Insurance Corporation of British Columbia v. Ari, 2023 NBKB 38
Reading Time: 4 minutes (approx.)
By: Alexandre Doucet (Articled Clerk)
The Insurance Corporation of British Columbia (“ICBC”) receives personal information from everyone who drives a vehicle in the province, including drivers’ names, addresses, license ID numbers, vehicle descriptions and VIN and plate numbers. One ICBC claims adjuster improperly accessed and sold various personal information of 78 ICBC customers to a third party, linking vehicle plates to their names and home addresses. This third party then used this information to engage in various criminal acts, including targeting the homes and vehicles of 13 of the 78 ICBC customers for acts of vandalism, arson, and violence.
At trial, ICBC customers whose personal information had been impacted brought a class action against ICBC. At trial, ICBC was found vicariously liable for its employee’s breach of s. 1 of the Privacy Act, RSBC 1996 c 373, which stipulates that it is a statutory tort for a person, willfully and without a claim of right, to violate the privacy of another. General damages were awarded on a class-wide basis.
ICBC appealed the court’s finding that it was vicariously liable, arguing that the information accessed by the claims adjuster was contact information that people would regularly provide to others and therefore could not be private. It also claimed to have put proper workplace privacy policies in place. In the alternative, ICBC argued the trial judge erred in awarding general damages on a class-wide basis.
The determination of whether a breach of privacy has occurred in British Columbia considers the following factors: “the context, including the nature, incidence, and occasion of the act, the relationship of the parties, and the degree of privacy the person is entitled to” [para 2 of the decision summary]. The BCCA agreed with the trial judge’s earlier observation that ICBC acknowledged that the contact information was personal information entitled to privacy, pointing to ICBC’s internal code of ethics.
The BCCA further concluded that the class members’ assumptions that the information would be used for legitimate purposes was reasonable, as was their expectation that ICBC would keep their personal information private. As for vicarious liability, the test stems from Bazley v. Curry, [1999] 2 S.C.R. 534, where the Supreme Court of Canada focused on whether the employee’s conduct was sufficiently related to conduct authorized by the employer to justify imposing vicarious liability on the employer. The BCCA found that the employee’s engagement in illegal activities was closely tied to their work duties, meaning that without the employer’s equipment and proprietary information, the commission of these crimes would be impossible. The BCCA found these crimes to be sufficiently related to the conduct authorized which affirmed the trial judge’s ruling that ICBC was vicariously liable.
Link: 2023 BCCA 331 (CanLII) | Insurance Corporation of British Columbia v. Ari | CanLII
