2021 QCCA 682, 2021 QCCA 682

Source: Court of Appeal of Québec

Date: 2021-04-28

Jurisdiction: Quebec

Citation: 2021 QCCA 682

Opinion

Levy c. Nissan Canada inc. 2021 QCCA 682 COURT OF APPEAL CANADA PROVINCE OF QUEBEC REGISTRY OF MONTREAL No: 500-09-028652-196 (500-06-000907-184) DATE: April 28, 2021 CORAM: THE HONOURABLE MARTIN VAUCLAIR, J.A. MARK SCHRAGER, J.A. JOCELYN F. RANCOURT, J.A. KARINE LEVY APPELLANT – Plaintiff v. NISSAN CANADA INC. RESPONDENT – Defendant JUDGMENT [ 1 ] On appeal from the judgment rendered on September 19, 2019, by the Superior Court, District of Montreal (the Honourable Mr. Justice Pierre-C.

Gagnon), granting Appellant’s application in part and authorizing the bringing of a class action against Respondent. [ 2 ] For the reasons of Schrager, J.A., with which Vauclair and Rancourt, JJ.A. concur, THE COURT : [ 3 ] ALLOWS the appeal in part; [ 4 ] REVERSES the judgment in first instance in part; [ 5 ] Substitutes paragraphs 149, 150, 151 and 152 of the judgement by the following: [149] AUTORISE l’institution d’une action collective de la nature d’une action en dommages-intérêts et en dommages punitifs dans le district de Montréal; [149] AUTHORIZES the bringing of a class action in the form of an Application to institute proceedings in damages and punitive damages, in the District of Montréal; [150] NOMME la demanderesse comme demanderesse représentante représentant toute personne incluse dans le groupe décrit comme suit : Toutes les personnes au Québec : (

i) dont les renseignements personnels ou financiers détenus par Nissan Canada ont été compromis dans une intrusion informatique dont l'intimée a été informée par les auteurs par courriel le 11 décembre 2017, ou (ii) qui ont reçu une lettre de Nissan Canada le ou vers le mois de janvier 2018 les informant de cette intrusion informatique; [150] APPOINTS the Plaintiff as the representative plaintiff representing all persons included in the Class described as: All persons in Québec: (

i) whose personal or financial information held by Nissan Canada was compromised in a data breach of which Respondent was advised by the perpetrators by email on December 11, 2017, or (ii) who received a letter from Nissan Canada on or about January 2018 informing them of such data breach; [151] IDENTIFIE comme suit les principales questions de droit et de fait à être déterminées collectivement : [151] IDENTIFIES the main issues of law and fact to be treated collectively as the following:

a) Nissan Canada inc. a-t-elle commis une faute relativement à l’entreposage et à la conservation des renseignements personnels et/ou économiques des membres du groupe? (

a) Did Nissan Canada Inc. commit a fault regarding the storage and the safe-keeping of the financial and/or personal information of the Class Members?

b) Nissan Canada inc. a-t-elle commis une faute en tardant à aviser les membres du groupe de la survenance d’une intrusion informatique? (

b) Did Nissan Canada Inc. commit a fault by delaying the notification to Class Members that a data breach had occurred?

c) Nissan Canada inc. a-t-elle commis une faute en raison des déficiences dans les avis aux membres du groupe concernant l’intrusion informatique? (

c) Did Nissan Canada Inc. commit a fault due to the deficiencies of the notices given to Class Members about the data breach?

d) Nissan Canada inc. a-t-elle commis une faute en raison de son omission d’aviser les membres du groupe des résultats de son enquête? (

d) Did Nissan Canada Inc. commit a fault due to its failure to inform the Class Members of the outcome of its investigation?

e) comme résultat, Nissan Canada inc. est-elle obligée de payer des dommages-intérêts compensatoires ou des dommages punitifs aux membres du groupe ? Et si oui, de quels montants? (

e) Is Nissan Canada Inc. liable to pay compensatory damages or punitive damages to the Class Members, as a result ?

And if so, in what amounts? [152] IDENTIFIE comme suit les conclusions de l’action collective à être instituée, comme suit : [152] IDENTIFIES the conclusions sought by the class action to be instituted as being the following: ACCUEILLIR l’action collective de la demanderesse au nom de tous les membres du groupe, contre la défenderesse; GRANT the Class Action of Plaintiff on behalf of all the Class Members against Defendant; CONDAMNER la défenderesse à payer aux membres du groupe des dommages-intérêts pour toutes pertes économiques et tout préjudice moral résultant de la perte par la défenderesse des renseignements des membres du groupe, et ORDONNER leur recouvrement collectif; CONDEMN Defendant to pay to the Class Members compensatory damages for all monetary losses and moral damages caused as a result of Defendant’s loss of Class Members’ information, and ORDER collective recovery of these sums; CONDAMNER la défenderesse à payer aux membres du groupe des dommages punitifs pour l’atteinte illicite et intentionnelle à leur droit à la vie privée et ORDONNER leur recouvrement collectif; CONDEMN Defendant to pay to the Class Members punitive damages for the unlawful and intentional interference with their right to privacy and ORDER collective recovery of these sums; LE TOUT avec intérêt plus l’indemnité additionnelle édictée au Code civil du Québec , plus tous les frais de justice incluant les honoraires des experts et des frais d’avis aux membres du groupe; THE WHOLE with interest and additional indemnity provided for in the Civil Code of Quebec and with full costs and expenses including experts’ fees and publication fees to advise Class Members; [ 6 ] THE WHOLE with legal costs in appeal.

MARTIN VAUCLAIR, J.A. MARK SCHRAGER, J.A. JOCELYN F. RANCOURT, J.A. Mtre David Assor Mtre Joanie Lévesque LEX GROUP INC. For Appellant and the class Mtre Malgorzata Weltrowska

Mtre Erica Shadeed DENTONS CANADA For Respondent Date of hearing: March 24, 2021 REASONS OF SCHRAGER, J.A. [ 7 ] This is an appeal from the judgment rendered on September 19, 2019, by the Superior Court, District of Montreal (the Honourable Mr. Justice Pierre-C. Gagnon) , [1] granting Appellant’s application in part and authorizing the bringing of a class action against Respondent. [ 8 ] The appeal pertains to the redefinition of the group crafted by the judge and to his refusal to authorize the conclusions for punitive damages. The appeal also seeks to address a previous ruling made by the trial judge while the case was pending.

I) FACTS [ 9 ] Nissan Canada Finance is a division of Nissan Canada Inc. which provides financing services to customers for the purchase or lease of Nissan, Infiniti and Mitsubishi vehicles. [ 10 ] Appellant was a former customer of Respondent who received a letter informing her of a data breach which occurred in December of 2017. [ 11 ] On December 11, 2017, three Nissan executives received an email from an unknown sender demanding a ransom in bitcoins. The sender purported to be in possession of all of Nissan “customers and proprietary information” and provided a sample of that information in a Dropbox.

The identity of the sender had yet to be ascertained at the time of the hearing in first instance. [ 12 ] On December 21, 2017, Nissan disclosed the incident to the public by posting a notice on its website. The notice provided information about free credit monitoring services available to its customers and recommended that they closely monitor bank accounts and credit card statements. However, the notice did not state that the sample of information contained social insurance numbers, which it did. [ 13 ] Nissan also mailed notices to all of its 1,300,000 Canadian customers informing them of the situation.

It mainly reiterated the content of the notice posted on its website. Appellant received her letter on January 30, 2018. [ 14 ] On February 12, 2018, Appellant filed her initial Application for Authorization to Institute a Class action (the “Application”) seeking leave to institute a class action on behalf of: All persons in (…) Quebec (…) (including their estates, executors or personal representatives), whose personal and/or financial information was (…) provided to Defendant before (…) the data breach that occurred on or before December 11, 2017, or any other Group(

s) or Sub-Group(

s) to be determined by the Court; (hereinafter, both Quebec residents and non-Quebec resident Class Members [ sic ] are collectively referred to as "Class Member(s)", "Group Member(s)", the "Group", the "Class", "Consumers" or "Customers"). [ 15 ] The Application questions the fact that Nissan did not know about the data breach before December 11, 2017. [ 16 ] Moreover, it questions the conclusions of Nissan’s investigations concerning the breach which provided that: (1) the thief is or was probably an employee of Nissan or Infiniti who had access to the data, although his or her identity is unknown; (2) there was no indication that anything other than the information provided in the Dropbox was stolen; (3) the document deposited in the Dropbox was the Point-in-Time Database Extract of December 2016 composed of a selection of information about active customers of Nissan Canada; and (4) nothing indicated that the thief had made a fraudulent or inappropriate use of the data obtained by the intrusion. [ 17 ] Appellant mainly argues that Respondent did not have appropriate safeguards in place to protect the personal information of its customers against such intrusion and that it neglected to immediately advise its customers of the breach and provide the appropriate protection. [ 18 ] On October 5, 2018, Respondent filed an Application for Leave to Adduce Evidence.

By a judgment rendered November 30, 2018, the judge granted that application in part and authorized Respondent to file into evidence parts of the affidavit of Mr. Forrest Smith, Chief Information Officer for Nissan North America (“NNA”). [2] [ 19 ] On February 15, 2019, Appellant informed the Court of her counsel’s intention to cross-examine Mr. Smith on the content of his affidavit and requested that Respondent be ordered to communicate certain documents prior to the examination. Respondent agreed to communicate some of the documents requested. The modalities for Mr.

Smith’s examination were confirmed by a judgment dated March 9, 2019. [3] [ 20 ] The affidavit was, however, substituted by the one of Mr. Robert J. Slencak II, senior manager in the Information Security Department of NNA, because Mr. Smith was on a medical leave of absence. His examination took place on May 2, 2019.

[ 21 ] On September 19, 2019, the judge granted the Application in part and authorized the class action with respect to Appellant’s claim for compensatory damages. [4] [ 22 ] On October 28, 2019, Appellant filed a notice of appeal. The notice of appeal also indicated her intention to appeal the decision rendered on May 2, 2019 during the examination on affidavit of Mr. Slencak, wherein the judge granted Respondent’s objections to undertake to provide additional documentation requested by Appellant. II) THE JUDGMENT [ 23 ] The trial judge concluded that the first (similar claims) and third (impracticality of individual recourses) criteria of

article 575 C.C.P. were met in this case. [5] He also concluded that Appellant had the capacity to act as a representative of the group even if her information was not in the document deposited into the Dropbox. She did receive a letter from Respondent and established a prima facie case for her right to compensatory damages. [6] He also concluded that the allegations of the application were sufficient in order to let the claim for compensatory damages go forward. [7] [ 24 ] However, he determined that Appellant did not establish her right to punitive damages.

He concluded that the application did not provide sufficient allegations of fact supporting such claim.

More specifically, he noted that the application did not present a factual claim to the effect that Respondent had intentionally exposed its customers to a data breach. [8] He also stated that it was improbable that Respondent acted in a deliberate manner to harm its customers. [9] [ 25 ] The trial judge also ruled that the class was too broad and reduced its scope. [10] Therefore, he authorized the class action for all of Respondent’s customers from Quebec who received a letter from it in or about January 2018. [11] III) GROUNDS OF APPEAL [ 26 ] Appellant submits these three questions to the Court: (

i) Did the judge err in rejecting the class members’ rights to claim punitive damages? (ii) Did the judge err when he redefined the class and limited it to the persons who received a letter? (iii) Should the Court overrule the objections which were maintained by the first instance judge during the deposition? IV) DISCUSSION [ 27 ] The applicable standard for obtaining authorization to institute a class action is well known.

The authorization process is a filtering mechanism rather than a trial on the merits. [12] It requires the establishment of an “arguable case” or a “ prima facie case” [13] rather than a reasonable chance of success. [14] As such, the tribunal finds itself entrusted with the role of ruling out proceedings which are frivolous or manifestly unfounded in law in order to prevent parties from being “ subjected unnecessarily to litigation in which they must defend against untenable claims ”. [15] [ 28 ] In order to achieve that goal, the allegations set out in the application for authorization must appear to justify the conclusions sought or, in other words, must allow one to grasp the main line of the proposed narrative without necessarily being perfect . [16] As such, the allegations cannot be vague, general or imprecise and are held to be true [17] unless they appear implausible or manifestly inaccurate. [18]

a) Punitive damages [ 29 ] The Court has recently reiterated the applicable principles when dealing with a claim for punitive damages under

section 49 of the Quebec Charter of Human Rights and Freedoms [19] : [ translation ] [999] The extraordinary nature of punitive damages in Quebec civil law requires that their award result from an express provision of law, as provided by

article 1621 C.C.Q. The second paragraph of

section 49 of the Charter authorizes the award of punitive damages where the unlawful interference with rights or freedoms protected by the Charter is intentional. [1000] It was settled during the hearing that the analysis of intent should focus on the consequences of the injurious misconduct and not on the conduct itself. The case law requires proof (

i) that the author of the interference wished to cause the consequences of the wrongful interference or (ii) that he or she was aware of the immediate and natural or extremely probable consequences of his or her misconduct. [20] (References omitted)

[ 30 ] The notion of intentional interference requires more than simple negligence but is not as strict as a specific intent. In one of the landmark cases on the topic, the Supreme Court stated the following: [21] 121.

Consequently, there will be unlawful and intentional interference within the meaning of the second paragraph of s. 49 of the Charter when the person who commits the unlawful interference has a state of mind that implies a desire or intent to cause the consequences of his or her wrongful conduct, or when that person acts with full knowledge of the immediate and natural or at least extremely probable consequences that his or her conduct will cause . This test is not as strict as specific intent, but it does go beyond simple negligence.

Thus, an individual’s recklessness, however wild and foolhardy, as to the consequences of his or her wrongful acts will not in itself satisfy this test. (Emphasis added) [ 31 ] The judge concluded that the Application does not provide allegations to the effect that Respondent intentionally intended to expose its customers to a data breach. [22] He pointed out that if Respondent had indeed been careless or committed gross negligence, it did not act deliberately to harm its customers. [23] [ 32 ] The judge’s reasoning fails to acknowledge that an intentional interference can arise not only when the author of the negligence wishes to cause the consequence of the wrongful interference but also when a “ person acts with full knowledge of the immediate and natural or at least extremely probable consequences that his or her conduct will cause ”, [24] which is more likely to be the case here. [ 33 ] Paragraph 50 of Appellant’s re-amended Application in the

section addressing punitive damages reads in part as follows: [50] In fact, without limiting the generality of the forgoing, Defendant was grossly negligent and/or intentionally negligent when it: a. did not follow or properly implement an effective data security industry standard to protect the Class Members' personal information; b. failed to promptly notify the Class Members of the Data Breach; c. decided to only notify the Class Members more than six (6) weeks after it became aware of the Data Breach; (…) f. failed to properly and promptly send the credit monitoring activation code to Plaintiff as detailed above, and other Class Members; (…) h. failed to inform the Class Members of the fact that the extortionist had provided Defendant with a sample document of the stolen information, which contained valid Social Insurance Numbers; [ 34 ] While the allegations in such regard may be perfunctory, which may be inevitable prior to full discovery, they are nevertheless sufficient at this stage. [25] Indeed, Appellant alleged that Respondent’s behaviour was unlawful and intentional and Appellant presented an arguable case that Respondent’s failure to implement proper steps and required IT security measures could give rise to the award of punitive damages.

In such regard, Appellant alleged in paragraph 29 of the re-amended Application that Nissan experienced at least two other prior data breaches which raise the deterrent aspect of punitive damage awards. [26] The tribunal can certainly draw inferences from the allegations of fact in the Application [27] and deduce that Respondent had to know that a failure to implement proper measures could lead to the violation of the class members’ right to privacy as Appellant alleges in paragraphs 51 and 52 of the re-amended Application. [ 35 ] Moreover, the more than one-month delay between the breach and the web posting and sending of the letters could potentially be viewed as conduct undertaken (or abstained from) in full knowledge of the prejudicial consequences that could be suffered by Respondent’s customers during such period.

This may be the case notwithstanding Respondent’s explanation that there was an investigation of the incident ongoing at the time, which will be an issue for the merits. Nevertheless, the failure is alleged by Appellant, which is sufficient at this stage of the proceedings.

Indeed, the judge acknowledges that the delay appears to be “excessive” even when considered in light of the Act respecting the protection of personal information in the private sector . [28] Conduct after the breach can potentially give rise to punitive damages. [29] Here, Nissan’s delay perpetuated and aggravated the violation of its customers’ right to privacy. The violation did not end when the data was breached.

Rather, the violation commenced with the breach and continued, as alleged, while the information was in the hands of the perpetrators and Respondent did not act to protect its customers or enable them to protect themselves. [ 36 ] At the present stage of the proceedings, where we are only considering the allegations, delays in the management of the incident can potentially be the source of damages in addition to the conduct of Respondent in failing to protect personal information prior to the breach. [ 37 ] It would be premature at this stage to decide that there is no possible basis for the award of punitive damages since the granting of such damages must be based on an analysis of Respondent’s overall conduct. [30] The allegations need only be sufficient in order to comprehend the gist of the proposed narrative. [31] Here, Respondent’s conduct after the data breach as alleged is relevant and could potentially be the source for a condemnation of punitive damages.

In any event, doubt as to whether the standard has been met should be interpreted in favour of the plaintiff at the authorization stage. [32] [ 38 ] I consider that the judge erred in law in excluding authorization of the claim for punitive damages, such that I would propose to

allow the appeal on this ground to include such claim in the class action.

b) Redefinition of the class [ 39 ] The clarity of the definition of a group in a class action is important as it allows people to know if the class action concerns them or is likely to concern them and, thus, exercise their right to exclude themselves within the prescribed delay. [33] [ 40 ] As such, the courts have identified four main criteria pertaining to the definition of a group in a class action: (1) it must be based on objective criteria; (2) the criteria must have a rational basis; (3) the definition of the group should not be circular or imprecise; and (4) the definition of the group must not be based on one or more criteria which are dependent on the outcome of the class action on the merits. [34] [ 41 ] A plaintiff has the burden to identify a group that matches the reality and the scope of the problem at the origin of the dispute.

It is possible for a judge to redefine a class, “so that its dimensions are better aligned with the claim as framed by the applicant”. [35] The class can also be redefined at later stages in the proceedings and not only at the authorization stage. [36] [ 42 ] The Court has ruled that a class should not be unnecessarily broad. [37] I agree with the judge that the class proposed by Appellant (i.e. – all persons whose personal data was provided before the data breach of December 11, 2017) is too broad.

As the judge correctly stated, there is no limit in time so that the description proposed could include persons whose data was not breached. The judge was correct to redefine the class rather than to simply refuse authorization. [38] [ 43 ] On the other hand, I agree with Appellant that the judge’s limitation to those customers who received a letter is incorrect and thus inappropriate. [39] A victim of a data breach may have been among the 1.3 million to whom a letter was sent, but may never have received it for whatever reason, such as due to a change of address or simply because the letter was lost in the mail.

On the other hand, I understand that Respondent has not conceded or ascertained that all persons to whom a letter was sent did in fact suffer a data breach. Also, Respondent may have missed some people in the sending, which would make the description illogical because circular. I am, however, cognizant of Respondent’s argument that unless the judge’s description of the class is retained, Appellant would not be a member. It would thus appear that a combination of the descriptions is required.

As such, I consider that the judge committed a reviewable error in the manner in which he exercised his discretion to redefine the class. Accordingly, and respecting the criteria established in the case law as enumerated above, the group should be described as: “All persons in Québec: (

i) whose personal or financial information held by Respondent was compromised in a data breach of which Respondent was advised by the perpetrators by email on December 11, 2017, or (ii) who received a letter from Nissan Canada on or about January 2018 informing them of such data breach”. [ 44 ] The description is not too broad since, assuming Respondent’s good faith, the letters were sent to the 1.3 million active customers, such that those who did fall through the cracks (as Appellant states) should be few in number.

As well, assuming that Respondent’s information is correct, that number could be whittled down to the 278,450 active customers whose information Respondent believes was actually breached, although Appellant would argue that those who received a letter may have suffered damages even if their data was not breached. Lastly, those who suffered from the breach would be eligible to receive punitive damages (if awarded on the merits) even if they otherwise would not be entitled to compensatory damages.

c) The judgment regarding objections [ 45 ] To repeat, on May 2, 2019, when ruling on objections during the examination of Respondent’s representative, the judge decided to limit the cross-examination of Respondent’s representative on his affidavit and, more particularly, not to permit document discovery beyond the scope of the affidavit.

Without commenting on the merits of Appellant’s arguments, any appeal of this issue is not properly constituted and is time-bared. [ 46 ] Under the old Code of Civil Procedure , [40] a judgment rendered prior to authorization was not subject to appeal because it was not considered interlocutory as the class action had yet to be instituted. However, under the new Code of Civil Procedure , such a judgment is considered a judgment “rendered in the course of a proceeding” to which articles 31 and 32 C.C.P apply.

Therefore, it can be appealed with leave in accordance with the conditions set out in those articles. [41] [ 47 ] Appellant had 30 days to seek leave to appeal the judge’s ruling pursuant to articles 31, 32 and 360 C.C.P.

This delay has long expired. [ 48 ] Moreover, given the manner in which I propose to deal with the first two questions in the appeal, even if leave to appeal were to be granted at this stage, the appeal would be moot and thus contrary to the interests of justice. * * * [ 49 ] For all the foregoing reasons, I propose that the Court render judgment as follows: [ 50 ] ALLOWS the appeal in part; [ 51 ] REVERSES the judgment in first instance in part; [ 52 ] Substitutes paragraphs 149, 150, 151 and 152 of the judgment by the following: [149] AUTORISE l’institution d’une action collective de la nature d’une action en dommages-intérêts et en dommages punitifs dans le district de Montréal ; [149] AUTHORIZES the bringing of a class action in the form of an Application to institute proceedings in damages and punitive damages , in the District of Montréal;

[150] NOMME la demanderesse comme demanderesse représentante représentant toute personne incluse dans le groupe décrit comme suit : Toutes les personnes au Québec : (