Del Giudice v. Thompson, 2021 ONSC 2015
COURT FILE NO.: CV-19-00625030-00CP
DATE: 20210317
ONTARIO
SUPERIOR COURT OF JUSTICE
BETWEEN:
RINA DEL GIUDICE and DANIEL WOOD
Plaintiffs
- and -
PAIGE A. THOMPSON, CAPITAL ONE FINANCIAL CORPORATION,
CAPITAL ONE BANK (CANADA BRANCH), CAPITAL ONE (SERVICES) CANADA INC., CAPITAL ONE, N.A., CAPITAL ONE BANK (USA), N.A., GITHUB, INC., AMAZON WEB SERVICES INC., AND AMAZON WEB SERVICES (CANADA) INC.
Defendants
John A. Campion, R. Douglas Elliott, Hugh Scher, and Jonathan Nehmettalah for the Plaintiffs
Sarah Armstrong, Pavel Sergeyev and Berkley Sells for the Defendants Capital One Financial Corporation, Capital One Bank (Canada) Branch, Capital One (Services Canada Inc., Capital One, N.A., Capital One Bank (USA), N.A.
Scott Kugler and Elie Laskin for the Defendants Amazon Web Services Inc., and Amazon Web Services (Canada) Inc.
Deborah Glendinning, Lauren Tomasich, and Lauren Harper for the Defendant GitHub Inc.
Proceeding under the Class Proceedings Act, 1992
HEARD: March 17, 2021
PERELL, J.
REASONS FOR DECISION
[1] In this proposed class action, it is alleged that on March 22 or 23, 2019, the Defendant Paige Thompson, who was then a computer programmer at Amazon, hacked the data base of the Defendants Capital One Financial Corporation, Capital One Bank (Canada) Branch, Capital One Services Canada Inc., Capital One, N.A., Capital One Bank (USA), N.A. (collectively “Capital One”). The Capital One data was stored on the servers of the Defendants Amazon Web Services Inc., and Amazon Web Services (Canada) Inc. (collectively “Amazon”). Ms. Thompson allegedly misappropriated the data. She used it to mine for cryptocurrency. She posted unencrypted data on the Defendant GitHub Inc.’s website. GitHub is a subsidiary of Microsoft, and its website is a forum for software developers to share information.
[2] As a consequence of this data breach, it is alleged that personal and confidential information of 90 million customers of Capital One was compromised. It was estimated that 6 million Canadian Capital One customers were affected.
[3] On July 29, 2019, Capital One reported the data breach to the public, and disseminated a notice to its customers.
[4] On August 6, 2019, Rina Del Giudice commenced a proposed Canadian class action with respect to the data breach. Subsequently, Mr. Wood became a co-Plaintiff.
[5] The Plaintiffs plead the following causes eighteen causes of action: (a) Breach of Confidence; (b) Breach of Contract; (c) Breach of ten Statute(s)[^1]; (d) Breach of Trust/Fiduciary Duty; (e) Privacy tort(s); (f) Misrepresentation; (g) Negligence; and (h) Theft and conversion.
[6] The ten statutes alleged to have been breached are: (a) Consumer Protection Act, 2002, S.O. 2002, c. 30, Schedule A; (b) Civil Code of Quebec, L.R.Q., c. C-1991, art. 35-40; (c) Electronic Commerce Act, 2000, S.O. 2000, c. 17; (d) Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31; (e) Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5; (f) Privacy Act, R.S.B.C. 1996, c. 373; (g) Privacy Act, RSC 1985, c P-21; (h) The Privacy Act, C.C.S.M., c. P125; (i) Privacy Act, R.S.N.L. 1990, c. P-22; and (j) The Privacy Act, R.S.S. 1978, c. P-24.
[7] There are eight motions before the court, five of them are pending motions.
[8] First, with leave of the court in this case managed proceeding, Ms. Del Giudice and Mr. Wood have a pending motion to enjoin the disseminating of a notice to 51,000 putative Class Members that their confidential information may have been compromised. This circumstance arising from the original 2019 data breach was only recently discovered.
[9] Second, in resisting the injunction motion, Capital One delivered an affidavit from Carolyn Flanagan, who is an associate lawyer with Fasken Martineau Dumoulin LLP, the lawyers for Capital One, and now with leave of the court, before the court is the Plaintiffs’ motion to compel, Ms. Flanagan to answer questions that she refused to answer at her cross-examination.
[10] Third, with leave of the court, the Defendant GitHub joined by the Defendants Capital One and Amazon have a pending motion for an order that the information posted by the Defendant Paige A. Thompson on GitHub’s website be sealed as confidential information. In support of that motion, GitHub delivered an affidavit from Elie Farkas, an associate lawyer at Osler, Hoskin, & Harcourt LLP, GitHub’s lawyer of record.
[11] Fourth and Fifth, the Plaintiffs were granted leave to bring a refusals motion with respect to Mr. Farkas’ cross-examination, but now without leave of the court as an alternative to an Order compelling Mr. Farkas to re-attend to answer questions he refused to answer, the Plaintiffs now bring a motion for an omnibus order:
(a) striking out the Defendants’ motion for a sealing order;
(b) striking out Mr. Farkas’ affidavit;
(c) striking out paragraphs 7-12, and 24-44 of the affidavit of Christian Oehrgaard dated February 26, 2021;
(d) striking the affidavit of Wade Chafe dated March 1, 2021;
(e) striking paragraphs 1, 2, 4, 5, 6 (first sentence), 13, 26, 27, 28, 33, 43, 45 (first sentence), 47 (last sentence), 57 (last sentence), 66 (last sentence), 77 (last sentence), 81 (last sentence) of GitHub’s factum filed in the Bifurcated Certification motion;
(f) directing that no evidence shall be referred to, or filed, by any party as part of the Phase 1 motion on certification;
(g) requiring the defendants to serve and file their Statements of Defence within 20 days after a decision is rendered on the Phase 1 hearing; and
(h) directing that the jurisdiction motion be rescheduled to a date after Phase 1 of the certification motion and the delivery of the Statement of Defence.
[12] Sixth, Phase 1 of the bifurcated certification motion, which is to address only the cause of action criterion (s. 5 (1)(a) of the Class Proceedings Act, 1992) is pending and scheduled for June 7-9, 2021.
[13] Seventh, GitHub brings a motion to challenge the Ontario court’s jurisdiction over it. This is also a s. 5 (1)(a) matter, and GitHub’s jurisdiction motion shall be heard along with Phase 1 of the certification motion.
[14] Eighth, Phase 2 of the certification motion is scheduled for December 13-17, 2021.
[15] I shall hear the injunction motion on March 23, 2021.
[16] I shall hear the sealing order motion on March 31, 2021.
[17] I shall hear Phase 1 of the certification motion and Github’s jurisdiction motion on June 7-9, 2021.
[18] I shall hear Phase 2 of the certification motion on December 13-17, 2021.
[19] For the reasons that follow, I dismiss the two refusals motions with respect to the cross-examinations of Ms. Flannigan and Mr. Farkas respectively.
[20] For the reasons that follow, I dismiss the omnibus motion.
[21] The explanation for the dismissal of the refusals motions can begin by noting that the motions are very narrowly circumscribed motions in terms of the scope of permissible cross-examinations.
[22] The scope of a cross-examination of a deponent for a motion is narrower than an examination for discovery and a cross-examination is not a substitute for oral or documentary for discovery or an opportunity for a premature discovery.[^2] The examining party may not ask questions on issues that go beyond the scope of the cross-examination for the motion.[^3] Questions that are overbroad or speculative, that do not relate to the issues on the particular motion, colloquially known as a “fishing expedition” are not permitted.[^4]
[23] On a cross-examination, the questions must be relevant to: (a) the issues on the particular motion; (b) the matters raised in the affidavit by the deponent, even if those issues are irrelevant to the motion; or (c) the credibility and reliability of the deponent’s evidence.[^5]
[24] The justifications for refusals to answer questions are:[^6]
a. The question is fishing and goes beyond the scope of the motion.
b. The question is argumentative, not fair or capable of being answered, which is to say that the question is vague, unclear, inconsistent, unintelligible, redundant, superfluous, repetitious, overreaching, fishing, speculative, unfair, oppressive, or a matter of rhetoric or argument.
c. The question is not material, which is to say that the question falls outside the parameters of the action and does not address a fact in issue.
d. The question is irrelevant, which is to say that the question does not have probative value; it does not adequately contribute to determining the truth or falsity of a material fact.
e. The question has been answered; the question or the documents relevant to the question have already been provided by the party being examined.
f. The question is disproportionate, which is to say that the question may be relevant but providing an answer offends the proportionality principle; and
g. The question is privileged; the answer to the question is subject to a privilege, including lawyer and client privilege, litigation privilege, common interest privilege, or the privilege for communications in furtherance of settlement.
[25] Apart from some miniscule relevance to class size, which itself is a miniscule issue to the certification criteria, which do not involve a numerosity criteria, the Plaintiff’s injunction motion is irrelevant to the certification motion, which is not a merits motion. Moreover, there is no doubt that a notice is going to go out to the 51,000 putative Class Members and this notice will be a spent issue as far as certification is concerned.
[26] Notwithstanding the narrowness of what might be relevant to the injunction motion, Ms. Flannigan was cross-examined at length on March 10, 2021. The transcript is 153 pages of 388 questions and an insufferable number of vile exchanges between counsel. 77 questions are noted as refusals.
[27] Although Ms. Del Guidice’s and Mr. Wood’s counsel was utterly incapable of appreciating it, the Defendants’ sealing motion had the narrowest ambit for a cross-examination of Mr. Farkas on his six-paragraph affidavit.
[28] If granted, and whether I grant the sealing order, remains to be determined, all the sealing motion would achieve is that the public would be unable to read what Ms. Thompson posted on the GitHub web page.
[29] What Ms. Thompson posted was going to be before the court in any event at the concurrent GitHub jurisdiction motion and Phase I of the certification motion. The only difference is that a member of the public would not understand what everybody was talking about.
[30] There is absolutely no merit to Ms. Del Guidice and Mr. Wood’s paranoic fear that prohibited evidence was being introduced at a motion designed to test the legal viability of the pleadings. Paragraph 88 Ms. Del Guidice and Mr. Wood’s Amended Statement of Claim states:
- By computer system design and operation failings, including the Amazon One Flaw and Capital One Flaws, Thompson was able to infiltrate the Amazon Web cloud servers which stored the Capital One data including the Confidential Data of the Class Plaintiffs. Thompson exfiltrated the Confidential Data. Thompson published the data to the world by placing it on GitHub.
[31] While no evidence is admissible on a pleadings motion to test the viability of a cause of action, a pleading, however, is deemed to include any documents incorporated by reference into the pleading that form an integral part of the claim or defence.[^7] A motions judge is entitled to consider any documents specifically referred to and relied on in the pleading.[^8] The court may also consider documents in addition to the statement of claim when the documents provide an essential factual context omitted from the statement of claim.[^9]
[32] What Ms. Thompson posted on GitHub was going to be before the court at Phase 1 of the certification motion and at GitHub’s concurrent jurisdiction motion. Whether this material will get GitHub out from under the eighteen or so causes of action pleaded against it remains to be seen.
[33] The ambit for cross-examination of Mr. Farkas was very narrow. The issue on a sealing motion turns on the open-court principle.
[34] Notwithstanding the narrowness of what might be relevant to the sealing motion, Mr. Farkas was cross-examined at length on March 11, 2021. The transcript is 252 pages of 783 questions and an insufferable number of even viler exchanges between counsel. 286 questions are noted as refusals.
[35] I’ve read every excruciating page of Mr. Farkas’ transcript, and I am satisfied that all 286 refusals were fully justified on some combination of argumentative, redundant, overreaching, unfair, oppressive, fishing, premature discovery, immaterial, irrelevant, disproportionate, and/or privileged. In every instance, there was a multiple justification for the refusal.
[36] A reading of the transcript reveals that Mr. Campion of putative Class Counsel believed that there was some conspiracy by the Defendants who deceived him by asking for the Plaintiffs’ consent to sealing Ms. Thompson’s posting. There is no merit to this belief and Mr. Campion’s disappointment in his colleagues is misplaced. The fact that the public cannot see what Ms. Thompson posted is actually what the Plaintiffs would want since they plead that their confidential information or how to obtain access to it was posted on the Internet.
[37] The Plaintiffs can, of course, oppose the sealing motion as they may be advised. I will decide that issue on March 31, 2012, and as I have already said, it remains to be determined whether I shall grant the sealing order.
[38] I have seen Ms. Thompson’s posting. Remarkably, Mr. Campion has not yet looked at it and speculates grimly at what significance, if any, it may have to the Plaintiffs’ certification motion and to GitHub’s jurisdiction motion.
[39] Whether the Thompson posting is inadmissible at the hearings in June is a matter that I can deal with at the jurisdiction and Phase 1 certification motions in June. Judges have this metaphysical ability to disregard inadmissible and irrelevant evidence. If I mishandle this evidence, the Plaintiffs have their normal recourse of appealing my decision.
[40] Some limited evidence is admissible on a jurisdiction simpliciter, forum non conveniens motion.[^10] In a point that is more relevant to the Plaintiffs’ omnibus motion, judges also have the ability to separate the evidence for GitHub’s jurisdiction motion from the no-evidence of a pleadings motion.
[41] Turning to the omnibus motion, without prejudice to what the Plaintiffs may say at the hearing of the jurisdiction motion, the affidavits of Christian Oehrgaard sworn February 26, 2021 and Wade Chafe sworn March 1, 2021 should not be struck in advance of the jurisdiction motion.
[42] The impugned paragraphs of GitHub’s factum filed in respect of the motion addressing section 5(1)(a) of the Class Proceedings Act are entirely proper and should not be struck in advance of the Phase 1 certification motion hearing.
[43] There is no reason for me to change the timetable or the ordering of the interlocutory motions in this proposed class action.
[44] GitHub has the right to bring a jurisdiction motion that can be conveniently heard with Phase 1 of the certification motion. It remains eminently sensible to bifurcate the certification motion, given that the Plaintiffs have advance eighteen causes of action, and the Plaintiffs have substantially expanded the allegations that were made in the original statement of claim that I saw when I granted carriage to the consortium acting for the Plaintiffs.
[45] For the above reasons, I dismiss the refusals motions and the omnibus motion.
[46] If the parties cannot agree about the matter of costs, they may make submissions in writing beginning with the Defendants’ submissions within twenty days of the release of these Reasons for Decision followed by the Plaintiffs’ submissions within a further twenty days.
Perell, J.
Released: March 17, 2021
COURT FILE NO.: CV-19-00625030-00CP
DATE: 20210317
ONTARIO
SUPERIOR COURT OF JUSTICE
BETWEEN:
RINA DEL GIUDICE and DANIEL WOOD
Plaintiffs
- and -
PAIGE A. THOMPSON, CAPITAL ONE FINANCIAL CORPORATION,
CAPITAL ONE BANK (CANADA BRANCH), CAPITAL ONE (SERVICES) CANADA INC., CAPITAL ONE, N.A., CAPITAL ONE BANK (USA), N.A., GITHUB, INC., AMAZON WEB SERVICES INC., AND AMAZON WEB SERVICES (CANADA) INC.
Defendants
REASONS FOR DECISION
PERELL J.
Released: March 17, 2021
[^1] (a) Consumer Protection Act, 2002, S.O. 2002, c. 30, Schedule A; (b) Civil Code of Quebec, L.R.Q., c. C-1991, art. 35-40; (c) Electronic Commerce Act, 2000, S.O. 2000, c. 17; (d) Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31; (e) Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5; (f) Privacy Act, R.S.B.C. 1996, c. 373; (g) Privacy Act, RSC 1985, c P-21; (h) The Privacy Act, C.C.S.M., c. P125; (i) Privacy Act, R.S.N.L. 1990, c. P-22; and (j) The Privacy Act, R.S.S. 1978, c. P-24
[^2] Canada (Attorney General) v. Canadian Broadcasting Corp., 2016 ONSC 4938 (Master); Ainslie v. CV Technologies Inc., 2008 63217 (ON SC), [2008] O.J. No. 4891 at para. 27 (S.C.J.); Bot Construction (Ontario) Ltd. v. Dumoulin, [2007] O.J. No. 4435 (S.C.J.); Sun-Times Media Group Inc. v. Black, [2007] O.J. No. 795 at paras. 46–47 (S.C.J.).Fehringer v. Sun Media Corp., (2001), 2001 28060 (ON SC), 54 O.R. (3d) 31 at 35 (S.C.J.); Westminer Canada Holdings Ltd. v. Coughlan, [1989] O.J. No. 252 (Master), affd. [1989] O.J. No. 3038 (H.C.J.).
[^3] Westminer Canada Holdings Ltd. v. Coughlan, [1989] O.J. No. 3038 (H.C.J.); Toronto Board of Education Staff Credit Union Ltd. v. Skinner, [1984] O.J. No. 478 at para. 12 (H.C.J.); Thomson v. Thomson, [1948] O.J. No. 24 (H.C.J.).
[^4] Canada (Attorney General) v. Canadian Broadcasting Corp., 2016 ONSC 4938 (Master); Ontario Federation of Anglers & Hunters v. Ontario (Ministry of Natural Resources), 2002 41606 (ON CA), [2002] O.J. No. 1445 (C.A.), leave to appeal refused [2002] S.C.C.A. No. 252; Georgian Windpower Corp. v. Stelco Inc., [2007] O.J. No. 5762 (Master).
[^5] Ontario v. Rothmans Inc., 2011 ONSC 2504, leave to appeal refused 2011 ONSC 3685 (Div. Ct.); Shannon v. BGC Partners LP, 2011 ONSC 1415 at para. 8 (Master); Guestlogix Inc. v. Hayter, [2010] O.J. No. 4315, 2010 ONSC 5570 at para. 16 (Ont. S.C.J.); Bot Construction (Ontario) Ltd. v. Dumoulin, [2007] O.J. No. 4435 at para. 4 (S.C.J.); Caputo v. Imperial Tobacco Ltd., [2002] O.J. No. 3767 at paras. 14–15 (Master).
[^6] Fischer v. IG Investment Management Ltd., 2015 ONSC 3525; Fehr v. Sun Life Assurance Co. of Canada, 2015 ONSC 2908; Canadian Imperial Bank of Commerce v. Deloitte & Touche, 2013 ONSC 917; 2038724 Ontario Ltd. v. Quizno’s Canada Restaurant Corp., 2012 ONSC 6549; Axiom Plastics Inc. v. E.I. Dupont Canada Co., 2011 ONSC 4510; Ontario v. Rothmans Inc., 2011 ONSC 2504, leave to appeal refused 2011 ONSC 3685 (Div. Ct.).
[^7] McCreight v. Canada (Attorney General), 2013 ONCA 483; Montreal Trust Co. of Canada v. Toronto-Dominion Bank, [1992] O.J. No. 1274 (Gen. Div.).
[^8] Das v. George Weston Ltd., 2017 ONSC 4129 at paras. 14–29, affd 2018 ONCA 1053, leave to appeal refused [2019] S.C.C.A. No. 69; Martin v. Astrazeneca Pharmaceuticals PLC, 2012 ONSC 2744 at paras. 160–162, affd 2013 ONSC 1169 (Div. Ct.); Re*Collections Inc. v. Toronto-Dominion Bank, 2010 ONSC 6560 at para. 107; Web Offset Publications Ltd. v. Vickery (1999) 1999 4462 (ON CA), 43 O.R. (3d) 802 (C.A.), leave to appeal dismissed, [1999] S.C.C.A. No 460; Corktown Films Inc. v. Ontario, [1996] O.J. No. 3886 (Gen. Div.); Montreal Trust Co. of Canada v. Toronto-Dominion Bank, [1992] O.J. No. 1274 (Gen. Div.).
[^9] Beardsley v. Ontario Provincial Police, 2001 8621 (ON CA), [2001] O.J. No. 4574 (C.A.).
[^10] Ontario v. Rothmans Inc, 2013 ONCA 353 at paras. 54, 101 & 106; Shah v. LG Chem, Ltd, 2015 ONSC 628; Beijing Hehe Fengye Investment Co Limited v. Fasken Martineau Dumoulin LLP, 2020 ONSC 934 at paras 61-62; Vahle v Global Work & Travel Co Inc., 2020 ONCA 224 at para 12.