COURT FILE NO.: CV-19-00625030-00CP

DATE: 20210602

ONTARIO

SUPERIOR COURT OF JUSTICE

BETWEEN:

RINA DEL GIUDICE and DANIEL WOOD Plaintiffs

• and -

PAIGE A. THOMPSON, CAPITAL ONE FINANCIAL CORPORATION, CAPITAL ONE BANK (CANADA BRANCH), CAPITAL ONE (SERVICES) CANADA INC., CAPITAL ONE, N.A., CAPITAL ONE BANK (USA), N.A., GITHUB, INC., AMAZON WEB SERVICES INC., AND AMAZON WEB SERVICES (CANADA) INC. Defendants

John A. Campion, R. Douglas Elliott, Hugh Scher, Jeff Childs, Darrel Hotz and Glyn Hotz for the Plaintiffs

Deborah Glendinning, Lauren Tomasich, and Lauren Harper for the Defendant GitHub Inc.

Proceeding under the Class Proceedings Act, 1992

HEARD: In writing

REASONS FOR DECISION

PERELL, J.

[1] In this proposed class action, it is alleged that on March 22 or 23, 2019, the Defendant Paige Thompson, who was then a computer programmer at Amazon, hacked the data base of the Defendants Capital One Financial Corporation, Capital One Bank (Canada Branch), Capital One (Services) Canada Inc., Capital One, N.A., Capital One Bank (USA), N.A. (collectively “Capital One”). The Capital One data was stored on the servers of the Defendants Amazon Web Services Inc., and Amazon Web Services (Canada) Inc. (collectively “Amazon”). Ms. Thompson allegedly misappropriated the data. She used it to mine for cryptocurrency. She posted unencrypted data on the Defendant GitHub Inc.’s website. GitHub is a subsidiary of Microsoft, and its website is a forum for software developers to share information.

[2] Pursuant to s. 29 of the Class Proceedings Act, 1992,[^1] the Plaintiffs, Rina Del Giudice and Daniel Wood, seek court approval of a settlement with GitHub. In its effect, the settlement is a discontinuance of the action as against GitHub.

[3] For present purposes, the background to the settlement/discontinuance is as follows:

a. On August 6, 2019, Ms. Del Giudice commenced a proposed class action. GitHub was not initially joined as a defendant to the action.

b. There was a rival proposed class action, but on April 30, 2020, Ms. Del Giudice’s lawyers were granted carriage.

c. On August 27, 2020, a Fresh as Amended Statement of Claim was delivered that included GitHub as a party defendant.

d. The Fresh as Amended Statement of Claim was sent by a process server to GitHub on October 15, 2020 at the GitHub head office in San Francisco, California. GitHub does not have an office in Ontario.

e. I directed the certification motion be heard in two parts: Phase I – to address the s. 5(1)(a) criterion and pleading issues including any jurisdiction motions; and Phase II, to address the class definition, common issues, preferable procedure, and representative plaintiff criteria for certification. Phase I is scheduled for June 7, 8 and 9, 2021 and Phase II is scheduled for December 2021.

f. GitHub, which is an American corporation, challenged the court’s jurisdiction and this issue was to be dealt with as part of Phase I.

g. The Plaintiffs’ lawyers were directed to file their materials by October 15, 2020. Responding materials were due from the Defendants on March 1, 2021 for Phase I issues. The parties filed their materials.

h. The Plaintiffs’ lawyers delivered their response to the Defendants’ submissions in April, 2021. The Plaintiffs have filed their materials for both Phase I and Phase II.

i. On April 6, 2021 counsel for GitHub sent a written offer to settle that would let GitHub out of the action in Ontario. The terms of the Settlement Offer include a mutual release regarding all claims as between GitHub and the Plaintiffs. The settlement, if approved, will conclude that Action as against GitHub.

j. The Plaintiffs accepted the Settlement Offer.

k. Under the Class Proceedings Act, 1992, settlements of proposed class actions (i.e. uncertified actions) require court approval and the parties attended on May 20, 2021 for the settlement approval hearing. At that time, I adjourned the settlement approval motion, and I made the following endorsement:

1. In this proposed class action, it is alleged that on March 22 or 23, 2019, the Defendant Paige Thompson, who was then a computer programmer at Amazon, hacked the data base of the Defendants Capital One Financial Corporation, Capital One Bank (Canada Branch), Capital One (Services) Canada Inc., Capital One, N.A., Capital One Bank (USA), N.A. (collectively “Capital One”).

2. The Capital One data was stored on the servers of the Defendants Amazon Web Services Inc., and Amazon Web Services (Canada) Inc. (collectively “Amazon”).

3. Ms. Thompson allegedly misappropriated the data. She used it to mine for cryptocurrency. She posted unencrypted data on the Defendant GitHub Inc.’s website. GitHub is an American corporation and a subsidiary of Microsoft, and its website is a forum for software developers to share information.

4. Pursuant to s. 29 of the Class Proceedings Act, 1992, the Plaintiffs, Rina Del Giudice and Daniel Wood, seek court approval of a settlement with GitHub as memorialized in a Settlement Agreement, dated May 18, 2021.

5. At the commencement of the hearing today, I advised the parties that I was not inclined to approve the settlement as proposed. I asked the parties whether they would like to withdraw the motion for an opportunity to continue negotiations for a settlement that I might approve.

6. I advised the parties that I was not inclined to approve the proposed settlement for two reasons. The first reason was jurisdictional, and the second reason was based on the substantive merits of the settlement agreement and whether it met the test for approval.

7. The jurisdictional reason was that the court was being asked to make a binding ruling that it does not have jurisdiction based on the consent of the parties; however, it is not for the parties to confer or negate the court’s jurisdiction. The court cannot rule on its own jurisdiction based on an agreement of the parties as to what is the court’s jurisdiction.

8. The scope of the court’s jurisdiction must be decided on its merits. I cannot make a ruling on the court’s jurisdiction on consent especially in as important a matter as the case at bar in which the Plaintiffs plead numerous privacy causes of action.

9. What I could do is to treat GitHub’s jurisdiction motion as moot because of an agreement to discontinue as against GitHub without costs and then consider whether to approve the discontinuance. This approach however is not the basis of the Settlement Agreement.

10. The second reason, I was not inclined to approve the settlement is that if I were to treat the settlement for what it essentially is (a discontinuance to let GitHub out of the action because the court might not have jurisdiction and the Plaintiffs were confronted with other litigation risks), the evidence and the argument of the parties rather supported not approving the settlement.

11. In other words, the evidence and argument supported actually addressing GitHub’s jurisdiction motion on its merits and if the court did have jurisdiction, addressing whether it was in the best interests of the putative class members to irretrievably let GitHub out of the action at this juncture.

12. Having heard my comments, the parties asked that the motion be adjourned. I am accordingly adjourning the motion sine die.

[4] Following the adjournment of the settlement approval motion, the Plaintiffs and GitHub withdrew their motion and delivered a motion record for a revised settlement approval.

[5] The revised motion material addressed the jurisdictional concerns that had led me to adjourn the original settlement approval motion.

[6] The revised motion was on consent and the Plaintiffs and GitHub provided me with a draft Order.

[7] In support of the revised settlement approval/discontinuance motion, the Plaintiffs delivered an affidavit from Eli Bordman, an articling student with Gardiner Roberts LLP, one of the Class lawyers for the Plaintiffs. Mr. Bordman explained Class Counsel’s rationale for the settlement/discontinuance in paragraphs 20-22 of this affidavit as follows:

20. The settlement contemplated by the Settlement Agreement will not prejudice putative class members, and is fair, reasonable and in the best interests of putative class members, because amongst other reasons:

(a) after pursuing the claims against GitHub vigorously, the Plaintiffs have determined that the costs and risks involved in continuing to pursue the claims against GitHub outweigh the potential benefits of doing so;

(b) this Action will proceed in a more efficient, streamlined manner if the claims asserted against GitHub are discontinued;

(c) the Plaintiffs’ claims as against the Non-Settling Defendants will not be prejudiced by the discontinuance of their claims against GitHub;

(d) the settlement was negotiated at arm’s length;

(e) the Representative Plaintiffs and their counsel (who are experienced class action litigators) recommend the settlement be approved;

(f) GitHub has brought a motion challenging the court’s jurisdiction. It is clear that they intend to invest considerable resources into that motion. Even if the Plaintiffs prevail it is very likely that GitHub will appeal, creating further expense and delay. While Class Counsel believe that there is a reasonable basis for the Ontario courts taking jurisdiction, they accept that there is a real chance of GitHub prevailing on the issue and exposing the Representative Plaintiffs to an adverse costs award. As such, the risks and costs associated with continuing litigation against GitHub will be significant and outweigh the potential benefits to be gained from the litigation by the putative class members; and

(g) all orders as to costs are mutually waived and released as terms of the settlement.

21. GitHub was named as Defendant in two US actions related to the same data breach at issue in these Ontario class proceedings. GitHub has been released from the US Actions so that it is no longer a Defendant in those proceedings.

22. The allegations of wrongful conduct remaining in the Fresh as Amended Statement of Claim against the continuing Defendants raise substantial legal liability against Capital One Defendants, Amazon Web Defendants and Thompson. The remaining corporate Defendants have sufficient financial strength to meet any damages assessed in this Action. As a result, the Class Counsel have concluded that the interests of the Class Members are not adversely affected in liability or in damages by this Court’s approval of the Settlement Agreement releasing GitHub from the Action.

[8] Section 29 of the Class Proceedings Act, 1992 requires court approval for the discontinuance, abandonment, or settlement of a class action. To approve a settlement of a class proceeding, the court must find that, in all the circumstances, the settlement is fair, reasonable, and in the best interests of the class.[^2]

[9] In determining whether a settlement is reasonable and in the best interests of the class, the following factors may be considered: (a) the likelihood of recovery or likelihood of success; (b) the amount and nature of discovery, evidence or investigation; (c) the proposed settlement terms and conditions; (d) the recommendation and experience of counsel; (e) the future expense and likely duration of the litigation; (f) the number of objectors and nature of objections; (g) the presence of good faith, arm’s-length bargaining and the absence of collusion; (h) the information conveying to the court the dynamics of, and the positions taken by, the parties during the negotiations; and (i) the nature of communications by counsel and the representative plaintiff with Class Members during the litigation.[^3]

[10] In the case at bar, I am satisfied that the settlement with GitHub is fair and reasonable and in the best interests of the Class Members. The settlement is approved. I have signed the Order.

Perell, J.

Released: June 2, 2021

COURT FILE NO.: CV-19-00625030-00CP DATE: 20210602

ONTARIO SUPERIOR COURT OF JUSTICE

BETWEEN:

RINA DEL GIUDICE and DANIEL WOOD Plaintiffs

• and -

PAIGE A. THOMPSON, CAPITAL ONE FINANCIAL CORPORATION, CAPITAL ONE BANK (CANADA BRANCH), CAPITAL ONE (SERVICES) CANADA INC., CAPITAL ONE, N.A., CAPITAL ONE BANK (USA), N.A., GITHUB, INC., AMAZON WEB SERVICES INC., AND AMAZON WEB SERVICES (CANADA) INC. Defendants

REASONS FOR DECISION

PERELL J.

Released: June 2, 2021

[^1]: S.O. 1992, c. 6. [^2]: Fantl v. Transamerica Life Canada, [2009] O.J. No. 3366 at para. 57 (S.C.J.); Farkas v. Sunnybrook and Women’s Health Sciences Centre, [2009] O.J. No. 3533 at para. 43 (S.C.J.); Kidd v. Canada Life Assurance Company, 2013 ONSC 1868. [^3]: Fakhri v. Alfalfa's Canada, Inc., 2005 BCSC 1123; Jeffery v. Nortel Networks Corp., 2007 BCSC 69; Corless v. KPMG LLP, [2008] O.J. No. 3092 at para. 38 (S.C.J.); Fantl v. Transamerica Life Canada, [2009] O.J. No. 3366 at para. 59 (S.C.J.); Farkas v. Sunnybrook and Women’s Health Sciences Centre, [2009] O.J. No. 3533 at para. 45 (S.C.J.); Kidd v. Canada Life Assurance Company, 2013 ONSC 1868.