Certification Denied in Privacy Breach Proposed Class Action: No Intent, Just Human Error

March 15, 2025 | Soudeh Hosseini

OVERVIEW

In Quantz v. Ontario2025 ONSC 90, the Ontario Superior Court of Justice denied a motion for certification of a proposed class action against the Ministry of Children, Community and Social Services (the “Ministry”) following a privacy breach involving the Ontario Disability Support Program (“ODSP”).

The action arose from an incident in which a Ministry caseworker mistakenly sent an email to 103 ODSP clients, attaching a spreadsheet that contained the names, email addresses, and ODSP identification numbers of approximately 45,000 recipients.[1] The plaintiff asserted that this disclosure stigmatized ODSP beneficiaries and created a latent risk of unauthorized access to their case files, which contained sensitive medical and financial information.[2] The defendant conceded that the email was sent in error but argued that there was no willful intent and that no actionable harm resulted from the disclosure.[3]

The plaintiff sought to certify the proposed class action on the basis of four causes of action: intrusion upon seclusion, negligence, breach of confidence, and public disclosure of private facts.[4] The court proceeded to assess whether the plaintiff had pleaded a viable cause of action to meet the requirement under section 5(1)(a) of the Class Proceedings Act, 1992SO 1992, c 6 (“CPA”).

NO REASONABLE CAUSE OF ACTION

The motion judge held that the plaintiff’s amended statement of claim failed to disclose a reasonable cause of action. The motion judge found it was plain and obvious that none of the four pleaded causes of action were viable based on the pleaded facts.[5]  This article recaps the court’s assessment of the four causes of action and its “air of reality” analysis.

INTRUSION UPON SECLUSION

The court held that intrusion is unauthorized access by an outsider or rogue insider.[6] Here, the facts as pleaded showed that the caseworker acted within her authority, albeit mistakenly, and neither she nor the mistaken recipients could be construed as intruders.[7] Furthermore, citing Owsianik v. Equifax2022 ONCA 813, the court reiterated that careless data management alone does not meet the threshold for intrusion upon seclusion.[8] The court clarified that “the conscious or willful act of attaching the spreadsheet was not the tortious act”, and determined that the pleading did not support the notion that the email was sent consciously or wilfully to expose private information.[9]

NEGLIGENCE

The plaintiff alleged he and other putative class members suffered damages including stigma, psychological harms, and exposure to fraud and identity theft.[10] However, the court found the first two lacked credibility, noting that the plaintiff had publicly joked about the incident.[11] The court stated that psychological harm must be substantive and prolonged.[12] Non-physical harm must surpass momentary distress and since no real psychological disorder was pleaded, the damages were not adequately established.[13]

The court also stated that exposure to fraud and identity theft were speculative and insufficient to ground a negligence claim.[14]

BREACH OF CONFIDENCE

The court agreed that confidentiality was technically compromised, but there was no indication that the recipients of the spreadsheet accessed, shared, or used the information in any way that caused detriment to the ODSP clients.[15] The plaintiff had not pleaded self-dealing by the Ministry or any intention to act to the plaintiff’s detriment.[16] The court held that what was pleaded could only be read as a mistake that did not provide the sender with any benefit.[17]

PUBLIC DISCLOSURE OF PRIVATE FACTS

Intentionality and publicity are key features of this tort, which typically arises in cases where a former partner deliberately exposes and disseminates intimate images of the plaintiff to the world via the internet.[18]

The court stated that the inadvertent sharing of the spreadsheet with a limited group within the ODSP program did not constitute sharing with the “world at large”.[19] The court added that the amended statement of claim did not allege dissemination beyond this limited group.[20]

The court noted that the plaintiff described intention objectively – focusing on what the employee ought to have known – rather than addressing the employee's subjective state of mind.[21] Therefore, the court concluded that the incident lacked the widespread publicity, intentionality, and severity required to engage the tort.[22]  

“AIR OF REALITY” ANALYSIS AND THE COURT'S GATEKEEPING FUNCTION

The court explained that s. 5(1) of the CPA serves as a screening tool to decide if the claim is viable on the facts or, to state it simply, has an “air of reality”.[23] It determined that the pleaded facts could not realistically establish or support a version of events where the caseworker had adverted her mind to the improper disclosure.[24] Given the absence of this fundamental aspect of the intentional torts pleaded (except negligence) and that the damages had been left to be addressed at trial, the court found it appropriate to deny certification.[25]

KEY TAKEAWAYS

The court found that the intentional element essential to three of the torts (intrusion upon seclusion, breach of confidence, and public disclosure of private facts) was absent on the pleaded facts. The plaintiff would have needed to plead that the caseworker consciously intended or turned her mind to the improper dissemination of sensitive information. Rather, when viewed realistically, the incident amounted to nothing more than “human error”, not the kind of deliberate wrongdoing the pleaded torts are meant to address.[26]

Moving forward, plaintiffs in proposed privacy class actions are cautioned that deliberate misconduct or recklessness by the defendant must be specifically pleaded to sustain an intentional tort claim.

 


[1] Quantz v. Ontario, 2025 ONSC 90, at para 4.

[2] Quantz v. Ontario, at para 6.

[3] Quantz v. Ontario, at para 8.

[4] Quantz v. Ontario, at para 7.

[5] Quantz v. Ontario, at paras 577391104.

[6] Quantz v. Ontario, at para 51.

[7] Quantz v. Ontario, at para 53.

[8] Quantz v. Ontario, at para 44.

[9] Quantz v. Ontario, at para 45.

[10] Quantz v. Ontario, at para 59.

[11] Quantz v. Ontario, at para 60.

[12] Quantz v. Ontario, at paras 6264.

[13] Quantz v. Ontario, at paras 6265.

[14] Quantz v. Ontario, at paras 68-70.

[15] Quantz v. Ontario, at paras 7577-7884.

[16] Quantz v. Ontario, at para 90.

[17] Quantz v. Ontario, at para 90.

[18] Quantz v. Ontario, at para 93-94.

[19] Quantz v. Ontario, at paras 9496-97.

[20] Quantz v. Ontario, at para 97.

[21] Quantz v. Ontario, at paras 98-101.

[22] Quantz v. Ontario, at para 103.

[23] Quantz v. Ontario, at paras 106-108.

[24] Quantz v. Ontario, at para 112.

[25] Quantz v. Ontario, at para 112.

[26] Quantz v. Ontario, at para 114.

Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.