Setoguchi v Uber B.V., 2021 ABQB 18

Court of Queen’s Bench of Alberta Citation: Setoguchi v Uber B.V., 2021 ABQB 18 Date: 20210108 Docket: 1701 16003 Registry: Calgary Between: Dione Setoguchi Plaintiff - and - Uber B.V., Rasier Operations B.V., Uber Canada Inc. and Uber Technologies Inc. Defendants _______________________________________________________ Reasons for Decision of the Associate Chief Justice J.D. Rooke _______________________________________________________ I.

Introduction and Overview [ 1 ] The proposed representative plaintiff, Dione Setoguchi (Setoguchi), and members of the proposed national [1] class, were users of or drivers for the online transportation services provided by the Defendants (collectively, Uber). This proposed class proceeding flows from a hacking, by third parties or “unauthorized external actors” (Hackers [2] ), of Uber’s storage of class members [3] personal

information (PI)[4] or personal data (PD) (collectively Personal Data (PD)), in 2016 (2016 Hack). Setoguchi argues that Uber failed in its“contract, common law and statutory obligations to protect the personal [data] ... and [to] ensure it is not accessed by unauthorizedparties”, seeking personal and punitive damages as a result. [2] The real issue in this case is whether, assuming otherwise provable causes of action liability (contract, negligence, breach ofstatute, etc.), and compliance with the requirements for certification under s. 5(1) and (2) of the Class Proceedings Act, SA 2003, c.

C-16.5 (Act), there must be, and is, “some evidence” of or “some basis in fact”[5] for any real resulting common harm, loss or damage[6]from the alleged common law or statutory breaches.

In relation to negligence, Counsel for Uber explained it this way (TR20-85/30-38),relating to the characterization by Counsel for Setoguchi that: … breach of the standard of care equals liability without any consequent loss. [However]… no common issues can be certified becauseif that element of consequent harm is not present, the tort cannot be made out for any individual, much less for the class as a whole. [3] Uber argues (TR21 – 1/35-7) that there must be proof of harm or loss for a successful action in negligence, see: Mustapha v.Culligan of Canada Ltd, 2008 SCC 27 at para 3; Sun-Rype Products Ltd. v.

Archer Daniels Midland Co., 2013 SCC 58, at para 75;and discussion at TR20 – 87/14-28. The same can be said for many other statutory claims: 2038724 Ontario Ltd. v. Quizno’s CanadaRestaurant Corp., (ON SC), 2008, 89 OR (3d) 252 (OSCJ) (Quizno’s OSCJ) at para 106. [4] Setoguchi asserts that in contract there is no requirement of proof of harm, loss, or resulting damages: Costigan v. Ruzicka,1984 ABCA 234 at para. 17; Quizno’s OSCJ at para 106 (where only nominal damages were sought), as affirmed, on this point, at2038724 Ontario Ltd. v.

Quizno’s Canada Restaurant Corp., (ON SCDC), 2009, 96 OR (3d) 252, (Quizno’s CA) atpara 84; and Fanti v. Transamerica Life Canada, 2013 ONSC 2298 at para 126. [5] Uber says alternatively, absent evidence of actual loss or harm, this application for certification must be used as a“meaningful screening device”, and, with the Court exercising its “concomitant gate keeper function”, certification must be denied. Inoral argument (TR20 – 83/11 – 84/5, relying on Pro-Sys Consultants Let, v. Microsoft Corporation, 2013 SCC 57, [2013] 3 SCR 477,quoting from Hollick v.

Toronto City, 2001 SCC 68, [2001] 3 SCR 158), Counsel for Uber related this to the facts of this case. [6] To elaborate on these issues and positions, Setoguchi acknowledges (Setoguchi Brief, para 4; see, similarly, para 55) that: ... there is some uncertainty as to what exactly was accessed in the 2016 Hack, it is believed that the accessed information included atleast names, email addresses, telephone numbers, encrypted passwords, user IDs, user ratings, some geolocation information and in thecase of [Uber] drivers, driver’s licence information, driver ratings and payment statements.”[7][Emphasis Added] [7] Uber responded, in detail (Uber Brief, paras 3 - 8) that the PD: ... was primarily non-private personal information[8] - names, phone numbers and email addresses ... that is otherwise readily revealedby many people in their day-to-day participation in the world of electronic commerce.

It has been over three years since that criminal incident[9]. There is no evidence of any confirmed case of fraud, identity theft[10] orother economic loss to any Canadian as a result. ... Ms. Setoguchi’s ... PI is certainly personal, but it is not private. [Emphasis in the original]. ... Canadian Courts[11] have questioned the utility of certifying cases in the absence of evident economic losses.

Here ... the question ofwhether any Class Member has suffered a compensable (non-economic) loss is either ‘no’, or would require an individual considerationof each [class member’s] response to the breach.[12]Moreover, regulatory investigations and penalties[13] against Uber have alreadyadvanced the goal of behavioural modification[14]. Under the ‘practical cost-benefit approach’ and consider[ing] the impact of a classproceeding on Class Members, the defendants, and the court’, there is no meaningful purpose in certifying this action, which involvessuch benign[15] PI.

The role of certification as a “meaningful screening device”, and the Court’s concomitant ‘gate keeper function’, is thus as important asever in considering the utility of privacy breach class actions. [Emphasis added throughout, except where noted.] [8] Supporting reference is made by Uber to: Hollick v Toronto (City), 2001 SCC 68 at para 30; Pro-Sys at paras 103-4; andSoldier v. Canada (Attorney General), 2009 MBCA 12, at para 21. [9] Uber also referenced (TR20 – 81/31 – 82/32) Kaplan v. Casino Rama, 2019 ONSC 2025 at para 62, relying on Broutzas v.Rougage Valley Health System, 2018 ONSC 6315 and Grossman v.

Nissan Canada, 2019 ONSC 6180, to illustrate that there is nocause of action in negligence for the disclosure of non-private personal information: The scope and content of the applicable duty and standard of care depends on the sensitivity of the personal information that has beencollected. It is important to remember … that not all personal information is necessarily private or confidential: Generally speaking, there is no privacy in information in the public domain, and there is no reasonable expectation in contact information, which is in the public domain, being a private matter.

Contact information is publicly available and is routinely and readily disclosed to strangers to confirm one’s identification, age, or address.

[10] In Kaplan, Belobaba J. found, at para 6 (see Counsel for Uber’s submissions at TR20 – 86/14-33), that there was worry aboutthe hack, but, in denying certification, he found that “there is no evidence that any of [the proposed representative plaintiffs] sustainedany compensable financial loss or psychological harm as a result of the hacking episode…”.

Here, Uber urges (TR21-33/7 - 10) thatthere is no chance of loss following the Hack because the “personal information would have been in the public domain anyway”.Moreover, I find here that not only is there no evidence of harm or loss, there is evidence that there is no harm or loss. [11] Further, at para 30 of Kaplan, Belobaba J. notes that “the defendants’ failure to prevent the cyber-attack is not a ‘misuse’ ofconfidential information within the meaning of the breach of confidence tort.

So, it is doomed to fail.” [12] In Rogers v Rogers, [2005] OJ No 5287 at paras 82-3 (see also Uber’s arguments at TR21-10/3-22), Perell J. said thatinformation is not confidential if it is public knowledge and is not secret. It would therefore seem logical, based on this proposition, todeny certification. However, Uber faces two additional issues, as alluded to above. [13] First (see Hollick in reference to Taub v.

Manufacturers Life Insurance Co. (1998), (ON SC), 40 OR(3d) 379 (Gen Div)), all that Setoguchi is required to do at the certification stage is to allege a complete cause or causes of action,including alleged harm or loss resulting, as she has done. That is, even without providing any actual evidence of harm or loss, as proof ofthe allegations is deemed (for this purpose) to be established to maintain a valid cause of action, and s. 5(1)(

a) of the Class ProceedingsAct, SA 2003, c.c – 16.5 (Act) is deemed satisfied as a pre-requisite for certification, as I held in Eaton v. HMS Financial Inc. 2008ABQB 631 at para 27 (although evidence of harm was much clearer there than here). Thus, evidence to support the requirement of lossor harm, in the class proceedings context, is normally left for the common issues trial[16]. Nevertheless, and contrary to this promise, asMartin J. said, s. 5(1)(

a) has as its purpose, “to winnow out actions which are clearly frivolous or manifestly unfounded”: Kristal Inc. vNicholl & Akers, 2006 ABQB 168 at para 85. In essence I believe this is “gate keeping”, which I suggest can only be met by determiningwhether there is any evidence of harm or loss. Later, in Andriuk v. Merrill Lynch Canada Inc., 2013 ABQB 422 at para 68, she put thisinto perspective: The question is whether the pleadings disclose a supportable cause of action assuming the facts pleaded to be true....

A cause of actionwill be disclosed if the facts pleaded could possibly be considered to entitle the plaintiff to a legal remedy; conversely, if it is plain andobvious that the facts are incompatible with an entitlement to a remedy, or insufficient for that purpose so that the plaintiff has no chanceof success, then a cause of action will not be disclosed.... [Emphasis added.] Still later in Andriuk, after further analysis, Martin J. found (at para 108) that certification was not justified when lack of properpleadings combined with other missing factors, such that “… the pleadings as a whole do not provide properly detailed statements of thematerial facts to form the proper basis for these claims”. [Emphasis added.] [14] Second, as opposed to finding evidence to support the cause of action, the test for “some basis in fact” for actual loss or harmis, I find, normally (outside the gate keeping function) only relevant under class proceedings law to the common issues under s. 5(1)(c).Thus, in the alternative, if there is to be any exercise of a “meaningful screening device” or any “gate keeper function” herein, the Courtis forced to engage in the analysis of all the relevant requirements under s. 5(1) of the Act. [15] Of those factors, one is clearly established: an identifiable class of 2 or more persons – s. 5(1)(b).

Another is not really inserious issue: representative plaintiff, with a plan for proceeding and no conflicts – s. 5(1)(e).

That leaves the issues of: the substance ofthe alleged causes of action (aside from the issue of harm or loss) – s. 5(1)(a); common issues, which although I believe they aregenerally conceded, I will have some comments thereon – s. 5(1)(c); and, perhaps most important, whether a class action would be the“preferable procedure for the fair and efficient resolution of the common issues”, under s. 5(1)(d), as modified by s. 5(2) of the Act. [16] I will come back to examine these elements, but first it is necessary to further clearly delineate the background facts. II.

Background Facts [17] In October 2016 (the precise date of which is known to Uber – Setoguchi Brief, para 54), Uber was the subject of an attack byHackers, who illegally accessed electronic PD, collected and stored in the “cloud” by Uber.

Setoguchi alleges: - After accessing the PD, the Hackers made a ransom demand of Uber in 2016; - Uber was able to identify 2 Hackers (whom Setoguchi calls “cyber-criminals”); - Uber did not notify any of the class members, regulators (required under s. 10.1(3) of the PIPEDA[17], “if it is reasonable in thecircumstances to believe that the breach creates a real risk of significant harm to the individual” – similarly under s. 34.1(

a) of and thePersonal Information Protection Act, SA 2003, c P-6.5 (PIPA)), or police for over a year; instead paying the 2 Hackers $100,000, on thepromised “guarantee” that they would destroy[18] the PD, and; - The class only learned of the Hack in November 2017 after it was discovered by third parties and exposed in the media[19]. [18] Setoguchi argues (Setoguchi Brief paras 4 – 6) that there are no assurances that the information was destroyed, that the wordof the two criminals (identified at TR20-32/38-40) is not reliable, and that there is allegedly a third Hacker somewhere out there (TR20-32/3-34/4; TR20 – 58/17-59/24).

However, there is also no evidence that hacked PD was not destroyed indeed it is the contrary, as therehas apparently been none discovered in 4 years. [19] Uber referenced a similar issue in Kaplan at para 13 (substantially repeated at para 21), where certification was denied: The suggestion that additional information may have been stolen and could still be posted online by the hacker or his associates in themonths or years ahead is plausible but not persuasive.

Given the passage of two-and-one half years [here it has been over 4], … it is morelikely than not that the risks of any informational misuse from the … hacking episode are minimal to non-existent. And, if any additional

information is posted and misused in the months ahead, causing compensable monetary loss or psychological harm, [it’s at that point in time that] a class action can be commenced. In other words, there is no need to be concerned at this time about possible future claims. See also, to the same result: Beck v.

McDonald 848 F. 3d 262 (USCA Fourth Circuit) (Uber Authorities, Tab 17) at p. 12 - note also, from p. 13, that, in the US, mitigation and prophylactical (to ease fear of future harm [20] ) expenses do not qualify as harm. [ 20 ] Similarly, here, to what was noted above in Kaplan , if the hacked data is somehow found in the future, and there is any real evidence of resulting harm or damage, that would be the basis for a new cause of action – one with more substance than the mere speculation on this record [21] , and would not be a claim caught by the provisions of the Limitations Ac t, RSA 2000, c.

L - 12 , based on the discoverability principle. [ 21 ] In her Reply Brief (paras 22-3), Setoguchi argues the claim here is for current, not future harm, and that, of the Uber privacy cases in

Schedule “B”: … most cases involving data breaches have focused on the post-breach harm , and have largely ignored the permanent and irreparable loss of control over a collection of personal information. None of the cases cited by Uber have focused on the first instance of loss [22] … Consequently, none of the cases have stated that such loss is not capable of being actionable. “[Emphasis added]. In reply oral argument, Setoguchi’s Counsel also noted (TR21 – 57/36-41) that the privacy cases referenced in Uber’s

Schedule B were certification (or settlement) cases, not “merits determination by the courts”, at a common issues trial. [ 22 ] Ultimately there must be some evidence, and at any common issues trial, real proof of actual harm, whether of first instance loss or post-breach enhanced loss. Absent that proof at the common issues trial, this case cannot succeed. However, on this record, I find that there is no evidence of even the first loss , never mind post-breach or enhanced loss.

This leaves only a common law presumption, based on adequate pleadings, for cause of action purposes in class proceedings that there has been some harm or loss [23] . In the face of no such evidence, and in the spirit of Hryniak v.

Maudlin , 2014 SCC 7 , I believe that it is time for the Court to take its gate keeping function seriously, and end this litigation as a class proceeding now, leaving Setoguchi or any other member of the class to pursue a personal action if they so wish. [ 23 ] Put another way, there appears to be no evidence of actual first instance or post-breach harm that would forecast some success in a class proceeding after the common issues trial. There is only speculation about a future possibility of loss or harm.

Were this case to be certified at this stage, it would go to trial in the mere hope that evidence of loss or harm might at some point arise.

Paradoxically, this is exactly the point made by Setoguchi (Setoguchi Brief, para 23), namely that: There is a fundamental difference between speculating one will suffer loss in the future [my point above], and stating one has already suffered loss [I find no such evidence in this case, only a common law presumption] as a result of the information being acquired by criminals. [ 24 ] To add to this, Uber asserts (Uber Brief, paras 14 - 16) that the PD “did not contain any useful information for hackers, or for purchasers of stolen data”.

Specifically: The Plaintiff has not contested the evidence ... that the [PD] did not include payment credit card numbers [24] , bank account numbers, social security numbers, date of birth or similar government or tax identifiers. [25] (Emphasis in the original) ... As to ... passwords that were included in the [PD], [the evidence is] that those passwords were very strongly encrypted and it would be ‘computationally infeasible” to access them in unencrypted form.

The Plaintiff has not contradicted that evidence. [ 25 ] With this background, I will look at the resulting issue(s), summarize the decision to which I have come, and provide the analysis that has led to my conclusions. III. Issue(s) [ 26 ] Uber says the following about the only real issue in the proposed class proceeding (Uber Brief, para 13): “The predominating contested fact is whether or not [class members] have suffered any compensable harm resulting from the 2016 Data Incident.

The Plaintiff says they have; Uber says they have not.” [ 27 ] However, beyond that, absent consideration of all the pre-requisites in s. 5 of the Act (to which I will return, at least somewhat, and in the alternative), for the reasons set out above, in my mind, there remains only issues about the establishment of proper causes of action and the determination of preferable procedure – with some findings made in the alternative. IV.

Summary of Decision [ 28 ] I find that Setoguchi has not provided any evidence of class-wide harm, only pleadings of same.

More specifically, on this record, I not only find no evidence of any actual harm or loss , but do find evidence of no actual harm or loss , in relation to the common law or statutory breaches, including what is called “significant harm” in PIPEDA , s. 10.1(7) and (8) . [ 29 ] More specifically, I find that Setoguchi has provided no evidence, on this record, to show a breach of any truly confidential information, or either “first loss” (at the time of or directly related to or coincident with breach) or any of “additional loss”, “consequential loss”, “future loss”, “enhanced loss”, or any otherwise categorized significant consequential losses following the Hack and resulting alleged breach(es) [26] .This alone may not be sufficient to deny certification, because of what may have become (in retrospect) a flawed legal presumption of deemed fact by pleading, in the context of class actions.

Nevertheless, I do find, in all the

circumstances, that Setoguchi has not established that a class proceeding is a preferable procedure on this record. [30] The result is that certification is denied on the application before the court. V. Analysis – General [31] I will analyze some general issues that relate to this case, and then return to some of the certification criteria under the Act. A.

Screening Process [32] At para 103 of Pro-Sys, Rothstein J. stated (quoted, in part, by Counsel for Uber at TR20 – 83/18 – 34): ... it has been well over a decade since Hollick was decided[27], and it is worth reaffirming the importance of certification as ameaningful screening device.

The standard for assessing evidence at certification does not give rise to “a determination of the merits ofthe proceeding” (CPA, s. 5(7)); nor does it involve such a superficial level of analysis into the sufficiency of the evidence that it wouldamount to nothing more than symbolic scrutiny. [Emphasis is added.] [33] Put in other words, it seems to me that, if the “screening process” is to be “meaningful”, without determining the full legal andsubstantive merits of the litigation, including whether all elements of the Act to establish certification have been met, there must be someevidence or basis in fact for loss or damage.

The standard must be lower than the actual proof on a balance of probabilities necessary at acommon-issues trial (TR20-17/1-3), but the Representative Plaintiff must demonstrate at least some meaningful substance to the casebefore certification should be granted. It surely cannot be merely that, in effect, one needs only to speculate at the certification stage, only“establish [loss or damage] at the common issues trial” (TR20-12/9-29; 20/22-28), undoubtedly seeking a settlement in the interval.

Thisis the substance of why certification must and does fail in this case. [34] The best evidence on this record is that, at most, the only information taken by the Hackers was name, physical/mail address,and/or email, address or location (perhaps) (TR20 – 74/35) and (mobile) phone number of the customer. There is no evidence of any ofthis data having been released beyond the Hackers in the four years since the Hack. [35] As Uber argues, in essence, and I find, in this era there is a need to weed out claims that run afoul of the “plain and obviousassessment” of Hunt v.

Carey Canada Inc., (SCC), [1990] 2 SCR 959 at para 980[28], where there is no real substantial(non de minimus) or meritorious basis for the claim, and especially, post-Hryniak[29], where “the role of certification [is] a ‘meaningfulscreening device’ and the Court has a concomitant ‘gatekeeper function’...”.

This function is important to stop the arguments of “fulldebate”[30] of possibilities where there is no apparent substance. [36] On the contrary, Setoguchi’s thesis or theory (TR20 – 9/22-25; see also TR20-11/29-31 and TR20 -12/35-8) seems to be thatevidence of hackers having taken non-confidential information, without some evidence of actual compensable loss or harm, shouldnevertheless result in certification, on the basis of the presumption of merit to a cause of action that is properly pleaded.

If that were to bea view that is maintained by the courts, it would lead to certification in almost any case, no matter the importance of it – the messagewould be that you do not need to search for evidence of harm or loss, but merely need hire a “good pleader” to cover all of the pleadingsrequired to this end, regardless of the substance. [37] My answer is that I believe that there must be some evidence or basis in fact in support of real (not de minimus) compensableharm or loss, leading to a claim that is at least arguable, and that certification should indeed must not be allowed without it.

Otherwise, aclass proceeding could be a mere “fishing trip” based on speculation, without any evidence of fish being present. [38] Counsel for Setoguchi acknowledges (TR 20-12/38-13/10), the Courts don’t compensate for fear[31]. At its best this is onlyabout a case of fear of possible unknown future harm, and nothing more. B. Merits Test [39] My finding might seem to some to suggest that I am getting into a merits test[32] (prohibited by Hollick at para 16) andspeculating that the action, if certified, would not be successful, but it is not that simple.

It is not just that the proposed class proceedingwould be unsuccessful, absent some prospect of actual resulting harm for any breach where liability is found, but rather that, even if theclass proceeding were successful for baseline or nominal damages only, the reward would be de minimus and in fact, negative in thecontext of judicial economy and to access to justice: Kumar v. Mutual Life Assurance Co., [2003] OJ No 60 (CA), at para 54. [40] Hollick at para. 22, requires a proposed representative plaintiff to “come forward with sufficient evidence to supportcertification” (emphasis added).

Later, at paras 25-26, McLachlin C.J., for the Court, referenced Taub, as follows: In Taub ... the representative sought to bring a class action on behalf of the residents in her apartment building, alleging that mould in thebuilding was exposing the residents to health risks. The representative provided no evidence, however, suggesting that the mould hadbeen found anywhere but in her own apartment. The Court wrote (at pp. 380-81) that “the [Act] requires the representative plaintiff toprovide a certain minimum evidentia[ry] basis for a certification order” [emphasis added in Hollick].

While the [Act] does not require apreliminary merits showing, “the judge must be satisfied of certain basi[c] facts required by s. 5 of the [Act] as the basis for acertification order.” I agree that the representative ... must show some basis in fact to support the certification order.... In my view, the class representativemust show some basis in fact for each of the certification requirements set out in s. 5 of the Act, other than the requirement that thepleadings disclose a cause of action.

That latter requirement is of course governed by the rule that a pleading should not be struck forfailure to disclose a cause of action unless it is “plain and obvious” that no claim exists.... (Underlining emphasis added in these

Reasons.) Here, I find that the record shows that it is plain and obvious that no real claim exists. [ 41 ] From this we can see that there is a real issue as to the applicability of “some basis in fact” or “some evidence” (as above, “a certain minimum evidentiary basis”), and when each arises in certification proceedings. [ 42 ] This conflict between some evidence and some basis in fact was analyzed further by Rothstein J. in Pro-Sys , at para 100 as follows: The Hollick standard of proof asks not whether there is some basis in fact for the claim itself, but rather whether there is some basis in fact which establishes each of the individual certification requirements.

McLachlin C.J. did, however note in Hollick that evidence has a role to play in the certification process . She observed that ... [it is] clearly contemplate[d] that the class representative will have to establish an evidentiary basis for certification (para. 25). (Emphasis added.) [ 43 ] Thus, Pro-Sys also supports the Hollick principle (para 25 ) that the Act “requires the representative plaintiff to provide a certain minimum evidentia[ry] basis for a certification order” (emphasis in the original).

Accordingly, there are two requirements: evidence and some basis in fact – the latter tending to be at a more minimum level of proof, because, while, “the representative of the asserted class must show some basis [some evidence] in fact to support the certification order”, it is something less than an “assessment of the merits of the claims” which is prohibited at certification.

However, as noted above, apparently following the traditional law of what is required to maintain a pleading from being struck as showing no cause of action, Hollick at para 25 adds as: “some basis in fact for each of the certification requirements set out in s. 5 of the Act , other than the requirement that the pleadings disclose a cause of action ”. [Emphasis added.]. Does this mean that absolutely no evidence of loss or harm is required? It seems that Setoguchi’s Counsel believes so, on the basis of the current law.

That concept, I believe, is too open and the subject of potential abuse, in the absence of some gate keeping function, especially in the context of certification of a class action. One should not be able to obtain certification only on speculation as to possible evidence of harm or loss and a carefully worded pleading.

If that is not the principle that can now be carried forward based on this case, perhaps it will be in future cases. [ 44 ] Additionally, at para 104 of Pro-Sys , Rothstein J. stated (quoted, in part by Counsel for Uber at TR20 – 83/18 – 34): In any event, in my respectful opinion, there is limited utility in attempting to define “some basis in fact” in the abstract [33] . Each case must be decided on its own facts.

There must be sufficient facts to satisfy the applications judge that the conditions for certification have been met to a degree that should allow the matter to proceed on a class basis without foundering at the merits stage .... (Emphasis added.) [ 45 ] Here, Setoguchi has, I find, only shown that the PD includes name, address (street and/or email?) and mobile phone number – information that is no more private (subject to changes in technology) than was included in typical telephone directories of the past.

Thus, I find that she has provided no evidence of actual harm or loss, even assuming liability for any common law or statutory breach is found. [ 46 ] While perhaps limited to matters beyond “cause(

s) of action”, Pro-Sys has kept the rationale of “some evidence” and “some basis in fact” in Hollick alive as a meaningful screening device: paras. 100 and 102. In the latter para (case references omitted) Rothstein J. explained what some evidence or some basis in fact means: The Hollick standard has never been judicially interpreted to require evidence on a balance of probabilities.... The “some basis in fact” standard does not require that the court resolve conflicting facts and evidence at the certification stage.

Rather, it reflects the fact that at the certification stage “the court is ill-equipped to resolve conflicts in the evidence or to engage in the finely calibrated assessments of evidentiary weight....

The certification stage ... focuses on the form of the action in order to determine whether the action can appropriately go forward as a class proceeding....”. [ 47 ] As to cases such as this, where liability, considered alone, may otherwise be a matter to go forward to certification, the failure to provide some evidence – or basis in fact – for an actual loss to be established on a class-wide basis, may result in a denial of certification, as it did in Hollick , as interpreted by Rothstein J., in Pro-Sys , at para 139. See a restatement of the current law on this issue by Hall J., in Walter v.

Western Hockey League , 2017 ABQB 382 at paras 12 and 13 . [ 48 ] Uber makes other lengthy submissions relevant to merits determination (Uber Brief, paras 22 – 27 – footnotes in this section, as modified, are substantially from the Defendants Brief): In Microsoft [Pro-Sys] ... the Supreme Court of Canada emphasized that certification must still be a “meaningful screening device”, and that “some basis in fact” (i.e., some evidence from the Plaintiff) is required to show the certification criteria are met.... [Quoting paras 103-4 of Pro-Sys (above)] This is consistent with the fact that “[d]enial of class status… does not defeat the claim”, but “merely places the plaintiffs in the position of any litigant who comes before the court in [an] individual capacity”. [34] Further, “converting an ordinary piece of commercial litigation into a class proceeding may be seen by some observers simply as an in terrorem strategy to try to force a settlement”. [35] It is therefore important that plaintiffs come forward with sufficient evidence to justify invoking the scale and complexity of the class action procedure.

Otherwise, “the certification criteria would be argued in the air ”. [36] In this respect, the “party seeking certification of a class action bears the burden of showing some basis in fact”, and a “defendant can lead evidence ‘to rebut the inference of some basis in fact raised by the plaintiff’s evidence’”. [37] The class representative is required to “present sufficient evidence to support certification and… allow the opposing party to respond with its own evidence”. [38] Even if such evidence relates to the merits , it will be admissible so long as it also bears on the requirements for certification . [39]

Moreover, the Court is not prevented from weighing the Plaintiff’s evidence, or relying on the evidence of Uber, provided they do notdirectly conflict.

In Dine v Biomet Inc, the Ontario Superior Court held: The Supreme Court seems to draw a distinction between three situations: [1] weighing the plaintiff’s evidence in its own right; [2]weighing the plaintiff’s evidence while considering evidence brought by the defence to fill gaps in the record on matters not directlyaddressed by the plaintiff, and relying on this defence evidence to find the plaintiff failed to establish “some basis in fact”; and [3]weighing the plaintiff’s evidence against directly contradictory evidence from the defence. … [T]he first two assessments are appropriate….[40] In sum, as stated by the Supreme Court in Sun-Rype ..., the Court should not “lower the evidentiary standard necessary to satisfy thecriteria at the certification stage from some basis in fact to mere speculation”.[41] [Emphasis added throughout, except where otherwise noted].

C. Privacy Class Actions [49] Counsel for Setoguchi argued (TR 20 4/25 - 33) that “the courts have struggled with the development of privacy cases and thedecisions have lagged behind technological development”. That may be true, but this is not the case in which to engage in a definitiveanalysis of the matter.

To the extent that “the courts have struggled”, no matter the reason, to protect the security of truly privateconfidential information, I believe that the real issue is the ability to separate “token”, or “nominal”, or “baseline” cases where there isno evidence of real harm or loss, from cases where there is actual harm or loss. I consider this case to be, at best, an example of theformer. [50] As noted above, Uber’s Brief includes a

section (paras 28 – 32) on “Privacy Class Actions in Canada”, and attaches aSchedule “B”, identifying different categories of privacy class actions, including 11 cases of Data Breaches by External Actors.[42] Ofthese (leaving aside settlements[43]), only two have been certified. One of these is/was under appeal at the time of argument herein. Uberasserts that a review of the cases in

Schedule “B”, “reveals that in privacy class actions, the specific context is paramount to the decisionwhether to certify”, noting that “no Canadian Court has ever certified a data breach class action that concerned the disclosure of the sameor similar type of benign or public information at issue in this case, ie. name, email address and phone number”. [51] Uber categorizes these as a fourth category of “data breach” cases within the broader rubric of “privacy breach cases”, namely as Data Breaches by External Actors: Jones v.

Tsige, 2012 ONCA 32, 346 DLR (4th) 34[44], where, Uber argues, certification dependson the “sensitivity of the information accessed, and the impact to Class Members of dissemination”.

It is clear from Jones (see paras 71and 72) that harm will arise only: with regard to “the invasion [that is] highly objective causing distress, humiliation or anguish”; “proofof harm to a recognized economic interest is not an element of the cause of action”; “from deliberate and significant invasions of personalprivacy”; and “individuals who are sensitive or unusually concerned about their privacy are excluded”. [52] Relying on Grossman at para 10 and R. v.

Marakah, 2017 SCC 59, [20176] 2 SCR 608 at para 32, Uber asserts that “... here,the Data “cannot fairly be described as private information”, nor is it “information which tends to reveal intimate details of the lifestyleand personal choices of the individual.” I agree, and in particular find that there is no evidence or basis in fact that any class member had,or would have had, any reasonable expectation of privacy in the subject information: see Bernard v. Canada (Attorney General), 2014SCC 13 at para. 112, albeit in a different context. [53] While I will not reference all the cases in

Schedule “B”, some of them merit discussion. In Bourbonniere c. Yahoo! Inc.,2019 QCCS 2624 at para 37, the Court concluded that the need to change a password following a data breach, or the embarrassment ofspam mail to friends, was not sufficient to allow the matter to proceed as a class action.

See also further cases discussed in Bourbonniereat paras 38 – 44, that demonstrate (para 38), “the distinction between minor and transient upset and compensable injury ... [which] mustbe ‘serious and prolonged’ and rise above the ordinary annoyances, anxieties and fears that a person living in society may experience”,and thus, in the result (para 44): “[t]he transient embarrassment and inconvenience ... are of the nature of ordinary annoyance and do notconstitute compensable damages...”[Emphasis added]. [54] Uber further asserts (paras 47 – 49 of its Brief) that there is no factual evidence of any type of economic harm in the now 4years since the breach[45] and (paras 51 - 2 of its Brief) denies the Plaintiff’s assertion of an ‘impossible evidentiary burden’[46], notingcertifications that have been granted where the breaches are directly linked to individual harm and where the PI is “actually verysensitive”: Ari v.

Insurance Corporation of British Columbia, 2013 BCSC 1308, at para 54, aff’d 2015 BCCA 468; Evans v. Bank ofNova Scotia 2014 ONSC 2135, leave to appear ref’d 2014 ONSC 7249 (Div. Ct.); Tucci v. Peoples Trust Company, 2017 BCSC 1525;and Grossman (also relied upon, at para 10, for the statement, “Your name and address are certainly not private...”). [55] Li v. Equifax, 2019 QCCS 4340 (Equifax QC) deserves particular consideration. Setoguchi referred to para. 300: “...it is notsettled law that a claim for nominal damages cannot be certified” (see also Setoguchi’s reference to First City Trust Co. v.

Triple FiveCorp., 1989 ABCA 28 para 71– Setoguchi Reply Brief, para 38). However, referencing a 1970 English case, in Serban v. Egolf (1982), (BC SC), 43 BCLR 209 at paras 18 - 19, the Court declined to certify a “fictious loss”, for which it “would be contraryto justice and common sense to give the plaintiff’s claim the approval of the court, even to the extent of judgment for nominal damagesfor failing to preserve ...meritless claim” [Emphasis added].

While I entirely agree with Setoguchi that cases for nominal damages shouldnot all be sent to the dust bin, I believe cases with no apparent evidence or basis in fact for loss or harm, such as the case at Bar, shouldbe considered similarly to Serban.

Put another way: there still must be some evidence of actual harm or loss, or the claim is incomplete.Here, not only is there no evidence of significant harm, or insignificant harm; there is evidence that loss or harm is wholly non-existent.Similar circumstances were not sufficient for certification/authorization in Equifax QC, and they are not here – see para 27 – 34 ofEquifax QC, a translation of which was read into the record (TR20 - 78/31-40).

Moreover, I believe that, similar to Quebec, mutatismutandis, the risk of a future injury developing – a hypothetical injury - is not an injury that can be compensated: see Equifax QC at para

29 . This is different from real harm arising out of preventing further interference with PI: Zuckerman v. Target Corporation , 2017 QCCS 110 , at paras 73 , 77-78, referenced in Equifax QC at para 28 . [ 56 ] Uber argued (TR21 – 11/19-22) that Counsel for Setoguchi “pitch[ed] to you ... that the law needed to create a remedy ... to compensate people who have suffered a breach but no harm ” [Emphasis added.]. I am of the view that where there is a breach but no compensable harm, there can be no cause of action (aside, perhaps for a declaratory remedy).

As I said in the hearing (TR21 - 6/35-6), there will be no certification on the record and pleadings of this case “just because there has been a breach”. This I find to be appropriate, although I acknowledge that other courts have held that, if it “is not plain and obvious that there is no compensable harm” the matter can proceed to a common issues trial: see Hynes v. Western Regional Integrated Health Authority , 2014 NLTD(G) 137 at paras 28-30.

In effect, I have found that here, it is plain and obvious that there is no compensable harm, on this record. [ 57 ] Setoguchi (Setoguchi Reply Brief, paras 31-32) states that: “... after the determination of this first level of loss on a class-wide basis, Class Members who have suffered additional out-of-pocket or psychological losses will be invited to come forward to individually prove their losses” - see also Setoguchi Reply Brief, paras 39 – 40 re “enhanced losses”. However, I find no evidence on this record of either first level or enhanced harm or loss.

It is not sufficient for Setoguchi to merely argue that, “not even Uber can categorically state that no Class Member has been victim of fraud or some other type of use of their personal information...”.

I believe that Setoguchi must provide at least some evidence of this, and I find that she has not done so. [ 58 ] However, notwithstanding my belief that the certification application must present a way for the Court to exercise a gate keeping function in cases like this, and that there must be some evidence of harm or loss to support certification, it appears clear that the “some basis in fact” test has not yet been applicable to causes of action that are fully and completely pleaded [47] , including that there is harm and loss even where is evidence that there actually isn’t.

Thus, with regret, I must find that Uber is not successful in having certification denied on the basis that the pleadings fail to disclose a cause of action, except in so far as I may use it as gate keeping function. [ 59 ] Accordingly, alternatively, I move to the issue of specific criteria under the Act . VI. Analysis – Criteria under the Act [ 60 ] I will now address, more specifically, some of the remaining criteria for certification under s. 5 of the Act in the contest of the circumstances in this case. A. Causes of Action [ 61 ] Uber claims that the application for certification fails under the s. 5(1)(

a) provisions of the Act . I have discussed above the (perhaps, in retrospect, misplaced in the context of cases such as this) exemption from s. 5(1)(

a) of the need to support the claim at the certification stage with any evidence or basis in fact. However, I will analyze Uber’s submissions and Setoguchi’s responses, in any event. 1. Contract [ 62 ] Setoguchi pleads (para 32 of the ASofC) that her contract with Uber, and all others of the class, are “standard contracts of adhesion [48] , as the terms and conditions are universally and uniformly set out by Uber....”, and later references the terms extensively, ultimately alleging contract breaches for (1) storing the PD on the “cloud” without consent, and (2) the failure to notify Uber’s customers of the breach. [ 63 ] The contract(

s) extensively referenced by Setoguchi in the ASofC and in evidence can be considered in determining whether the pleading discloses a cause of action: Haikola v. The Personal Insurance Company , 2019 ONSC 5982 at para 48 . [ 64 ] As to the first alleged breach, Uber claims (TR21-20/35 – 26/24) that the contract provides for unrestricted types of storage through the members consents and thus, certification must be denied on the authority of Leonard v. The Manufacturers Life Insurance Company , 2016 BCSC 534 , at paras 183-9 .

While that is not the focus of my primary concern about this case, I agree with Uber that it is another reason to deny certification for the claim in breach of contract.

Put another way, if I were to have otherwise granted certification of this action, in light of the apparent consent on the record, and in accord with the principles of Hryniak , I would have denied certification in respect of this first alleged breach of contract. [ 65 ] As to the second alleged breach, namely the failure of Uber to disclose or give notice of the Hack, Uber submits (Uber Brief, paras 199 - 203, referencing Andriuk at para 82 , and TR21 – 26/31- 27/28) that there is no contractual provision requiring Uber to give such notice, nor any pleading of material facts to support an implied term of contract.

Counsel for Setoguchi replies (TR21/65/4-19 & 66/12-14) that it is pleaded, relying on para 42 of the ASofC. Uber retorts that Setoguchi merely relies (para 47 of the Setoguchi Brief) on the pleading, which Uber calls a bald assertion, without reference to material facts, and in denial of both the actual evidence in relation to the claim, and the proposition that, “implied terms cannot be used to rewrite a contract for the parties” [49] . [ 66 ] Setoguchi would leave this argument to the common issues trial, which Counsel on her behalf argues is required to deal with such things as the

interpretation of the contracts and implied terms. Thus, the issue of dealing with it at certification as compared to determining it at the common issues trial is directly in issue. As I have denied certification of this case for other reasons, this issue is moot. However, because the issue is sufficiently raised in the pleadings, and the answer is far from clear, had I granted certification herein, I would have included this second contract breach allegation as a cause of action to be certified. [ 67 ] In

summary, the certification of both contract issues is moot, in that I have denied certification herein for other reasons.

However, had I otherwise granted certification, I would have: (1) denied certification on first alleged contract breach, lack of consent to storage of PD on the cloud [50] ; but (2) granted certification on the second alleged contract breach of an implied term to notify Uber users of data breaches. 2. Negligence [ 68 ] At para 38 of the ASofC, Setoguchi alleges that the transfer of the user information to the cloud was “not done in an anonymized manner and no steps were taken to protect the identities of Users...”. Without more, this could well be an allegation is support of a cause of action in negligence.

Additionally, a cause of action in negligence was specifically pleaded at paras 44 – 56 in relation to both the storage of user information on the cloud and the failure to provide notice of the Hack. Had I not refused certification herein for other reasons, it is certainly arguable that the pleadings support certification in respect of the cause of action of negligence. However, based on relatively recent authority, which I accept in the context of this case, I have come to the opposite conclusion. [ 69 ] In the recent case of Stewart v.

Demme , 2020 ONSC 83 , Morgan J., at paras 25-27 & 85-86 [51] , noted that the plaintiff there suffered no actual damage beyond the fact of the invasion of her private health information. While noting that the “invasion of privacy is itself a form of harm”, Morgan J. concluded that it: ... is not the type of harm that suffices for a negligence claim.

Unlike intrusion against seclusion [52] , which is one of the few areas of tort law allowing for “symbolic” or “moral damages”, Jones , para 75 , negligence liability requires that actual harm be manifest and caused by the wrong . [Emphasis added.] [ 70 ] Uber, in referring to Stewart , further emphasises that “the fact of access [alone] is not the kind of harm that can support [the] tort” of general negligence.

Counsel for Setoguchi described (TR21 – 70/34-38) Stewart as seeking an answer to the question of “whether a privacy violation can be highly offensive and actionable even if it is fleeting and causes no harm”. That appears to be exactly the situation we have here, although Setoguchi argues that here the harm is not “fleeting”. [ 71 ] On the same point Morgan J. in Stewart , held (para 92 , as argued by Uber at TR21 – 1/35-39) that “there is no credible evidence that harm has been caused on anything resembling a class-wide basis” and the cause of action of negligence was denied certification for that reason.

The same result follows here. [ 72 ] Indeed, in the opening paragraph of his decision in Stewart , Morgan J. said: “The central question in this motion is whether a privacy violation can be ‘highly offensive’ and actionable even if it is fleeting and causes no harm.” Morgan J, concluded (at paras 92 & 94) that: ... “there is no credible evidence that harm has been caused on anything resembling a class-wide basis”, and that: “there is insufficient evidence of a viable cause of action in negligence, at least on a class-wide basis.

I would not certify any common issues based on that claim”, The cause of action of negligence was denied certification for that reason. The same result follows here. 3.

Other Causes of Action [ 73 ] Setoguchi pleaded causes of action for breaches of statutory duties (paras 57 - 67 of the ASofC) but Counsel on her behalf indicated that these proposed causes of action were not being pursued (see TR21-40/19-24), and thus I do not need to deal with those matters. [ 74 ] At paras 44 – 56 of the ASofC, Setoguchi appears to combine a number of causes of action under the title of “Negligence, Breach of Confidence and Invasion of Privacy”.

I have dealt with negligence as a cause of action, but Setoguchi does not directly plead in respect of the latter two. [ 75 ] In written briefs, the two parties spar on the issue of Breach of Confidence (Setoguchi Brief, paras 105-108; Uber Brief, paras 216-219), but no such specific cause of action appears to have been pleaded in the ASofC. [ 76 ] Similarly, while there was discussion in the written and oral arguments about invasion of privacy in a general sense, there was no focused arguments in respect of invasion of privacy and no specific pleading in the context of causes of action. [ 77 ] Thus, the positions of the parties in respect of these aspects of the claim is less than clear.

In any event, in light of the other conclusions to which I have come on certification, I see no need to make further, hypothetical, conclusions in respect of any other cause of action, had I not otherwise denied certification. B. Common Issues [ 78 ] Setoguchi sets out a number of common issues in the ASofC, and particularizes those into 18 common issues (some with sub- issues) in Appendix “C” of her formal Application for Certification filed January 31, 2019.

By the time this matter got to oral argument, common issues 10, 11, and 14 had been withdrawn. [ 79 ] Having denied certification for other reasons, I need not deal with common issues extensively, but I will comment on some. [ 80 ] First, common issues 1(

a) and 3 would not be certified as I have denied the first alleged breach of contract as a cause of action; 1(

b) and 1(

c) cannot go forward for negligence, but 1(

c) can as it relates to the second alleged breach in contract, all for the reasons noted above.

[ 81 ] Second, common issues 8-9, 12-13, and 15-17, appear to relate to declarations of rights with respect to PIPEDA , PIPA , and the Consumer Protection Act , RSA 2000, c. C-26.3 respectively, not as causes of action in themselves, but as relevant to the cause of action of negligence, and, presumably for the purpose of seeking declarations of law relating to further investigations and pursuits of rights under those pieces of legislation.

Had I granted certification, I would have left those to the common issues trial. [ 82 ] That leaves common issue 18, and its 5 sub-issues as to damages, which I will now address. [ 83 ] Item 18 of Setoguchi’s proposed common issues deals, in a very general way, with several aspects of damages.

In essence, while common issue 18 only seeking “an award of damages”, without categorization, Setoguchi actually seeks an aggregate assessment of nominal damages, without proof of harm or loss, merely for the data breach (first loss damages) for the majority of the class, with the possibility that individual members of the class could come forward at or after the common issues trial to assert more serious or enhanced claims of damages for any real harm or loss. [ 84 ] Setoguchi (Setoguchi Reply Brief, para 30 and TR20-11/34-39, based on Good v.

Toronto Police Services Board , 2016 ONCA 250 ) makes a distinction between, as I interpret it, baseline damages (actual, quantified and proved) in negligence and nominal damages (no actual quantified proof of damages) in contract breaches [53] . [ 85 ] Uber asserts [54] that Setoguchi’s claim for nominal damages in contract (now, by these Reasons limited to the alleged second breach relating to failure to give notice of the data breach), is sought to be assessed on an aggregate basis (thereby trying to avoid individual assessments), with the possibility of claims for more substantial damages, and is incompatible with the law.

In that regard, Uber claims that, in law, an award of nominal damages precludes more substantial damages – it is an “either-or proposition” [55] , where certifying for one would deny the other.

Counsel for Setoguchi argues (TR21 – 64/64/3 – 65/2), on the other hand, based on para 74 of Good , that it is not an “either/or proposition” and that it does not preclude a class member seeking additional damages (see reference back to Cook at the last paragraph of footnote 43), and Counsel on her behalf makes the point that the Act and the powers of a common issues trial justice can find appropriate mechanisms to work through these to give a just remedy to all class members, depending on the loss or harm they suffered, if any. [ 86 ] Put another way, and by

summary, Uber asserts that, if the Court were to certify for nominal damages, that would preclude claims for actual, more substantial, damages, and vice versa . In this conundrum, Setoguchi (who, the evidence supports would personally only be entitled to nominal damages) might, Uber argues, be in a conflict with any members of the class who have suffered actual damage, and might not be a suitable representative plaintiff, and/or a sub-class encompassing those plaintiffs who have suffered actual damages would necessarily require an impermissible merits analysis.

Thus, it is argued by Uber, that, in effect, Setoguchi cannot “ride both horses at the same time”, or try to do so, where the claim is on behalf of the class of all Uber’s members whose PD was accessed. Thus, Uber claims that the way in this class action has proceeded makes certification hopeless, and it thus must be refused as it stands. [ 87 ] Uber further asserts that, in law, there cannot be any middle ground of “enhanced nominal damages”: Hi-Way Service Ind. V. Olson , 2000 ABCA 294 at para 3 .

A breach of contract, even if not a frivolous claim, but with no actual loss, may still preclude an award of nominal damages: Herron v. Hunting Chase Inc. , 2001 ABQB 1134 at 76, affd. 2003 ABCA 219 at para 39 [56] (not a class proceeding); and Serban , at para 18 . [ 88 ] Moreover, it is asserted by Uber (in its Brief, at para 224 and TR21 – 54/1-6), in essence, that the Court must reject the “certify now, worry later” approach taken by many plaintiffs in class proceedings, as described by Campbell J. in Fisher v Richardson GMP Limited

(2019) ABQB 450, at paras 138 and 140-141, leaving the process for the determination of many significant individual issues to the common issues trial judge to sort out. [ 89 ] Additionally, Uber argues (para 109 of the Uber Brief, relying on Stevens v.

Ithaca Energy Inc. , 2019 ABQB 474 ) that the consequences of nominal damages can be very unfair to a defendant (here suggested to be in the tens of millions of dollars, based on $100 for every one of the 800,000+ Canadian class members) without any real benefit to individual members of the class: … even a symbolic award … could threaten the financial survival of … defendants. Just the threat of such titanic awards would give class plaintiffs undue leverage to extract lucrative settlements in cases where nobody has suffered any harm and where no person will receive any meaningful compensation.

However, Counsel for Setoguchi argues (TR21 – 67/4-12) that the large substantial total claim is only a product of how many members there are in the class. [ 90 ] While it is not disputed that there are cases for breach of contract, or negligence, for nominal or baseline damages (respectively) in ordinary or class actions (see comments of Setoguchi’s Counsel at TR20-12/4-9), for the reasons stated above, on this record, this is does not appear to be one of them. [ 91 ] In the result, in regard to the common issues over the compatibility of nominal and/or more substantive damages (on which I believe the law needs more clarity), and the way to assess damages (e.g. an “aggregate assessment” under common issue 18(b)), and their quantum, if any, and its fairness, if I were to not have denied certification for other reasons, I would have left the issues of whether Setoguchi can “ride two horses” and the common issues that follow to the common issues trial.

As to Setoguchi’s potential conflict, I do not find that established now, but if certification were to have been granted it would be open to the common issues justice to re-examine. C. Preferability [ 92 ] The proposed representative plaintiff bears the onus of showing that a class proceeding would be the preferable procedure. To elaborate on the issues of preferability in legislation not identical to the Ac t (to which I will return), but containing the relevant principles thereto nevertheless, Perell J. summarizes the considerations in Berg v.

Canadian Hockey League , 2017 ONSC 2608 , at paras 177-186 , which I accept for the purposes of the analysis in this case.

[ 93 ] To elaborate, in simple terms, even assuming that all the other criteria of s. 5 of the Act are met to establish liability for common law or statutory relief, in this case there is no air of reality to any damages, other than baseline or nominal damages, at best, being proven on a basis of the current record. Any further assessment of damages would require individual trials, such that a class action might not be preferable, as “preferable” was broadly defined in Hollick , at para 28 , as a “manageable method of advancing the claim” and as “preferable to other procedures”.

Here, primarily, that would be individual trials in small claims court for the negligible damages that might arise from liability for breach alone, or in regular civil court for any substantial damages – though, again, not only is there no evidence on this record to support substantial damages, there is in fact evidence that there have been no damages . [ 94 ] To examine this further, the Act deals with preferability in s. 5(1) (d), allowing the Court to (“may”) “consider any matter that the Court considers relevant to making the determination”, but must consider the factors in (2)(

a) to (e). [ 95 ] In this case, I do not find, as to s. 5(2) that (a) (commonality over individual claims), (b) (individual control), or (c) (other claims) argue against preferability, and I do not need to address those further. [ 96 ] As to s. 5(2) (d), “whether other means of resolving the claims are less practical or less efficient”, they may be, but only to the extent that, if many claimants were to pursue claims for nominal damages under regular, non-class litigation, that could be contrary to judicial economy , because there could, if pursued, be a very significant number of cases brought forward for what would be, in essence, purely nominal damages.

However, that result – high cost of pursuit, but no or de minimus recovery – might be just, to the extent that the claims are relatively trivial. The bottom line is that/those claim(

s) is/are simply de minimus and not worth pursuing in the proportional world after Hryniak . However, there may be other statutory options that do not involve litigation that I will discuss below. [ 97 ] Preferability is often denied on the need for individual proof by class members. Where there is only a base (baseline or nominal) amount of damages sought, or awarded, there may be no need for individual assessment and thus preferability is achieved, even if there is no class-wide harm: Uber referencing (TR21 – 36/2-36) Good v. Toronto , at paras 73-5.

However, here, it is clear that even absent current evidence, Setoguchi’s claim is left open (TR21 – 6/8-9) for future claims of substantive damages, which will require individual assessment. This is a factor to be considered, albeit not determinative in itself, as to preferability: see s. 5(2) (

a) of the Act . [ 98 ] As to more substantive claims, if any (none yet brought to the attention of the Court), beyond nominal claims, they may justify individual actions, although if there were many such claims, judicial economy might be in jeopardy, which could lead to the declaration of a sub-class instead, if that is possible. It is worth noting that the possibility of a sub-class was argued against by both Uber and Setoguchi (for different reasons) as seen above.

Moreover, even if a sub-class(es) were required, and permitted in law, to allow for access to justice , to the extent that they were allowed there would be fewer common issues, and more individual issues.

In such a case, individual issues might predominate to such an extent as to not make the class action procedure preferable. [ 99 ] The complexity of the number of different causes of action herein (discussed above), if allowed to be certified, might also cause more complexity to the administration of the claims, and, accordingly preferability might be compromised, subject to methods being used to reduce redundancies. [ 100 ] As to more general considerations relevant to preferability, as alluded to near the beginning of these Reasons Hollick provides, at para 27 , that: “in the absence of legislative guidance, the preferability inquiry should be conducted through the lens of the three principal advantages of class actions – judicial economy, access to justice, and behaviour modification ” and, at para 28, “assess the litigation as a whole”, including “ what is really in issue in the case ” (emphasis added) [57] . [ 101 ] Hollick at para. 29 , also notes that: The Act ... requires only that a class action be the preferable procedure for “the resolution of the common issues ” ... and not that a class action be the preferable procedure for the resolution of the class members’ claims” (Emphasis in the original), but the Court significantly and importantly added: I would not place undue weight, however, [on the difference] ....

As one commentator [58] writes: ‘The [American] class action [rule] requires that the class action be the superior method to resolve the “controversy”.... [This] distinction can be seen as creating a lower threshold in [Canada] than the U.S. ...

However, it is important to adopt a practical cost-benefit approach to this procedural issue, and to consider the impact of a class proceeding on class members, the defendants and the court.’ [Emphasis added.] [ 102 ] The debate ends, para. 30, with the point (cite omitted) that: ... the preferability requirement asks that the class representative demonstrate that, given all of the circumstances of the particular claim , [a class action] would be preferable to other methods of resolving these claims and, in particular, that it would be preferable to the use of individual proceedings”. [Emphasis added.] In all of the circumstances of this case, for the reasons that follow, I find this requirement of preferability has not been met. 1.

Judicial Economy [ 103 ] Although Counsel for Setoguchi argues that first loss damages would not require individual assessment, because “class-wide harm can be established”, it is, as Counsel for Setoguchi contemplated [59] , not clear that she can establish class-wide harm on this record. Thus, I find, on the question of judicial economy , beyond the question of a barely successful nominal liability cause(

s) of action, and foreseeability of possible harm beyond that, even the assessment of nominal damages (if any), on this record, might revert, for all class members, in all situations of claims, to individual assessments, especially if Uber’s defences (e.g. past history of release of PI) are allowed to be considered. In the result, I conclude that certification in this case would not be “a fair, efficient and manageable method of advancing the claim” or “preferable to any other reasonably available means of resolving the class members’ claims, both of which are

required for finding a class proceeding a preferable procedure” [60] : AIC Limited v Fletcher , 2013 SCC 69 at paras 1 , 21, 24-26 & 48- 49, which case stands for the proposition (at para. 1) that s. 5(1) (

d) of the Act requires: To have a proposed class action certified, the plaintiff must show that there is some basis in fact to conclude that a class proceeding would be the preferable procedure for resolution of the common issues raised in the action.... See also Rumley v. British Columbia , 2001 SCC 69 , [2001] 3 SCR 184 at para 35 ; Amyotrophic Lateral Sclerosis Society of Essex County v. Windsor (City) , 2015 ONCA 572 , at para 62 ; and Price v. Lundbreck A/S , 2018 ONSC 4333 at paras 147 & 154-6 .

Additionally, in this case, absent some evidence of actual loss or harm, “it becomes difficult to say that the resolution of the common issue[s] will significantly advance the action”: Hollick at para. 32 . [ 104 ] Absent such evidence, it would not be consistent with judicial economy , and thus preferability, to allow this case to be certified, and I don’t. 2. Access to Justice [ 105 ] Access to Justice in class action law, following Hollick , must consider both the procedural and substantive: AIC at paras 24 et seq .

While the ability of accessing other trust fund remedies, as noted in Hollick at para 33 , is not available here, similar considerations have convinced me that a class proceeding in this case would not “serve the interests of access to justice”, because, at best, they appear to be nominal damage claims that are “so small as to be non-existent” – as I said above, de minimus , or, although there is, again, no evidence to support same, potentially “so large as to provide sufficient incentive for individual action”.

In either case, this is not a basis on which, in all the circumstances, a class action is a preferable procedure, and I so find here. 3.

Behavioural Modification [ 106 ] As to the theory pertaining to behavioural modification , the existence of common harm, but a regulatory scheme to deal with it, as in Hollick at paras 34 -5 , and here, may be a basis, when considering all other matters, not to advance a case for certification, due to lack of preferability. [ 107 ] I find that Uber’s failure to notify class members, regulators or the police, and only doing so when “caught out” by some unknown source through the media, is a matter deserving of a penalty(ies) for behaviour modification . [61] Behaviour modification was relied upon extensively by Counsel for Setoguchi as the prime “shine brighter” basis for certification, while at the same time declaring that “this is not a case just about behaviour modification ”.

Setoguchi, nevertheless, tries to triangulate hypothetical nominal or baseline damages into behaviour modification , all as a basis for certification [62] . [ 108 ] If certification were to have been granted, the question would be whether behaviour modification is already accomplished in the regulatory process, which would normally be the role for the common issue’s justice, after certification.

But, again, is there a gate keeping function in the certification application justice? [ 109 ] Put into other words, one does not get to certification without at least some evidence, beyond the common law presumption of some real loss or harm, and some actual basis for nominal or base line damages.

Recognition of behavior modification would not normally, alone, bootstrap one into certification of what appears to be a hopeless case for recovery of actual losses at the common issues trial. [ 110 ] Setoguchi’s Counsel’s arguments emphasize behaviour modification [63] over evidence of loss or harm, and she argues that the regulatory sanctions were a mere “slap on the wrist” [64] (TR 20-16/11).

Uber responds (TR 20 - 65/23-28 & TR21- 49/1-8) that $194 million in penalties (Counsel for Setoguchi, at TR21/54/24 states that $148 million of that was by agreement between Uber and US regulators) and other regulatory security and monitoring requirements are no mere “slap”. The adequacy of the penalty may be one factor, but I do not believe that the Courts are here to police, in a class proceeding, behavioral modification by regulatory agencies – even though the need for behaviour modification is a factor in preferability.

To be clear, however, where there is a proper case to certify (not here, I find), that does not mean that behavioral modification should not be a factor, and assessed on its merits, including a consideration of the impact of regulatory decisions. [ 111 ] Where there are breaches with significant provable damages, they would be on top of any regulatory penalties, and further damages by way of penalties for behavioural modification could have a very significant impact.

Where there are not significant damages, Uber argues (TR21 – 52/3-17), that certification here, on these facts, would lead to certification on every data breach, namely that all organizations holding data: “... will need to know that to the extent that they are subject to a data breach they will be subject to a class action without any member having to prove harm and regardless of the type of information that is accessed”, whether personal and non- personal information. [ 112 ] Additionally, regulatory proceedings are (relatively) inexpensive, and were available, and used, in this case, to exact penalties and to bring to public light the Defendants’ actions.

There was significant negative media attention (see Uber Brief, paras 184-8 & Setoguchi Brief, paras 60 - 8). This is all relevant to behavioural modification. Thus, while not measured with exact precision, I find that I do not need to certify this proposed class action as preferable, or required, alone, or in conjunction with other elements, for behavior modification .

Certainly, as noted above, behaviour modification alone is not a sufficient basis for certifying a class proceeding. [ 113 ] Moreover, see Leonard at paras 241-253 (particularly 253), where the Court said, in effect, that the preferable procedure to certification for alleged breaches under controlling Acts was for the regulators to enforce the provision of the Acts, and for them (or those affected) to use (where there are recovery procedures) those Acts, for recovery, without litigation, individual or class based.

Thus, applying similar logic, I find that the goal of behavioural modification has been met here, but also that this logic is a basis to find that a class action for an alleged breach of the Privacy Act is not the preferable procedure.

[ 114 ] The bottom line is that, any reasons to advance behavioral modification in this case does not bootstrap, by itself, the case to certification, where there are reasons, as here, as to why certification is not granted. 4. Conclusion on Standard Factors Relevant to Preferability [ 115 ] In

summary of these standard factors, while behaviour modification [65] is a laudable goal of class actions, and may have some incremental merit here, especially when the other special purposes of class proceedings - access to justice , and judicial economy [66] – are in place, in the facts of this case, I do not find behaviour modification sufficient, on its own, for approval of certification. [ 116 ] Additionally, it is my expectation, based on the record in this case, that certification not being allowed here, there will be no individual actions proceeding for nominal damages, and thus no need for considering access to justice (and any class members with actual substantive damages would be able to afford bringing them individually, or in a new proposed class action) and, in the total result, judicial economy will be further achieved. [ 117 ] Thus, in conclusion, I find that a class proceeding in the circumstances of this case is not the preferable procedure under the standard factors within s. 5(1) (

e) and (2) of the Act . 5. A New Factor - Proportionality [ 118 ] The Act provides in s. 5(2) that, as to preferability, “the Court may consider any matter that the Court considers relevant to making that determination”. [ 119 ] In Berg , Perell J., at paras 187-8 , added a new factor to preferability, namely proportionality, recognizing the cultural change in Hryniak (as I raised earlier in these Reasons).

At some length he said: And one should now add to the preferable procedure factors the factor of the relationship between access to justice, which is the preeminent concern of class proceedings, and proportionality in civil procedures . The importance of proportionality to access to justice was recently expressed by the Supreme Court of Canada in Hryniak v. Mauldin ... at paras. 1-2, 27 , where the Court stated: Ensuring access to justice is the greatest challenge to the rule of law in Canada today. Trials have become increasingly expensive and protracted .

Most Canadians cannot afford to sue when they are wronged or defend themselves when they are sued, and cannot afford to go to trial. … Increasingly, there is recognition that a culture shift is required in order to create an environment promoting timely and affordable access to the civil justice system . This shift entails simplifying pre-trial procedures and moving the emphasis away from the conventional trial in favour of proportional procedures tailored to the needs of the particular case.

The balance between procedure and access struck by our justice system must come to reflect modern reality and recognize that new models of adjudication can be fair and just . ...A proper balance requires simplified and proportionate procedures for adjudication, and impacts the role of counsel and judges. This balance must recognize that a process can be fair and just, without the expense and delay of a trial, and that alternative models of adjudication are no less legitimate than the conventional trial.

The proportionality analysis , which addresses how much procedure a litigant actually needs to obtain access to justice, fits nicely with the part of the preferable procedure analysis that considers whether the claimants will receive a just and effective remedy for their claims. [Emphasis added to all passages.] [ 120 ] Perell J. importantly went on further and in detail, at paras. 195 -206, to deny the causes of action of contract and negligence, among others, in favour of statutory breach and another (irrelevant here), saying this: In the immediate case, the Plaintiffs bring six causes of action to answer the one critical question and the Defendants concede that the Plaintiffs have properly pleaded their causes of action...

However, the Defendants submit that [certain] ... causes of action ... are redundant and add unnecessary and burdensome complexity to the claim.... I agree with the Defendants’ submission. In considering the preferable procedure criterion, the court should consider the rights of the plaintiffs and defendants , the extent to which certification furthers the objectives underlying the Act , whether the claimants will receive a just and effective remedy for their claims, the relationship between proportionality and access to justice, and the complexity and manageability of the proposed action as a whole .

Based on these considerations, I conclude that [ certain causes of action] ... do not satisfy the preferable procedure criterion. I agree with the Defendants’ assertion that [certain causes of action including] ... negligence ... are redundant, and I add the breach of contract claim to the list of redundancies. ... In this proposed class action, if the Plaintiffs prove that ... the Defendants breached [statutes] ... then they will succeed on their breach of statute claim and on their unjust enrichment claim and there would be no need to prove [other causes of action].

Conversely, if the Plaintiffs fail to prove that the Defendants breached the ... statutes, they will not be able to snatch victory from the jaws of defeat by proving [other causes of action] .... The redundant causes of action cause enormous problems of manageability ....

... In my opinion, it is inimical to the access to justice principles of the [Ontario Act] to succumb to the argument that it would be simply unjust and unfair to deny the Class Members the opportunity to prove all the claims they have that satisfy the criteria for certification without regard to whether they actually need to prove all those claims in order to achieve access to justice. The [Ontario Act] is designed to provide the class members with the access to justice that they need, and needs are different than wants .

For a cause of action to be certified, the preferable procedure criterion must be satisfied , and that criterion is designed to ensure that the class members get the access to justice they need, keeping in mind a genuine judicial economy of a manageable mass claim. In my opinion, in the case at bar, only the breach of statute and [one other] causes of action need be certified.

I conclude that only for these causes of action , the preferable procedure criterion is satisfied. [Emphasis added throughout.] [ 121 ] Thus, similarly in principle, if not in fact, were I to have certified this action on this record, in any event of other conclusions herein, I would have, having regard to proportionality as articulated in Berg , limited certification to negligence, not any other causes of action pleaded. 6.

Conclusion on Preferability [ 122 ] In the circumstances of this case, allowing it to proceed as a class action would simply not be “fair” to the resolution of the issues, as is the key to the preferability requirements in s. 5(1) (

d) of the Act . [ 123 ] Put another way, picking up on: the sentiments set out in Berg , including a need for a new culture of proportionality arising from Hryniak ; the gatekeeping function of class action certification; the sentiments behind Rule 3.68 and the need to weed out unmeritorious and de minimus claims; and the evidence on the record to date that there is no compensable harm or loss for any breach, and no assurance that there will be; I find that the preferability analysis does not support certification in this case on this record. [ 124 ] Uber argues (Uber Brief, para 189), that the proposed class action “is not the preferable procedure is a sufficient basis on which to refuse certification”.

I agree and, in the result, I find that Setoguchi has not established that this class action is preferable and therefore certification is dismissed. VII. Conclusion [ 125 ] For the above reasons, I have concluded that this claim will not be certified – certification is denied. VIII. Costs [ 126 ] The parties may speak to costs, if at all, in a timely fashion.

[…]