British Columbia Employer Found Vicariously Liable For Data Breach

The Ontario Court of Appeal recently released a trilogy of decisions (Winder v. Marriott International, Inc., 2022 ONCA 815; Obodo v. Trans Union of Canada, Inc., 2022 ONCA 814; Owsianik v. Equifax Canada Co., 2022 ONCA 813) ruling that organizations which collect and store personal information (database defendants) are not liable for invasions of privacy perpetrated by third-party hackers. While those decisions limit the ability of plaintiffs to pursue an invasion of privacy claim in Ontario against database defendants for data breaches committed by unauthorized outsiders, organizations still should be mindful of potentially extensive liability for data breaches committed by their own employees under the doctrine of vicarious liability.