Executive Summary: Key Legal and Evidentiary Issues

• Elizabeth Finley brought a proposed class action on behalf of 359,663 Ontario residents whose personal health information was allegedly stolen from Ontario's COVaxON vaccination system.
• Central to the claim is the tort of intrusion upon seclusion and whether Raise Limited is vicariously liable for the alleged misconduct of its employee, Ayoub Sayid.
• Sayid and Rahim Abdu were charged with unauthorized use of a computer under s. 342.1(1)(c) of the Criminal Code following a November 2021 search warrant executed by the Ontario Provincial Police.
• Proving that the breach caused class members distress, humiliation, or anguish — elements required to establish compensable harm — presented a significant evidentiary challenge for class counsel.
• Given the size of the class and the difficulty of individual recovery, the $600,000 settlement fund was directed cy-près to MediaSmarts, a Canadian non-profit focused on digital literacy and online safety.
• No objections or opt-out requests were received, and the court approved the settlement as fair, reasonable, and in the best interests of the class.

Facts of the case

During and after the COVID-19 pandemic, the Ontario government established the COVaxON system to manage vaccination data, allowing the Ontario Ministry of Health, vaccination locations, and staff to collect and use personal health information of Ontario residents. Raise Limited, a staffing and consulting services company, was contracted by Ontario to support the COVaxON system. Its personnel were required to collect personal health information from individuals, upload it into COVaxON, and use it to manage vaccine records, reminders, and certificate updates.

On 6 July 2021, plaintiff Elizabeth Finley and her daughter attended a COVID-19 vaccination clinic in Niagara Falls. In booking her appointment through the Ontario Ministry of Health vaccination booking system, she provided her name, address, telephone number, health card number, and other personal health information. Ayoub Sayid, an employee of Raise Limited, is alleged to have stolen the personal health information of class members — including Ms. Finley — and, together with Rahim Abdu and possibly others, sent scam text messages to some of those individuals. Following the execution of search warrants by the Ontario Provincial Police in November 2021, several devices, computers, and laptops were seized, and both Mr. Sayid and Mr. Abdu were taken into custody and charged with unauthorized use of a computer contrary to s. 342.1(1)(c) of the Criminal Code. On 16 November 2021, Ms. Finley was among 359,663 individuals notified by the Ontario Provincial Police that their personal health information in Ontario's COVID-19 vaccination system had been accessed without authorisation, and that her name and phone number were found on the accused's seized laptops.

Contractual and statutory framework

Raise Limited's obligations arose from its contract with Ontario to support the COVaxON system, under which its personnel were authorised to access and manage personal health information for defined vaccination management purposes. The plaintiff's claims were advanced under the tort of intrusion upon seclusion and vicarious liability. The certification criteria were assessed under s. 5(1) of the Class Proceedings Act, 1992, S.O. 1992, c. 6, while settlement approval was governed by s. 27.1(5) of the same Act, which requires the court to find that a settlement is fair, reasonable, and in the best interests of class members before it can be approved.

Court's reasoning and analysis

The court was satisfied that the certification criteria under the Class Proceedings Act had been met. The pleaded allegations disclosed a viable cause of action in intrusion upon seclusion and vicarious liability; there was an identifiable class of 359,663 individuals; vicarious liability raised a common issue across all claims; and a class proceeding was the preferable procedure, avoiding duplication, ensuring consistent findings, and resolving claims efficiently. Elizabeth Finley was found to be an appropriate representative plaintiff with no apparent conflict with the class.

On settlement approval, the court acknowledged genuine litigation risk. Not all unauthorised access to personal health information will support a class action grounded in intrusion upon seclusion, as illustrated by Stewart v. Demme, 2022 ONSC 1790 (Div. Ct.). Even if such a claim could be sustained, proving that the breach caused individual class members distress, humiliation, or anguish — and therefore compensable harm — would have remained difficult. Despite investigative efforts by class counsel, very few putative class members came forward with supporting evidence, and any per capita recovery would likely have been nominal given the size of the class. The settlement was reached through arm's-length mediation before the Honourable Thomas Lederer, a retired judge of the court, with the assistance of experienced counsel. Consistent with the principles in Wein v. Rogers Cable Communications Inc., 2011 ONSC 7290, Przybylska v. Gatos Silver, Inc., 2024 ONSC 2196, and Rabbat v. Nadon, 2025 ONSC 5187, the court was entitled to assume, in the absence of evidence to the contrary, that the settlement presented by experienced class counsel represented the best reasonably achievable outcome.

Because individual distributions were infeasible given the size of the class, the net settlement funds were directed cy-près to MediaSmarts, a Canadian non-profit organisation and registered charity. MediaSmarts focuses on digital literacy, online privacy, cybersecurity education, media literacy, and public education concerning online risks, including scams and misuse of personal information — areas directly connected to the issues raised by this case. The organisation proposed to use the funds to build on its established "Break the Fake" programme by developing a new workshop focused on practical skills for preventing online scams and fraud. The court also found the proposed class counsel fees reasonable: the contingency fee was appropriately reduced from 33% to 25% of the gross recovery, with between 350 and 375 hours of fee-earner work anticipated by the time the settlement is finalised.

Ruling and outcome

The court certified the action as a class proceeding for settlement purposes and approved the $600,000 all-inclusive settlement fund. Class counsel fees of $150,000 (25% of the gross recovery) plus HST and disbursements of $46,000 were approved, leaving a net settlement amount of $384,500 to be distributed cy-près to MediaSmarts. No objections or opt-out requests were received. The plaintiff, Elizabeth Finley, on behalf of the class of 359,663 Ontario residents, was the successful party. The court approved the settlement, the designation of MediaSmarts as cy-près recipient, the release provisions, and all other relief sought in the notice of motion as fair, reasonable, proportionate, and in the best interests of the class.