Executive Summary: Key Legal and Evidentiary Issues

• EIS was found to have technically breached its Agreement with TD Waterhouse by storing backup copies of TD Data on CDs commingled with data from other EIS clients, contrary to the Agreement's segregation requirements.
• Despite the breach, the commingled backup CDs did not worsen the complexity or cost of the data repatriation process, and the backup system actually preserved TD Data that became inaccessible after a cyberattack damaged EIS's servers.
• No breach was found regarding EIS's failure to notify TD Waterhouse of an attempted data breach, as the attack was successfully repelled and no TD Data was accessed or removed.
• TD Waterhouse's request to reduce the quantum meruit repatriation costs payable to EIS was dismissed, as the technical breach did not alter the effort or expense required to complete the repatriation.
• Compelling EIS to continue providing transition services beyond the original contractual period was granted by the court, on the same negotiated terms, until 12 months after repatriation is complete.
• TD Waterhouse's request to appoint KPMG Inc. as an implementation monitor was dismissed as an extraordinary and intrusive remedy not warranted by the circumstances.

Facts of the case

TD Waterhouse Canada Inc. ("TD Waterhouse"), a wealth management firm and wholly owned subsidiary of The Toronto-Dominion Bank, has maintained a commercial relationship with Electronic Imaging Systems Corporation ("EIS") since 1999. EIS, founded by Rose Kramer in 1977, designs, develops, and hosts customized workflow software and imaging systems for financial institutions and other clients. From 2007 onward, the parties' relationship was governed by a formal agreement executed June 19, 2007, subsequently amended ten times (the "Agreement"). Under the Agreement, EIS received documents from TD Waterhouse, imaged and indexed them, and uploaded them to a centralized portal for TD Waterhouse's use. In fall 2024, TD Waterhouse advised EIS it would not be renewing the Agreement and requested that EIS repatriate approximately 180 million unique images and associated metadata (the "TD Data"). The Agreement expired May 15, 2025, but contemplated a one-year transition period — expiring May 15, 2026 — during which EIS would continue to provide business-as-usual services.

On August 15, 2025, Justice Steele issued a mandatory injunction (the "Injunction") requiring EIS to return the TD Data and requiring TD Waterhouse to compensate EIS on a quantum meruit basis at commercially reasonable daily rates: TD Waterhouse Canada Inc. v. Electronic Imaging Systems Corp., 2025 ONSC 4718. By the time of the hearing on May 5, 2026, EIS had returned only approximately 5 million of the approximately 180 million images. A cyberattack on September 17, 2025, had been repelled by EIS's systems, but the attempted breach caused server damage that rendered much of the TD Data on EIS's servers inaccessible. The parties attended a joint technical meeting at EIS's offices on March 25, 2026, at which TD Waterhouse learned that backup copies of its data were stored on approximately 67,000 CDs commingled with data from other EIS clients. TD Waterhouse subsequently sought: (i) appointment of KPMG Inc. as an implementation monitor; (ii) a declaration that EIS had breached the Agreement; and (iii) amendments to the Injunction adjusting the repatriation costs payable by TD Waterhouse and extending the transition services period.

Policy terms and contractual clauses at issue

Three provisions of the Agreement were central to this motion. Section 16 — the segregation covenant — required EIS to ensure that "no TD data is used for any purpose whatsoever other than to provide the Services hereunder and, for greater certainty, will keep all TD data physically and logically secured and segregated from data used in EIS' own business." This provision was included in the original 2007 Agreement and all subsequent amendments. Section 14 of Schedule D set out EIS's data breach notification obligations, requiring EIS to notify TD Waterhouse "promptly, but in any event no later than 5 business days" after becoming aware of any unauthorized access, copying, modification, use, disclosure, or loss of TD Personal Information. Section 20(b) addressed transition services, permitting TD Waterhouse to require EIS to continue performing services for up to 12 months following termination or expiry, with TD Waterhouse retaining the right to terminate all or part of those services on 30 days' written notice.

Reasoning and analysis

On the question of the commingled backup CDs, Justice Steele applied the interpretive principles from Sattva Capital Corp. v. Creston Moly Corp., 2014 SCC 53, which require that contracts be read as a whole, giving words their ordinary grammatical meaning consistent with the surrounding circumstances, and in accordance with sound commercial principles: Scanlon v. Castlepoint Development Corp., (1992) 11 O.R. (3d) 744 (C.A.). The court found that Section 16 contained no carve-out permitting backup data to be held on commingled CDs, regardless of EIS's intent. Accordingly, EIS's unilateral decision to create backup CDs containing data from multiple clients constituted a technical breach of the Agreement. The court noted, however, that EIS's own affidavit evidence — sworn as early as April 25, 2025 — had disclosed the existence of these commingled CDs, undercutting TD Waterhouse's claim that it only discovered the commingling at the March 25, 2026 joint meeting. Critically, the court found that the technical breach caused no actual harm and did not complicate the repatriation process; indeed, the backup CDs preserved data that would otherwise have been lost following the cyberattack on EIS's servers. The court also noted that TD Waterhouse had conducted annual audits of EIS's contractual compliance without ever raising a concern about data storage practices.

On the notification obligation, the court agreed with EIS that Section 14 of Schedule D was not triggered because EIS's systems successfully repelled the attack — no TD Data was accessed, removed, or compromised, meaning the contractual threshold for notification was never met.

On the question of adjusting repatriation costs, Justice Steele applied the test from Labourers' International Union of North America, Local 183 v. Castellano, 2020 ONCA 71, and the equitable supervision principles from Doucet-Boudreau v. Nova Scotia, 2003 SCC 62. The court was not persuaded that the technical breach changed the compensation framework established in the Injunction. Ms. Kramer's evidence — unchallenged on this point — was that the repatriation process would be equally complex and time-consuming whether conducted from EIS's servers or the backup CDs. The court also noted that KPMG LLP's cost estimate of under $500,000 was based on TD Waterhouse's own understanding of the repatriation process, not EIS's specific systems, limiting its evidentiary weight.

On the transition services issue, the court distinguished this situation from cases cautioning against judicially compelled contract negotiations, such as Best Lifestyle v. County of Simcoe, 2019 ONSC 6619, and Vale Canada Ltd. v. Priestly Demolition Inc., 2020 ONSC 6763. Justice Steele found that the circumstances were exceptional: EIS was already obliged to repatriate data it had been holding for years; the repatriation would outlast the contractual transition period; and EIS itself had agreed to continue providing the services, seeking only to renegotiate the terms. The court noted that EIS held virtually all the negotiating leverage given its continued possession of the TD Data, and that extending the transition services on the existing contractual terms would both protect TD Waterhouse and incentivize EIS to complete repatriation efficiently.

On the implementation monitor, the court applied the intrusive remedy principles from Anderson v. Hunking, 2010 ONSC 4008, and Akagi v. Synergy Group (2000) Inc., 2015 ONCA 368, which require that receiver-like appointments be used sparingly and tailored carefully to the circumstances. The court found there was little to no risk of TD Waterhouse failing to recover its data given the existing Injunction and EIS's expressed willingness to cooperate. The court also observed that the delays in repatriation were partly attributable to TD Waterhouse itself, which had directed EIS to stop its repatriation work due to cost concerns.

Ruling and overall outcome

Justice Steele issued her endorsement on May 14, 2026. TD Waterhouse was partially successful. The court confirmed a technical breach of the Agreement by EIS with respect to the commingled backup CDs but found no breach of the data breach notification obligation. TD Waterhouse's request to appoint KPMG Inc. as an implementation monitor was dismissed, as was its request to reduce the repatriation costs payable to EIS under the Injunction. The court did grant TD Waterhouse's request to extend the transition services obligation: the Injunction was amended to require EIS to continue providing transition services until the date that is 12 months after EIS has completed the return of all images and associated metadata, subject to TD Waterhouse's right to terminate all or part of those services on 30 days' written notice. Because neither party was wholly successful on the motion, no costs were awarded — each party was ordered to bear its own costs.