Litvin v. Mackenzie Financial Corporation

Court File No.: CV-23-93325-CP

Date: October 30, 2025

Superior Court of Justice – Ontario

Proceeding Commenced under the Class Proceedings Act, 1992

Parties

Re: Alexander Litvin and David McNairn, Plaintiffs

And: Mackenzie Financial Corporation and Investorcom Holdings ULC, Defendants

Before: C. MacLeod RSJ

Counsel

For the Plaintiffs (Moving Parties): Jean-Marc Leclerc & Maria Robles

For the Defendant Mackenzie Financial Corporation: Cathy Beagan Flood & Z. William Totske

For the Defendant Investorcom Holdings ULC: Amanda Quayle K.C., Danny Alcorn, Deborah Berlach & Dakota Foster

For the plaintiffs in the B.C. action (intervenor): Theodore P. Charney & Caleb Edwards

Heard: June 16 – 18, 2025

Reasons and Decision

Introduction

[1] This is a motion to certify a Multi Jurisdictional Class Proceeding pursuant to s. 5 and 5.1 of Ontario's Class Proceedings Act (the "CPA"). Pursuant to the legislation, there are various preconditions to certification. Assuming certification is appropriate, the court must then have regard to whether there are other similar class proceedings and whether to certify national or multi-jurisdictional classes.

[2] Besides the plaintiffs who seek certification and the defendants who oppose it, there is also an intervenor. That is because a similar proposed class proceeding has been commenced in British Columbia. The intervenor (plaintiff in the B.C. action) urges the court to carve out class members that would, in the submission of the intervenor, be more appropriately the subject of litigation in that province under the B.C. class proceedings regime.

[3] The motion was complex as all of the parties introduced significant amounts of evidence, and the motion took almost three days to argue. As I will discuss, evidence in relation to the merits of the action plays a limited role at this stage. On a certification motion, the court is simply concerned with whether a collective proceeding is superior to other mechanisms for seeking redress and, if so, what form the action should take. It is premature to weigh the merits or to try to predict the outcome of the litigation.

[4] I have concluded that certification is appropriate. It is also appropriate to certify a national or multi-jurisdictional class. However, in my view, it is premature to carve out plaintiffs who live in British Columbia or in other provinces until the courts in other provinces have also considered the certification matter and determined how the litigation, if any, in those jurisdictions should proceed. Where there are competing class proceedings in different jurisdictions and more than one is certified, class definitions may have to be adjusted as events unfold.

Background

[5] As a starting point, it is helpful to describe the facts that give rise to the proposed cause of action. A summary of facts at this stage risks glossing over important nuances and must leave room for evidence that will be uncovered during the litigation. It is important to remember that the action is at a preliminary stage, prior to production or discovery. In addition, subsection 5 (5) of the Act provides that "an order certifying a class proceeding is not a determination of the merits of the proceeding". The summary should not be taken as binding or as findings of fact.

[6] By way of very general overview, Mackenzie Financial Corporation ("Mackenzie") is one of Canada's largest investment management companies. It sponsors mutual funds, holding hundreds of billions of dollars of investments for its clients. In that context, it holds financial information and personally identifying information (PII) for well over a million individuals. Besides identifying information such as names, addresses, birth dates, banking information, and net worth, Mackenzie also has access to social insurance numbers (SIN).

[7] Mackenzie subcontracts the delivery of client materials to Investorcom Holdings ULC ("ICOM") and for that purpose provides ICOM with client information. ICOM is in the business of providing compliance and customer communication for various wealth and investment firms including Mackenzie. In its current form, ICOM is an amalgamated corporation, with its head office in British Columbia. One of the predecessor corporations, Investorcom Inc., was an Ontario corporation. The current corporation succeeds to the rights and obligations of all of the predecessor corporations including the former Ontario corporation. Mackenzie is headquartered in Toronto but has clients throughout Canada. ICOM continues to have a significant presence in Ontario.

[8] According to the plaintiff, part of the contractual commitment between Mackenzie and its clients, states that Mackenzie is "committed to protecting the privacy of personal information that it collects" and if it transfers information to third party service providers, it ensures by contractual means that the information is "protected to the same degree as it is when it is in our possession".

[9] Because ICOM was required to mail information concerning investor accounts to clients, the material provided to ICOM included specific PII. In particular, both Mackenzie and ICOM had electronic files including the SINs of many of the investors.

[10] At some point in early 2023, ICOM's systems were infiltrated by cybercriminals using a vulnerability in "GoAnywhere" file transfer software used by ICOM. This vulnerability was discovered by the software manufacturer ("Fortra") who issued a "patch" and the vulnerability may only have been open to exploitation for a very brief window of time. It was long enough for cybercriminals who are on the look out for ways to exploit vulnerabilities. During this time period, it appears the hackers gained access to ICOM's files.

[11] This came to light when ICOM received a ransomware demand threatening to put private information relating to clients on the "dark web" in March of 2023. ICOM notified Mackenzie and Mackenzie notified its clients of this issue in April of 2023. This was about two months after the vulnerability first came to light and the owner of GoAnywhere released the patch. It was about one month after Mackenzie was advised of the incident by ICOM and after ICOM received the ransom demand from the hacker group.

[12] While there is no doubt the criminals gained access to ICOM's systems and their demand included proof that they had copied certain system files, it is not clear that the criminals actually "exfiltrated" the PII and at least to date there is no evidence that PII has been sold on the dark web. In addition, Mackenzie has provided each of its clients with complementary credit monitoring. It is therefore possible that a court could conclude the members of the proposed class have suffered no damage. On the other hand, the plaintiffs argue that simply the possibility that PII has been exposed and the need for clients to take enhanced steps to protect themselves against identity theft (perhaps for a lifetime) is a breach of duty of care, which should give rise to some form of compensation.

[13] The plaintiffs' expert provides examples where exfiltrated PII from a data breach event is misused many years after the event. The plaintiffs argue that this risk, resulting anxiety and the ongoing need to take precautions against identity theft and other misuse of the PII demands compensation. The critical question then is whether the defendants owed a duty to foresee and prevent a hacker attack and whether the plaintiff is entitled to damages or other remedies in the absence of specific proof of misuse of the PII.

[14] The allegation against MacKenzie is that it was careless in the use and release of PII in an insecure form to ICOM. It is alleged that ICOM in turn took inadequate care to ensure that the data in its control was secure. Even if ICOM did not know of the specific vulnerability in the GoAnywhere software, that vulnerability could not have been exploited had there been adequate security in place. In particular, it is argued, the "administrative console" had to be exposed in order for the hackers to gain access. ICOM ought to have known that it was the custodian of PII and should have taken better steps to protect it.

[15] As I will discuss, this is not the forum to determine if the plaintiff can sue successfully. The question for today is whether the plaintiffs should be allowed to sue collectively. What is required at this stage is not certainty that the action will succeed but only a plausible claim which is best pursued as a class action.

The Test for Certification

[16] It is not necessary to repeat and analyze the tests for certification in lengthy reasons every time a motion is argued. The criteria to be considered by the court are set out in the legislation and have been interpreted in rich jurisprudence. Although there were significant amendments to the Act in 2020, they do not fundamentally change the nature of a certification motion. Whether an action may proceed as a Class Proceeding is primarily, but not entirely, a procedural question.

[17] Although supplemented by other subsections of the Act and by the 2020 amendments, the basic mandate of the court on a certification motion remains that set out in s. 5 (1) of the Act. The Act directs the court to certify a class proceeding if the moving party satisfies the following:

(a) the pleadings or the notice of application discloses a cause of action;

(b) there is an identifiable class of two or more persons that would be represented by the representative plaintiff or defendant;

(c) the claims or defences of the class members raise common issues;

(d) a class proceeding would be the preferable procedure for the resolution of the common issues; and

(e) there is a representative plaintiff or defendant who,

(i) would fairly and adequately represent the interests of the class,

(ii) has produced a plan for the proceeding that sets out a workable method of advancing the proceeding on behalf of the class and of notifying class members of the proceeding, and

(iii) does not have, on the common issues for the class, an interest in conflict with the interests of other class members.

[18] As described by the Supreme Court of Canada in Hollick and as discussed at length in various decisions of this court cited by both parties, the criteria for certification may be divided into two parts. Subsection (a) requires only an analysis of the pleadings to determine that it is not "plain and obvious" that the plaintiff's action cannot succeed and is certain to fail. That analysis is a pleadings analysis in which evidence of the merits is not considered. It is identical to the analysis under Rule 21.01 (b) which asks the court to consider, assuming the facts as pleaded are true, whether it is plain and obvious that the action cannot succeed. To phrase this differently, the first subsection asks, even if the facts pleaded are proven, can this action succeed?

[19] The other parts of the test require an evidentiary basis, but this has been characterized only as requiring "some basis in fact". Although this is a screening mechanism and the moving party must satisfy all five criteria, it need not do so on a "balance of probabilities". The focus is on the form of the action and not on the merits. The plaintiff cannot be called upon to prove the case in order to obtain certification as a class proceeding.

[20] Subsection (1.1) was added to the Act in 2020 to provide guidance in respect of the analysis under subsection (5) (1) (d). Subsection (1.1) (a) provides that a class proceeding is the preferable procedure only if the proposed proceeding "is superior to all reasonably available means of determining the entitlement of the class members to relief or addressing the impugned conduct of the defendant" including "a quasi-judicial or administrative proceeding, the case management of individual claims in a civil proceeding, or any remedial scheme or program outside of a proceeding."

[21] Further, even if there are common questions of fact or law in common to class members, the subsection provides that the court must be satisfied that those common issues predominate over any questions only affecting individual members of the class. These are not dramatic changes from the criteria addressed in jurisprudence, but they are a clear indication that the legislature does not intend certification to be automatic, particularly if the members of the class have other avenues available to them.

[22] A further amendment was the addition of s. 4.1 of the Act which provides that "if before the hearing for certification, a motion is made under the rules of court that may dispose of the proceeding in whole or in part, or narrow the issues to be determined or the evidence to be adduced in the proceeding, that motion shall be heard and disposed of before the motion for certification, unless the court orders that the two motions be heard together."

[23] While this does not appear to preclude a summary judgment motion or other dispositive motion being launched after certification if circumstances arise that make it appropriate to do so, it does signal a clear legislative intention that class proceedings be conducted as efficiently as possible and wherever possible before the parties run up costs on certification. It follows, in my view, that a motion to strike pleadings pursuant to r. 21 or r. 25 ought to be brought prior to or in conjunction with certification. Where no such motion is brought, that should inform the level of scrutiny the court gives to the pleadings under s. 5 (1) (a) of the Act.

[24] It is important to note that s. 5 (1) (a) only requires that the court be satisfied the pleadings disclose a cause of action. As noted above and in the jurisprudence, this is a low bar. The court must assume that unless the pleadings are ridiculous or incapable of proof, the facts set out in the pleading are true and it must be read generously.

[25] In addition, while failing to disclose a cause of action is a reason that a pleading could be struck under r. 25.11 or r. 21.01 (1) (b) or 21.01 (3) (d), it is only one basis for relief under those rules. Section 5 (1) (a) does not attract the complete analysis that might arise on a pleadings motion and a certification motion in the absence of such a motion should not invite a stealth attack on the pleadings beyond the question of whether or not a cause of action is disclosed. Still less, should a certification motion become a shadow summary judgment motion.

[26] It follows that scrutiny under s. 5 (1) (a) does not invite the parties to engage in a line by line debate about the propriety of the pleadings. While certification judges have been willing to prune away aspects of a claim that cannot succeed and allow those aspects that can succeed to be the subject of certification, the certification motion is not as such a pleadings motion. As s. 4.1 now makes clear, if a party wishes to bring such a motion, they should do so prior to or in tandem with the certification motion.

[27] Ontario has pleading rules that are essentially unchanged from the rules adopted in England and Canada in the late 19th Century. "Fact based pleading" requires parties to plead the material facts on which they intend to rely but not the evidence to prove those facts. Moreover, although pleading of a conclusion of law is permissible if the facts are pleaded which lead to that conclusion, it is not strictly required. Ontario pleading rules "do not require the invocation of one formula or another to relegate a claim to one or another type of action." Technically, therefore a statement of claim need not name the cause of action, and it is possible to plead facts that lead to more than one basis of liability or more than one conclusion of law.

[28] As discussed above, s. 5 (1) (a) only speaks to review of the pleadings and there is no need to prove the facts as alleged. The other criteria for certification do require evidence and it is possible that evidence will overlap with evidence going to the merits. The court may need to know how the plaintiff intends to prove the case in order to determine if there are common issues or if the proposed action can be pursued efficiently. It is in this context that the expert evidence tendered by each party must be considered. The court at this stage should not determine which competing expert may be correct, but the expert reports demonstrate the nature of the evidence that will be required and may satisfy the "some basis in fact" test.

[29] Once the basis for certification is established, the court must consider other criteria. As mentioned above, there are now nonexclusive legislative criteria for determining if a class proceeding is the "preferable procedure".

[30] In addition, the court must consider the existence of other class proceedings and whether it would be preferable for "some or all of the claims of some or all of the class members, or some or all of the common issues" to be resolved in the class proceeding in another jurisdiction. Where the plaintiff proposes to certify a multi-jurisdictional class proceeding, s. 5.1 of the Act requires the court to consider whether to defer to a multi-jurisdictional class proceeding in another jurisdiction, whether to carve out class members who are members of a class in such a proceeding, or alternatively to certify an Ontario multi-jurisdictional class proceeding without such limitation if "Ontario is the appropriate venue for the proceeding".

[31] To be clear, the fact that there may be other class proceedings in other jurisdictions is an important consideration, but it is not determinative.

[32] For various reasons, it is sometimes appropriate for there to be more than one class proceeding. In some cases, the courts of various provinces will communicate and coordinate their proceedings or may even hold joint hearings. In addition, class definitions and staying of an action in whole or in part may be revisited by the class proceedings judge at later stages in the litigation should events transpire that make it necessary to do so.

Analysis

Cause of Action

[33] There is no doubt that the plaintiff pleads the constituent elements of negligence against both defendants. He pleads that the defendants each had a duty of care to the plaintiffs and the investors whose data they had possession of to keep that data secure. They plead that infiltration by hackers is a foreseeable risk against which the defendants took inadequate precautions, failed to respond in a timely fashion and the plaintiffs suffered damage as a result. Similarly, he pleads the basis for contractual liability. In either case, liability turns on the nature of the duty of care, foreseeability, and the adequacy of protective measures. The plaintiff also pleads proximity and the obligation to supply a service. This may be sufficient to permit a court to award damages for pure economic loss or to grant another remedial order.

[34] Unfortunately, news of data breaches is currently an almost daily occurrence, and it appears that cybercrime and hacking of databases is epidemic. The issue at the core of the litigation is whether the duty of the defendants extends to protecting clients of Mackenzie from the risk of pure economic loss, or from the risk of future potential losses, if cybercriminals gain access to PII and might misuse that data in the future.

[35] The defendants are in slightly different circumstances from each other because the class members have a direct relationship with Mackenzie but none with ICOM. ICOM is in a contractual relationship with Mackenzie but not with Mackenzie's clients. It is arguable, however, that the contract with Mackenzie is relevant to the assumption of a duty of care and ICOM assumed a duty to the clients by taking possession of the data under the terms imposed by Mackenzie. That is, that they would take all reasonable measures to keep that data safe. It would have been readily apparent to both Mackenzie and to ICOM that harm might come to clients if their personal and financial data or their PII, which was to be held in confidence, became exposed.

[36] Other data breach cases cited by the parties have been certified as class actions. While it is not certain that the plaintiff can impress upon the defendants so high a duty, it is not impossible of success. The obligation to protect confidential data entrusted to a defendant for a limited purpose is an obligation that has been recognized and as such it is now a recognized duty. Alternatively, if it is a novel duty, it is not one that is doomed to failure and cannot succeed. The necessary facts are pleaded to conduct an "Anns/Cooper analysis", should that be necessary. At this stage, the court lacks the full evidentiary matrix to conclusively engage in the analysis. On a certification motion proposing to establish a novel duty of care, it is the function of the court to ensure that if the facts as pleaded are proven, such an analysis would not be certain to fail.

[37] The plaintiff also claims that the defendants stood in a fiduciary relationship to the plaintiff. This is a plausible argument based on the description of Mackenzie as a "trustee" and of its obligations described in various documents. In reality this is simply stating that the defendants are impressed with a high duty of care. If the court concludes that the defendants are in a position of trust and the plaintiffs in a position of vulnerability such that a duty of care should be imposed to protect the plaintiffs from the nefarious acts of cybercriminals, it is quite possible on these facts that the court will impose a fiduciary relationship on one or both defendant. I cannot rule it out, but of course liability is also possible without characterizing the defendants as fiduciaries for reasons discussed. I appreciate there may be additional remedies available against a trustee or fiduciary that might not readily be available against a tort defendant who is not imbued with that relationship, but it is premature to decide that question provided the basis for the finding is adequately pleaded. I cannot conclude that the claim the defendants are fiduciaries is impossible of success.

[38] The plaintiffs also argue that they should be beneficiaries of ICOM's contractual obligation to Mackenzie relying on cases such as Fraser River and London Drugs. I consider that conclusion to be possible on the facts as pleaded. It is obvious that the purpose of the contract with Mackenzie and the conditions on which ICOM received the data is for the protection of clients such as the plaintiffs. As discussed above, it is also arguable that receiving the information on these terms is sufficient to impose a duty in tort. It is evident who would suffer damage if the confidential information or PII was stolen or made public. As I will discuss below, even if there is no applicable or enforceable statutory obligation in a particular jurisdiction, the almost constant attention to this issue by legislatures across Canada and around the world for that matter, supports an argument that data custodians should now be alert to the highly sensitive nature of PII and have a duty to protect it.

[39] In conclusion, the claim as pleaded easily meets the test under s. 5 (1) (a). It would be unreasonable without delving deeply into the evidence to conclude that the Fresh as Amended Statement of Claim is impossible of success.

Other Certification Criteria

[40] That being the case, there is little difficulty with the other criteria in s. 5 (1). There is an identifiable class. The proposed plaintiffs are perfectly acceptable class representatives and are not conflicted. The proposed litigation plan is reasonable. There is certainly a common issue regarding the duty of care and whether it was breached. There is a common issue as to whether remedial measures put in place by Mackenzie are adequate and whether compensation is required under these circumstances.

Reliance on Statutes

[41] In Canada, breach of a statutory duty does not in and of itself create civil liability but the breach of a statutory standard may inform the analysis of the appropriate standard of care. The existence of a statutory duty may also be used to identify the existence and extent of a common law duty of care. Statutory requirements may also inform public policy arguments if an Anns/Cooper analysis is required. Finally, compliance with statutory standards may be an explicit or an implicit term of a contract. Statutorily imposed standards are therefore material facts and may be pleaded even if the statute does not create a specific remedy.

[42] In some cases, however, legislation may create or impose civil liability. When the legislature takes this step, it is an open question whether the statute is codifying existing law, modifying the common law or creating an entirely new right and remedy. The answer is a question of statutory interpretation.

[43] In this case, the plaintiff has pleaded breach of standards at common law (or which the plaintiff argues should exist at common law), breach of standards created by or affirmed by contract and breach of standards recognized in the privacy legislation of various jurisdictions where such legislation exists.

[44] The plaintiff has specifically pleaded and relied upon legislation in British Columbia, Manitoba and Newfoundland and Labrador. Each of those statutes provide that it is a "tort, actionable without proof of damage, for a person wilfully and without claim of right to violate the privacy of another person." The plaintiff has also pleaded the privacy legislation in Quebec which provides specific restrictions on invasions of privacy or establishing a file on a person and provides for certain remedies.

[45] Three questions flow from the province specific statutes. The first is whether this court has any jurisdiction to apply those statutes. The second is whether the differences in the legal rights preclude the certification of a national class or require subclasses for those provinces. The third is the question raised by the intervenor, whether there is a juridical advantage to suing in British Columbia that would make it the preferred forum, at least for plaintiffs covered by those specific statutes.

[46] The fact that certain provinces have provided that "wilfully" or intentionally invading privacy is actionable "without proof of damage" does not preclude liability for negligence at common law or pursuant to contract. Liability under the statutes of B.C., Manitoba and Newfoundland and Labrador is triggered only for intentional invasion of privacy. Nothing in those statutes purports to limit liability that would exist otherwise.

[47] The plaintiff seeks to categorize the conduct of the defendants as "reckless" or wilfully blind to the possible consequences of a data breach and to equate that with wilful intrusion. This theory is pleaded even more specifically in the B.C. class action which also relies on breaches of the federal privacy legislation to inform the interpretation of the provincial statutes and to inform the issue of consent to the use of SINs. As I will discuss, the intervenor regards the approach of the B.C. courts to this issue to be a juridical advantage.

[48] For purposes of certification, it is objectively the case that elevating negligence or breach of contract to willfulness or intentional violation of rights is a difficult position. In Owsianik v. Equifax, the Ontario Court of Appeal acknowledged that recklessness intrusion into private affairs could satisfy the requirement of intention for purposes of the tort of "intrusion upon seclusion". The court, however, emphasised that two findings, were necessary. Firstly, there must be an intrusion and secondly there must be nefarious intent.

[49] The court rejected the notion that recklessly failing to safeguard information lawfully held by the defendant could be interpreted as "intrusion". It held that on the allegations made in that case "Equifax failed to take steps to prevent independent hackers from conduct that clearly invaded the plaintiffs' privacy interests in the documents stored by Equifax" but Equifax did not itself "interfere with those privacy interests." In particular, at paragraph 61 the court held as follows:

"[61] In summary, the claim brought against Equifax fails at the conduct component of the tort of intrusion upon seclusion. Equifax's negligent storage of the information cannot in law amount to an invasion of, or an intrusion upon, the plaintiffs' privacy interests in the information. Equifax's recklessness as to the consequences of its negligent storage cannot make Equifax liable for the intentional invasion of the plaintiffs' privacy committed by the independent third-party hacker. Equifax's liability, if any, lies in its breach of a duty owed to the plaintiffs, or its breach of contractual or statutory obligations."

[50] It would therefore be difficult to argue that Mackenzie or ICOM wilfully breached the privacy rights of the plaintiff by intruding upon their privacy. I appreciate that there is a more nuanced argument. It can be argued that consent to storage of the PII is vitiated if that consent is conditional on due diligence. Although that might assist in fixing the defendants with liability for the breach in contract or in tort, it is still difficult to see how this can be wilful invasion of privacy by the defendants within the meaning of the provincial privacy legislation.

[51] I accept the argument that reckless lack of care could be found to be willful disregard of the plaintiff's rights but that is not the same as wilful invasion of privacy. For that reason, I would have declined to certify breach of the privacy legislation which appears to require the same findings as the tort of "intrusion upon seclusion".

[52] There is a further complication, and this gives rise to the position of the intervenor that this court should cede the field to the courts of British Columbia (the original position) or carve out classes in certain provinces (the current position). This is because the provincial legislation in three provinces confers jurisdiction under the statute on a named court in that province and on the Federal Court under PIPEDA.

[53] Three decisions of this court cited by the intervenor establish that a court in Ontario has no jurisdiction to award damages under the provincial privacy statutes which name the specific provincial court or under PIPEDA which names the Federal Court. It has consistently been held in Ontario that although the court can apply foreign law in adjudicating a case in Ontario to which the law of another jurisdiction applies, it does not have jurisdiction to grant a purely statutory remedy where the statute grants exclusive jurisdiction to a particular court.

[54] With respect to s. 4 of the British Columbia privacy legislation conferring jurisdiction on the Supreme Court of British Columbia, Abella J. in her concurring judgment in the Supreme Court of Canada held that what s. 4 grants is exclusive jurisdiction to the Supreme Court of British Columbia to the exclusion not only of other courts in British Columbia, but to the exclusion of all other courts, within and outside British Columbia. This point was not directly addressed by the other members of the court who were in the majority. The three judges in the minority did address the point and disagreed that this was the correct interpretation of the law. Even had they agreed, four judges of the Supreme Court do not a majority make. The SCC has to date left this question unanswered.

[55] Following the Ontario jurisprudence, I would decline to certify a proceeding for remedies under the provincial privacy legislation in the three common law provinces or Quebec. Firstly, the case as pleaded does not in my view make out a case of willful intrusion into the privacy of the plaintiff by these defendants. Secondly, at least under the current state of the law, it appears this court lacks the competence to grant a remedy under specific provincial laws designating particular courts to do so.

[56] It should be emphasised that this is not a finding that the statutes of those provinces limit the jurisdiction of this court to adjudicate or grant remedies to residents of those provinces in any way. It is simply a conclusion that the legislation in question does not confer jurisdiction on this court under those statutes. The court will always take cognizance of the law in other provinces. That is not the same thing as administering or applying a specific statute.

[57] Accordingly, the court may certify classes including the residents of other provinces, and the plaintiff may refer to the existence and content of local privacy legislation in each province as a material fact. It would not be appropriate to certify the question of whether or not there is liability or a remedy under those statutes which confer jurisdiction on a particular court.

[58] For the same reason, it is unnecessary to carve out subclasses for those provinces. If there is liability at common law or for breach of contract the statutory remedy may not be required. If a remedy under the provincial statute goes beyond what is available otherwise and is not included in the class proceeding, then the class proceeding would not prevent a resident of that province from seeking a separate remedy under the provincial statute if the class proceeding is insufficient.

[59] The intervenor argues that the law is better for the plaintiffs in British Columbia. In Douez 2022, Ivy J. carefully distinguished between territorial jurisdiction and subject matter jurisdiction and noted the disagreement at the Supreme Court of Canada in Douez 2017. The court held that no provincial legislature was competent to limit the jurisdiction of a court in another province. Therefore, the Supreme Court of British Columbia was at liberty to apply the privacy statutes of Manitoba and of Newfoundland and Labrador. This analysis, repeated by the same judge in another case, was fully endorsed by the British Columbia Court of Appeal.

[60] The problem with relying on the current state of jurisprudence as a juridical advantage is that the jurisprudence may have changed by the time the litigation reaches trial. It can be anticipated that the Ontario Court of Appeal will weigh in on this matter shortly and in the event our Court of Appeal disagrees with the British Columbia Court of Appeal, it is almost certain the question will make its way to the Supreme Court of Canada. There may also be statutory amendments. Juridical advantages based on favourable jurisprudence are not static.

[61] In any event, the ability of a domestic court to apply foreign law is a question that is nuanced and context specific. In Douez, which is still before the B.C. courts, the issue is a supposed conflict between the privacy legislation and a forum selection clause. The question was whether a general provision conferring jurisdiction under the statute on the B.C. Supreme Court was intended to override a forum clause. The choice in Douez was between California (under the contract) and British Columbia (where the plaintiff resided and the privacy breach occurred.) It is being argued before Canadian courts. The courts of California were not asked to rule on whether they were competent to apply the B.C. privacy statute under California law.

[62] In the Ontario line of cases, the issue was primarily whether the court in Ontario could award a purely statutory remedy which legislation in the province creating that remedy had conferred on the local court. The issue has been application of a specific remedial statute and not the more general question of interpreting and applying the lex loci. Furthermore, none of the jurisprudence in either Ontario or British Columbia has distinguished between extraterritorial limitation of jurisdiction and extraterritorial creation of jurisdiction. If it is clear that the legislature of a province cannot limit the jurisdiction that a court in another province already enjoys, it is arguable that no provincial legislature can expand the jurisdiction of such foreign courts by conferring upon such courts remedial jurisdiction the court does not have under its own laws on its own territory. This may or may not be a bright line. There may be a significant distinction between applying the law of another jurisdiction recognizing rights in its territory on the one hand and undertaking a specific or novel adjudicative task assigned only to a court or tribunal in that province.

[63] As discussed above, I am not convinced that on the facts as pleaded, it is necessary for this court to specifically apply the remedial privacy legislation in the named provinces to certify a class nor is it necessary to invoke that legislation to grant remedies to class members residing in those provinces. After all, if the plaintiff is unable to establish that he suffered damages due to failure by the defendants to take adequate care, the plaintiff will be in significant trouble. To rely only on the provincial statutes imposing liability for "wilful" intrusion "without proof of damages" leaves the class without a case in those provinces that do not have such legislation, in particular Ontario. If liability and damages can be established in Ontario, without relying on the privacy statutes, such liability will also exist in those provinces.

[64] For the reasons articulated above, I would neither certify the question of whether remedies can be granted under those statutes, nor would I exclude the plaintiff from relying on the existence of those statutes as material facts or as policy grounds in asserting its other claims. The statutes may be pleaded but a remedy under those statutes will not be a common issue.

[65] I consider it extremely unlikely that punitive damages would be appropriate in this case, but the plaintiff have pleaded Mackenzie was a fiduciary and a trustee and took inadequate steps to protect highly sensitive information with which it had been entrusted. Punitive damages if sought, must be pled and the allegations to support such an award are contained in the statement of claim. The court would have to find that the conduct of the defendants was high handed or malicious and oppressive and so offended the courts sense of decency that an ordinary award of damages was insufficient to express such condemnation. Scepticism is not the test. Paragraphs 82 and 83 of the claim summarize the basis for the claim. Essentially, the plaintiffs plead that the conduct of the defendants was wildly reckless under the circumstances.

Competing Class Proceedings

[66] Turning now to the existence of the class proceeding in British Columbia, at this point in time it is premature to stay the Ontario class proceeding in favour of B.C. because the proceeding in B.C. is not yet certified and it is not yet known whether there will be overlapping classes.

[67] There is no national framework for class proceedings in Canada as there is in the United States because in Canada the federal government has no competence to legislate in the area of property and civil rights or civil procedure. The framework for national class proceedings is reliant entirely on the principles of comity and stare decisis and to a lesser extent on reciprocal enforcement of judgments. There would be a significant problem should a court in one province conclude there is no liability while the court in another concluded that there was on the same set of facts in relation to overlapping classes. There would equally be a conflict of laws problem if two different courts purported to grant damages to members of overlapping classes. Class proceedings judges across the country are aware of this.

[68] This is managed generally by provisions such as s. 5.1 of the Ontario Act and by mutual respect and deference between coordinate courts in each province:

5.1 (1) The court may make any order it considers appropriate on a motion to certify a multi-jurisdictional class proceeding, including,

(a) certifying the proceeding if,

(i) the conditions set out in subsection 5 (1) are met, and

(ii) the court determines, having regard to subsections 5 (6) and (7), that Ontario is the appropriate venue for the proceeding;

(b) refusing to certify the proceeding if the court determines that it should proceed as a multi-jurisdictional class proceeding or proposed multi-jurisdictional class proceeding in another jurisdiction; or

(c) refusing to certify the proceeding with respect to class members that the court determines may be included as class members in a class proceeding or proposed class proceeding in another Canadian jurisdiction.

[69] These options are neither exclusive nor mandatory. It may or may not be appropriate for Ontario to assume jurisdiction over a national class. Assuming it does so, and if there are parallel class proceedings in other jurisdictions, this court may refuse certification, limit certification or it may forge ahead. It is not infrequent that there is more than one class proceeding. In some cases, this requires coordination between courts. In others it means removing residents of certain provinces from the class or classes.

[70] Multiple proceedings are generally to be avoided if possible. Besides considerations of judicial efficiency, there are issues of cost and fairness for the parties. It is unreasonable for a defendant to be facing multiple class proceedings with different demands for production and discovery unless it is necessary in the interests of justice. Similarly, it would be confusing and unnecessary for individual class members to find themselves subject to overlapping class proceedings which might bind them unless they opt out. One option is to stay one of the actions, another is to adjust the class definitions.

[71] It is not however necessarily to conclusively determine this question today. At the time of writing, there is only one other active class proceeding in Canada and that is the action in British Columbia. Mr. Charney, whose office is in Toronto and is also a member of the Ontario bar, is class counsel in the B.C. action. The defendants sought to have that action dismissed as abuse of process on a preliminary motion in British Columbia but were unsuccessful. It remains possible that the Supreme Court of British Columbia will refuse or limit certification.

[72] Both in Ontario and British Columbia the existence of other proceedings in other provinces are factors to be considered and each court needs to know the decision of the other in order to fully discharge its statutory duties. I have been advised that the B.C. court has adjourned the certification hearing to December in order to know the outcome in Ontario. Once the court in British Columbia has ruled, it may be appropriate to revisit the question of whether or not the classes in this proceeding should be adjusted or limited.

[73] The Ontario Act now has detailed provisions for a carriage motion when there are multiple class proceedings in this province under the Act. Had Mr. Charney launched the second class proceeding in Ontario, this court would have been called upon to determine which action should proceed and who should be given carriage. There is no such scheme at a national level except for the decision by each court whether the proceeding in that jurisdiction should proceed or not and what classes it should encompass. Accordingly, the decision by each court whether to allow a class proceeding and the relationship between parallel proceedings is always a work in progress.

[74] Much time was spent in argument in a type of "beauty contest" where the intervenor attempted to persuade me that the pleadings in the British Columbia action were superior to the pleadings in the Ontario action and the plaintiff argued the opposite. While in part this focused on the jurisprudence relating to application of the privacy statutes in the three provinces mentioned earlier, it was also argued that references to PIPEDA and other details made it more likely that the B.C. class action would deliver justice for the proposed classes in those provinces. Firstly, with respect, pleading is not an exact science and comparison of pleading styles, providing the basic requirements are met, is not usually helpful. More importantly, it is not for the court in Ontario to assess the merits of a B.C. pleading under the B.C. rules of pleading. The merits of that pleading will be assessed, if at all, in the certification motion in B.C. Counsel in Ontario has already amended the pleading to incorporate aspects of the other action, including addition of ICOM as a party. This is part of the process of refining the action as more facts are gathered and as counsel learn from each other.

[75] To return to the criteria for certification, there is no doubt that the events in question have a significant connection to Ontario. Mackenzie has its head office in Ontario and the largest group of investors are to be found in this province. Although ICOM is now a British Columbia corporation, one of the predecessor corporations, Investorcom Inc. was domiciled in Ontario. ICOM continues to have a significant presence in this province with offices in Brantford and Toronto. The incident in question arose from the provision of services to Mackenzie by ICOM. It is entirely appropriate to certify an Ontario class action and subject to whether or not the B.C. action is also certified, to certify it as a national class action.

The Class Definition and the Common Issues

[76] There was not a great deal of time spend focusing on the class definition or on the proposed common issues. At the recent case conference, I advised counsel that I would provide my ruling on certification but in all probability, I would only rule in a preliminary manner on the common issues.

[77] This is for two reasons. Firstly, once counsel have my decision, the plaintiffs and the defendants may be able to reach agreement on these aspects in the context of taking out a formal order. If the parties are in agreement about the appropriate class definition or the common issues in order to render the litigation more efficient, I may well defer to their joint views on the matter. At the very least, they should have the opportunity to discuss the matter.

[78] The second reason is my view that a long detailed list of common issues is neither necessary nor appropriate. I regard the issues in this case as requiring answers to a fairly clear and simple set of questions. As stated earlier, the fundamental questions are the extent of the duty of care, the nature of the duty, whether it was breached and whether or not the members of the class suffered compensable damages or are entitled to aggregate or other relief. I have proposed wording for those issues but did not hear submissions on that point or on the proposed wording.

Conclusion

[79] In conclusion, the action will be certified as a class proceeding. I will remain the class proceedings judge, and the litigation plan is given preliminary approval subject to any future agreement between the parties or to case management orders that may subsequently be made.

[80] I invite the parties to agree on the class definition and common issues or to make submissions if they cannot agree but are not content with the tentative list attached. Failing either of the above within the next 30 days, the class definition and common issues will be as set out below.

Costs

[81] I also invite the parties to agree on a costs disposition. If they are unable to do so, then they may obtain direction from my office regarding written or oral costs submissions within the next 30 days.

[82] If counsel require more than 30 days in light of the pending hearing in British Columbia, I am prepared to grant a reasonable extension of the times in paragraphs 78 and 80.

Justice C. MacLeod

Date: October 30, 2025

Schedule A – Class Definition

The class consists of all persons in Canada whose personal information held by Mackenzie Financial Corporation was exposed to appropriation by unauthorized persons ("hackers") as the result of a security breach occurring on or about January 18, 2023. The defendants or their subsidiaries are excluded from the class.

Schedule B – Common Issues

1. What personal information of the class members was accessed by the hackers?

2. Did MFC owe the class members a duty of care to safeguard the personal information of the class members and to prevent unauthorized access?

3. Did ICOM owe a duty of care to the class members with regard to the personal information in its possession to safeguard that information and to prevent unauthorized access?

4. If MFC or ICOM owed duties to the class members, were those duties at common law, contract, as fiduciaries or a combination thereof?

5. If MFC or ICOM owed duties of care to the class members, were those duties breached and if so, how did the acts or omissions of the defendants fall below the standard of reasonable or requisite care?

6. Did remedial and mitigation measures taken by the defendants or either of them fully mitigate against any real risk of harm or is there an ongoing or permanent risk that personal information will become public and be misused?

7. If liability is found against the defendants or either of them, is this a case for aggregate damages or other remedies?

8. Do the circumstances in this case justify or require an award of punitive damages?