The data breach that affected Mackenzie Financial Corp. and InvestorCOM Inc. sparked dual class-action lawsuits. Now, the Supreme Court of British Columbia has partially certified a claim in B.C., alongside the existing action in Ontario.
In 2023, communications firm InvestorCOM learned that a group of cybercriminals exploited a software vulnerability to collect private data on investors, potentially including Mackenzie clients. That prompted the filing of proposed class suits against the fund manager and InvestorCOM in both Ontario and B.C.
Last year, the case filed in Ontario was certified as a multi-jurisdictional class proceeding for alleged claims of negligence and breach of contract against both companies, and for breach of fiduciary duty/breach of trust against Mackenzie. However, the judge in Ontario declined to certify claims seeking remedies under provincial privacy legislation.
The companies are appealing the certification decision, and the investor plaintiffs are appealing the decision not to certify the privacy claims.
That appeal has yet to be scheduled, but in the meantime, a court in B.C. has now certified the case filed in that province — but only for alleged breaches of privacy legislation, ruling that the other claims should be dealt with in the Ontario action.
While the plaintiffs in that action argued for certification of the entire case in B.C., the court ultimately ruled that the best option was to just certify the privacy claims in B.C., while leaving the other claims to be resolved in Ontario.
“Proceeding in that way gives due consideration to the interests of all parties in each of the relevant jurisdictions, ensures the ends of justice are service for residents of the statutory privacy tort provinces, avoids irreconcilable judgments and minimizes the coordination that will be required in that regard, and promotes judicial economy,” the court said in its ruling on June 19.
The court also dismissed certain claims for residents of Québec, and it found that investors can pursue claims to compensate them for the risk of future harm, and for the costs of preventing future harm, but not for the “mental or emotional distress” of having their data exposed.
It also ruled that there’s no basis for punitive damages in the case.
None of the allegations have been proven.