Cybersecurity Class Actions Against Database Defendants Persist, But Hurdles For Plaintiffs Remain

By Sarah Dever Letson, CIPP/C, Meaghan McCaw and Bertina Lou¹

Two decisions earlier this month from the Court of Appeal for British Columbia left open the question as to whether so-called "database defendants" can be held liable in negligence or statutory privacy torts where, due to their inadequate security, a third-party hacker accesses a person's private information in the database defendant's possession.²

In both cases, the Court of Appeal concluded that class actions based on negligence and statutory breach of privacy claims were "not bound to fail."

These cases arguably broaden the potential application of statutory privacy torts to database defendants. Both statutory and common law privacy torts do not require proof of actual damage. However, plaintiffs will still face challenges on proving damages for those claims, such as negligence, that require proof of pecuniary loss.