2022 QCCA 685, 2022 QCCA 685

Lamoureux c. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM) 2022 QCCA 685 COURT OF APPEAL CANADA PROVINCE OF QUEBEC REGISTRY OF MONTREAL No: 500-09-029478-211 ( 500-06-000774-154 ) MINUTES OF HEARING DATE: May 13, 2022 CORAM: THE HONOURABLE GENEVIÈVE MARCOTTE, J.A. MARK SCHRAGER, J.A. PETER KALICHMAN, J.A.

APPELLANT COUNSEL danny lamoureux Mtre louis demers Mtre alexandra sorrentino ( Gilbert Séguin Guilbeault ) Absent RESPONDENT COUNSEL Investment Industry Regulatory Organization of Canada (IIROC) Mtre ALEXIS ALAIN LERAY Mtre stéphane pitre ( Borden Ladner Gervais ) By videoconference M tre ANNE MERMINOD ( Borden Ladner Gervais ) Absent On appeal from a judgment rendered on March 26, 2021, by the Honourable Florence Lucas of the Superior Court, District of Montreal .

NATURE OF THE APPEAL: Class action – Liability – Investment Industry Regulatory Organization of Canada – Loss of personal information – Absence of compensable injury – Ordinary annoyances. Clerk at the hearing: Lesly Ramos Courtroom: Antonio-Lamer HEARING 9:34 a.m. Commencement of the hearing. Resumption of the hearing of May 10, 2022. The parties were excused from appearing in Court. BY THE COURT: Judgment – see page 3. 9:35 a.m. End of the hearing.

Lesly Ramos, Clerk at the hearing JUDGMENT [ 1 ] The appellant appeals from a judgment rendered on March 26, 2021, by the Superior Court, District of Montreal (the Honourable Florence Lucas), dismissing the class action instituted against the respondent. * * * [ 2 ] The respondent, the Investment Industry Regulatory Organization of Canada, is an organization that enforces the rules governing the proficiency, activities, and financial conduct of investment dealers across Canada and the registered representatives who work for them.

The respondent’s duties include inspections to ascertain the compliance of dealers’ client accounts. [ 3 ] On February 22, 2013, one of the respondent’s inspectors left his laptop computer (the Computer) on a train. The Computer was never found. [ 4 ] The information in the Computer was password protected. However, despite the respondent’s internal policies aimed at greater protection, it was not encrypted. The respondent hired an independent expert to (

i) determine precisely what information the Computer contained and (ii) help it manage the risk related to the loss of personal information. The expert determined that the Computer contained personal information on more than 50,000 investors. [ 5 ] The respondent met with the dealers concerned in early April 2013 to inform them about the situation and give details of the measures it had taken and would be taking to protect their clients’ information. At the same time, it signed agreements with two credit information agencies to set up measures to protect the investors concerned.

Among other things, the respondent planned to introduce an alert service that would inform credit providers of the greater risk of fraud in relation to the investors whose information had been lost so that they could take extra precautions to make sure they were dealing with the real account holders.

The respondent also retained the services of a call centre to respond to any questions the investors and dealers might have about the situation. [ 6 ] The respondent sent a first letter to the investors in late April 2013, informing them of the loss of the Computer, providing information about the call centre, and offering a free credit alert service for six years.

The respondent sent a second letter on April 30, 2013, informing the investors that no identity theft or fraud had been detected since the loss of the Computer and offering them some further protection. [ 7 ] On April 30, 2013, Paul Sofio brought proceedings before the Superior Court for authorization to institute a class action against the respondent on behalf of all persons whose personal information had been lost and to claim compensatory damages of $1,000 for each member of the class. On August 20, 2014, the Superior Court dismissed Mr. Sofio’s application on the grounds that he had not

succeeded in demonstrating the existence of a compensable injury. Mr. Sofio appealed that judgment, but his appeal was dismissed. [1] [ 8 ] On November 16, 2015, the appellant brought his own application for authorization to institute a class action against the respondent. Even though his proceedings were essentially based on the same facts as Mr. Sofio’s action, his application was different in many aspects, including, among other things, a claim for damages for the unlawful use of personal information.

The appellant also gave more details about the inconvenience he claims to have suffered as a result of the loss of his personal information. [ 9 ] On October 26, 2017, the Superior Court authorized the appellant to institute the class action against the respondent. The trial took place over eight days in December 2020. After his evidence was closed, the applicant sought permission to amend his pleading to add a claim for all the expenses incurred by the members of the class.

The respondent contested the application to amend, which was taken under advisement. * * * [ 10 ] The judge started her analysis by dealing with the application to amend. She found that, since the application had been submitted only at the end of the trial, the respondent would be deprived of the opportunity to defend itself.

She therefore dismissed the application to amend, finding that it would be contrary to the interests of justice to grant it, especially since it contravened the judicial contract. [ 11 ] Since the respondent acknowledged its fault in losing the Computer and in not providing adequate protection for the personal information of the investors it contained, the judge moved directly to the analysis of the damage and of causation. She considered each component of the moral damages claimed and concluded that the appellant had not succeeded in establishing a compensable injury.

With respect to the allegations of unlawful use of personal information, the judge found that the appellant had not succeeded in establishing a connection between the incidents he and other investors experienced and the loss of the Computer. In this regard, she relied mainly on the uncontradicted evidence of an expert witness. As for punitive damages, the judge rejected the assertion that the respondent had acted with recklessness or indifference.

On the contrary, relying on an uncontradicted expert opinion, she found that the respondent had complied with best practices in the circumstances. * * * [ 12 ] On appeal, the appellant argues that the judge committed reviewable errors in practically all aspects of the judgment. [ 13 ] Regarding damages, the appellant submits that the judge erred in concluding that the moral damages were merely normal inconveniences that every citizen must accept.

In his view, the judge failed to give adequate weight to the testimony of the investors, which clearly described the anxiety they suffered due to the situation, their difficulty in getting answers from the respondent and the credit agencies, and the excessive amount of time it took for them to obtain credit. He argues that the judge did not consider the evidence establishing that the protective measures offered through the credit agencies made it longer for many members to obtain credit.

He also states that the judge did not consider the fact that the respondent’s expert received only partial information, such that her finding that there was no connection between the evidence of fraud and identity theft and the loss of the Computer was clearly erroneous. [ 14 ] With respect to punitive damages, the appellant argues that the judge erred in failing to acknowledge that the respondent’s actions amounted to unlawful and intentional interference with his rights.

In particular, he emphasizes the fact that the respondent did not encrypt the information contained in the Computer and that it delayed reacting to the incident and notifying the investors. The appellant submits that the judge erred by relying on the expert’s evidence of the amount of time it took to inform the investors and set up the appropriate measures; according to him, the expert had made no mention of that time frame. [ 15 ] The appellant argues that the judge also erred by refusing to grant the amendment he requested at the end of the trial.

In his view, it was clear to the respondent that such a request would be submitted and, in any event, his application for compensatory damages included a request for the reimbursement of expenses.

He submits that the judge incorrectly applied the principle of proportionality, which should have favoured the amendment. [ 16 ] Last, the appellant argues that the judge erred by awarding costs in favour of the respondent, in particular because she did not take into account the parties’ unequal resources and the respondent’s failure to comply with the time limits set to ready the case for trial. [ 17 ] In the weeks preceding the appeal hearing, the appellant filed an amended notice of appeal to add a claim for damages based on an hourly rate.

The respondent contested that amendment, pointing out that it was late, that no such application had been made at trial, and that it would be contrary to the interests of justice to grant it. * * * [ 18 ] The appeal must fail. [ 19 ] The appellant questions practically all of the judge’s findings of fact but has not managed to identify – much less establish – any palpable and overriding errors in the judgment under appeal, although the burden was on him to do so. Instead, he asks the Court to re- examine the evidence and come to a different conclusion from that of the judge.

That, however, is not the role of an appellate court. [2] [ 20 ] On the issue of compensatory damages, the judge divided the amounts claimed into four categories: (

i) the anxiety, anger, and stress related to the loss of the personal information; (ii) the investors’ obligation to monitor their accounts; (iii) the inconvenience and loss of time involved in dealing with the credit agencies that the respondent made available; (iv) the shame and delays experienced while trying to obtain credit. In regard to the first category, she applied the Supreme Court’s decision in Mustapha [3] and concluded that the evidence did not meet the threshold of compensable injury.

As for the second category, she applied this Court’s decision in Sofio [4] and concluded that the evidence did not show that the investors’ obligation to monitor their own accounts exceeded normal expectations. With respect to the third category, she acknowledged that it could be a compensable injury, but found that in this case, the respondent had provided free credit agency services and that the time it took to obtain such protection was not compensable. Last, regarding the difficulty of obtaining credit, the judge again decided that there was no evidence of compensable injury. She also noted that, since the

difficulties stemmed only from the free fraud alert service provided by the respondent, the investors could have refused that service. [ 21 ] The appellant does not agree with the judge’s findings of fact, but he has not succeeded in demonstrating that she made any palpable or overriding error in their regard. [ 22 ] The damages claimed for unlawful use of personal information are dealt with separately. The judge did not imply that those damages are not compensable.

There is no doubt that the members who were victims of fraud and identity theft did suffer damages, especially in terms of the time it took them to deal with financial institutions, credit agencies, and service providers, not to mention the anxiety, stress, and instability that such a situation can create. However, it was up to the appellant to demonstrate on a balance of probabilities that the unlawful use and the attempted unlawful use of the information resulted from the loss or theft of the Computer.

In the judge’s view, the appellant did not meet that burden, and the Court sees no reviewable error in that conclusion. Moreover, the Court finds no error in the judge’s decision to rely on the reports of the respondent’s expert witness that found no connection between the loss of the Computer and the incidents of unlawful use of personal information, based on various considerations and analyses.

It should be noted that, according to the expert, if the loss of the Computer had caused the various attempts to unlawfully use the investors’ personal information, he would have expected a much greater volume of applications for credit at the credit bureaus, a much higher volume of frauds presumed to have been suffered by the investors, online discussions about the incident, and greater consistency between the various incidents of fraud and identity theft. The appellant submitted no evidence to contradict either of those assertions or the conclusion to which they lead.

He insisted that the information on which the expert relied was incomplete or inaccurate but was not able to demonstrate how that led to an overriding error. [ 23 ] The same conclusion applies to punitive damages. The Court is of the view that the judge did not err in concluding that the criteria for awarding punitive damages were not met. There is no reviewable error in her conclusion that the respondent had no intention to harm the members or that it was unaware of the immediate and natural consequences of its wrongful conduct.

It is important to note that the judge found that not only was the appellant unsuccessful in demonstrating reckless or indifferent conduct, but that the uncontradicted expert evidence established that the respondent did in fact follow best practices in the circumstances.

Contrary to what the appellant suggests, there is no reason to consider that the expert failed to take into account the delays incurred in responding to the incident or notifying the investors when arriving at that conclusion. [ 24 ] On the awarding of costs, the appellant has not successfully demonstrated that the judge erred in principle or used her discretionary power unreasonably.

On the contrary, there was nothing unreasonable in her decision to reject the argument that the parties’ unequal resources justified deviating from the general rule according to which legal costs are borne by the unsuccessful party, especially since the appellant did not provide her with any evidence or concrete arguments in support of his position. [ 25 ] As for the application to amend at trial, a high degree of deference is owed to the judge’s discretion, and the appellant has not successfully demonstrated a reviewable error in her decision to refuse the amendment.

Taking into account the fact that the request was made only at the end of the trial, it is obvious that granting the application would disrupt the balance between the parties. [ 26 ] Last, with respect to the application to amend the notice of appeal, the appellant argues that this case is unique, and to some extent unprecedented, and that the Court should therefore show flexibility by authorizing an amendment incorporating a compensation method that appeared only recently in the settlement of a similar case. The Court does not agree.

Contrary to the appellant’s position, to authorize this amendment would deprive the respondent of its right to dispute the factual basis of the application and would not serve the interests of justice. FOR THESE REASONS, THE COURT: [ 27 ] DISMISSES the application to amend the notice of appeal, with legal costs; [ 28 ] DISMISSES the appeal, with legal costs. GENEVIÈVE MARCOTTE, J.A. MARK SCHRAGER, J.A. PETER KALICHMAN, J.A.