On May 7, 2019, in Kaplan v. Casino Rama Services
Inc. (Kaplan), the Ontario Superior Court of Justice
refused to certify a privacy class action arising out of a criminal
cyberattack that included allegations of breach of privacy, breach
of contract and negligence. The decision comes on the heels of
another recent decision denying certification of a privacy class
action, Broutzas v. Rouge Valley Health
System (Broutzas), which signals that Canadian courts are
scrutinizing the appropriateness of class proceedings in these
types of highly individualized cases.
BACKGROUND
In November 2016, Casino Rama publicly announced that it was the
victim of a criminal cyberattack in which patron, employee, and
vendor information was stolen. The hacker stole a disparate
collection of documents, with no consistency in the nature or
sensitivity of the personal information included. After the
defendants refused to respond to the hacker's ransom demands,
the hacker posted the stolen
