Ari v Insurance Corporation of British Columbia, 2022 BCSC 1475.
Reading Time: 4 minutes (approx.)
By: Chloe Jardine (Articled Clerk)
The Insurance Corporation of British Columbia (“ICBC”), which maintains a database of
personal information for every license holder and registered owner of a motor vehicle in the
province, was at the centre of a legal action when a former employee accessed this database and
sold information to a third party.
Between April 2011 and January 2012, thirteen individuals were the victims of shooting and
arson attacks on their homes and/or vehicles. The only connection these victims shared is that
their vehicles had each, at one point or another, been parked in the Justice Institute of British
Columbia parking lot.
Former ICBC claims adjuster, Candy Elaine Rheaume, was fired when investigation into the
attacks uncovered that she had accessed the personal information of at least 79 individuals
without any apparent business purpose. This information was sold to a third party, and ultimately
used to carry out the attacks.
This class action was commenced on behalf of all individuals who had their personal information
improperly accessed and those that reside with these individuals including, but not limited to,
those who were victims of attacks. The initial issue was whether the former claims adjuster
committed a breach of the Privacy Act, RSBC 1996, c 373. If so, the subsequent issue was
whether the ICBC was vicariously liable for their employee’s conduct.
The Supreme Court of British Columbia found that Candy Elaine Reaume had breached the
privacy of these individuals, as there was a reasonable expectation that the ICBC would protect
any personal information collected. Further, the ICBC was found vicariously liable for the
conduct as the court indicated that “…risk of such conduct was not only foreseeable, it was
actually foreseen” [para 74]. The Court highlighted the ICBC’s own privacy protocols, in which
the ICBC informs employees about the need to protect the privacy of personal information
collected and warns of the consequences resulting from accessing this personal information
without a business purpose.
Notably, the Court highlighted the involuntariness of providing information to the ICBC. All
drivers need to provide information to the ICBC to obtain a license and insure a vehicle in the
province. The Court found that, because providing this information to the ICBC is mandatory,
there is a reasonable expectation that the ICBC will protect this information.
The ICBC was found vicariously liable for the general damages and pecuniary damages caused
by its employee’s breaches, but did not justify an award of punitive damages against the ICBC.
Link: https://www.canlii.org/en/bc/bcsc/doc/2022/2022bcsc1475/2022bcsc1475.html?autocompleteStr
=ari%20v%20&autocompletePos=11
