Employer's Potential Liability in Class Action for Employee's Breach of Privacy A Good Reminder For All
A recent decision of the Ontario Superior Court of Justice highlights the increasing focus on (and potential liability arising from) customers' and clients' privacy rights and the importance for employers to properly monitor the activities of their employees. Additionally, while the decision comes from Ontario, which, unlike British Columbia, has endorsed the tort of "intrusion upon seclusion", it also raises questions about whether British Columbia courts will eventually recognize the tort.
Evans v The Bank of Nova Scotia was a decision regarding the certification of a class action that involved a bank employee who admitted to accessing and stealing personal information from 643 of the bank's clients for fraudulent purposes. Two of those clients - Michael and Crystal Evans - were named as representative plaintiffs in the class action alleging vicarious liability against the bank for a number of causes of action, including the tort of intrusion upon seclusion, endorsed by the Ontario Court of Appeal in 2012.
The court certified the class action, finding that the bank had created the opportunity for its employee to abuse his power by allowing him unsupervised access to clients' personal information without installing any monitoring system and that there was a significant connection between the risk created and the employee's wrongful conduct.
The bank argued that a class action proceeding was inappropriate for 35 of the plaintiffs because they were residents of British Columbia or New Brunswick - two provinces that have declined to endorse the tort of intrusion upon seclusion (see our previous posts with respect to British Columbia here and here). The judge's comments in Evans highlight the developing nature of this tort and raise the question of whether courts in British Columbia may endorse it as a cause of action in the future:
 The tort of intrusion upon seclusion has only recently been recognized by the Ontario Court of Appeal and is settled in Ontario. However, until the matter is ultimately decided at the Supreme Court of Canada, I find that the law in Canada is not settled on this issue. While the Courts in British Columbia and New Brunswick have not as of yet recognized the tort of intrusion upon seclusion, I was not given caselaw to suggest that they have definitively shut the door on this cause of action...
Although BC courts have not "as of yet" recognized the tort of intrusion upon seclusion, given the court's acknowledgment of potential vicarious liability in Evans for breach of privacy, the decision is a good reminder to BC employers (where we have a statutory cause of action for breach of privacy) of the importance of maintaining an adequate monitoring system for employees who have contact with personal information.
Aside from the implications of the decision with respect to the tort of intrusion upon seclusion in Ontario, given the potential liability that arises from certifications of class actions and the increasing focus on privacy rights generally, developments in these areas of the law should be of interest to employers in every province, particularly if employees have ready access to personal information.
We will be sure to keep you updated.