Executive Summary: Key Legal and Evidentiary Issues

• Matthew Wright brought a proposed class proceeding against General Motors Financial of Canada, Ltd. and three individual defendants over a data breach involving customer personal and financial information.
   
• Between 2012 and 2015, an employee or employees of GM Financial allegedly accessed customer data that was later used in an identity theft scheme, prompting notification to more than 2,000 potentially affected customers.
   
• Nine class members, designated Group 1, are known to have suffered actual identity theft as a result of the breach.
   
• Certification for settlement purposes occurred on March 24, 2026, followed by a formal notice and opt-out process with only one timely opt-out and no objections.
   
• Justice MacLeod applied the two-part test from Cass v. WesternOne Inc. to assess whether the settlement was fair, reasonable, and in the best interests of the class.
   
• Approval extended to a $898,930.00 total settlement value, including compensation for class counsel, a claims administrator, and an honorarium to the representative plaintiff.
   

Facts of the case

Matthew Wright commenced this proposed class proceeding in 2016 against General Motors Financial of Canada, Ltd. and three individual defendants, Moussa Kante, Cynthia Gilbert, and Line Pharand. The claim arose from a data breach in which an employee or employees of GM Financial, or its predecessor FinanciaLinx Corporation, accessed the personal and financial information of customers between 2012 and 2015 in the course of automobile financing services. That information was used, disseminated, or sold as part of an identity theft scheme. GM Financial became aware of the situation in 2015 and notified more than 2,000 potentially affected customers. Several individuals were subsequently arrested and prosecuted, and the individual defendants in this action did not defend the claim, were noted in default, and pled guilty to possession of falsified identification in the names of certain class members. Some customers became victims of identity theft, while many more remained at risk without having suffered actual harm. The plaintiff sought damages exceeding $60,000,000, along with the cost of credit monitoring, identity theft insurance, out-of-pocket expenses, and other losses. After GM Financial served a Notice of Intent to Defend, the parties exchanged mutual disclosure and discovery and engaged in what the court described as vigorous negotiation, reaching a settlement in October of the prior year, subject to court approval.

Policy and legislative provisions at issue

The settlement approval was governed by section 27.1 of the Class Proceedings Act, 1992, which sets the primary consideration as whether a proposed settlement is fair, reasonable, and in the best interests of the class. Justice MacLeod noted that although the 2020 amendments codifying this standard did not apply when the action was commenced in 2016, they were consistent with the pre-existing jurisprudence. The settlement agreement itself contained a provision capping the defendant's total exposure, describing the settlement amount as inclusive of class counsel fees and disbursements, distributions to the settlement class, cy-pres donations, costs and interest, the plaintiff's honorarium, administration expenses, and applicable taxes. Under the agreement, the class was defined as anyone who provided personal information to GM Financial or its predecessor while obtaining automobile financing and who received the 2015 breach notification. The certified common issue asked whether the settling defendant owed a duty of care to the plaintiff and class members, whether that duty was breached, and what damages, if any, resulted.

Reasoning and analysis

Justice MacLeod adopted the analytical framework from Cass v. WesternOne Inc., 2018 ONSC 4794, which he found consistent with the criteria later codified in the Act, as discussed in Dufault v. The Toronto-Dominion Bank, 2024 ONSC 961. That framework calls for two exercises: a risk analysis comparing the settlement against likely trial outcomes without deciding the merits, and a structural analysis of the fairness of the settlement's terms and distribution scheme, as described in Redublo v. CarePartners, 2022 ONSC 1398. Citing Forbes v. Toyota Canada Inc., 2018 ONSC 5369, the court emphasized that the legislation exists to provide access to justice without foreclosing the rights of class members to meaningful compensation, while Buis v. Keurig Canada Inc., 2025 ONSC 6875, supported the view that an exhaustive re-analysis is unnecessary on every approval motion. Applying these principles, the court found the settlement was negotiated at arm's length after strenuous negotiation, and that class members other than the nine known identity theft victims were unlikely to have recovered compensation through any other process. Because the underlying events occurred more than a decade earlier, the court accepted that resulting harm had likely already crystallized, allowing affected members to self-identify. The court also considered the honorarium request under Haikola v. The Personal Insurance Company, 2019 ONSC 5982, finding the modest amount justified given the plaintiff's time and exposure to risk, and reviewed the contingency fee arrangement with reference to Dufault, noting that class counsel had funded the litigation and achieved a significant result despite recovering less than the amount originally claimed.

Ruling and overall outcome

Justice MacLeod approved the settlement, finding it fair, reasonable, and in the best interests of the class as a whole. The court approved a total settlement value of $898,930.00, of which $200,000.00 represented the cost of credit monitoring and identity theft insurance already provided to class members. Compensation components were also approved, comprising $71,191.70 in claims administrator expenses, a $2,000.00 honorarium to the representative plaintiff, and $253,808.30 in class counsel fees, disbursements, and HST. Remaining settlement benefits, capped at $371,930.00, provide $7,000.00 to Group 1 class members and others demonstrating identity theft, with up to an additional $5,000.00 per person for receipted out-of-pocket expenses, while other class members receive $85.00 each; any unclaimed funds are to be distributed cy-pres to Pro Bono Ontario. No single global damages figure was awarded to the class as a whole, as compensation varies by category of claimant and depends on individual claims submitted through the approved process.