In many privacy class actions, the corporate defendant is the victim of a data breach – either internal or external – and there is some other wrongdoer that caused or contributed to the alleged harm. To the extent that the corporate defendant intends to make a claim against the wrongdoer, through either a third party claim or a separate action, these issues should be dealt with in a timely way, and within any prescribed time period.
The B.C. Supreme Court’s recent decision in Ari v Insurance Corporation of British Columbia (2020 BCSC 1087) is an important reminder of this. This an ongoing class action that has already raised various issues in the privacy class action context, including issues of vicarious liability and class definition.
This most recent decision addresses when a defendant in a class proceeding (i) will be able to add a third party to that proceeding; and (ii) will be able to succeed on a motion to have a separate claim against such third parties heard together with an ongoing class proceeding. These are important procedural and strategic issues to consider in any class proceeding and particularly in privacy cases, where there is so often a third party wrongdoer.
Background
This case involves a class action against an insurance company (the “Insurer”) alleging breach of privacy (the “Class Action”) resulting from the conduct of a former employee of the Insurer who accessed and sold the personal information of seventy-eight of the Insurer’s customers to others who facilitated arson, shooting and vandalism attacks on the homes of thirteen of the customers.
Six years after the Class Action was started, and following certification, the Insurer issued a third party notice against the former employee and vandals, seeking contribution and indemnity (the “Third Party Notice”). The allegations in the Third Party Notice were the same as those in a separate action by the Insurer against the same defendants that was commenced five years after the commencement of the Class Action and five days before the certification hearing began (the “Insurer Action”).
The plaintiff and one of the other named third parties applied for a declaration that the Third Party Notice was a nullity because it was filed out of time and without the leave of the Court as required by the Supreme Court Civil Rules (the “Rules”). The Insurer in turn applied for either leave to file the Third Party Notice nunc pro tunc (“now for then”) or an order that the Insurer Action be heard at the same time as the Class Action. The Insurer claimed that evidence from the third parties would be necessary in the Class Action, and that duplicate proceedings should be avoided.
The decision: the third party notice
First, the court held that the Third Party Notice was out of time. The Insurer filed its third-party notice without leave six years after the Class Action was started. This was clearly outside the 42-day period for filing third part notices set out in Rule 3-5 of the Rules. The Third Party Notice was therefore a nullity.
The court also dismissed the Insurer’s application for leave to file the Third Party Notice nunc pro tunc. Although the court has discretion to grant leave to file the notice nunc pro tunc, it did not. The question of whether a class proceeding should include third party claims should normally be raised at or before certification, particularly because the presence of third party claims may be relevant to the question of whether a class proceeding is the preferable procedure, and may require the court to identify additional or common issues. The court acknowledged that in some exceptional circumstances, a third party claim might only become apparent after certification. However, that was not the case here. The Insurer had been aware of the role of the third parties and had filed a separate action against them.
The court also found that the Third Party Notice was an abuse of process. In the Third Party Notice, the Insurer was seeking the same relief for the same alleged wrongs as in the Insurer Action.
The decision: consolidation with the Insurer Action
Secondly, the court dismissed the Insurer’s application to have the Class Action and the Insurer Action be heard at the same time.
The Insurer argued that the two actions should be tried together because the evidence of the former employee and other third parties would be before the court on the Class Action, and the court could make findings of fact against them that would prejudice them in defending the Insurer’s claim. Further, the Insurer argued that an essential element of one of the common issues (whether the former employee breached the class members’ privacy pursuant to BC’s Privacy Act when she accessed the class members’ personal information wilfully and without a claim of right from the Insurer’s database) was that the information was accessed “without a claim of right”. The Insurer argued that the plaintiff in the Class Action would have to call evidence from the former employee to show that she accessed and used the information outside her employment context. In order to establish that the private information that left the Insurer was connected to the property damage, the plaintiff would also need to prove that the information was delivered to and shared amongst the third parties.
However, the court held that the Insurer’s submissions were inconsistent with its own pleadings. The Insurer had admitted that the former employee had accessed the personal information of class members without a claim of right, that she had shared the information with the other third parties, and that the information was used to attack the homes of subclass members. As result of these admissions, the court rejected the Insurer’s argument – the plaintiff would not have to prove the facts admitted to by the Insurer.
The court ultimately held that the trial of common issues would determine whether the former employee’s conduct, which the Insurer had admitted for the purpose of the Class Action, constituted a breach of class members’ privacy, whether the Insurer was vicariously liable for the conduct, and whether the class members were entitled to damages. It was therefore not necessary, just or convenient for the issues raised by the Third Party Notice to be litigated with the common issues in the Class Action.
Takeaways for business
The court’s decision offers important lessons for when and how the defendant in class proceedings should assert claims against third parties. These issues are particularly important in privacy claims where there is often some third party wrongdoer.
A defendant seeking to assert a claim against a third party should consider its strategy at the outset, including whether to proceed by way of a third party claim or separate action. This might require taking steps to identify all of the wrongdoers. Under Rule 29.02 the Ontario Rules of Civil Procedure, a third party claim shall be issued ten days after the defendant delivers a statement of defence, or at any time before the defendant is noted in default,. This may lead to different timing considerations than in B.C. However, developing and carrying out a strategy at the outset will avoid any arguments about delay and the potential of making arguments that are inconsistent with prior admissions, both of which caused the defendant to lose its application in this case.
For more information about Denton’s data expertise and how we can help, please see our Transformative Technologies and Data Strategy page and our unique Dentons Data suite of data solutions for every business, including enterprise privacy audits, privacy program reviews and implementation, and training in respect of personal information.
