It is proving difficult for plaintiffs to get a data breach class action certified in Quebec.
The latest attempt in Li c. Equifax inc., 2019 QCCS 4340 fell flat. The Quebec Superior Court refused to certify a class action arising out of the Equifax data breach. The court found that the proposed representative plaintiff failed to meet the low bar for certification because he did not suffer any compensible damage and the foundation for punitive damages was not made out.
On the issue of compensible damage, the court found that Li had not suffered any economic harm from the breach. There was the theoretical possibility he might suffer losses in the future, but these losses were hypothetical and speculative. As to the mental suffering alleged by Li, the court followed previous jurisprudence in Quebec in which the court has said that the effects of the breach are ordinary inconveniences, anxieties and fears that every person living in society must regularly accept.
On the issue of punitive damages, the court found that the Li failed to plead sufficient facts to establish a claim for punitive damages. Li needed to plead that Equifax’s conduct was intentional or reckless in order to justify punitive damages. However, Li did not make those allegations.
This case is yet another in a line of cases in Quebec in which plaintiffs are being met with resistance to certification. Earlier this year, the Quebec court also refused to certify a class action in Bourbonnière c. Yahoo! Inc., 2019 QCCS 2624 for similar reasons. Previously, the Quebec Court of Appeal came to the same conclusion in the context of a case arising out of the loss of a laptop containing personal information in Sofio c. Investment Industry Regulatory Organization of Canada (IIROC), 2015 QCCA 1820.