Court File and Parties
COURT FILE NO.: CV-18-590402-CP
DATE: 20191223
ONTARIO
SUPERIOR COURT OF JUSTICE
B E T W E E N:
BORIS GROSSMAN and MICHAEL ARNTFIELD
Plaintiffs
- and -
NISSAN CANADA INC. c.o.b. as NISSAN CANADA FINANCE and c.o.b. as INFINITY FINANCIAL SERVICES CANADA, NISSAN CANADA FINANCIAL SERVICES INC. SERVICES FINANCIERS NISSAN CANADA INC., and NISSAN NORTH AMERICA, INC.
Defendants
Proceeding Commenced under the Class Proceedings Act, 1992
BEFORE: Justice Edward P. Belobaba
COUNSEL: Matthew D. Baer, Vadim Kats, Christopher Du Vernet, Carlin McGoogan and Emily Assini, for the Plaintiffs / Responding Parties
Michael D. Schafler, Kirsten Thompson and Chloe Snider for the Defendants / Moving Parties
HEARD: In writing
Motion to Amend the Class Definition
[1] I certified this data breach action as a class proceeding about two months ago.[^1] In my reasons for decision, I invited the defendants to bring a motion to amend the class definition as and when appropriate. The defendants took up this invitation with alacrity and are back before this court asking that the class definition be amended.
[2] For the reasons set out below, the defendants’ motion is granted.
Background
[3] I will simply restate the factual background from my certification decision.
[4] In December 2017, an unknown Nissan employee accessed a company data base that contained the personal information of thousands of customers who had financed the lease or purchase of their Nissan vehicle. The unknown employee emailed a “sample” of the stolen data to company executives and demanded the payment of a ransom.[^2] I will refer to this as the Sample.
[5] Nissan refused to pay the ransom demand, posted news of the incident on its website, notified its 932,000 customers and offered one year of free credit monitoring.
[6] It appeared from the investigation that followed that the stolen data consisted of four uniform categories of personal information: the customers’ name and address; the vehicle model and VIN; the terms of the lease/loan and monthly payment amount; and the customer’s credit score. Initially, there was some concern about social insurance numbers, but this has now been investigated and there is no evidence that any SINs had been misappropriated.
[7] Fortunately, some two years later, there is no evidence that any of the stolen information has been made public or otherwise misused by the extortionist. There has been no activity on the dark web. There is no evidence of any breach-related fraud or identity theft. Only about four per cent of the 932,000 Canadian customers who received the notice letter have opted for the free credit monitoring.
[8] The plaintiffs understand that any actual or out of pocket losses are probably minimal to non-existent. Therefore, they rely primarily on “intrusion upon seclusion” a new privacy tort that was recognized by the Court of Appeal in 2012.[^3] The advantage provided by the intrusion tort is that up to $20,000 in “symbolic” or “moral” damages can be awarded even if no financial or out of pocket loss has been sustained.[^4]
The certified class definition
[9] I rejected the plaintiffs’ proposed class definition because it was overly broad and not rationally connected to the proposed common issues.[^5] Instead, I certified the following class definition:
All persons resident in Canada, including their estates, executors or personal representatives but excluding persons resident in Quebec, who (1) provided personal information to one or more of the defendants (or any of their affiliates or subsidiaries) when financing a lease or purchase of a Nissan vehicle over the five years ending on December 11, 2017 and (2) received a notice letter from Nissan about the December 2017 data breach.
[10] It is important that the class definition allow class members to self-identify. I was content with the above definition, but I invited the defendants to bring a motion to amend the class definition “if Nissan can provide a more appropriate definition of class membership that satisfies the self-identification objective or if the upcoming discoveries suggest some other good reason to do so.”[^6]
The motion to amend
[11] The defendants ask that the class definition be amended as follows:
All persons residing in Canada, including their estates, executors or personal representatives but excluding persons resident in Quebec and excluding corporate persons, who had active leases or loans with Nissan Canada Inc. or Nissan Canada Financial Services Inc. Services Financiers Nissan Canada Inc. in the period from December 22, 2016 to January 12, 2017.
[12] The proposed amendment is based on three key submissions. First, that this court found at certification that “the entirety of the stolen information was contained in the Sample.”[^7] Second, that the Sample contained the personal information of Nissan customers who had active leases or loans with Nissan Canada between December 22, 2016 and January 12, 2017. And third, that corporate customers should be excluded from the class because they have no privacy rights and cannot recover symbolic or moral damages for intrusion upon seclusion.
[13] I accept the first two submissions. As for excluding the corporate customers, I am not prepared to consider and decide this important issue as a “add on” in the context of a motion to amend the class definition. The defendants may well be right, but the issue deserves to be adjudicated as a separate question of law.
[14] The plaintiffs say the motion to amend the class definition is premature because there is the “possibility” that customer data other than that contained in the Sample “might” have been stolen and that such evidence may be discovered as this case proceeds. If such evidence actually materializes, the plaintiffs will have every right to ask for a further amendment of the class definition. At this point, however, the defendants’ motion, with the one exception already noted, is well-founded.
Disposition
[15] The defendants’ motion to amend the class definition as proposed herein is granted except for the words “and excluding corporate persons” which, as indicated, will require a separate determination.
[16] I will defer the costs discussion until the litigation about the class definition has been concluded.
Justice Edward P. Belobaba
Date: December 23, 2019
[^1]: Grossman v Nissan Canada, 2019 ONSC 6180. [^2]: According to its factum, Nissan’s investigation concluded that this was “an inside job” by “an unknown employee who accessed the customer information and misused it to try to extort Nissan.” [^3]: Jones v Tsige, 2012 ONCA 32. [^4]: Ibid., at paras. 71, 74-75 and 87. [^5]: Supra, note 1, at para. 35. [^6]: Ibid., at para. 37. [^7]: Ibid., at para. 42.