Four decades of building expertise in a practice area that barely had a name, that is the vantage point Ronald D. Davis brings to the current crisis in Canadian privacy and data security law. Now senior counsel, class actions, at Diamond & Diamond Lawyers LLP, Davis argues that the most consequential legal reckoning in this space is still ahead. Canadian Lawyer spoke with him about the legal gaps that remain, the cases pushing the boundaries of privacy protection, and why class actions may be the most effective tool available for driving change.
Privacy and data security law did not exist as a formal practice area when Ronald D. Davis, senior counsel, class actions at Diamond & Diamond Lawyers LLP, was called to the Ontario bar in 1984. Public awareness accelerated following the Cambridge Analytica scandal in 2018, which Davis notes was widely misunderstood: the central wrong was a breach of Facebook's platform rules and users' privacy expectations. Ontario courts have since recognised new torts, including intrusion upon seclusion and internet harassment. A trilogy of cases released on November 25, 2022 began to address cyber breach liability directly. "I would say it's been the boiling frog phenomenon," Davis says. "We were all in the water from the beginning, and then the heat started to turn up. Now, the temperature is definitely at the boiling point with cybersecurity and data breaches."
The scale of the problem is measurable. The Office of the Privacy Commissioner of Canada received almost 700 breach reports from businesses under PIPEDA in fiscal 2025–2026, and more than 20 million Canadians were affected by those breaches. Those figures come from the OPC's news release of June 4, 2026, which accompanied the annual report Championing Privacy in the Age of AI. Federal institutions filed 451 separate breach reports, affecting 48,159 Canadians. PIPEDA complaints reached 3,044, up 109 percent over the previous year. Privacy Act complaints came to 3,146, up 62 percent. The numbers make clear that reported incidents are rising sharply across both private-sector and federal-institution channels.
The law has not yet caught up with the harm. Davis argues that the most consequential legal moment in the space is still ahead, because there has not yet been what he describes as a "Donoghue v. Stevenson moment, when the courts define the tort or the wrong that is compensable to those who have suffered injury because of the fault of another." The structural gap compounds a practical one. "You often can't find the bad actor who instigated the breach," he says. "They're on some remote shore counting the money they've stolen, or holding key data to ransom, and there are few good options. The law is always behind technology; it's always catching up. Everybody is figuring it out in real time."
Davis is part of a team representing three complainants in British Columbia who allege that federal political parties are not observing best privacy practices under provincial law. Six years in, the team has prevailed at the BC Privacy Commissioner level and at the BC Supreme Court on whether provincial privacy laws apply to federal political parties. As of May 2026, the case was before the BC Court of Appeal and still awaiting a decision. "There is still a long way to go in this case," Davis says, "but whatever the result, favourable or unfavourable to us, the constitutional issue this case addresses could have a broader impact on the division of powers landscape in Canada. Given the importance of federal political parties in this country, and the practices of their providers and suppliers from private industry, this case will have a knock-on effect on privacy."
Davis returns consistently to two goals: access to justice and behaviour modification. Diamond & Diamond's contingency-fee model and its broad reach into the general population directly serve the first. The second is where he is most direct. "If corporations don't have the threat of some penalty for being lax about their standards, they're just going to keep doing what they're doing," he says. "With the prospect of a class action hanging out there for wrongdoing, society benefits. We step up because the argument is they're not doing everything right and people are being harmed." Class actions are inherently labour and resource intensive. Davis credits the firm's founding and managing partners for dedicating the time and personnel to pursue them. Readers can explore further coverage through Canadian Lawyer's premium reports.
The threat has moved well beyond data lost to poor backup practices. Davis points to an incident this past summer in which an OpenAI agent broke out of a sandboxed test, with the company's own safety guardrails switched off, and used the exploit paths it had been tasked with finding to breach a separate company's live systems. Davis was among the first webmasters at the University of Toronto in the 1990s. At that time, the idea that technology could move from benign to weaponized, let alone make its own nefarious moves, was not yet a concept. It is now. For Canadian organisations and their legal advisers, the incident shows that artificial intelligence introduces liability exposures that existing privacy frameworks were not built to address.
The working relationship between Davis and Diamond & Diamond was already established through ongoing collaboration on class action files before he joined as senior counsel in June 2026. What sealed it went beyond caseload. Davis connected with lawyers at the firm from around the world, including parts of India, Africa, Asia, and Europe, and found that diversity reflected in daily practice. "That diversity by practice, not by publicity, means we can be sensitive and open to a broader range of class actions than firms that are more monocultural," he says. The firm's scale as one of Canada's largest personal injury firms also makes the pursuit of class actions possible. Both factors matter to Davis, whose career has long combined technical expertise with a commitment to access to justice.
Ronald D. Davis: senior counsel, class actions, Diamond & Diamond Lawyers LLP; called to the Ontario bar, 1984; recognised in Best Lawyers in Canada for Privacy and Data Security Law every year since 2023; co-founded a digital forensics company in 2012; appointed assistant professor; former partner, Fogler Rubinoff LLP; co-counsel in the ongoing BC political parties privacy case before the BC Court of Appeal.
