This privacy class action resulted from a data breach by cybercriminals. In September 2013, the cybercriminals accessed the Defendant’s system, which contained personal information of customers and prospective customers.[1] The action, with an approximate class size of 12,000 people, was certified in August 2017 and included a claim in negligence.[2]
The Defendants sought to have the class action dismissed for want of prosecution, arguing that the Plaintiffs took insufficient steps to advance the litigation. The Defendants also sought to have the claim struck or decertified, asserting that the Plaintiffs failed to plead a type of loss capable of grounding a claim in negligence.
Neither of the Defendant’s applications were successful. This case offers important insight into the development of negligence law in the context of privacy breaches. The Court’s conclusions indicate that negligence claims may proceed in the absence of present loss. The Court signalled that the theft of sensitive, personal information may sufficiently qualify as an “injury to the person or property damage” for a claim in negligence.
Please log in to read the full article.