Superior Court of Justice
COURT FILE NO.: CV-16-566248-00CP
DATE: 2019/08/07
ONTARIO
SUPERIOR COURT OF JUSTICE
BETWEEN:
NATALIA KARASIK, RAHUL SURYAWANSHI, DAVID BRUNI, and ELIE CHAMI
Plaintiffs
- and -
YAHOO INC. and YAHOO! CANADA CO.
Defendants
Counsel: Tina Q. Yang for the Plaintiffs Michael Beeforth and Dennis Wong for the Defendants
Proceeding under the Class Proceedings Act, 1992
HEARD: August 1, 2019
REASONS FOR DECISION
PERELL, J.
[1] In 2013 and 2014, the FSB, the Federal Secret Service of the Russian Federation, cyber-attacked the defendants Yahoo Inc. and Yahoo! Canada Co. (collectively, "Yahoo"). In the 2013 attack, the FSB stole information about approximately 3 billion Yahoo user accounts worldwide. In the 2014 attack, the FSB stole information from approximately 500 million Yahoo user accounts.
[2] There was another cyber-attack in 2016, which Yahoo believes also was perpetrated by the FSB. This attack involved the use of forged cookies that allowed hackers access to a limited number of user accounts without passwords.
[3] In 2016, pursuant to the Class Proceedings Act, 1992,[^1] Natalia Karasik, Rahul Suryawanshi, David Bruni and Elie Chami commenced an action against Yahoo Inc. and Yahoo! Canada Co. advancing privacy torts and restitutionary and statutory claims arising from the data breach.
[4] In 2018, the Plaintiffs served their motion record for a motion seeking certification of this action.
[5] In response to the certification motion, Yahoo delivered affidavits from Sean Zadig, Seema Reddy, and Anindya Ghose. Mr. Zadig is a cybersecurity manager for Yahoo. He describes the scope and source of the three data breaches from internal investigations, investigations conducted by Mandiant (a third-party data security firm), and by the FBI investigations. Ms. Reddy was General Legal Counsel to Yahoo! Canada Co. during the relevant time. Dr. Ghose has a Ph.D. in information systems and is a professor at the Leonard N. Stern School of Business at New York University. She delivered an expert report, which, in part, responds to the Plaintiffs' expert, Ashkan Soltani.
[6] Cross-examinations of Mr. Zadig, Ms. Reddy, and Dr. Ghose are scheduled to proceed in Toronto, San Francisco, and New York in August 2019.
[7] The plaintiffs made 20 requests for information and documents referred to in the affidavits of Mr. Zadig, Ms. Reddy, and Dr. Ghose. Without acknowledging the appropriateness of the plaintiffs' requests before the cross-examinations and at this stage of the proceeding, Yahoo delivered the requested information and documents - save for one request that Yahoo submits is irrelevant to certification and/or disproportionate to the issues before the court at the certification.
[8] The outstanding request concerns Dr. Ghose's report, and it is a request for Yahoo's database of its Canadian 16.9 million Canadian users.
[9] The certification motion is scheduled to be heard on October 31 and November 1, 2019.
[10] The Plaintiffs submit that the database is relevant to the issues of the class definition and the commonality of various common issues and whether there is a workable methodology to establish that Yahoo earned revenues that it would not otherwise have earned, which concerns the commonality of the proposed unjust enrichment common issues.
[11] Yahoo submits that the Plaintiffs have not met the onus of explaining how access to the database is relevant and, in any event, the Plaintiffs' request is disproportionate and ought not to be granted.
[12] There is no automatic right to documentary discovery at the certification stage, and a party seeking such discovery must demonstrate the need for it; for the certification motion, which is a procedural motion that does not go to the merits of the action, there is limited production of documents that are shown to be relevant to the issues on certification.[^2]
[13] The onus is on the party seeking documents for the certification motion to explain why the requested documents are relevant to the issues of certification, and bald assertions that the documents may be relevant do not suffice.[^3]
[14] At the pre-certification stage proportionality is of a particular concern, and the production of documents must be proportionate to the needs of the certification motion and what is necessary to inform the certification hearing.[^4]
[15] In determining whether a document should be produced, a guiding principle is fairness, and a party should not request production of more than it needs for the purposes of the certification motion nor should a party hold back the production needed by his or her opponent to inform the focused purposes of the certification hearing; production must be proportionate to the exigencies of the particular case and the particular certification motion.[^5]
[16] In the immediate case, the Plaintiffs have been provided with a considerable amount of data and information pre-certification and pre the cross-examinations for the certification motion. They have been provided with Dr. Ghose's expert report, but they have not explained why they need the database that was made available to Dr. Ghose save for the bald suggestion that they need it to cross-examine Dr. Ghose. As best as can understand the nature of Dr. Ghose's evidence at this juncture, he has extracted or manipulated information from the data base to draw conclusions. There is no suggestion that the data-base is inaccurate and it has not been made clear to me why access to it is necessary to cross-examine Dr. Ghose on his methodology and his report.
[17] Put simply, I agree with Yahoo's argument that the Plaintiffs have not met the onus of explaining how access to the user database is relevant to the certification motion and, in any event, the Plaintiffs' request is disproportionate in the circumstances of the immediate case.
[18] I, therefore, dismiss the Plaintiffs' motion.
[19] If the parties cannot agree about the matter of costs, they may make submissions in writing beginning with Yahoo's submissions within twenty days after the release of these Reasons for Decision, followed by the Plaintiffs' submissions within a further twenty days.
Perell, J.
Released: August 7, 2019
COURT FILE NO.: CV-16-566248-00CP
DATE: 2019/08/07
ONTARIO
SUPERIOR COURT OF JUSTICE
BETWEEN:
NATALIA KARASIK, RAHUL SURYAWANSHI, DAVID BRUNI, and ELIE CHAMI
Plaintiffs
- and -
YAHOO INC. and YAHOO! CANADA CO.
Defendants
REASONS FOR DECISION
PERELL J.
Released: August 7, 2019
[^1]: S.O. 1992, c. 6. [^2]: Kaplan v. Casino Rama Services Inc., 2018 ONSC 3545 at para. 34; Labourers' Pension Fund of Central and Eastern Canada (Trustee of) v. Royal Bank of Canada, 2017 ONSC 87 at para. 41; Parker v. Pfizer Canada Inc., 2012 ONSC 1652; Bartram (Litigation guardian of) v. Glaxosmithkline Inc., 2011 BCSC 1174 at para. 11; Roveredo v. Bard Canada Inc., 2010 ONSC 5240; Pro-Sys Consultants Ltd. v. Microsoft Corp., 2007 BCSC 1663 at paras. 23-25; Caputo v. Imperial Tobacco Ltd. (1997), 34 O.R. (3d) 314 at p. 320 (Gen. Div.). [^3]: Kaplan v. Casino Rama Services Inc., 2018 ONSC 3545 at para. 35; Labourers' Pension Fund of Central and Eastern Canada (Trustee of) v. Royal Bank of Canada, 2017 ONSC 87 at para. 41; Dine v. Biomet Inc., 2015 ONSC 1911 at para. 9. [^4]: Kaplan v. Casino Rama Services Inc., 2018 ONSC 3545 at para. 44; Daniells v. McLellan, 2016 ONSC 5958, at para. 41. [^5]: Cirillo v. Ontario, 2018 ONSC 4359 at paras. 19-20; Daniells v. McLellan, 2016 ONSC 5958; Parker v Pfizer Canada Inc., 2012 ONSC 1652.