Executive Summary: Key Legal and Evidentiary Issues

• Scope of Quebec’s private-sector privacy statute (LPRPSP) and whether Zenleads’ “business-to-business” data about professionals falls within, or is exempted by, the law’s exception for work-related contact information.
• Sufficiency of the plaintiff’s pleadings and evidence at authorization, including whether alleged facts about Apollo.io’s collection, profiling and commercialization of data disclose a “cause défendable” under art. 575 C.p.c.
• Characterization of the alleged conduct as civil faults under the Civil Code of Québec (arts. 35, 36, 37, 1457 C.c.Q.) and as violations of the Quebec Charter right to privacy, justifying compensatory and potentially punitive damages.
• Recognition of non-traditional harms (loss of control over personal data, algorithmic profiling, economic value of personal information) as compensable material and moral prejudice at the authorization stage.
• Treatment of the statutory “professional information” and “public information” exceptions, and whether LinkedIn-based and mobile-phone data, as well as inferred profiles, escape privacy protections.
• Adequacy of the proposed representative and definition of the class, including objective criteria, size, and the existence of common issues suitable for collective determination in a privacy class action.

Facts and background of the dispute

Cheikhou Badji, an individual residing in Québec, sought permission to bring a class action against Zenleads Inc., operator of the Apollo.io business intelligence and sales platform. He alleged that Zenleads collected, held, used, communicated and commercially exploited his and other Québec residents’ personal information without their consent. The claim was brought in the Superior Court of Québec, Class Actions Chamber, and this judgment deals only with whether the action may proceed as a class action, not with liability or damages on the merits.

Badji discovered that Apollo.io displayed a profile about him containing his full name, current employer, job title as an accountant, contact details and his complete professional background, together with a link to his LinkedIn profile. He maintained that he never consented to Zenleads’ collection, retention, use or communication of this information, had no contractual relationship with the company, and did not authorize any commercial use of his data. He further alleged that the platform monetizes access to certain data points, such as mobile numbers and emails, by requiring the expenditure of “credits” when users click to reveal these fields.

According to the allegations, Zenleads operates a contributor network that integrates with customers’ customer-relationship management (CRM) systems, address books, email inboxes and electronic calendars. Through these integrations, it is said to harvest personal information about third parties—people who are not Zenleads’ customers and who are unaware their information is being collected. The plaintiff also claimed that Zenleads’ systems engage in algorithmic profiling, generating scores or inferences about individuals (for example, predicting interests or behavior) that are then used to enhance the commercial value of Apollo.io’s database.

Badji proposed to represent a group defined as all natural persons residing in Québec whose personal information was held, collected, used, communicated and/or otherwise commercialized by Zenleads without their consent since 2 June 2022. The definition has two prongs: persons whose information was already in Zenleads’ systems before that date but continued to be exploited thereafter, and those whose information was first collected after that date. The start date corresponds to the start of the non-prescribed period, three years before filing.

Legal framework governing authorization of the class action

At this stage, the Court’s role is limited to a “filtering” function under article 575 of the Code of Civil Procedure. The judge must determine whether the plaintiff meets four conditions: that the claims raise common legal or factual questions; that the alleged facts appear to justify the conclusions sought; that the composition of the group makes mandates or joinder impracticable; and that the proposed representative can adequately represent the class. The threshold is intentionally low: the plaintiff need only show a “cause défendable”—a simple possibility of success—not a realistic or reasonable likelihood of prevailing at trial.

The judge emphasized that authorization is not a trial on the merits. Facts well pleaded are taken as true unless contradicted by documentary evidence, and the court must avoid a detailed assessment of evidence which can only properly be made at trial, especially where relevant information is in the defendants’ control. The Court also stressed that while class actions serve important social objectives—access to justice, deterrence, victim compensation, and efficient use of judicial resources—those objectives do not replace the statutory criteria. Defendants should only have to face a class proceeding where the asserted claim is at least supportable on its face.

Alleged statutory and civil faults relating to personal information

Badji’s claim relies heavily on Québec’s private-sector privacy statute, the Loi sur la protection des renseignements personnels dans le secteur privé (LPRPSP). He invoked provisions that limit collection to necessary information, require lawful means of collection, oblige collection directly from the person concerned unless exceptions apply, and impose strict duties to inform individuals about the purposes of collection, the means used, their rights of access and rectification, and their right to withdraw consent. The LPRPSP also restricts communication of personal information to third parties absent consent or a statutory authorization, and requires express consent for sensitive information.

The Civil Code of Québec provisions on privacy and civil liability are also central. Articles 35–37 C.c.Q. protect the right to respect for private life and restrict constitution, use and communication of “dossiers” about individuals to situations where there is a serious and legitimate interest, limiting collection to relevant information and prohibiting unauthorized communication or incompatible uses. Article 1457 C.c.Q. contains the general fault-based liability rule, imposing a duty to follow rules of conduct to avoid causing harm to others, with liability for material, moral or bodily injury caused by fault.

On the constitutional-like side, the plaintiff alleged violations of the Québec Charter of human rights and freedoms, particularly articles 4, 5 and 9, dealing with dignity, honor and reputation, respect for private life, and professional secrecy. The judge underscored that privacy protections in Canadian law have been characterized by the Supreme Court as having quasi-constitutional status, and that the right to privacy under the Charter encompasses confidentiality, control and anonymity in respect of personal data.

The contested “professional information” and public-information exceptions

Zenleads’ principal defence at authorization was that the information at issue concerned the exercise of professional functions and therefore fell within the LPRPSP’s express carve-out for “renseignements personnels qui concernent l’exercice par la personne concernée d’une fonction au sein d’une entreprise,” such as name, job title, business address, business email and business telephone number. On this view, Apollo.io was essentially a digital business-card exchange built from public or semi-public sources, placing it outside much of the statute’s protective machinery.

The Court refused to dispose of the case at the authorization stage on this basis. The allegations indicated that Zenleads held more than standard professional contact information: in Badji’s case, a link to his full LinkedIn profile, his mobile phone number and his full professional trajectory, as well as algorithmically generated inferences or scores about him. The judge found it was not clear at this stage whether such elements qualify as exempt “function-related” information. For example, whether a mobile number used in both personal and professional contexts, or a link to a rich LinkedIn profile, should be treated as exempt professional information or as protected personal data is a matter for full evidence and legal debate.

Similarly, the Court declined to hold at this early stage that data scraped from sites like LinkedIn is outside the LPRPSP merely because it might be considered “public.” The judgment noted that prior privacy decisions involving facial recognition databases and social media scraping illustrate that the public character of a source does not automatically remove information from statutory privacy protection. Whether Zenleads’ use of data from LinkedIn or other platforms falls within the law’s public-information exception is therefore reserved for the merits.

Algorithmic profiling and the evolving concept of privacy harm

A distinctive feature of the case is the emphasis on algorithmic profiling. Badji alleged that Zenleads uses predictive analytics to infer characteristics, interests and potential behaviors of individuals, thereby creating new layers of personal information beyond the raw data originally collected. The LPRPSP now contains specific provisions addressing technologies used to identify, locate or profile individuals, requiring transparency and limiting their use absent proper consent.

The judge accepted that, at least at authorization, the alleged use of profiling techniques, together with the large-scale commercialization of inferred data, could amount to both statutory violations and independent civil faults. The judgment acknowledges recent case law recognizing that unauthorized use of personal information—in particular in digital and AI-driven environments—can itself constitute an infringement of the Charter right to privacy. Loss of control, targeted behavioral tracking, and the risk of discriminatory pricing or manipulation were treated as plausible forms of harm that warrant collective examination at trial.

Assessment of the alleged prejudice and causation

The plaintiff pleaded a detailed list of harms said to flow from Zenleads’ activities. These included irreversible loss of control over personal information; exposure to behavioral tracking and manipulation through targeted campaigns affecting purchasing decisions or political opinions; stress and anxiety about possible misuse or fraud; risk of discriminatory pricing and other forms of algorithmically driven disadvantage; and impairment of autonomy in decision-making due to non-consensual behavioral nudging. He also claimed that members had incurred or would incur costs to protect their digital identities and had suffered inconvenience and uncertainty about the scope of the unauthorized data dissemination.

The judge found these allegations clear and sufficiently specific to meet the low threshold at authorization. In particular, the claim that the economic value of personal information appropriated and commercialized by Zenleads constitutes material loss was held to be arguable, drawing on recent Québec jurisprudence that accepted similar theories in other privacy class actions. The Court emphasized that the exact quantum of loss need not be established at this stage.

As for causation, the Court accepted that there is at least a prima facie factual presumption linking the alleged unlawful collection and commercialization of data to the claimed damages. It is reasonable to presume that any loss in the value of personal data or the privacy harms alleged arises, if proven, from Zenleads’ practices. The Court therefore concluded that the three elements of extra-contractual liability under article 1457 C.c.Q.—fault, damage and causal link—were adequately alleged for authorization purposes.

Charter violations, secret professional communications and punitive damages

The Court drew a distinction among the different Charter-based theories advanced. It held that the allegations were sufficient to support an arguable Charter violation of the right to respect for private life under article 5, given the nature of the data and the alleged loss of control. However, the claims relating to professional secrecy and to harm to dignity, honor and reputation (articles 4 and 9) were found too hypothetical or vague. The pleadings did not adequately show that confidential professional communications protected by privilege had actually been captured, nor did they concretely describe reputational harm specific to Badji. These aspects will not proceed as distinct causes of action.

On punitive damages, the plaintiff sought an award under both the Charter (article 49, second paragraph) and the LPRPSP (article 93.1), which sets a minimum punitive amount of CAD 1,000 where an intentional or grossly negligent illegal intrusion into protected rights causes prejudice. The Court recalled that, at authorization, it is enough that the pleading as a whole allows the tribunal to infer an alleged “atteinte illicite et intentionnelle”—conduct done in full knowledge of its likely consequences or with a will to produce them, going beyond mere negligence.

Here, the Court held that the detailed description of Zenleads’ business model—building a for-profit platform on the non-consensual harvesting, enrichment and sale of individuals’ personal information—supports an arguable inference that any rights violations, if proven, were committed knowingly and for profit. This was sufficient to allow the punitive-damages claim to proceed to trial, with the assessment of amount, if any, reserved for the merits.

Class definition, common questions and representative adequacy

On class definition, the Court held that the proposed group—Québec residents whose personal information was collected, held, used, communicated and/or commercialized without consent since 2 June 2022—is based on objective and verifiable criteria. It noted that the likely number of affected individuals is very large (estimated around one million), that Zenleads is in a position to identify them from its databases, and that proceeding by individual mandates or joinder is impracticable in these circumstances. The bifurcated structure of the class (pre-existing data continuing in use after the start date, and newly collected data) was found to contribute to clarity.

The judge also confirmed that there were several significant common questions suitable for collective determination. These include whether Zenleads’ practices violate the LPRPSP, the Civil Code and the Charter; whether the personal information at issue has compensable economic value; whether members suffered material or moral prejudice as a result of non-consensual collection and commercialization; and whether punitive damages are warranted. One proposed common issue, relating specifically to professional secrecy, was effectively set aside because the underlying cause of action was not sufficiently alleged. Otherwise, the common-issue requirement was clearly satisfied.

Regarding representative adequacy, the Court found that Badji has a personal, arguable claim against Zenleads based on the presence of his own detailed profile on Apollo.io, encompassing both basic contact data and more extensive professional and inferred information. He alleges the same type of rights violations as other class members, has an evident interest in pursuing the case, and no conflict of interest with the group was identified. Accordingly, he was deemed a proper class representative.

Outcome of the authorization decision and monetary consequences

In its dispositive section, the Superior Court granted Badji’s application for authorization of a class action and for his designation as representative. The Court authorized the class action against Zenleads Inc., confirmed the class definition, identified the principal common questions, and set out the main conclusions sought, including collective recovery of compensatory damages allegedly equal in part to the value of the personal information exploited, as well as collective punitive damages, subject to proof at trial. It also determined that, barring timely exclusion, members would be bound by the eventual judgment, fixed a 60-day opt-out period following notice to members, and indicated that further debate on the content and mode of publication of notices would occur later.

For present purposes, this judgment does not decide Zenleads’ liability or fix any amount of damages, costs or fees. It simply opens the door for the class proceeding to go forward on the merits in the District of Montréal. The successful party at this stage is Cheikhou Badji, whose application for authorization is allowed, but no specific monetary award or quantified costs are ordered in his or the class members’ favor in this authorization judgment, and the total amount of any future monetary recovery, if any, cannot yet be determined.