Search by
Facts of the case
Mackenzie Financial Corporation is an investment management company that engaged InvestorCOM Inc. ("ICOM"), a regulatory compliance and customer communications service provider, to produce and deliver written communications required to be sent to investors. To facilitate ICOM's services, Mackenzie provided its investors' personal information to ICOM — including, in many cases, social insurance numbers that were embedded within an undifferentiated field of digits, which ICOM was unaware of. On March 22, 2023, ICOM learned that a cybercriminal group known as Cl0p ("CLOP") had exploited a vulnerability in "GoAnywhere" software licensed and used by ICOM. CLOP gained unauthorized access to files on an ICOM server (the "Cyberbreach") and accessed data relating to approximately 1.487 million Canadian Mackenzie investors, including just over 1.262 million social insurance numbers (the "Mackenzie Data"). The plaintiff pleaded that CLOP also exfiltrated — that is, stole — the Mackenzie Data, though the defendants denied this, noting that the Mackenzie Data was not included in CLOP's publication of data stolen from ICOM after ICOM refused to pay a ransom demand. After learning of the Cyberbreach, ICOM notified Mackenzie, which in turn notified its investors, including the plaintiff Martin L'Anton. Mackenzie engaged TransUnion and subsequently Equifax to provide no-cost credit monitoring and identity theft protection services, initially for two years and later extended to five years. The plaintiff registered for the TransUnion services and also purchased additional credit monitoring from Equifax independently.
In response to the breach, two separate proposed multi-jurisdictional class actions were commenced. L'Anton commenced this BC Action, and two investors — Alexander Litvin and David McNairn — commenced an action in Ontario (the "Ontario Action"). Both actions advanced claims in negligence, breach of contract, and statutory privacy torts under statutes in four jurisdictions: British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador (the "Statutory Privacy Tort Provinces"). The Ontario Action additionally included a breach of fiduciary duty/breach of trust claim against Mackenzie. The Ontario Action was subsequently certified as a multi-jurisdictional class proceeding in respect of negligence, breach of contract, and breach of fiduciary duty claims, but the Ontario court declined to certify the provincial privacy legislation claims on the ground that it lacked jurisdiction to grant remedies under those statutes: Litvin et al v. Mackenzie Financial Corporation et al, 2025 ONSC 6138.
Contractual and statutory provisions at issue
The plaintiff's breach of contract claim against Mackenzie relied not only on Mackenzie's contract with its customers, but also on Mackenzie's Privacy Protection Notice ("PPN"), a Privacy Protection Statement ("PPS"), and Mackenzie's contract with ICOM (the "ICOM Contract"). The plaintiff argued that the PPN and PPS formed part of Mackenzie's contract with its investors and that aspects of PIPEDA were incorporated into the PPN by reference, creating contractual obligations. As against ICOM, the plaintiff pleaded that class members were third-party beneficiaries of the ICOM Contract, relying on language in the PPN regarding protection of personal information in Mackenzie's contracts with third parties and on Mackenzie's ability to oversee and audit ICOM's services. The court found it was at least arguable that the PPN and PPS could give rise to contractual obligations between Mackenzie and the plaintiff, and that the class members could potentially be found to be intended beneficiaries of the ICOM Contract, given that the sharing and use of their personal information was central to ICOM's services. The statutory privacy tort claims arose under the Privacy Act, R.S.B.C. 1996, c. 373; Privacy Act, C.C.S.M. c. P125; Privacy Act, R.S.S. 1978, c. P-24; and Privacy Act, R.S.N.L. 1990, c. P-22 — each of which creates a tort for unlawful violation of privacy actionable without proof of loss.
Court's reasoning and analysis
Justice Ramsay applied the well-established certification framework under s. 4(1) of the Class Proceedings Act. On the pleadings requirement under s. 4(1)(a), the court found that the breach of contract claims against both Mackenzie and ICOM disclosed arguable causes of action, declining to engage in the merits assessment that would be required to resolve Mackenzie's argument that the PPN and PPS could not give rise to contractual obligations. On negligence, the court accepted that it was at least arguable that both Mackenzie — as the data custodian who collected and then provided the class members' personal information to ICOM — and ICOM — which had actual custody of that data — owed a duty of care to the proposed class members. The claim for damages for mental or emotional distress was, however, struck at the pleadings stage, as the ANOCC did not plead material facts sufficient to allege psychological injury rising above ordinary anxiety. Claims for damages reflecting an increased risk of future harm and out-of-pocket credit monitoring expenses were found to be at least arguable, relying on Tucci v. Peoples Trust Company, 2023 BCSC 2004 and Campbell v. Capital One Financial Corporation, 2022 BCSC 928. On the statutory privacy tort claims, the court found the pleaded failures in data storage and protection sufficient to give rise to an arguable claim of wilful violation of privacy, drawing on G.D. v. South Coast British Columbia Transportation Authority, 2024 BCCA 252. The court also found the s. 4(1)(b) identifiable class requirement met, but amended the proposed class definition to exclude Quebec residents given the failure to satisfy the pleadings requirement in relation to Quebec law claims. Common issues were found to exist across the remaining claims, and the representative plaintiff was found adequate.
On the multi-jurisdictional preferability analysis under s. 4(3) of the CPA, the court concluded that — with the exception of the Privacy Act claims — it was preferable for claims to be resolved in the Ontario Action. Key factors included the existence of an already-certified national class proceeding in Ontario, the risk of irreconcilable findings, and the objective of judicial economy. The Ontario Action also included a breach of fiduciary duty claim not advanced in BC, which further weighed in favour of Ontario. The court rejected the plaintiff's proposal to have both proceedings run concurrently on a coordinated basis, finding it an extraordinarily novel and unworkable proposal. However, the court found that the Privacy Act Claims — which the Ontario court had declined to certify for jurisdictional reasons — were uniquely available in the BC Action and that residents of the Statutory Privacy Tort Provinces had a strong interest in having those claims adjudicated in British Columbia.
Ruling and overall outcome
The BC Action was certified as a class proceeding, but only in respect of the common issues arising out of the Privacy Act Claims. The plaintiff, L'Anton, achieved partial success: the BC Action was certified as a class proceeding, but certification was confined to the statutory privacy tort claims. All remaining claims — negligence, breach of contract, and others — were found preferable for resolution in the Ontario Action pursuant to s. 4(3) of the CPA. The certification order was made without prejudice to future applications should the outcome of the Ontario Action appeal change the relevant circumstances. No monetary award was made, and no costs were awarded for the hearing, in accordance with s. 37(1) of the CPA.
Download documents
Plaintiff
Defendant
Other
Court
Supreme Court of British ColumbiaCase Number
S238293Practice Area
Class actionsAmount
Not specified/UnspecifiedWinner
Trial Start Date