Key Points:

• Background:

  • ICBC employee Candy Rheaume accessed and sold personal information (linking license plates to home addresses) of customers.
  • This information was used for criminal activities, including arson and shootings.
  • ICBC was found vicariously liable for the breach of privacy under the Privacy Act, R.S.B.C. 1996, c. 373.

• Appeal Issues:

  • ICBC argued the information was not private, vicarious liability was improperly imposed, and general damages should not be class-wide.

• Court Findings:

  • Privacy Expectation:
    • Customers had a reasonable expectation that ICBC would use their information only for legitimate purposes.
    • The employee’s conduct in selling information violated privacy.
  • Vicarious Liability:
    • ICBC was liable as it created the risk and opportunity for the employee's misconduct, which was related to her duties.
  • General Damages:
    • The Privacy Act allows class-wide general damages without individualized proof.

• Outcome:

  • Appeal dismissed; ICBC's liability upheld. However, the specific total monetary award, including costs and damages, was not detailed in the provided document.

Legal Principles:

• Privacy Act (BC):
  • Establishes a statutory tort for willful violation of privacy, actionable without proof of damage.
  • Privacy expectations are contextual.
• Vicarious Liability:
  • Employers can be liable for employees’ actions if related to job duties and if the employer created the risk.

Implications:

• Organizations must protect customer information and monitor employee access.
• Privacy breaches can lead to class action claims and significant legal consequences.