The Ontario Court of Appeal clarified an important limit on privacy claims in the context of cyber incidents — a decision with real implications for Canadian-Israelis operating or investing in data-driven businesses connected to Canada.

Denying class certification in three proposed class actions (Owsianik v. Equifax Canada Co., Obodo v. Trans Union of Canada, Inc. and Winder v. Marriott International, Inc.) the Court found that companies storing personal information are not liable for their failure to protect this information from third-party hackers. 

Why this matters in Canada

Unlike some other jurisdictions, Canada currently has no private right of action under federal privacy legislation for data breaches. Because of this gap, plaintiffs have often tried to rely on the common-law tort of intrusion upon seclusion to seek damages after data breaches.

In the recent trilogy of appeals for class certification, the Court found that a defendant’s recklessness surrounding the violation of privacy (i.e. the storage of plaintiffs’ information, as opposed to the breach itself) was not sufficient to satisfy the requirements of the inclusion upon seclusion tort. 

What claims remain possible

Canadian organizations may still face claims for:

• Negligence;

• Breach of contract; and

• Breach of statutory duties

However, these claims typically require proof of actual, quantifiable loss. For the time being, the door to moral damages for individual data breach victims – as available under the inclusion upon seclusion tort – has been shut. 

Takeaways for Global companies 

For global companies that collect, store, or process Canadian personal data, this decision brings some clarity — and some limits — to litigation risk in Canada.

Canadian courts are signaling that cybersecurity failures will be assessed through traditional legal frameworks, not expanded privacy torts. Nonetheless, while Canada has narrowed one avenue for class actions following data breaches, strong data governance and security practices remain essential; particularly for cross-border businesses operating in Canada.