An employer who is innocent of negligence or other
misconduct can be vicariously liable for the tort of intrusion upon
seclusion based on a data breach committed by one of its
employees.
Grossman v. Nissan Canada,
2019 ONSC 6180, per Belobaba, J.
Facts + Issues
In December 2017 one of Nissan's employees (who was
unidentified) stole personal information relating to Nissan
customers. The employee then emailed a sample of the stolen data
along with a ransom demand to Nissan threatening to disclose the
data unless the ransom was paid.
The Court noted that "[a]t all material times, the unknown
employee was an employee authorized to conduct business on behalf
of the Defendants" and that "[t]his authority included
accessing the information at issue for some purposes." (para
50).
