Campbell v. Capital One Financial Corporation

2020 BCSC 1696 Campbell v. Capital One Financial Corporation

IN THE SUPREME COURT OF BRITISH COLUMBIA Citation: Campbell v. Capital One Financial Corporation, 2020 BCSC 1696 Date: 20201109 Docket: S198617 Registry: Vancouver Between: Duncan Campbell and Matthew Clement Plaintiffs And Capital One Financial Corporation and Capital One Bank (Canada Branch) Defendant - and - Docket: S199109 Registry: Vancouver Between: Theresa Botterell and Adam Botterell Plaintiffs And Capital One Bank (Canada Branch) Defendant Brought Under the Class Proceedings Act, [R.S.B.C. 1996], c. 50 Before: The Honourable Madam Justice Iyer Reasons for Judgment Counsel for Plaintiffs, Duncan Campbell and Matthew Clement: T. Charney K. Garcha P. Sanghe Counsel for the Plaintiff, Theresa Botterell and Adam Botterell M. Canofari G. Rafter J. Campion Counsel for Defendant, Capital One Financial Corporation: A. Borrell L. Cooper Place and Date of Hearing: Vancouver, B.C. October 13 and 14, 2020 Place and Date of Judgment: Vancouver, B.C. November 9, 2020

INTRODUCTION [1] These cross-applications are filed by two proposed representative plaintiffs, each seeking carriage of a proposed national class action proceeding in British Colombia. Other related proposed class actions have been filed in Ontario, Alberta and Quebec. [2] All of these actions arise out of a cyber attack on the information technology systems of Capital One Financial Corporation and/or Capital One Bank (Canada Branch) ("Capital One") on March 22 or 23, 2019 ("Privacy Breach"). Capital One issues credit cards for its banking business, and issues credit cards for Costco Wholesale and the Hudson's Bay Company. The Privacy Breach affected its six million Canadian customers and 100 million American customers. [3] Capital One learned about the Privacy Breach on April 21, 2019. It addressed the problem in its firewall, restoring security on July 19, 2019. [4] On July 29, 2019, Capital One publically announced the Privacy Breach. It explained that the compromised personal and confidential information included name, social insurance number, date of birth, mother's maiden name, address, email address, phone number, employer name, housing situation, annual income, status of mortgage, banking information, credit scores, credit limits, balances, payment history, transaction data, linked bank account numbers, purchase and transaction history, and contact information. [5] With

respect to its six million Canadian customers, Capital One explained that the Privacy Breach affected information submitted on credit card applications between 2005 through early 2019, but also included some people's credit scores, credit limits, balances and payment history, and fragments of transaction histories over a total of 23 days in 2016-2018. As well, the Privacy Breach compromised about one million social insurance numbers. I will refer to all of this information as the "Confidential Data".

THE ACTIONS [6] Nine actions were commenced in Canada following the Privacy Breach: Jurisdiction Plaintiff Law Firm British Columbia Botterell Boughton Law Corporation Gill Garcha & Company Campbell Charney Lawyers Alberta Wazniuk Guardian Law Group Lehmann Higgarty Law Ontario Del Giudice* Cambridge LLP, Gardiner Roberts LLP, Hotz Lawyers, Scher Law Professional Co. Slapinski Landy Marr Kats LLP, McKenzie Lake Lawyers, Du Vernet Stewart, Quebec Goulet Siskinds Desmeules Royer* Consumer Law Group [7] The starred actions have been awarded carriage, so only one action in each of Quebec and Ontario is proceeding to certification. It is unclear whether there will be a carriage contest in Alberta. In BC, the Gill Action is not proceeding as Garcha and Company are now working with Charney Lawyers. I will refer to this counsel group as "CG". Boughton Law Corporation is working with Guardian Law in Alberta (Wazniuk Action), the four Ontario firms (Del Giuduce Action), and Consumer Law Group in Quebec (Royer Action). I will refer to this group as "BG". [8] Different actions name different defendants. All name one or more of the following Capital One entities: Capital One Financial Corporation, Capital One Bank (Canada Branch), Capital One (Services) Canada Inc., Capital One N.A. and/or Capital One Bank (USA) N.A. [9] The Confidential Data was stored on servers owned by Amazon Web

Services Inc. and Amazon Web Services (Canada) (collectively, "Amazon"), one or both of whom are also defendants in some actions. The hacker, Paige Thompson, who has been arrested and criminally charged, is also named as a defendant in some actions. Finally, GitHub Inc., a website operator that may have published the Confidential Data and/or programs used by Ms. Thompson in the hack is a defendant in some actions. [10] In its carriage application, the Botterell Action seeks leave to file a Further Amended Notice of Civil Claim that is substantially broader than its current pleading. When I discuss the Botterell Action below, I am referring to amended pleading it seeks to file.

APPLICABLE LAW [11] The question in a carriage motion is which proposed action is in the best interests of the putative class while being fair to the defendants and promoting the objectives of class proceedings? Those objectives are access to justice, behaviour modification and judicial economy: Del Giudice v. Thompson, 2020 ONSC 3623 at para. 64. [12] Courts have developed an overlapping and non-exhaustive list of 17 factors to guide this assessment, recently summarized in Wong v. Marriott International Inc., 2020 BCSC 55 at para. 24 (citing Rogers v. Aphria Inc. 2019 ONSC 3698 at para. 17): (1) The Quality of the Proposed Representative Plaintiffs; (2) Funding; (3) Fee and Consortium Agreements; (4) The Quality of Proposed Class Counsel; (5) Disqualifying Conflicts of Interest; (6) Relative Priority of Commencement of the Action; (7) Preparation and Readiness of the Action; (8) Preparation and Performance on Carriage Motion; (9) Case Theory; (10) Scope of Causes of Action; (11) Selection of Defendants; (12) Correlation of Plaintiffs and Defendants; (13) Class Definition; (14) Class Period; (15) Prospect of Success: (Leave and) Certification; (16) Prospect of Success against the Defendants; and (17) Interrelationship of Class Actions in more than one Jurisdiction. [13] In this case, the fundamental difference between the two proposed class actions is their theories of the case. As discussed below, factors 10 to 17 (and, to some extent 7 and 8) all flow from this fundamental difference. I consider the factors 1-4 neutral or of minimal significance and will not address them. Factor 5 does not apply.

ANALYSIS [14] The primary difference between the Campbell Action and the Botterell Action is that the Campbell Action is a relatively straightforward breach of privacy claim against Capital One arising from the Privacy Breach whereas the Botterell Action advances multiple discrete claims against Capital One and three other related entitites, Amazon and GitHub starting in 2005 and culminating with the Privacy Breach. BG describes the claim in the Botterell Action as follows: it incorporates misuse of information properly received in the first place but used in a manner unexpected and unknown to the proposed class for many years without notice. The case relies upon the failure to warn before the confidential data was hacked, and the failure to notify after it was hacked and made available to the world. The case is unique because the pleading covers the failure to inform the Canadian proposed class even after it was so directed by one of the legislative bodies to which it is responsible, namely the United States Senate. The length of data misuse for profit, misappropriation of financial personalities and failure to warn gives rise to strict liability which has never been advanced in the context of a data breach. This is not a novel cause of action; it is a first time application of strict liability in this context. [15] Some of the differences between the two proposed actions

are: Botterell Action Campbell Action Defendants Paige Thompson, Capital One Financial Corporation, Capital One Bank (Canada Branch), Capital One (Services) Canada Inc., Capital One N.A., Capital One Bank (USA) N.A., GitHub Inc., Amazon Web Services, Amazon Web Services (Canada) Inc. Capital One Financial Corporation, Capital One Bank (Canada Branch) Class Definition The class of persons in Canada who applied for credit cards between 2005 and 2019 and/or provided confidential financial and personal information to Canada One or contracting parties in Canada, including the Bay, Costco, Walmart, JC Penny and MasterCard, and others unknown to the class plaintiffs between 2005 and 2019 All Canadians and Canadian Corporations who were notified that their information was compromised in the Privacy Breach[1] Class Period January 1, 2005 to July 30, 2019 Not expressly defined Causes of Action Breach of trust/fiduciary duty, conversion, breach of privacy, intentional/reckless intrusion upon seclusion, intentional misappropriation of financial personality, breach of contract, breach of duty to warn, negligence, misrepresentation, statutory breaches (banking, consumer protection, privacy and freedom of information) Negligence, breach of contract/warranty, breach of honesty, good faith and dealing, breach of confidence, intrusion upon seclusion, breach of privacy, statutory breaches

(privacy, consumer protection) [16] BG's claim in the Botterell Action is substantially the same as that in the Del Giudice Action. Although there are differences between the Campbell Action and the Slapinski Action (the unsuccessful contender in the carriage contest in Ontario), both advance straightforward privacy breach claims. Therefore, it is useful to consider Perell J.'s comparison of the two proposed actions in Del Giudice: 88 The claims and causes of action pleaded in both actions are not fanciful or frivolous and the competing litigation strategies are both reasonable and defensible. Upon analysis, neither case theory would be deficient in achieving substantive and procedural access to justice and genuine behaviour modification, and at the end of the day, each action had its pros and cons in achieving those goals and neither action had disqualifying deficiencies, although I repeat that neither action is a lock for certification. 91 It is not the case that the Del Giudice Action will yield larger and more comprehensive damages. Wrongdoing causes damages; causes of action provide remedies for the wrongdoing and there is no double counting where more than one defendant causes or contributes to the harm suffered by the plaintiffs, which is what is alleged to have occurred in the immediate case. 98 Notwithstanding the arguments of counsel in the Del Giudice Action, it is

not the case that the success of the case against Capital One depends upon joining GitHub and Amazon. Capital One is the party that had a contractual and up front and personal relationship with the Class Members and the Slapinski action has advanced an arguable case against Capital One. The duty of care in the relationship between a bank and its customers is developed legal territory. The duty of care of a remote Internet service provider or of an Internet chat room provider to a banker's customer is undeveloped or underdeveloped legal territory. 99 The arguable case against Capital One does not depend upon the joinder of GitHub or Amazon. From the procedural perspective of the march to certification, then discoveries, and a trial, the joinder of GitHub and Amazon as parties as opposed to witnesses adds enormous level of complexity to the case. 100 If the arguable causes of action against Capital One succeed, the causes of action against GitHub and Amazon are, practically speaking, redundant and those cases, which have more litigation risks than the claim against Capital One are unlikely to snatch victory from the jaws of defeat of the causes of action against Capital One. 10 I repeat the point made several times above that while the causes of action against Capital One, GitHub, and Amazon have the same labels of negligence, breach of fiduciary duty, breach of confidence, and

intrusion on seclusion, the claims are discrete claims. Thus, for instance, the Class Members' negligence claim against GitHub is not the same as the Class Members' negligence claim against Capital One, which is not the same as the Class Members' negligence claim against Amazon. 102 The same may be said about the other causes of action advanced in the Del Giudice Action. If the Class Members' claims against Capital One fail in the Del Giudice Action, it is highly unlikely that the much more legally difficult claims against GitHub and Amazon will succeed to save the Class Members from a losing war. 103 Counsel in the Slapinski Action made a reasonable and defensible decision to not join GitHub and Amazon. If it turns out that Amazon was no more than the lessor of computers, which is the understanding of Counsel in the Slapinski Action, then without deciding the point on a carriage motion, it does strike me that it was a reasonable decision to not open up a second theatre of litigation war against a very formidable opponent. Thus, it was not an easy decision to refuse carriage to the Slapinski action. 104 This all said, it is too early to tell whether GitHub and Amazon perpetrated culpable wrongs and caused or contributed to the injuries suffered by the Class Members. It is too early to tell whether the addition of GitHub and Amazon will present an unmanageable litigation. It is

too early to tell whether Capital One will third party and claim contribution and indemnity from GitHub and Amazon or whether the Defendants will join forces and form a defence alliance. GitHub and Amazon will be witnesses in any event, and it is too early to tell whether GitHub and Amazon should or should not be parties to the litigation. I note that Amazon is a party defendant in the Québec litigation. [17] The Del Giudice Action is now proceeding in Ontario. On August 27, 2020, Perell J. set dates in January 2021 for the first part of a bifurcated certification hearing, at which time he will determine whether the pleadings disclose a cause of action. BG proposes to file an amended pleading in Del Giudice that is essentially the same as that it proposes to file in this court in Botterell. In his directions on August 27, Perell J. noted that Capital One and Amazon intend to challenge the Del Giudice Action's proposed amended statement of claim, and that GitHub may have a jurisdictional challenge. [18] Against this background, I must decide carriage. [19] As I have indicated, the primary difference between two proposed actions is their different theories of the case. All the claims in the Campbell Action are advanced in the Botterell Action, which is far more complex. Having reviewed the material before me, I am satisfied that, with respect to factors 10-14, each proposed

action is satisfactory. That is, the scope of the causes of action, which defendants are named, the correlation of plaintiffs and defendants, class definition, and class period are all equally appropriate in light of each proposed action's case theory. [20] Factors 15 and 16 (prospects of success at certification and at trial) are less certain for the Botterell Action because it is a far broader in scope. I reject BG's submission that the Campbell Action cannot succeed against the defendants it has named. Without pre-judging the issues to be determined at certification, the material before me demonstrates that the Campbell Action has at least as an arguable cause of action on its theory of the case as the Botterell Action does on its theory of the case. [21] I am unpersuaded by either of BG's or CG's arguments casting aspersions on the other side's preparation and readiness of its proposed action or its preparation and performance on the carriage motion. [22] In sum, other than their different case theories, in my view, the proposed actions are on equal footing. For Perell J. the determinative factor in awarding carriage to the Del Giudice Action over the Slapinski Action was the possibility that Amazon and/or GitHub might be liable on BG's theory of the case (Del Giudice, at para. 105). [23] In my view, granting carriage to the Botterell Action does not advance the interests

of the class or promote the objective of class proceedings statutes in behaviour modification beyond what awarding carriage to the Del Giudice Action has already achieved. What would very likely happen if I awarded carriage to the Botterell Action is that it would not proceed until after a certification decision in Ontario. Practically speaking, it would stand or fall with that decision. [24] In contrast, granting carriage to the Campbell Action appropriately defers to the certification stage an assessment of the preferability of the competing case theories. As the Court of Appeal explained in Fantov v. Canada Bread Company, Limited, 2019 BCCA 447, the recent amendments to the CPA respecting multijurisdictional proceedings establish that issues related to competing proposed class actions should be addressed at the certification stage, not in a carriage motion (at para. 51): 51 The recent amendments to the CPA create a mechanism to resolve these issues. They have set up a process and procedure by which a case management judge, in the context of a certification application, can determine whether the proceeding should go forward in whole or in part, or alternatively, be heard in another jurisdiction. By requiring the party that commences a class proceeding to serve a representative plaintiff in any existing or proposed multi-jurisdictional class proceeding commenced elsewhere in

Canada and by giving the right to the person so served to make submissions at the certification hearing, the new legislation has done away with the need for stalking horse actions like Fantov to be commenced. Whether and how the proceeding will go forward is decided not in the context of the carriage motion, but rather, at certification pursuant to a set of criteria set out in the legislation. [25] This is because the legislative criteria for deciding whether it is preferable for all or part of a local action to proceed or the matter should proceed in another jurisdiction benefits from the more developed evidentiary record before the court in a certification hearing as compared to a carriage motion (Fantov, paras. 64-66). [26] Concerns about overlaps between proposed class actions, including class members participating in more than one action do not arise until certification because it is not until the court grants certification that the class action and the class come into existence. The legislative provisions that apply to certification of proposed multijurisdictional class proceedings are designed to address these concerns. [27] In addition to these considerations, by the time of a certification hearing in the Campbell Action, Perell J. may well have decided the cause of action issues in the Del Giudice Action that are scheduled for hearing in January 2021, assisting the court to compare the two proposed actions under the legislative criteria. [28] For these reasons, I award carriage to the Campbell Action. "Iyer J." [1] As Capital One has notified all affected entities, this is the applicable class definition.