On March 15, 2021, the Ontario Court of Appeal (the Court), inĚýFamily and Children’s Services of Lanark, Leeds and Grenville v Cooperators General Insurance Company,Ěý, reversed the lower court’s decision that found that Co-operators General Insurance Company (Co-operators) had a duty to defend Family and Children’s Services of Lanark, Leeds and Grenville (FCS) and Laridae Communications Inc. (Laridae) against two claims in relation to a cyber hack.

Laridae was retained by FCS to perform communication and marketing services, including working on FCS’ website. FCS subsequently discovered that its website had been hacked and that a report containing personal information of 285 clients and subjects of FCS’ investigations was disclosed on Facebook without authorization. Both companies were insured by Co-operators and claimed that Co-operators had a duty to defend against the following two claims that arose out of the event:

1. a $75 million class action brought against FCS alleging that FCS was negligent in securing its website; and
2. a third-party claim in that proceeding brought by FCS against Laridae for negligence and breach of contract.

Co-operators denied that it had a duty to defend because its policies excluded claims arising from the distribution of data by means of an internet website. All three parties brought applications to determine the rights that depend on the interpretation of the policies.

The Court disagreed with the lower court’s finding that the matter could not be addressed by way of application, stating that there were no material facts in dispute requiring a trial and that the policy provisions in issue were clear and unambiguous. Upon assessing the issue, the Court found that the substance and true nature of both claims arose from the wrongful appropriation and distribution of confidential personal information on the internet. The Court held that all claims asserted were covered by the clear and unambiguous language of the exclusion clauses, and therefore Co-operators had no duty to defend either claim.

The Court did not waver when faced with FCS and Laridae’s argument that applying the data exclusions would nullify meaningful coverage under the policy. The Court held that the policies clearly stated that Co-operators would not insure against all risks, and therefore, holding the parties to the terms of the agreement, aligned with the reasonable expectations of the parties.

Written by M. Imtiaz Karamat, Osgoode Alumnus and Student-at-Law at Deeth Williams Wall LLP.

The post Ontario Court Of Appeal Finds Insurance Coverage Does Not Apply To Cyber Hack appeared first on IPOsgoode.

InĚýĚýthe school’s computer technician found the photos and alerted the principal, who called the police. The police downloaded and stored the material as well as the browser history without a warrant. The defendant, the teacher Mr. Cole, argued a Charter of Rights violation under section 8, which protects Canadians against unreasonable search and seizure.

The outcome at theĚýĚý– here validated by the Supreme Court – is a boon to employee rights and a warning to workplace HR departments. Moreover, the ruling is a strong step toward affirming the new reality that technology is not neutral in legal battles, it impacts the rights relationships we have with others and the way that individuals orient themselves in the world. The holding, written by Justice Fish, described the relationship between computer data and its user with the phrase “connected to his biographical core.”

Workplace policies are also not determinative of a person’s reasonable expectation of privacy…ĚýThe police in this case infringed the accused’s rights under s.Ěý8 of the Charter.Ěý The accused’s personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core.Ěý Pulling in the other direction are the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school.Ěý These considerations diminished the accused’s privacy interest in his laptop, at least in comparison to a personal computer, but they did not eliminate it entirely.

The Ontario Court of Appeal (OCA) decision clarified that s.8ĚýĚýto the school technician performing inspections within the scope of their duties, but rather to state intrusion by police.

The Supreme Court outlined the concept that privacy can be reasonably expected on a workplace computer where personal use is reasonably expected.

In Cole’s case the determinant factors are mixed. The school board granted employees permission to use their laptops for “incidental” personal use. His expectation of privacy, though, should have been limited because the school’s policy was clear that data and messages “generated on or handled by” board devices would be considered school board property.

There are some HR and technology policy-type actions that employers can take to better protect the company's interest, as outlined , , and .

But there is only so much that employers can do to safeguard. ĚýIf personal use is allowed or can be reasonably expected on company devices, employees can expect a degree of privacy. ĚýHowever, the situation is not always clear as there are that can diminish an employee's expectation of privacy.

One large area not yet explored by pundits is the growing prevalence of sanctioned social media use by companies for external communications and recruitment. The more companies require employees to be on quasi-professional and quasi-personal networks like LinkedIn, Twitter and even in some industries, Facebook, the more the line blurs between professional and personal use on company devices.

Ultimately in R v Cole, the majority felt that the evidence gathered from the laptop could be used when the case was retried. "The admission of the evidence would not bring the administration of justice into disrepute," wrote Fish.

Justice Abella dissented, arguing that it should be excluded.

There are two related lower court decisions.ĚýĚý(2009)Ěýis an OCA decision confirming that a university professor must provide personal electronic data to a French government’s terrorism investigation.ĚýĚý(2009)Ěýis an Alberta Court of Appeal decisionĚýthat allowed an employer’s application to dismiss a wrongful termination suit following the distribution of inappropriate material using a work computer.

There are multiple privacy statutesĚýĚýandĚý, but little recognition of a tort of invasion of privacy. The recentĚýĚý(2012) decision introduced a new privacy tort in Ontario, but this case was not appealed to the Supreme Court.

Denise Brunsdon is a JD/MBA candidate at Western University.

The post Pornography, Privacy and Professional Computers appeared first on IPOsgoode.

Until recently, Canada did not recognize protection for invasion of personal privacy per se between individuals. This position was seen in the Ontario Superior Court of Justice decision in , where Whitaker J. found that a freestanding tort of the invasion of privacy did not exist in Ontario. Jones v. Tsige was a case where the defendant improperly accessed the plaintiff's private banking information in an attempt to confirm whether the plaintiff was receiving child support payments. The Superior Court of Justice notedĚýthat Canadian courts were reluctant to recognize a separate right in light of the Ontario Court of Appeal’s decision in ,Ěýwhere the court noted that there is no "free standing right" to dignity and privacy under the charter, and dismissed the plaintiff’s claim on the basis that Ontario law did not recognize a tort of breach of privacy. This position was criticized by many academics and even under IP Osgoode in by David Vaver.

This position was reversed by the Ěýin a decision two weeks ago, whereby Sharpe J.A. recognized a new tort, “intrusion upon seclusion”, finding that aggrieved parties should have recourse for violations of their privacy, especially in an age where vast amounts of private information is generated and stored. Summary judgement was granted in Jones' favour, with damages amounting to $10,000.

A similar case was decided in the England and Wales High Court, , where a dispute between two directors of a company led to supposedly private conversations being used in a malicious way to make false allegations about the health of one of the directors. The director, Mr. Cooper, was having a private discussion with anotherĚýdirector, whereby he disclosed certain health issues he was facing in a manner that was explicitly confidential. The CEO, Mr. Turrell, had the room “bugged”, andĚýmade public allegations about Cooper’s health on both his blog and Twitter account, embedding the transcript and the recording of the discussion. In coming to his decision, Tugendhat J., granted a permanent injunction for the plaintiff andĚýa rather large sum of damages to Mr. Cooper: ÂŁ50,000 for libel, an additional ÂŁ30,000 for misuse of private information. It was also notedĚýin obiter that had there been only misuse of private information, he would have given ÂŁ40,000 in damages.

These cases demonstrate a growing trend around the world towards extending the common law to provide legal protection where one member of the public misuses the private information of another. In the ever-evolving reality of technological advances, it has become trivially easy for a malicious party to capture the personal and private information of an individual, and it is a welcome sight to see the Courts starting to take an active role in demonstrating that this form of behavior is not acceptable in today’s society.

Brian Chau is a JD candidate at Osgoode Hall Law School.

The post Is Anyone Listening? appeared first on IPOsgoode.