Federal Court Of Canada Certifies Privacy Breach Class Action

Sweet v Canada,¹ is the latest privacy class action to be certified by the Federal Court of Canada. In this case, the data breach arose from a cybersecurity incident involving Government of Canada online accounts, which were accessed by hackers who then fraudulently applied for COVID-19 benefits on behalf of tens of thousands of Canadians. The decision is noteworthy because it is the first to certify a class action against the government for its negligent failure to safeguard personal and financial data from third-party hackers.

The decision in Sweet v Canada implies that public and private entities may yet be held accountable for third-party data breaches.² Ontario courts have thus far been reluctant to certify (or uphold certification on appeal) of class actions where the underlying breach of privacy was the result of third-party wrongdoing.³ As such, this decision may have implications for the future of privacy class action jurisprudence in Canada.