Peoples Trust Data Breach Allegedly Impacted Thousands of Canadians

The Court of Appeal for British Columbia has ruled that a class action lawsuit accusing Peoples Trust Company of failing to safeguard user data prior to a 2013 data breach can proceed to trial.

In a judgment released Sept. 4, the appeals court ruled that the plaintiffs had properly pleaded a cause of action in contract and negligence, but not breach of confidence. This decision upholds a lower court decision that certified the Peoples Trust data breach class action lawsuit.

Appeals Court Notes B.C. Courts Don’t Recognize Certain Privacy Torts

The judge found that breach of privacy and intrusion upon seclusion are legal principles not currently recognized under British Columbia law, but that these legal claims could potentially be pursued under federal common law.

The tort of intrusion upon seclusion is a principle governing invasion of privacy, a civil wrong first recognized in 2012 by an Ontario court.

The Peoples Trust class action lawsuit Canada originally included allegations of breach of privacy and intrusion upon seclusion, but those claims were removed by the British Columbia lower court judge. The plaintiff did not appeal the removal of these privacy claims.

“It is, in some ways, unfortunate that no appeal has been taken,” Justice Harvey Groberman wrote in his order. “In my view, the time may well have come for this Court to revisit its jurisprudence on the tort of breach of privacy.”

Justice Groberman continues: “It may be that in a bygone era, a legal claim to privacy could be seen as an unnecessary concession to those who were reclusive or overly sensitive to publicity, though I doubt that that was ever an accurate reflection of reality.”

“Today, personal data has assumed a critical role in people’s lives, and a failure to recognize at least some limited tort of breach of privacy may be seen by some to be anachronistic.”

Peoples Trust Failed to Safeguard User Data, Class Action Says

According to the Peoples Trust data breach class action lawsuit, the company failed to install certain software updates and apply patches on the server which held its database, creating security vulnerabilities that were reportedly exploited by cybercriminals operating out of China.

Peoples Trust’s failure to implement proper security measures led to the unencrypted data of 12,000 customers being stolen, according to the data breach class action lawsuit.

The compromised information reportedly included names, addresses, email addresses, birthdates, phone numbers, social insurance numbers, and occupations. Credit card applicants also reportedly had their mothers’ birth names copied, according to the Peoples Trust data breach class action lawsuit.

Upon becoming aware of the data breach, Peoples Trust reportedly made a timely report to the federal Privacy Commissioner’s Office and notified those affected as required under the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

The Privacy Commissioner’s Office reportedly noted numerous deficiencies in Peoples Trust’s privacy protection. Upon the completion of its investigation, these deficiencies were reportedly resolved and Peoples Trust reportedly implemented measures designed to adequately safeguard user data.

Peoples Trust had asked the appeals court to dismiss the data breach class action lawsuit Canada, claiming it cannot be held liable for the data breach because its website included a limited liability clause notifying users: “Your use of this Website is at your own risk.”

Although Peoples Trust has experienced a setback from this most recent court ruling, the company could still appeal the case to the Supreme Court of Canada.

Peoples Trust has recently settled a $17 million class action lawsuit accusing it of improperly taking fees from Vanilla Prepaid Visa Cards.

Canada Privacy Law

Saskatchewan privacy lawyer David Krebs told IT World Canada that this appeals court decision has caught his attention.

“It’s a signal that Candian privacy law is moving in a certain direction, that a common law tort of privacy is here to stay,” Krebs said. “This is another indication that intrusion upon seclusion tort exists in Canada.”

Teresa Scassa, a University of Ottawa law professor, pointed out that the appeals court had dismissed Peoples Trust’s argument that consumers cannot sue under civil law because the Personal Information Protection and Privacy Act, a federal law that applies to federally-regulated Peoples Trust, provides consumers with a mechanism with which to resolve their complaints.

Scassa says that “it’s interesting that an appellate court says (PIPEDA) is not a complete code, it doesn’t preclude other avenues of recourse,” such as claims of negligence.

She also notes that most data breach class action lawsuits have been settled out of court, meaning there is very little legal precedent for such claims.

What do you think about the Peoples Trust data breach? Should the company be held responsible for not implementing measures designed to adequately safeguard user data before the investigation? Tell us your thoughts in the comment section below! 

The Peoples Trust Data Breach Class Action Lawsuit is Gianluca Tucci, et al. v. Peoples Trust Company, Case No. CA44714, in the Court of Appeal for British Columbia, Canada. 

Read More Lawsuit & Settlement News:

Indigenous Lawyer Files Lawsuit Against Firm Representing Indian Day School Survivors

Google Allegedly Collects and Sells Users’ Personal Data

Pandemic Business Interruption Insurance Canada Potential Lawsuit

Long-Term Disability Lawyer | Insurance Claim Denial Help