SUPERIOR COURT OF JUSTICE - ONTARIO
RE: Elizabeth Finley, Plaintiff
AND:
Raise Limited, Defendant
BEFORE: Mew J.
COUNSEL: Sean Brown and Christopher Lupis, for the Plaintiff
Alexandra Moser, for the Defendant
HEARD: 11 June 2026, at Ottawa
ENDORSEMENT
1This proposed class proceeding is brought on behalf of 359,663 Ontario residents arising from the alleged unauthorised taking and misuse of personal information from Ontario’s COVaxON system by an employee of the defendant.
2Subject to approval by the court, the parties now consent to certification of the class action and settlement of the claims which it advances.
Background Facts
3During and following the COVID-19 pandemic, the Ontario government established a vaccination management system – the COVaxON system – which enabled the Ontario Ministry of Health, vaccination locations, and staff, to collect and use certain personal health information of Ontario residents, including COVID-19 vaccination data.
4The defendant provides staffing and consulting services and was contracted by Ontario to, inter alia, support the COVaxON system. The defendant and its personnel were required to collect personal health information from individuals and upload it into the COVaxON system. They would also use the personal health information in COVaxON to determine when the person last received a dose of the vaccine, to send individuals reminders or other communications on vaccine bookings and updates to vaccine certificates and would update the individual’s record after administering a vaccine.
5On 6 July 2021, Elizabeth Finley and her daughter attended a COVID-19 vaccination clinic In Niagara Falls. Prior to attending the clinic, she completed an online form through the Ontario Ministry of Health vaccination booking system. As part of that process, she provided personal information including her name, address, telephone number, health card number, and other personal health information required to book the appointment.
6Ayoub Sayid was an employee of the defendant. He is alleged to have stolen the personal health information of class members, including Ms. Finley, and, with the help of Rahim Abdu (and possibly others), sent scam texts to some class members.
7Following the execution of search warrants by the Ontario Provincial Police in November 2021, several devices, computers and laptops were seized, and Mr. Sayid and Mr. Abdu were taken into custody. They were both charged with unauthorized use of a computer contrary to s. 342.1(1)(c) of the Criminal Code.
8Ms. Finley was one of 359,663 individuals who received notification from the Ontario Provincial Police advising that their personal health information contained in Ontario’s COVID-19 vaccination system had been accessed without authorisation on 16 November 2021. She was told that the accused’s laptops seized by the OPP contained her name and phone number.
9The plaintiff alleges, among other things, that the defendant is vicariously liable for Mr. Sayid's alleged intrusion upon seclusion of the class members and that the defendant is liable for damages and related relief arising from the data breach.
Certification
10The Plaintiff seeks certification of this action as a Class Proceeding for settlement purposes only. The proposed class definition is “all 359,663 Ontarians whose Personal Information was taken and misused in the Breach, excluding senior executives, officers, directors, and managers of the Defendant” (capitalised terms are those used in the parties’ settlement agreement).
11The criteria for certification of a class proceeding are set out in section 5(1) of the Class Proceedings Act, 1992, S.O. 1992, c. 6. Based on the uncontested contents of the motion record, I am satisfied those criteria have been met in this case. In particular:
a. the pleaded allegations disclose a viable action for the tort of intrusion upon seclusion and vicarious liability arising from the alleged misconduct of Mr. Sayid;
b. there is an identifiable class of 359,663 individuals who were advised that their personal information was taken and misused;
c. whether the defendant is vicariously liable for intrusion upon the seclusion of each class member raises a common issue for their claims;
d. a class proceeding is the preferable procedure as it is superior to all reasonably available means of determining the class members’ claims. A class proceeding in this context avoids duplication of claims; ensures consistent findings across claimants; and allows each claim to be resolved efficiently.
12Elizabeth Finley is an appropriate representative plaintiff. She is a member of the proposed class. She understands her responsibilities and role within the action. She has no apparent conflict with the class.
13Because the parties have reached a settlement agreement, a certification order containing the particulars set out in s. 8(1) of the Class Proceedings Act is surplus to needs. Similarly, a litigation plan that goes beyond implementation of the settlement agreement is not required.
Approval of Settlement
14The proposed settlement was reached after arm’s-length mediation before the Honourable Thomas Lederer, a retired judge of this court, with the assistance of experienced counsel. It provides a $600,000 all-inclusive settlement fund, from which approved fees and disbursements will be paid, with the net settlement fund distributed cy-près to MediaSmarts, a Canadian non-profit organisation and registered charity whose work is closely connected to the online privacy, digital literacy, cybersecurity, and scam prevention issues raised by this case.
15The proposed fees of class counsel are $150,000 (or 25% of the gross recovery) plus HST and disbursements of $46,000. Accordingly, the net settlement amount would be $384,500.
16On 27 March 2026, I made an order approving the form and manner of notice of the certification and settlement approval motion, fixing deadlines for opt-outs and objections, and for related relief.
17No objections to the proposed settlement have been received. Nor have any opt-out requests been received.
18Section 27.1(5) of the Class Proceedings Act provides that the court shall not approve a settlement unless it determines that the settlement is fair, reasonable and in the best interests of the class members.
19When considering the approval of negotiated settlements, the court may consider, among other things: (a) likelihood of recovery or likelihood of success; (b) amount and nature of discovery, evidence or investigation; (c) settlement terms and conditions; (d) recommendation and experience of counsel; (e) future expenses and likely duration of litigation and risk; (f) recommendation of neutral parties, if any; (g) number of objectors and nature of objections; (h) the presence of good faith, arm’s-length bargaining and the absence of collusion; (i) the degree and nature of communications by counsel and the representative parties with class members during the litigation; and (j) information conveying to the court the dynamics of and the positions taken by the parties during the negotiation.
20The test is not whether the settlement meets the demands of a particular class member. A settlement need not be perfect. It need only fall within a zone or range of reasonableness. In the present case, one of the challenges was that despite the investigative efforts of class counsel, very few putative class members came forward with evidence that would assist in proving that the breach caused distress, humiliation, or anguish in context of a claim for intrusion upon seclusion. Consequently, class counsel acknowledged that a possible recovery for each putative class member would be difficult given the size of the class and the nominal award the court would be likely to order on a per capita basis based on the type of information improperly accessed.
21As a result, since the size of the proposed class would make individual payments under the settlement agreement infeasible, MediaSmarts was identified as a non-profit organisation and registered charity deserving of the net settlement funds. The court was advised that MediaSmarts focuses on improving digital literacy, online privacy, cybersecurity education, media literacy, and public education concerning online risks, including scams and misuse of personal information. The motion record contains a focused proposal and plan submitted by MediaSmarts which describes how the proposed financial support from the settlement would allow MediaSmarts to build on the success of its established “Break the Fake” programme by developing a new workshop focused on practical skills for preventing online scams and fraud.
22There was undoubtedly litigation risk had the certification of this class action been contested. Not all situations in which personal health information has been improperly accessed will support a certification of a class action grounded on intrusion upon seclusion: Stewart v. Demme, 2022 ONSC 1790 (Div. Ct.). Even assuming that an intrusion upon seclusion claim could be sustained, there would have remained an issue as to whether the breach caused class members distress, humiliation, or anguish and, hence, compensable harm or damage.
23That said, the plaintiff’s claim was not speculative. The pleaded case was supported by the fact that personal information was taken from COVaxON by an individual who had been placed in a position of access through the defendant’s staffing role. The information was then allegedly misused in connection with scam text messages directed at members of the public. The size of the affected group, the use of a government health-related system, and the connection between the information taken and attempted fraud all supported the seriousness of the claim.
24Public policy favours the settlement of disputes such as this. Where settlement has been reached through arm's length negotiations and is being presented for approval by experienced class counsel, the court is entitled to assume, in the absence of evidence to the contrary, that it is being presented with the best reasonably achievable settlement: Wein v. Rogers Cable Communications Inc., 2011 ONSC 7290, at para 20; Przybylska v. Gatos Silver, Inc., 2024 ONSC 2196, at para. 10; Rabbat v. Nadon, 2025 ONSC 5187, at para. 42.
25For the forgoing reasons, as expanded upon in the plaintiff’s factum, I am satisfied that the proposed settlement is fair, reasonable and in the best interests of the class members.
26In my view, the proposed fees of class counsel are reasonable. The 33% contingency fee set out in the contingency fee agreement between class counsel and the representative plaintiff was, quite appropriately, reduced to 25% for the purposes of the proposed settlement. The record indicates that between 350 and 375 hours of fee-earners’ work will have been spent on this matter by the time that settlement is finalised.
Disposition
27For the foregoing reasons, an order shall go certifying this action as a class proceeding for settlement purposes, approving the settlement agreement, including the designation of MediaSmarts as the cy-près recipient, approving the fees and disbursements of class counsel, and approving the proposed release provisions and the other relief sought in the notice of motion, as fair, reasonable, proportionate, and in the best interests of the class.
Mew J.
Date: 11 June 2026