K.W. v. Accor Management Canada Inc.

2023 BCSC 1149 K.W. v. Accor Management Canada Inc.

IN THE SUPREME COURT OF BRITISH COLUMBIA Citation: K.W. v. Accor Management Canada Inc., 2023 BCSC 1149 Date: 20230705 Docket: S210980 Registry: Victoria Between: K.W. Plaintiff And: Accor Management Canada Inc. d.b.a. Fairmont Empress, J. Doe #1 d.b.a. The Willow Stream Spa at Fairmont Empress, J. Doe #2, and J. Doe #3 Defendants Before: The Honourable Justice V. Jackson Reasons for Judgment Counsel for the Plaintiff: P. W. Dudding, M.C.E. Merryfield and M. Gallegos Dupuis, Articled Student Counsel for the Defendant Accor Management Canada Inc. d.b.a. Fairmont Empress: B. W. Dixon, M. T. Maniago and I. A. Vanderslice Place and Dates of Trial/Hearing: Victoria, B.C. June 27-29, 2022 July 21-22, 2022 October 21, 2022 Written Submissions Received: February 28, 2023 and June 6, 2023 Place and Date of Judgment: Victoria, B.C. July 5, 2023 Table of Contents I. NATURE OF THE APPLICATIONS.. 3 II. FACTUAL CONTEXT OF THE CLAIM.. 3 III. THE TEST FOR CERTIFICATION.. 10 IV. DOES THE NOTICE OF CIVIL CLAIM DISCLOSE A CAUSE OF ACTION?.. 12 A. Breach of confidence. 13 B. Breach of privacy legislation.. 14 C. Breach of fiduciary duty. 15 D. Unjust enrichment 16 E. Negligence. 17 F. Breach of contract 19 V. CONCLUSION.. 20 I. NATURE OF THE APPLICATIONS [1] The plaintiff applies under s. 2(2) of the Class Proceedings Act, R.S.B.C. 1996, c. 50 [CPA] for an order certifying this action (the

"Action") as a class proceeding and appointing her as the representative plaintiff. The defendant Accor Management Canada Inc. ("Accor") opposes certification. [2] The plaintiff's original notice of civil claim was filed March 25, 2021. Her application seeking an order that the action be certified as a class proceeding was filed June 28, 2021 (the "Certification Application"). She filed a further notice of application on November 25, 2021[1] seeking an order permitting her to act in this proceeding under a pseudonym until the Court had determined her Certification Application, or, in the alternative, the style of cause was amended so as to reflect her actual name (the "Anonymity Application"). Accor takes no position with respect to the Anonymity Application. [3] The plaintiff amended her notice of civil claim on May 19, 2022 (the "NOCC"). On the same date the plaintiff filed a further notice of application seeking orders removing J. Doe #2 as a defendant in the action and a consequential amendment of the style of case. Accor consents to that relief and I so order. II. FACTUAL CONTEXT OF THE CLAIM[2] [4] The plaintiff's proposed class action stems from the unauthorized access of a database which is alleged to have contained health information provided to the Willow Stream Spa at the Fairmont Empress Hotel in Victoria, British Columbia, by some of its clients. The Empress Hotel,

including the Willow Stream Spa (the "Spa"), is operated and managed by Accor. [5] The Spa offers professional health and wellness spa services to both hotel guests and non-guests. In providing the spa services, the Spa, and third-party service providers, collect and store information provided by the Spa's clients. [6] In September 2019, the plaintiff attended the Spa at the Empress Hotel for a 90-minute stress relief massage (the "Treatment"). When the plaintiff booked the Treatment, the Spa required her to provide her credit card information in order to secure the appointment, and also collected information from the plaintiff including her full name, telephone number, email address, and street address. When the plaintiff attended for her treatment, staff at the Spa required the plaintiff to complete an "intake form", which asked for information, including the plaintiff's name and address, date of birth, and medical information. [7] In early January 2021, Cyrus Molavi also attended at the Spa for a 60-minute therapeutic massage. As had been the case with the plaintiff, at the time of booking Mr. Molavi was required to provide his credit card information to secure the appointment, and to provide his full name, telephone number, email address, and street address. When he attended for his appointment, which was on the same day, he was required to and did complete an intake form

which included his detailed medical history, including family history, medical conditions, injuries, illnesses, allergies, and medications. [8] The process described by the plaintiff and Mr. Molavi is consistent with the Spa's practice of obtaining client information at two stages, the first being the booking stage, and the second being the intake stage. The Spa uses a cloud-based licensed booking software hosted and maintained by a third-party service provider, Book4Time Inc. ("Book4Time"), which collects and stores data, including Spa clients' information, and the Spa has access to that information. Book4Time collects data through two user interfaces: a customer-facing interface (the "Front End") which is an online booking platform Spa clients can use to book a treatment, and a Spa‑facing interface (the "Back End"), which authorized employees at the Spa are able to access using login credentials, and through which Spa staff can, among other things, enter data in order to create or change bookings. [9] In order to book a Spa service using the Front End interface, a client is required to provide their name, phone number, and email address. Spa clients also have the option of creating a guest account when they access the Front End interface, and if they do so they are required to enter their birthdate. [10] Any Spa client using the Front End interface is also required to "check

a box" indicating that the client accepts the Spa's terms and conditions. Only after the client has entered the required information, and checked the box accepting the Spa's terms and conditions, is the client able to proceed to "guarantee" their appointment, which directs them to a payment card webpage on which the client is required to enter their credit card information, including expiry date. The credit card's three digit security code is not collected. [11] The payment card webpage is hosted, and the credit card information entered by the Spa's clients maintained, by Book4Time's third party storage vault provider, SIX Payment Services. Once the credit card "guarantee" is accepted, the booking is complete and an automatic confirmation email is generated and sent to the email address that has been provided by the Spa client. [12] In 2021, approximately 25 percent of the Spa's bookings were made via the Front End. Spa clients who used the Front End to book a treatment were presented with a privacy policy. The privacy policy is that of Book4Time, not Accor. [13] Spa clients also have the option of booking spa services in person, over the telephone, or by email, all of which involve an authorized employee at the Spa entering the client's information through Book4Time's Back End interface, which is only accessible by a user with valid login credentials. The scope of access staff

of the Spa have to the Back End information varies, depending on the security permission the Spa has assigned to them. Clients booking through the Back End interface are required to provide their name, email address, and mobile phone number, but optional data fields also appear on the form and allow the employee to input such information as the client's home address, billing address, and home and business phone numbers. While the client's credit card information is not required to confirm an appointment from a technical perspective, the Spa's director candidly conceded that it is the Spa's policy to require clients who book in person, over the telephone, or, with a slight variation in procedure, via email, to provide their credit card information to the authorized employee at the Spa, who then enters the credit card information using the Back End interface in order to guarantee the Spa client's booking. As is the case with the Front End, the credit card information is entered on a payment webpage hosted, and the credit card information maintained, by SIX Payment Services. [14] When a Spa service is booked using the Back End interface, the Spa's employee may also check boxes indicating various health conditions and treatment preferences provided by the client. However, according to the Spa's director, this information is "not required", and therefore the amount and nature of the

optional information collected varies as between Spa clients. [15] When the Spa client attends for their appointment, the Spa's intake procedure involves asking the Spa client to provide additional information before their appointment. Spa clients are provided with a hard copy of a "confidential medical history form", on which clients are asked to note whether certain listed medical conditions apply to them, and to list any other medical conditions or injuries which are not listed, as well as any medications they are taking. Clients are asked to sign the document to acknowledge the information they have provided on the form is true, accurate, and complete. These medical history forms are collected by the employee attending the Spa's front desk. The Spa's routine practice is for that employee to record any information that is relevant to the client's treatments, which may be some, all, or none of the information on the form, and which may or may not include the Spa client's birthdate, via the Back End interface into the Spa client's individual online profile maintained by Book4Time. Some, but not all, of the medical information the plaintiff provided on her intake form was entered by a Spa staff member into the plaintiff's online profile which was then maintained by Book4Time. [16] Spa clients receiving registered massage therapy treatments are given another "confidential

patient history form" to complete, which seeks additional information including the Spa client's occupation, and asks them whether a more detailed list of health conditions apply to them, whether in the past or currently. It also seeks additional information about prior hospitalizations, major accidents, illnesses, surgeries, and details about their current condition. Spa clients receiving registered massage therapy treatments must sign the confidential patient history form, authorizing "the clinic and its associated RMTs to collect personal and medical information" they have provided "in order to contact" the Spa client and acknowledging they understand their "personal and medical information is confidential and will only be disclosed to third parties with [their] permission". These confidential patient history forms are provided directly to the registered massage therapist at the Spa, and none of the information from these forms is recorded into the Back End interface. [17] Additional information was required during the COVID-19 pandemic. Spa clients were required to fill out a COVID-19 questionnaire, in either paper or digital form, which asked a series of questions intended to screen clients for potential COVID-19 risk. Digital copies of the COVID-19 questionnaire were attached to the client's online profile in Book4Time. [18] In short, various types of information

collected by the Spa from its clients was shared with, and electronically maintained by, either Book4Time or SIX Payment Services in their respective databases for use by the Spa. [19] On February 14, 2021, an imposter using an email address in the Spa director's name contacted a Spa employee, pretending to be the director of the Spa, and requested the login credentials for the booking system. The employee, believing that imposter to be the director, responded the same day and provided Book4Time login credentials. This activity came to the attention of the Spa director on March 18, 2021, when a Spa client forwarded to a Spa staff member an email the client had received a few days earlier, in which an attempt was made to obtain the client's credit card information, and the client was told a Spa coordinator would be contacting the client. The Spa staff person forwarded the suspicious email to the Spa director. Upon learning of the suspicious email the Spa's client had received, the director of the Spa logged in to the Back End of Book4Time, checked login records, and noticed what they described in their affidavit as "unusual activity". The director subsequently learned about the login credentials having been provided in response to the imposter's email by a Spa employee on February 14, 2021. This type of targeted approach to obtaining unauthorized access from a specific person is

a type of "spear phishing" or "social engineering" cyberattack. [20] Upon discovering the suspicious logins and learning that the login credentials had been provided to an imposter, the director of the Spa immediately deactivated the relevant accounts on March 18, 2021, and caused Book4Time to reset the login credentials for all Book4Time user accounts on March 19, 2021 after the Spa's close of business. [21] The Spa subsequently caused the police, the Spa's payment gateway service provider, the Office of the Information and Privacy Commissioner of B.C., and the Office of the Privacy Commissioner of Canada, to be notified of the situation. Thereafter the Spa began to take steps towards notifying Spa clients. [22] On March 23, 2021, the Spa notified both the plaintiff and Mr. Molavi by email that their information--name, addresses, telephone numbers, email addresses, birth date, payment information, information about the plaintiff's appointments and treatments at Spa (collectively referred to in the NOCC as "Personal Information")--had been compromised (the "Data Breach"), although at the time notice was given, the full nature and extent of the Data Breach was not fully known. [23] When the plaintiff received the notice of the Data Breach, she was angry, frustrated, anxious about identity theft and credit card fraud, highly offended, and concerned about criminals using her

personal information for nefarious purposes. Although the plaintiff's evidence was that she had provided details about past surgeries as well as a rare medical condition, and was anxious about the Database Breach in relation to the private medical information she had provided, evidence from the database shows such information was not entered into her online profile. The plaintiff's evidence, in her second affidavit, is that she "experienced heightened anxiety with respect to the database breach for a period of approximately 9 months" and that when she thinks about the Data Breach and the potential consequences now, she still feels "some anxiety and frustration". [24] Mr. Molavi's evidence is that he also felt frustrated, worried, and was also highly offended and concerned about his personal information being used for criminal purposes, such as identity theft and credit card fraud. Both the plaintiff and Mr. Molavi have been actively monitoring their credit card statements to ensure there is no suspicious activity. In her second affidavit, the plaintiff estimates she spends approximately one hour extra per month monitoring her statements ever since the Data Breach, but she has not paid for a credit monitoring service. The plaintiff has noticed that since the Data Breach, she has experienced a significant increase in spam calls and phishing/spam emails. Mr. Molavi has also

experienced an increase in spam calls and phishing/spam emails, but does not describe it as significant. There is no evidence that he has paid for a credit monitoring service either. [25] Between February 14 and March 18, 2021 (the "Breach Period") there were approximately 52,000 Spa client files in the Book4Time database. All of the information stored in the Book4Time database during the Breach Period had the potential to be, and may have been, accessed by an unauthorized person or persons. Access via one type of Spa account would have allowed the unauthorized person or persons to navigate the Back End interface to view a client's contact information, appointment dates and times, and any notes entered regarding a client's medical history or services, as well as the last four digits of a client's credit card, but not the full credit card number or expiry date. Access via the other Spa account, which occurred on four different days during the Breach Period, would have allowed the unauthorized person or persons to view any information provided by a Spa client that was stored in Book4Time, including the credit card information of Spa clients who had bookings on those four days, and who had checked in for their service but had not yet checked out. The Spa was closed on three of the four days the unauthorized person or persons accessed the employee's full access account. On the one

day the Spa was open when the employee's account was accessed without authorization, there was a maximum of approximately 32 clients who had bookings. [26] Neither the Empress Hotel nor the Spa have received any information from Spa clients about what information may have been accessed by the unauthorized person or persons, or how any of the information potentially accessed may have been used. Neither the plaintiff nor Mr. Molavi deposed they were aware of any actual use of the information they had provided to the Spa. [27] In brief, the information of some Spa clients was accessible during the Breach Period. It is possible that all of the information in the Book4Time database was taken or compromised, that some of it was, or that none of it was. If it was in fact accessed, there is the potential that it has already been misused but not yet discovered, or that it could be misused in the future. [28] The NOCC pleads that as a result of the Data Breach the plaintiff and the other proposed class members "have suffered and will suffer, injury, damages, and loss". III. THE TEST FOR CERTIFICATION [29] Section 4(1) of the CPA establishes the test for certification. On application, the Court must certify a proceeding as a class proceeding if the following requirements are met. (a) the pleadings disclose a cause of action; (b) there is an identifiable class of 2 or more persons; (c) the

claims of the class members raise common issues, whether or not those common issues predominate over issues affecting only individual members; (d) a class proceeding would be the preferable procedure for the fair and efficient resolution of the common issues; (e) there is a representative plaintiff who (i) would fairly and adequately represent the interests of the class, (ii) has produced a plan for the proceeding that sets out a workable method of advancing the proceeding on behalf of the class and of notifying class members of the proceeding, and (iii) does not have, on the common issues, an interest that is in conflict with the interests of other class members. [30] The Court must not refuse to certify a class proceeding merely because of one or more of the following: the relief claimed includes a claim for damages that would require individual assessment after determination of the common issues; the relief claimed relates to separate contracts involving different class members; different remedies are sought for different class members; the number of class members or the identity of each class member is not known; or the class includes a subclass whose members have claims that raise common issues not shared by all class members: CPA, s. 7. [31] Courts are not to take an overly restrictive approach to interpreting the CPA, but are to approach the legislation in a manner that

gives full effect to the benefits of class proceedings, including judicial economy, improved access to justice, and behaviour modification: Hollick v. Toronto (City), 2001 SCC 68 at para. 15. [32] A certification application focuses on the form of the proceeding, not its underlying merit. The question at the certification stage is not whether the claim is likely to succeed, but whether the suit is appropriately prosecuted as a class action: Hollick at para. 16; Pro‑Sys Consultants Ltd. v. Microsoft Corporation, 2013 SCC 57 [Pro-Sys] at paras. 99-100. [33] Although the merits of the claim are not the focus of the inquiry at the certification stage, the Court is nonetheless required to perform a gatekeeping function to ensure only claims in the common interest of class members are advanced: Finkel v. Coast Capital Savings Credit Union, 2017 BCCA 361 at para.

15. The Court's gatekeeping role is not discharged if it does nothing more than undertake a "perfunctory" examination of the proposed class proceeding: Setoguchi v. Uber BV, 2023 ABCA 45 at para. 44; Finkel at para. 15; Pro-Sys at para.

103. The objects of the CPA are not furthered where a proceeding fails when heard on its merits because the test for certification was not met: Jastram Properties Ltd. v. Tan, 2019 BCSC 475 at para. 22; Finkel at para.

15. IV. DOES THE NOTICE OF CIVIL CLAIM DISCLOSE A CAUSE OF ACTION? [34] In considering whether the pleadings disclose a cause of action, the pled facts are assumed to be true and disclose a cause of action unless it is "plain and obvious" no claim exists: Pro-Sys at para. 63; Hollick at para.

25. Pleadings are to be construed liberally with allowances made for deficiencies in drafting: Finkel at paras. 16-17. A pleading will disclose a cause of action where the facts pled could arguably or possibly entitle the plaintiff to a legal remedy: Jiang v. Peoples Trust Company, 2017 BCCA 119 at para. 55. [35] The NOCC alleges Accor's acts and omissions in relation to the Data Breach give rise to the following causes of action: a) Negligent performance of a service and negligent misrepresentation; b) Breach of contract; c) Breach of fiduciary duty; d) Breach of confidence; e) Unjust enrichment; and f) Breach of privacy and intrusion upon seclusion. [36] At the hearing the plaintiff abandoned her claim based on intrusion upon seclusion, recognizing that the governing jurisprudence has affirmed no such common law cause of action have been recognized in B.C. to date: Ladas v. Apple Inc., 2014 BCSC 1821 at para. 76; Ari v. Insurance Corporation of British Columbia, 2015 BCCA 468 at para. 9; Tucci v. Peoples Trust Company, 2020 BCCA 246 at para. 11 [Tucci CA]. [37] The defendant argues the plaintiff has failed to plead the material facts necessary to establish several of the causes of action the plaintiff seeks to advance, and argues the entirety of the NOCC suffers from an overarching defect, namely that there is no claim for compensable loss. A. Breach of confidence [38] To

establish a claim for breach of confidence a plaintiff must establish: a) the information conveyed was confidential; b) the information was communicated in confidence; and c) the confidential information was misused by the party to whom it was communicated, to the detriment of the party conveying the information (emphasis added). Lac Minerals Ltd. v. International Corona Resources Ltd., [1989] 2 S.C.R. 574 at 635-636, 1989 CanLII 34; Tucci CA at para. 110. [39] Breach of confidence is an intentional tort: Tucci CA at para.

113. The plaintiff's allegations of organizational and technical failures by the defendants do not establish, expressly or by inference, an intention to betray the confidence reposed in them, nor is such an intention pled. The plaintiff concedes the Personal Information was taken by a malicious third party. The "gravamen" of a breach of confidence is the intentional betrayal of confidence by the party to whom the confidential information was imparted: Tucci CA at para.

113. Intentional acts which are not intended to result in such a betrayal, but which may have inadvertently facilitated or led to that consequence, are more appropriately left to be addressed by other torts, such as negligence: Tucci CA at para. 113. [40] I conclude the plaintiff's breach of confidence claim is bound to fail. B. Breach of privacy legislation [41] The Privacy Act, R.S.B.C. 1996, c. 373, creates a tort that is actionable without proof of damages: s. 1(1). In creating a tort that is actionable per se, the legislature has created a presumption that some compensable loss flows from the invasion of privacy rights, but in the absence of specific proof of damages a plaintiff may only be entitled to a nominal or modest award: Ari v. Insurance Corporation of British Columbia, 2022 BCSC 1475 at paras. 80-81. [42] The essential elements of a claim for breach of privacy under the Privacy Act are: 1) the defendant violated the plaintiff's privacy; 2) the violation was wilful; and 3) the violation was without a claim of right: Privacy Act, s. 1(1); G.D. v. South Coast British Columbia Transportation Authority, 2023 BCSC 958 at para. 38. [43] In the context of a claim for breach of privacy under the Privacy Act, "wilful" is to be interpreted "narrowly", and requires "deliberate" conduct, meaning "an intention to do an act which the person doing the act knew or should have

known would violate the privacy of another person": Hollinsworth v. BCTV, 59 B.C.L.R. (3d) 121 at para. 29, 1998 CanLII 6527 (C.A.); G.D. at paras. 41-42. The phrase "without a claim of right" means "an honest belief in a state of facts which, if it existed, would be a legal justification or excuse": Ari v. Insurance Corporation of British Columbia, 2013 BCSC 1308 at para 55, aff'd 2015 BCCA 468; G.D. at para.

40. Here, the plaintiff has not pled facts that could establish the defendants intentionally or deliberately breached the plaintiff's privacy. [44] The plaintiff does not dispute that the Data Breach was undertaken by a malicious third party. The plaintiff relies on Ladas and Douez v. Facebook, Inc., 2014 BCSC 953 as supporting her breach of Privacy Act claim. However, both Ladas and Douez alleged violations of privacy intentionally and directly committed by the parties to whom confidential information had been conveyed. [45] The Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 [PIPEDA], does not establish any private cause of action. Except in circumstances which do not apply in this case, the Personal Information Protection Act, S.B.C. 2003, c. 63 [PIPA], does not establish private causes of action: s.

57. There is no common law tort for breach of statute, and such breaches are generally subsumed within the law of negligence: Sharp v. Royal Mutual Funds Inc., 2021 BCCA 307 at paras. 69-70. [46] I conclude the plaintiff's breach of privacy claim is bound to fail. C. Breach of fiduciary duty [47] The plaintiff argues the spa-client relationship rendered the putative class members vulnerable to the exercises of discretion and that vulnerability and inequality of power gives rise to fiduciary duties on the part of the defendants. The plaintiff took me to no case authority in which a fiduciary duty has been recognized in the context of a spa-client relationship. She seeks to establish the existence of an ad hoc fiduciary relationship between the putative class members and the defendants, either directly or vicariously. [48] Where a relationship is one in which a fiduciary duty has not yet been recognized, to establish such a duty a claimant must show that 1) the alleged fiduciary has undertaken to act in the best interests of the alleged beneficiary or beneficiaries; 2) a defined person or class of persons is vulnerable to a fiduciary's control; and 3) a legal interest or a substantial practical interest of the beneficiary stands to be adversely affected by the alleged fiduciary's exercise of discretion or control: Alberta v. Elder Advocates of Alberta Society, 2011 SCC 24 at

paras. 29-36 [Elder]. With regard to the first "hallmark" of a fiduciary relationship, a plaintiff must "be able to point to a forsaking by the alleged fiduciary of the interests of all others in favour of those of the beneficiary, in relation to the specific legal interest at stake". The plaintiff has not pled facts that establish the defendants' forsaking of the interest of all others in favour of their clients' interests. I agree with Justice Goodridge, then of the Trial Division, that the statutory imposition of a responsibility to take "reasonable" steps does not establish the required undertaking: Hynes v. Western Regional Integrated Health Authority, 2014 NLTD(G) 137 at para. 48; PIPA, s. 4(1); PIPEDA, s. 3. [49] With regard to the second hallmark, vulnerability is essential but insufficient on its own to support a fiduciary claim: Elder at para. 28, citing Galambos v. Perez, 2009 SCC 48 at para. 67. [50] I conclude the plaintiff's breach of fiduciary duty claim is bound to fail. D. Unjust enrichment [51] Unjust enrichment has three essential elements: a) an enrichment of the defendant; b) a corresponding deprivation of the plaintiff; and c) the absence of any juristic reason for the enrichment. Tucci v. Peoples Trust Company, 2017 BCSC 1525 at para. 170, rev'd in part on other grounds 2020 BCCA 246 [Tucci SC]; Ileman v. Rogers Communications Inc., 2014 BCSC 1002 at

para. 100, aff'd 2015 BCCA 260, leave to appeal to SCC ref'd, 36600 (11 February 2016). [52] The plaintiff pleads the defendants enriched themselves by using part of the monies paid for spa services for their own benefit, rather than investing in the necessary safeguards to protect putative class members' Personal Information. However, while the plaintiff argued at the hearing before me that this created a corresponding deprivation to class members by way of placing their Personal Information at risk, there are no facts pled to support the deprivation element of this cause of action. Further, there are no facts pled that explain how any such risk translates into a corresponding economic deprivation. In addition, I agree with the defendants that the service contract the plaintiff seeks to enforce provides a juristic reason for enrichment; a contract that provides for the enrichment of a defendant is a juristic reason for it: Ileman at para.

108. This is not a case where the purported benefit to the defendant is alleged in the NOCC to have been provided "extra‑contractually, or beyond the scope of the contract": 676083 B.C. Ltd. v. Revolution Resource Recovery Inc., 2021 BCCA 85 at para. 50. [53] I conclude the plaintiff's unjust enrichment claim is bound to fail. E. Negligence [54] An action brought in negligence requires a plaintiff to establish 1) the defendant owed them a duty of care; 2) the defendant's behaviour breached the standard of care; 3) the plaintiff sustained compensable damages; and (4) the damage was caused, in fact and in law, by the defendant's breach: Mustapha v. Culligan of Canada Ltd., 2008 SCC 27 at para. 3. [55] I note that the plaintiff pleads the defendants owed the putative class members a duty of care in relation to the management, security, and handling of Personal Information. While facts pled are assumed to be true for the purposes of the cause of action analysis on a certification application, the existence of a duty of care is not an allegation of fact. It is a conclusion of law that is dependent on and arises from material facts that support that conclusion: Young v. Borzoni, 2007 BCCA 16 at para. 52. [56] The NOCC alleges putative class members have suffered, and will suffer, injury, damages, and loss. The issue of whether the plaintiff has pled compensable damages is at the

heart of the dispute between the parties on this application. [57] Pure economic loss is economic loss that is unconnected to a plaintiff's physical or mental injury or to physical damage to property: 1688782 Ontario Inc. v. Maple Leaf Foods Inc., 2020 SCC 35 at para. 17 [Maple Leaf], citing Martel Building Ltd. v. Canada, 2000 SCC 60 at para. 34, D'Amato v. Badger, [1996] 2 S.C.R. 1071, 1996 CanLII 166 at para. 13, and Saadati v. Moorhead, 2017 SCC 28 at para.

23. In contrast, consequential economic loss results from damage to a plaintiff's rights: Maple Leaf at para.

17. The common law of tort does not recognize a general right protecting against the negligent or intentional infliction of pure economic loss: Maple Leaf at para.

19. Instead, pure economic loss is only recoverable in certain circumstances, including negligent misrepresentation or performance of a service: Maple Leaf at paras. 20-21. The original NOCC pled both types of economic loss, but only alleged negligence simpliciter. [58] After receipt of the defendants' written argument, the NOCC was amended to allege categories of negligence that permit recovery for pure economic loss: negligent misrepresentation or performance of a service. As a result of those amendments, the NOCC now alleges causes of action that permit recovery for pure economic loss. However, that does not mean the economic losses the plaintiff alleges in this case are compensable. To be certified as a claim, the loss alleged must be compensable: Del Giudice v. Thompson, 2021 ONSC 5379 at paras. 223, 226-229. [59] As the Alberta Court of Appeal has observed, damages for risk of future harm or the increased risk of harm have generally not been recognized in Canadian tort law: Setoguchi at para.

54. Some of the harm alleged in the NOCC is for these types of non-compensable harm (exposure to future false marketing; exposure to stalking and harassment; risk of harm to their property, finances and creditworthiness). Other forms of loss, injury and damages alleged are broadly described (humiliation, stigmatization and/or discrimination, and violation of personal dignity and autonomy) and, in my view, more appropriately categorized as psychological upset, rather than compensable personal injuries. While the plaintiff asserts damage to reputation or relationships, such a claim alone is insufficient to ground an action in negligence: Young v. Bella, 2006 SCC 3 at para. 56. [60] For emotional or psychological injury to be compensable it "must be serious and prolonged and rise above the ordinary annoyances, anxieties and fears that people living in society routinely, if sometimes reluctantly, accept": Mustapha at para.

9. The plaintiff has pled the Data Breach caused the putative class members "psychological or mental distress which is serious and prolonged, and rises above ordinary annoyances, anxieties and fears". However, a bald recitation of the Mustapha test for compensable injury is not a substitute, nor does it obviate the requirement, for pleading facts that satisfy the compensable harm requirement. The plaintiff has failed to plead facts to support the conclusion that any of the putative class members have suffered or will suffer psychological or mental distress which is serious and prolonged and rises above the ordinary annoyances and fears of life in the digital age: Mustapha at para.

9. A "heightened" anxiety for a few months, followed by "some anxiety" thereafter is inadequate. [61] As Justice Masuhara sagely observed in Tucci SC, "inconvenience, frustration and anxiety are part of normal life": para.

198. Damages for lost time and inconvenience to respond to the Data Breach that take such forms as engaging in precautionary communications about potential misappropriation of Personal Information and responding to any misuse of the Personal Information, all of which the plaintiff alleges, can be compensable in nature, but only where, as is the case with psychological injury, it meets the threshold for compensable loss, which requires the damage to be "serious and prolonged" and rise above the ordinary annoyances, anxieties, and fears that a person living in society may experience: Bourbonnière c. Yahoo! Inc., 2019 QCCS 2624 at paras. 37-44 and the cases cited therein. Even where such damage rises to the threshold to be compensable, damages may be of a limited magnitude: Tucci CA at para. 121. [62] Based on the facts pled this Court finds the lost time and inconvenience alleged do not rise to meet the threshold of constituting annoyances and frustrations beyond those that people living in society in a digital age routinely, if sometimes reluctantly, accept. [63] I conclude the plaintiff's negligence claim is bound to fail. F. Breach of contract [64] The NOCC sufficiently pleads a contract and a breach of its terms. Breach of contract is actionable without proof of damages, although in such cases only nominal damages are awarded: Tucci SC at para. 111, citing Fraser Park South

Estates Ltd. v. Lang Michener Lawrence & Shaw, 2001 BCCA 9 at para. 46, Southin J.A. dissenting. Nominal damages are awarded to acknowledge the commission of a legal wrong where no actual loss is proven: see Davidson v. Tahtsa Timber Ltd., 2010 BCCA 528; Tucci CA at para. 121. [65] However, the plaintiff's claim is not framed as a nominal damages case. Instead, the plaintiff has alleged loss. However, for the reasons already outlined in the negligence analysis, I find the plaintiff has failed to plead a case for any loss that is compensable. [66] I conclude the plaintiff's breach of contract claim is bound to fail. V. CONCLUSION [67] I find the NOCC does not disclose a cause of action as required by s. 4(1)(a) of the CPA. [68] As a result of my conclusion it is not necessary for me to address the other requirements for certification and I decline to do so. However, I wish to add that I share some of the defendant's concerns with respect to the circumstances by which Mr. Molavi became involved in the litigation, and the failure to disclose his connection to the plaintiff's firm. [69] The plaintiff's Certification Application is dismissed. [70] The plaintiff had sought an order granting her leave to proceed under a pseudonym until the Court had determined the plaintiff's Certification Application. Given the Certification Application has now been dismissed, the Anonymity

Application is moot and is dismissed. "V. Jackson, J." The Honourable Justice V. Jackson [1] The Anonymity Application predates Practice Direction 61 - Applications to Commence Proceedings Anonymously, issued by Chief Justice Hinkson effective 2022/05/02, which requires a party who files an originating pleading using initials or a pseudonym to file, at the same time, a notice of application for an anonymity order in accordance with Part 8 of the Supreme Court Civil Rules or Part 10 of the Supreme Court Family Rules, unless there is an enactment which authorizes or requires the party to proceed anonymously. [2] The facts set out are based on the evidence filed for the preliminary procedural step of the Certification Application. They do not constitute final findings of fact based on the admissible evidence ultimately tendered by the parties at any future hearings on the substantive issues.