IN THE QUEEN'S BENCH JUDICIAL CENTRE OF REGINA. -and-

Transcription

1 ..,. ~ I CANADA ) PROVINCE OF SASKATCHEWAN ) } ()7 Q.B.G. No '-' IN THE QUEEN'S BENCH JUDICIAL CENTRE OF REGINA Between: NICOLE BRITTIN -and- PLAINTIFF THE MINSTER OF HUMAN RESOURCES AND SKILLS DEVELOPMENT CANADA and THE ATTORNEY GENERAL OF CANADA DEFENDANTS Brought under The Class Actions Act. STATEMENT OF CLAIM NOTICE TO DEFENDANTS 1. The plaintiff may enter judgment in accordance with this Statement of Claim or such judgment a may be granted pursuant to the Rules of Court unless: within 20 days if you were served in Saskatchewan; within 30 days if you were served elsewhere in Canada or in the United States of America; within 40 days if you were served outside Canada and the United States of America (excluding the day of service) you serve a Statement of Defence on the plaintiff and file a copy thereof in the office of the local registrar of the Court for the judicial centre above named. 2. In many cases a defendant may have the trial of the action held at a judicial centre other than the one at which the Statement of Claim is issued. Every defendant should consult his lawyer as to his rights. 3. This Statement of Claim is to be served within six months from the date on which it is issued. 4. This Statement of Claim is issued at the above-named judicial centre the 21st day ofjanuary, C. Gabel '"'~--~- --~. Dy. Local Reg,st~ifr Local Registrar

2 '. STATEMENT OF CLAIM THE PARTIES 1. The Defendant, the Minister of Human Resources and Skills Development Canada ("HRSDC"), heads the HRSDC department of the Government of Canada which includes the HRSDC's agents, management, representatives, and employees who acted on its behalf, and at all material times was responsible for inter alia ensuring that the Defendants complied with its duties and obligations. 2. The Defendant, the Attorney General of Canada, pursuant to Section 23(1) of the Crown Liability and Proceedings Act, RSC 1985 c C-50, represents Her Majesty the Queen in Right of Canada (hereinafter "the Government") in this proceeding, and at all material times was responsible for inter alia ensuring that the Defendants complied with its duties and obligations. 3. The Plaintiff, Nicole Brittin, claims on her behalf and on behalf of the Class and all Class Members for an order pursuant to The Class Actions Act certifying this action as a class proceeding and appointing her or other members of the Class as representative plaintiff(s) of the Class. 4. The Plaintiff is a resident of Regina, and at all material times was a resident of Saskatchewan. Having accessed government student loans between 2003 and 2006, the Plaintiff is one of those affected by the loss of Personal Information contained in the portable hard drive lost by the Defendants on or about November 5, Indeed, the Plaintiff consulted with HRSDC on January 1 ih, 2013, and was informed that her personal and private information had been lost by the Defendants in the Privacy Breach. - 2-

3 , The Plaintiff is part of a class of persons from across Canada affected by the loss of Personal Information contained on the portable hard drive. 7. The Plaintiff and Class Members were participants in the Defendants' Canada Student Loan Program ("CSLP") between the years 2000 and The Class Members are individuals who communicated to the Defendants Personal Information including their names, social insurance numbers, dates of birth, contact information and their corresponding loan balance with the CSLP. CLASS MEMBERS 9. This action is brought on behalf of the Plaintiff in her own right, and pursuant to The Class Actions Act, SS 2001, c C ("The Class Actions Act"), on behalf of all persons resident in Saskatchewan and throughout Canada and abroad, who have communicated personal and private information to the Defendants, which information may have been later lost or stolen from a portable hard drive identified as missing from an HRSDC office on or about November 5, The Plaintiff is representative of a Class of persons, situated in Canada and abroad, more particularly described as follows: "All persons (including their estates, executors, or personal representatives), who have communicated personal or private information to the Defendants between the years 2000 and 2006, which information may have been later lost, misplaced, or stolen." 11. Hereinafter both resident and non-resident Class Members are collectively referred to as the "Plaintiff', "Class Members", or the "Class". - 3-

4 OVERVIEW OF THE CLAIM 12. A portable hard drive containing the personal and private information of approximately 583,000 Canada Student Loan borrowers from 2000 to 2006 was held by the Defendants as a back-up storage option at their office in Gatineau, Quebec. The portable hard drive contained various types of information that, when used together, constitutes private information from the Plaintiff and Class Members, including names, dates of birth, Social Insurance Numbers, addresses and student loan balances ("Personal Information"). 13. The Defendants received Personal Information from the Class Members during the course of extending student loans to the Plaintiff and Class Members. Personal Information was communicated to the Defendants for the Defendants' restricted use and was to be utilized only for the purpose for which it was originally provided. 14. In or about November, 2012, HRSDC loaded Personal Information of Class Members onto an external hard drive device for use in a survey. The information was not encrypted. Failure to encrypt the data was a clear breach of basic safety standards that are required by government when handling Personal Information. 15. On or about November 5, 2012, a HRSDC employee discovered that the portable hard drive containing unencrypted Personal Information was missing (the "Privacy Breach"). 16. Not until several weeks later, on November 28, 2012, was HRSDC's Departmental Security Officer notified of the Privacy Breach. 17. Weeks after initially reporting the loss of Personal Information to HRSDC' s Departmental Security Officer, on December 14, 2012, the Office of the Privacy Commissioner of Canada was notified of the Privacy Breach. 18. On January 7, 2012, the Privacy Breach was referred to the Royal Canadian Mounted Police for investigation. -4-

5 19. Finally, on January 11, more than two months after the initial loss of Personal Information - the Defendants revealed to the Canadian public limited information about the Privacy Breach. 20. At sometime prior to January 11, 2012, the Defendants became aware that the portable hard drive had been lost and possibly subject to unauthorized access. The Defendants delayed notifying the proper law enforcement agencies. Furthermore, the Defendants delayed notifying the Plaintiff and Class Members of the Privacy Breach. 21. The Defendants' failure to advise the public, the Plaintiff, the Class Members, and the proper authorities in a timely manner of the Privacy Breach represents a negligent and reckless disregard for the privacy interests of the Plaintiff and Class Members. The Defendants failure to notify the Class as soon as practicable that Personal Information had been lost or stolen indicates a failure on the part of the Defendants to mitigate harm to the Class Members. 22. The damage caused to the Plaintiff and Class Members by the Defendants' loss of Personal Information is exponentially compounded by the fact that the Personal Information was not encrypted. The lack of encryption by the Defendants is not only a breach of standard privacy protection protocols independent of the loss of Personal Information, it also makes illicit use of Personal Information less difficult to undertake. 23. As a result of the Privacy Breach, the Plaintiff and Class Members must, inter alia, monitor their own credit and bank account activities for fraudulent behavior. The actual and potential threat to the Class Member's privacy and other interests can be expected to continue indefinitely. Furthermore, several Class Members have indicated to the Plaintiffs counsel that they have experienced emotional distress due to this violation of their privacy. - 5-

6 .. CAUSES OF ACTION 24. The causes of action in this claim include, but are not limited to: a. negligence; b. breach of confidence and fiduciary duty; c. violation of privacy legislation; d. breach of contract; e. breach of statutory duty; and f. breach of Section 7 of the Canadian Charter of Rights and Freedoms. (A) NEGLIGENCE 25. The Defendants: a. owed each Class Member a duty of care to ensure that each Class Member's Personal Information remained privileged and not disclosed to other parties; b. knew that a breach of this duty would cause damage to the Plaintiff and Class Members; and, c. knew, or ought to have known, that their substandard method of the maintenance of Personal Information and the security of the same were such that it was inevitable, or at least probable, that Personal Information would likely be lost, stolen or otherwise disclosed, in breach of their common law, statutory and equitable duties 26. The Defendants were required to meet a standard of care because: a. Personal Information communicated by each of the Class Members was unique to that Class Member; b. Personal Information pertained to the identity and financial interest of each of the Class Members; c. Personal Information was communicated to the Defendants under circumstances where the Class Members had no choice in the communication if he or she wanted to obtain the Defendants' services. -6-

7 .' 27. The Defendants had a duty to protect Personal Information of the Plaintiff and Class Members which duty they have negligently breached. 28. The Defendants were negligent in failing to have security measures in place, including but not limited to encryption and proper storage and tracking protocols, including failing to store and encrypt components of Personal Information on separate hard drives so that the loss or theft of one does not permit misuse without the loss or theft of both, sufficient to prevent the loss and potential misuse of Personal Information. 29. The Defendants were negligent in failing to immediately notify the public of the loss of Personal Information, thereby preventing the Plaintiff and Class Members from immediately taking steps to protect their financial interests. Furthermore, the Defendants failed to immediately inform the Royal Canadian Mounted Police and other regulatory bodies of the loss ofpersonal Information. (B) BREACH OF CONFIDENCE AND FIDUCIARY DUTY 30. The Defendants are liable in tort for the damages suffered by the Plaintiff and Class Members in that: (a) The Plaintiff and Class Members communicated Personal Information to the Defendants, all of whom received the said information knowing the same to be privileged. (b) Personal Information was communicated to the Defendants for the sole and limited purpose of the Defendants' use in the context of the provision of student loans to the Plaintiff and Class Members; c) The Defendants received Personal Information knowing the limited purpose for which it was communicated, by reason whereof they became and were at all material times under a duty of confidence towards the Plaintiff and Class Members in respect of the said Personal Information, such that the loss of that information constitutes a breach of confidence. - 7-

8 d) The Plaintiff and Class Members stand in a relationship with the Defendants which is a relationship of trust and confidence; e) The Defendants had a power of control and care relating to the maintenance and disclosure of Personal Information; f) The Plaintiff and Class Members were vulnerable to personal and economic loss which would result depending upon the way in which the Defendants exercised their power of control relating to the personality of Personal Information communicated; and g) The Defendants knew, therefore, that the Plaintiff and Class Members were relying upon them for the safe-keeping and non-disclosure of the communicated Personal Information and the reliance was detrimental to the Class because of the loss of the portable hard drive and the associated disclosure of the Personal Information. C) VIOLATION OF PRIVACY LEGISLATION 31. The Defendants are liable for the damages suffered by the Plaintiff and Class Members resulting from loss and disclosure of their Personal Information. Such disclosure constituted an infringement of their privacy as contemplated by the Privacy Act, RSS 1978, c P-24 ("Privacy Act"), and similar applicable legislation in other Canadian jurisdictions. 32. The Plaintiff and Class Members specifically rely upon the Privacy Act and similar legislation across Canada, including: a. Freedom of Information and Protection of Privacy Act, RSO, 1990, c F.31; b. Freedom ofinformation and Protection of Privacy Act, RSPEI, 1988, c F-15.01; c. Freedom of Information and Protection of Privacy Act, RSA 2000 c F-25; d. Freedom of Information and Protection of Privacy Act, SNS, 1993, c 5; e. Privacy Act, RSBC, 1996 c 373; f. Privacy Act, RSC, 1985, c P-21; g. Privacy Act, RSNL, 1990, c P-22; h. Right to Information and Protection of Privacy Act, SNB, 2009, c R-1 0.6; and -8-

9 i. The Privacy Act, CCSM, c P-125; 33. The Plaintiff and Class Members further rely upon The Personal Information and Electronic Documents Act, SC 2000, c 5 ("PIPEDA") generally, and, without limiting the generality of the foregoing, Division 1 of Part 1 of PIPED A and Schedule 1 to PIPED A and specifically that: a) The Defendants breached Article 4.5 of Schedule 1 by retaining Personal Information longer than required for its purposes; b) The Defendants breached Article 4. 7 of Schedule 1 in failing to safeguard the Plaintiff and Class Members' Personal Information. D) BREACH OF CONTRACT 34. The Defendants monitor and operate student loan program(s) and services for the Plaintiff and Class. As part of this program, the Defendants entered into a contractual relationship with the Plaintiff and Class Members. 35. An express and implied term of the contract between the Defendant and the Plaintiff and Class Members was that Personal Information provided by the Plaintiff and Class Members would not be disclosed to third parties without consent. Accordingly, the Defendants were under a contractual obligation to maintain the personal nature of Personal Information communicated by the Plaintiff and Class Members. 36. It was the foreseeable result of the contravention of the agreement that the release of Personal Information could and would cause damages to the Plaintiff and Class Members. Therefore, the Defendants breached their contractual obligation to the Plaintiff and Class Members to preserve the secrecy and personal nature of their Personal Information. E) BREACH OF STATUTORY DUTY 37. The Defendants failed to adhere to the requirements of, inter alia, the enabling statute of HRSDC, the Department of Human Resources and Skills Development Act, SC 2005, c 34-9-

10 ("HRSDC Act"), which requires, at section 32, that Personal Information collected by HRSDC is privileged and should not be made available except as permitted by the HRSDC Act. The Privacy Breach therefore amounts to a breach of statutory duty by the Defendants. 38. The Defendants' clear lack of adherence to any internal security policies that may have been put in place endangered the personal, financial, and privacy interests of the Plaintiff and Class Members and thus constitutes deliberate, unlawful conduct in the exercise of public functions. The Defendants have inflicted psychological stress, inconvenience, and other harm upon the Plaintiff and Class Members as a result of the loss or misplacement of their Personal Information. 39. The Defendants were aware not only that this conduct was unlawful, but also that it had the potential to injure the Plaintiff and Class Members. The failure to develop or adhere to adequate security policies and practices constituted deliberate behaviour that was inconsistent with the obligations of a public office and demonstrates a conscious disregard for the personal, financial and privacy interests of the Plaintiff and Class Members. F) BREACH OF THE CANADIAN CHARTER OF RIGHTS AND FREEDOMS 40. The loss of Personal Information of the Plaintiff and Class Members by the Defendants was a clear breach of the reasonable expectation of privacy guaranteed to the Plaintiff and Class Members under section 7 of the Canadian Charter of Rights and Freedom/. 41. The loss of Personal Information of the Plaintiff and Class Members by the Defendants has had a serious and profound effect on the psychological integrity of same. There is no justification, legal or otherwise, for the loss of Personal Information of the Plaintiff and Class Members by the Defendants. 1 The Constitution Act, 1982, Schedule B to the Canada Act 1982 (UK), 1982, c

11 SUITABILITY OF CLASS PROCEEDINGS 42. There are questions of law and fact that are common to the Class Members which predominate over questions affecting only individual Class Members. These common questions include: a) Was there a duty of care owed by the Defendants to the Plaintiff and Class Members? b) Did the Defendants breach that duty of care? c) Did the Defendants commit a breach of confidence? d) Did the Defendants violate The Privacy Act, the PIPEDA, or other similar privacy or consumer protection legislation in Canada? e) Did the Defendants violate government standards or similar industry standards that govern the safe storage of Personal Information? f) Did the Plaintiff and Class Members sustain damages and, if so, what is the appropriate measure for damages? g) Are punitive damages appropriate? 43. The Plaintiff is committed to prosecuting the claim and has retained competent counsel experienced in class action litigation. The Plaintiff's claim is typical of the claims of other Class Members and on the common issues the Plaintiff has no interest which is in conflict with other Class Members. The Plaintiff will fairly and adequately protect the interests of the Class. 44. A class action is an appropriate method for the fair and efficient adjudication of the issues as well as achieving fairness and justice without overburdening the Court system with a multiplicity of individual claims. The prosecution of separate actions would create the risk of conflicting decisions on the same facts and issues. 45. All of the Class Members have in common that they suffered a loss as a result of the Defendants' failure to protect their Personal Information. Members of the Class are so -11-

12 numerous that joinder of individual claims in a single action is not practical. Each Class Member should be readily identifiable from information and records available from the Defendants. Additionally, because the damages suffered by individual members of the Class may in some circumstances be relatively small, the expense and burden of individual litigation make it impossible for such Class Members individually to address the wrongs done to them. 46. Accordingly, a class action is an appropriate method and is superior to other available methods for the fair and efficient adjudication of the issues and achieving fairness and justice without over burdening the Court system with a multiplicity of individual claims. 47. The Class is so numerous that joinder of all members is impractical. The Plaintiff's counsel has been contacted by thousands of individuals who belong to the proposed Class. The identities of the Class Members will be easily ascertained using the Defendants' records. As such, a class action is the most efficient and economic method of proceeding. Once the identity of all Class Members is known, they can be notified of the loss of their Personal Information and the commencement of this class action through a mass mail out and through advertisement in newspapers and magazines and such other channels for providing notice as this Honourable Court may require. The result of Court supervised notice will be that all affected parties will be informed of the potential financial risks that they face and the potential remedies. DAMAGES 48. The Plaintiff and Class Members have suffered significant loss and damage including emotional harm and injury to their economic interests, all of which were foreseeable damage directly resulting from the loss of their Personal Information by the Defendants. 49. As a result of the Defendants' acts and omissions as aforesaid, the Plaintiff and Class Members are potentially exposed to theft or misuse of their identity, theft from their bank and other financial accounts, and theft from credit card accounts. -12-

13 50. As a result of the Defendants' acts and omissions as aforesaid, the Plaintiff and Class Members have suffered harm for which they claim damages. They have suffered and will continue to suffer serious injuries including emotional trauma from the stress of fearing or knowing that unauthorized persons may have their Personal Information. Further, the Plaintiff and Class Members' pecuniary losses and expenses are ongoing, and potentially include, inter alia: a. loss from their bank accounts as a result of the loss of their social insurance numbers; b. loss from their credit card accounts; c. loss of otherwise employable time spent consulting with counsel, with credit professionals, or with other individuals relevant to the loss of the portable hard drive, with resultant financial loss; d. funds directly or indirectly expended in furtherance of gathering information about the loss of Personal Information, such as that spent on long-distance telephone charges, or postage; or e. funds directly or indirectly expended in the course of protecting personal information, as a result of the loss of security of same by the Defendants, such as fees incurred changing credit cards, changing personal identifiers (such as social insurance numbers), monitoring bank accounts and credit card statements and other preventative measures. 51. Pursuant to the common law, the PIPEDA, the Privacy Act, and privacy legislation across Canada, the Defendants are liable to pay damages to the Plaintiff and Class Members. The nature and degree of the Plaintiff's and Class Members' privacy entitlement is circumscribed by what is "reasonable in the circumstances" and liability may be found against the Defendant even if the Defendant did not act willfully. 52. Further, or in the alternative, the conduct and actions ofthe Defendants were improper and unlawful, and the Defendants knew in the circumstances that their conduct and actions would cause economic injury to the Plaintiff and Class members, and the Defendants are therefore liable to the Plaintiff and the Class members. -13-

14 53. Further, or in the alternative, the conduct and actions ofthe Defendants were unlawful and improper, and intended to cause harm and economic loss to the Plaintiff and other Class Members, and constitutes tortuous interference with the economic interests of the Plaintiff and Class Members, rendering the Defendants liable to pay resulting damages. CAUSATION 54. The acts, omissions, wrong doings, and breaches of legal duties and obligations of the Defendants have caused or materially contributed to the Plaintiff and Class Members suffering injury, economic loss, and damages. 55. The Plaintiff and Class Members have suffered real and substantial injury, economic loss, and damages arising from the aforesaid acts, omissions, wrong doings, and breaches of legal duties and obligations of the Defendants, and are therefore entitled to the relief sought and judgment against the Defendants. AGGRAVATED, PUNITIVE, AND EXEMPLARY DAMAGES 56. The Defendants have demonstrated and taken a cavalier and arbitrary approach with respect to their obligations to the Class Members. At all material times, the conduct of the Defendants as set forth above was willful, wanton, and in a reckless manner. 57. The Defendants acted in a cavalier manner regarding Personal Information of the Plaintiff and Class Members. In government actors of the size and expected responsibility of the Defendants who have acted in a cavalier manner notwithstanding the knowledge they ought to have had about the risk and incidence of loss of Personal Information, the only means to impress upon the Defendants and others like them the importance of proper care in dealing with Personal Information is through a significant award of exemplary damages. 58. The Defendants knew or ought to have known of the recent Canadian history of the loss of Personal Information by government actors, these incidents having received broad media -14-

15 attention. Specifically, the Defendant, HRSDC, lost a USB key containing Personal Information of over 5,000 Canadians in late Even in the face of a series of public losses of Personal Information, the Defendants nonetheless acted in the cavalier manner which resulted in the loss of the unencrypted portable hard drive and the Plaintiff's and Class Members' Personal Information. 59. The Defendants achieve a huge financial advantage by the centralized storage of information and as here the back up storage. The back up was to permit an unnecessary research project - it was not even for a purpose related to providing a service to the 583,000 Class Members put at risk. In circumstances where huge savings result from centralized computer savings, society has the right to demand that a small portion of those savings be put into appropriate security. But repeatedly the Defendants and other large Canadian actors have acted in a cavalier way with Personal Information entrusted to them rather than spending the appropriate, but still modest sums in relation to the savings, to reasonably protect again the loss of computer storage units. 60. In this circumstance, only a significant award of exemplary damages by this Honourable Court will make the point to the Defendants and others like them that appropriate care must be taken when dealing with Personal Information of Canadians. 61. The Defendants' aforesaid acts, omissions, wrong doings, and breaches oflegal duties and obligations constitute unfair government practices and dealings with debtors and the public. 62. As a result of the aforesaid acts, omissions, wrong doings, and breaches of legal duties and obligations by the Defendants, the Plaintiff and Class Members have sustained substantial injury, economic loss and damages, and are entitled to awards of aggravated, punitive, and exemplary damages

16 GENERAL f Privacy Act, RSC, 1985, c P-21; g. Privacy Act, RSNL, 1990, c P-22; h. Right to Information and Protection of Privacy Act, SNB, 2009, c R-1 0.6; and i. The Privacy Act, CCSM, c P-125; 64. The Plaintiff also specifically relies on the doctrine of res ipsa loquitur and vicarious liability as it relates to the liability of the Defendants. 65. If issue is taken with service of documents upon any Defendant, the Plaintiff seeks leave to have service on any of the Defendants' affiliates, predecessors, associated or related governmental agencies and entities be accepted as valid service against all Defendants. 66. The Plaintiff, as representative of the class of persons, corporations, and entities resident or situated in Saskatchewan, and a subclass of persons, corporations, and entities not resident or situated in the Province of Saskatchewan, but resident or situated in another Canadian province or territory, have suffered injury, economic loss, and damages as a result of the Defendants' acts, omissions, wrong doings, and breaches of legal duties and obligations, included but not limited to: deceit, misrepresentation, negligence, intentional and negligent misrepresentation, misleading and misinforming the Class Members and members of the public, failure to make proper public disclosure, and failure to fulfill their statutory and common law duties and obligations to the Plaintiff and the Class Members. The Plaintiff 63. The Plaintiff relies upon The Class Actions Act, the Pre-judgment Interest Act, SS , c P-22.2, PIPEDA, the Privacy Act, and similar privacy legislation across Canada, including: a. Freedom of Information and Protection of Privacy Act, RSO, 1990, c F.31; b. Freedom of Information and Protection of Privacy Act, RSPEI, 1988, c F-15.01; c. Freedom of Information and Protection of Privacy Act, RSA 2000 c F-25; d. Freedom of Information and Protection of Privacy Act, SNS, 1993, c 5; e. Privacy Act, RSBC, 1996 c 373; -16-

17 therefore claims, on behalf of himself and all Class Members, for the following relief against the Defendants, on a joint and several basis: a) An Order to certify this proceeding as a class proceeding and an order appointing a Representative Plaintiff of the Class (and any subclasses), as described herein; b) General and special damages for members of the Class in an amount to be determined at trial; c) General and pecuniary damages for negligence; d) General and pecuniary damages for breach of confidence or tort; e) General and pecuniary damages for violation of privacy; f) Damages for unjust enrichment or other equitable relief, g) Exemplary, aggravated, and punitive damages; h) Pre-judgment interest on the foregoing sums in accordance with the Prejudgment Interest Act SS , c P-22.2 and regulations thereto or, alternatively, in such other amounts that this Honourable Court may allow; and i) Such further and other relief as counsel may advise and this Honourable Court may allow. Dated at the City of Regina, in the Province of Saskatchewan, this 21st day of January, This document prepared by: MERCHANT LAW GROUP LLP Saskatchewan Dr. Regina, SK S4P 1H8 Telephone: (306) Facsimile: (306) Attention: E. F. Anthony Merchant, Q. C. MERCHANT LAW GROUP LLP Per: Counsel for the Plaintiff -17-