|
Torts - Infringement of Privacy (3). Del Giudice v. Thompson
In Del Giudice v. Thompson (Ont CA, 2023) the Court of Appeal considered whether various causes of action emanating from data hacking were made out, here in determining whether causes of action where pleaded in class certification purposes.
In these quotes the court considered Jones v Tsige 'intrusion upon seclusion':i. Intrusion upon seclusion
[31] The appellants advance a claim of intrusion upon seclusion against Ms. Thompson, Capital One, and Amazon Web. The elements of this cause of action were set out in Jones v. Tsige, 2012 ONCA 32, 108 O.R. (3d) 241, at para. 71, and recently reiterated in the trilogy of Owsianik v. Equifax Canada Co., 2022 ONCA 813, 164 O.R. (3d) 497, at para. 54; Obodo v. TransUnion of Canada, Inc., 2022 ONCA 814, 164 O.R. (3d) 520, at paras. 22-23; and Winder v. Marriot International, Inc., 2022 ONCA 815, 164 O.R. (3d) 528, at paras. 20‑21:(i) The defendant without lawful justification intrudes physically or otherwise into the seclusion of the plaintiff in his or other private affairs or concerns;
(ii) The defendant’s intrusion is intentional or reckless; and
(iii) The invasion would be highly offensive, causing distress, humiliation or anguish to a reasonable person. [32] The motion judge found it plain and obvious that there is no viable claim for intrusion upon seclusion against either Capital One or Amazon Web. He reasoned that:1. the failure to prevent the intrusion by Thompson could not itself be an intrusion;
2. even if the failures of Capital One or Amazon Web to prevent an intrusion could be considered an intrusion, then the intrusion was authorized by the terms of the application form, credit agreement, and privacy policy, which were incorporated by reference into the pleading;
3. the alleged misconduct of Capital One and Amazon Web was neither intentional nor reckless; and
4. Capital One and Amazon Web’s alleged mistakes in safeguarding the appellants’ data did not give rise to the requisite degree of offense. [33] After the motion was decided, this court released its judgments in Owsianik, Obodo, and Winder, which established that a hack of a database by a third party does not constitute intrusion upon seclusion by the database operator. That disposes of the question that was before the motion judge.
[34] However, the appellants now seek to distinguish the trilogy on the basis that their claim is not based in negligent custodianship, but concerns the improper retention and misuse of data, which includes its improper aggregation and ultimate migration to a third-party platform.
[35] Regardless, the claim cannot succeed. Some of the flaws identified by the motion judge are easily transposed onto the new argument. One in particular is dispositive. Whether the alleged misdeeds of Capital One and Amazon are characterized as mistakes in safeguarding information or improper retention and misuse of that information, neither characterization satisfies a key element of intrusion on seclusion: that the conduct be of a highly offensive nature causing distress, humiliation, or anguish to a reasonable person. In the specific circumstances of this case, the aggregation and sale of the financial information obtained by Capital One – even on the generous assumption that the appellants could succeed on the argument that they did not consent to its use – is not highly offensive and could not be considered humiliating by a reasonable person. Unlike genuine intrusion claims, there is nothing into which the Capital One can be said to have intruded. It solicited information and that information was given. The data was aggregated and inputted into algorithms to be used for marketing purposes. Nowhere, in any of this, is anything of an individual’s biographical core exposed to public or private view. No individual is placed in a spotlight. Whatever may be objectionable with what Capital One did, it is not aptly described as an intrusion into seclusion.
|
