Failing To Prevent A Cyber Attack Is Not Intrusion Upon Seclusion

In a decision that significantly alters the existing dynamics for privacy class actions in Ontario, the Divisional Court has held in  Owsianik v. Equifax Canada Co. that gatherers and custodians of personal data cannot be liable for intrusion upon seclusion when third parties steal or access that data.

Cybercrime is a top security issue, and organizations need to focus on bolstering their defences against cyber attacks. In recent years, organizations that were victims of high-profile cyber attacks frequently faced privacy class actions, regardless of whether the impact on privacy was meaningful and whether people suffered harm. The Owsianik decision has the potential to curtail the number of privacy class actions brought where there is no loss of privacy and no harm.