Executive Summary: Key Legal and Evidentiary Issues

• Adequacy of Estée Lauder’s safeguards for storing and protecting customers’ personal and financial information in Canada.
• Timeliness and sufficiency of Estée Lauder’s notices to affected individuals about the May and July 2023 data breaches.
• Potential liability of Estée Lauder for compensatory, moral and punitive damages arising from the confidentiality incidents.
• Appropriateness of authorizing a national class action for settlement purposes only, without any admission of liability.
• Compliance of the proposed pre-approval notices and notice program with Québec’s Code of Civil Procedure requirements.
• Rights of class members to opt out, to object, and the procedural consequences if the settlement is not ultimately approved.

Background and facts of the data breach class action
The case arises from two reported confidentiality incidents involving personal and financial information held by Estée Lauder in Canada. The first incident allegedly occurred on or around May 31, 2023, and the second on or around July 12, 2023. According to the judgment, the plaintiff, Liraz Cohen, alleges that personal or financial information of customers held by Estée Lauder was compromised and/or stolen in those events. Individuals were also notified by Estée Lauder via email or letter on or about October 19, 2023, regarding the May incident, and on or about September 5, 2023, regarding the July incident. The class consists of all persons in Canada whose personal or financial information was allegedly compromised in either incident, or who received the corresponding notification letters or emails about the May or July 2023 breaches.

Commencement of the proposed class action
On September 7, 2023, the plaintiff filed an application in the Superior Court of Québec (Class Action Division) seeking authorization to institute a national class action against Estée Lauder Cosmetics Ltd. and The Estée Lauder Companies Inc. The claims focus on alleged wrongs associated with the data breaches, including how the information was stored and the way in which the incidents were communicated to affected persons. At the time of this judgment, the class action had not yet been authorized on a contested basis. Instead, the matter comes before the Court in the specific context of a proposed settlement, with Estée Lauder agreeing to a settlement-only class authorization.

Settlement agreement and class authorization for settlement purposes
On April 20, 2026, the parties entered into a formal Settlement Agreement to fully and finally resolve all claims asserted by the plaintiff and the putative class members in relation to the data breach allegations. Estée Lauder expressly consented to the authorization of a national class action for settlement purposes only, and without any admission of liability. The Court concluded that the plaintiff’s application met the criteria under article 575 of the Québec Code of Civil Procedure, which governs authorization of class actions. On that basis, the Court authorized the bringing of the class action against Estée Lauder for settlement purposes only and granted the plaintiff, Liraz Cohen, the status of representative for the defined class. The judgment also formally adopts, by reference, the definitions contained in the Settlement Agreement, ensuring that the settlement’s terminology and class definition govern for the purposes of this judgment.

Common questions and alleged faults
For settlement purposes, the Court identified several common questions of fact and law to be treated collectively. First, it will be examined whether Estée Lauder committed a fault regarding the storage and safe-keeping of class members’ personal information. Second, the case raises whether Estée Lauder erred by delaying notification or failing to properly notify class members that a data breach had occurred. Third, there is a question as to whether Estée Lauder’s notices and information provided about the data breach were deficient, potentially amounting to a further fault. Finally, the settlement framework contemplates whether Estée Lauder may be liable for compensatory damages, moral damages or punitive damages and, if so, in what amounts. These questions frame the legal and evidentiary issues that the settlement approval process must address in order to determine whether the proposed resolution is fair and reasonable for the class.

Notice program, opt-out rights and objections
Because the Court has authorized the class action for settlement purposes, it must ensure that class members receive proper notice and a meaningful opportunity to decide whether to participate. The Court approved the draft pre-approval notices attached to the Settlement Agreement and ordered that they be published and disseminated in accordance with the agreed-upon notice program. The judgment sets the settlement approval hearing for June 3, 2026, at the Montreal Courthouse. At that hearing, the Court will be asked to determine whether the Settlement Agreement is fair, reasonable and in the best interests of the class, and whether to grant class counsel’s application for fees, disbursements and applicable taxes, along with any other appropriate matters. Class members are given the right to opt out of the class action, with a deadline of 30 days after the notice date. Those who opt out will not be bound by the Settlement Agreement, will not receive any benefits under it if approved, and will have no standing to oppose its approval. Class members who remain in the class may submit written objections to the settlement before the deadline stated in the notices, or they may object in person at the approval hearing. The Court also approves the appointment of Concilia Services Inc. as the Settlement Administrator, tasked with carrying out the functions, roles and responsibilities set out in the Settlement Agreement.

Effect of non-approval and overall outcome
The judgment addresses the procedural consequences if the Settlement Agreement is not ultimately approved or is terminated in accordance with its terms. In that scenario, all negotiations, statements and procedures related to the Settlement Agreement will be deemed to have been made without prejudice to the rights of the parties, and the parties will be restored to their respective positions as they were immediately before signing the agreement. This structure preserves each side’s litigation rights in the event the settlement does not receive final judicial approval. In terms of outcome, this particular decision is not a final merits judgment and does not approve the settlement itself. Instead, it grants the plaintiff’s application to authorize the class action for settlement purposes, approves the notice regime, sets the approval hearing, and names the settlement administrator. In that procedural sense, the successful party at this stage is the plaintiff, Liraz Cohen, in her capacity as proposed representative for the national class, because the Court grants the relief she sought in connection with settlement-only authorization and notice. No monetary award, costs, or damages are ordered in this judgment, and the judgment is explicitly rendered without legal costs, so the total amount granted in favor of the successful party cannot yet be determined.