 Ontario Ltd. v. The Great Atlantic and Pacific Company of Canada Ltd. (2002), 2002 6199 (ON SC), 62 O.R. (3d) 535 at para. 45 (S.C.J.), aff’d (2004), 2004 16620 (ON SCDC), 70 O.R. (3d) 182 (Div. Ct.).

[^115]: Markson v. MBNA Canada Bank, 2007 ONCA 334; Hollick v. Toronto (City), 2001 SCC 68.

[^116]: Musicians’ Pension Fund of Canada (Trustee of) v. Kinross Gold Corp., 2014 ONCA 901; AIC Limited v. Fischer, 2013 SCC 69; Hollick v. Toronto (City), 2001 SCC 68.

[^117]: Cloud v. Canada (Attorney General) (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 at para. 52 (C.A.), leave to appeal to the S.C.C. ref'd, [2005] S.C.C.A. No. 50, rev'g (2003), 2003 72353 (ON SCDC), 65 O.R. (3d) 492 (Div. Ct.); Chadha v. Bayer Inc. (2003), 2003 35843 (ON CA), 63 O.R. (3d) 22 (C.A.), leave to appeal to S.C.C. ref’d [2003] S.C.C.A. No. 106.

[^118]: AIC Limited v. Fischer, 2013 SCC 69 at para. 35; Hollick v. Toronto (City), 2001 SCC 68 at para. 28.

[^119]: AIC Limited v. Fischer, 2013 SCC 69 at paras. 48-49.

[^120]: Amyotrophic Lateral Sclerosis Society of Essex County v. Windsor (City), 2015 ONCA 572 at para. 62; Caputo v. Imperial Tobacco Ltd., 2004 24753 (ON SC), [2004] O.J. No. 299 at para. 62-67 (S.C.J.).

[^121]: Musicians’ Pension Fund of Canada (Trustee of) v. Kinross Gold Corp., 2014 ONCA 901 at para. 125; AIC Limited v. Fischer, 2013 SCC 69 at paras. 27-38.

[^122]: 2014 SCC 7.

[^123]: 2014 SCC 8.

[^124]: Marcantonio v. TVI Pacific Inc., [2009] O.J. No. 3409 (S.C.J.) at para. 9; Silver v. IMAX Corp., 2009 72334 (ON SC), [2009] O.J. No. 5585 at paras. 215-216 (S.C.J.), leave to appeal to Div. Ct. refused, 2011 ONSC 1035 (Div. Ct.); Markson v. MBNA Canada Bank, 2007 ONCA 334.

[^125]: Fantl v. Transamerica Life Canada, 2016 ONCA 633; OPA v. Ottawa Police Services Board, 2014 ONSC 1584 at para. 59 (Div. Ct.); Cannon v. Funds for Canada Foundation, 2012 ONSC 399 at paras. 340, 350-351, leave to appeal to Div. Ct. refused, 2012 ONSC 6101 (Div. Ct.); Ramdath v. George Brown College of Applied Arts & Technology, 2010 ONSC 2019 at para. 103; Silver v. Imax Corp., 2009 72334 (ON SC), [2009] O.J. No. 5585 (S.C.J.), leave to appeal to Div. Ct. refused, 2011 ONSC 1035 (Div. Ct.); Hickey-Button v. Loyalist College of Applied Arts & Technology (2006), 2006 20079 (ON CA), 267 D.L.R. (4th) 601 (Ont. C.A.); Murphy v. BDO Dunwoody LLP, 2006 22809 (ON SC), [2006] O.J. No. 2729 (S.C.J.); Lewis v. Cantertrot Investments Ltd., [2005] O.J. No. 3535 at para. 20 (S.C.J.); Canadian Imperial Bank of Commerce v. Deloitte & Touche, 2003 38170 (ON SCDC), [2003] O.J. No. 2069 at para. 35 (Div. Ct.); Carom v. Bre-X Minerals Ltd. (2000), 2000 16886 (ON CA), 51 O.R. (3d) 236 at paras. 48-49 (C.A.), rev’g (1999), 1999 14794 (ON SCDC), 44 O.R. (3d) 173 (S.C.J.), leave to appeal to S.C.C. refused, [2000] S.C.C.A. No. 660.

[^126]: Arabi v. Toronto-Dominion Bank, [2006] O.J. No. 2072 (S.C.J.), aff’d 2007 56527 (ON SCDC), [2007] O.J. No. 5035 (Div. Ct.); Mouhteros v. DeVry Canada Inc. (1998), 1998 14686 (ON SC), 41 O.R. (3d) 63 (Gen. Div.).

[^127]: Musicians’ Pension Fund of Canada (Trustee of) v. Kinross Gold Corp., 2014 ONCA 901.

[^128]: Fantl v. Transamerica Life Canada, 2016 ONCA 633 at para. 26.

[^129]: Batten v. Boehringer Ingelheim (Canada) Ltd., 2017 ONSC 53 at para. 209, aff’d, 2017 ONSC 6098 (Div. Ct.), leave to appeal to C.A. refused (February 28, 2018); Vester v. Boston Scientific Ltd., 2015 ONSC 7950 at para. 140, additional reasons, 2017 ONSC 1095; O’Brien v. Bard Canada Inc., 2015 ONSC 2470 at para. 221.

[^130]: Drady v. Canada (Minister of Health), 2007 27970 (ON SC), [2007] O.J. No. 2812 at paras. 36-45 (S.C.J.); Attis v. Canada (Minister of Health), [2003] O.J. No. 344 at para. 40 (S.C.J.), aff'd [2003] O.J. No. 4708 (C.A.).

[^131]: Hughes v. Sunbeam Corp (Canada) Ltd. (2002), 2002 45051 (ON CA), 61 O.R. (3d) 433 (C.A.); Boulanger v. Johnson & Johnson, [2002] O.J. No. 1075 (S.C.J.).

[^132]: Kang v. Sun Life Assurance Co. of Canada, 2013 ONCA 118; Voutour v. Pfizer Canada Inc., [2008] O.J. No. 3070 (S.C.J.); LeFrancois v. Guidant Corp., [2008] O.J. No. 1397 at para. 55 (S.C.J.); Matoni v. C.B.S. Interactive Multimedia Inc., 2008 1539 (ON SC), [2008] O.J. No. 197 at paras. 71-77(S.C.J.); Boulanger v. Johnson & Johnson Corp., [2002] O.J. No. 1075 at para. 2 (S.C.J.), leave to appeal granted, [2002] O.J. No. 2135 (S.C.J.), varied (2003), 2003 45096 (ON SCDC), 64 O.R. (3d) 208 (Div. Ct.), varied 2003 52154 (ON CA), [2003] O.J. No. 2218 (C.A.).

[^133]: Western Canadian Shopping Centres Inc. v. Dutton, 2001 SCC 46 at para. 41.

[^134]: Carom v. Bre-X Minerals Ltd. (1999), 1999 14794 (ON SCDC), 44 O.R. (3d) 173 (Div. Ct.), rev’d on other grounds (2000), 2000 16886 (ON CA), 51 O.R. (3d) 236 (C.A.); Cloud v. Canada (Attorney General) (2004), 2004 45444 (ON CA), 73 O.R. (3d) 401 at para. 95 (C.A.); Caputo v. Imperial Tobacco Ltd., 2004 24753 (ON SC), [2004] O.J. No. 299 at para. 76 (S.C.J.); Griffin v. Dell Canada Inc., 2009 3557 (ON SC), [2009] O.J. No. 418 at para. 100 (S.C.J.).

[^135]: Caputo v. Imperial Tobacco Ltd., 2004 24753 (ON SC), [2004] O.J. No. 299 at paras. 62-67 (S.C.J.); Griffin v. Dell Canada Inc., 2009 3557 (ON SC), [2009] O.J. No. 418 (S.C.J.).