Lam v. Flo Health Inc.

2025 BCSC 993 Lam v. Flo Health Inc.

IN THE SUPREME COURT OF BRITISH COLUMBIA Citation: Lam v. Flo Health Inc., 2025 BCSC 993 Date: 20250530 Docket: S212825 Registry: Vancouver Between: Jaime Kah Cate Lam Plaintiff And Flo Health Inc. Defendant Brought pursuant to the Class Proceedings Act, RSBC 1996, c. 50 Before: The Honourable Justice Blake Reasons for Judgment In Chambers Counsel for the Plaintiff: A.C.R. Parsons N.A. McQuarrie T.P. Charney Counsel for the Defendant: P.E. Veel C. Windsor Place and Date of Hearing: Vancouver, B.C. February 13, 2025 Written Submissions of the Plaintiff: Written Submissions of the Defendant: March 12, 2025 April 8, 2025 Place and Date of Judgment: Vancouver, B.C. May 30, 2025 Table of Contents I. INTRODUCTION.. 3 II. ANALYSIS. 4 A. Section 4(1)(a) 5 1. Breach of Express and Implied Contractual Terms. 6 2. Breach of the Duty of Good Faith and Honest Performance. 17 3. Remedy of Disgorgement 22 B. Section 4(1)(c) 25 III. CONCLUSION.. 27 I. INTRODUCTION [1] At its heart, this proposed class action alleges that the defendant, Flo Health Inc. ("Flo"), intentionally violated the privacy of people who used the Flo Health & Period Tracker application (the "App") to track their reproductive cycles. Ms. Lam says that she and others used the App and entered highly sensitive personal information into it because they relied on Flo's assurances that the information they input into the App

would be kept private. This is a unique privacy case in that it is neither a data-hacking nor a data-stripping case; rather, the plaintiff alleges Flo intentionally disseminated highly sensitive personal information users of the App entrusted Flo with. [2] In reasons for judgment indexed as Lam v. Flo Health Inc., 2024 BCSC 391 ("2024 Reasons") I concluded that the plaintiff's claim for certification of a proposed class action was partially successful. I certified the claim as a class proceeding, and appointed Ms. Lam as the representative plaintiff for the following class: All Canadian residents, excluding residents of Québec, who used the Flo: Health & Period Tracker Application, between June 1, 2016 and February 23, 2019. [3] I concluded that the plaintiffs' further amended notice of civil claim filed March 15, 2022 ("FANOCC") disclosed causes of action for breach of the statutory privacy acts, intrusion upon seclusion (except for British Columbia and Alberta) and breach of confidence. I found the causes of action for negligence, unjust enrichment, breach of the applicable consumer protection statutes, breach of the Competition Act, R.S.C. 1985, c. C-34 and conversion were bound to fail, and I did not see any potential remedy to the fundamental deficiencies. Finally, I found the cause of action for breach of contract, as pleaded, did not disclose a cause of action, but I

gave leave to the plaintiff to further amend their pleading for that specific claim. [4] In response, the plaintiff filed a further fresh as amended notice of civil claim ("Amended FANOCC") on August 28, 2024. She says this amended pleading properly sets out a claim for breach of contract and a breach of the duty of good faith and honest performance. She seeks an order certifying these causes of action and an order certifying the corresponding additional common issues. II. ANALYSIS [5] These reasons should be read in conjunction with my 2024 Reasons, and I will not repeat the undisputed background facts at this time. [6] In my 2024 Reasons, I noted the problems with the breach of contract claim, as pleaded, as follows: [94] However, the plaintiff pleaded a series of alleged terms in generic language in the FANOCC, and failed to plead that a specific express contractual term (or terms) of any Privacy Policy was breached. The plaintiff also failed to clearly identify any specific implied terms of the contract, and failed to plead the factual basis for the implication of any contractual terms. These are significant deficiencies in the FANOCC, particularly as the language of the various privacy policies expressly permitted Flo to disclose some information to the third-party analytics providers. Flo argues that if the plaintiff "alleges that the Privacy Policy did not permit the

disclosure that were made and that Flo therefore breached its terms, it is incumbent on the plaintiff to identify precisely which provisions she says were breached". I must agree. [95] Apparently in response to this argument, the plaintiff significantly reformulated the basis of her breach of contract claim in oral argument. The plaintiff now argues that there were two specific breaches of the contract: a) a direct breach of a promise not to share health information; and b) a lack of meaningful consent to the disclosure that Flo admits took place. [99] Flo quite properly does not argue that the FANOCC could not be amended to be pleaded in a way that could properly establish a cause of action in breach of contract that is not bound to fail pursuant to s. 4(1)(a) of the CPA. However, Flo says that in its current formulation, I cannot assess whether there is a viable breach of contract claim pleaded. [100] Upon a careful review of the FANOCC, I am satisfied that it is not currently pleaded in a sufficient manner to support a cause of action in breach of contract. I am persuaded that it is critical in this action that the express and implied terms of the contract be pleaded with appropriate clarity and detail, as the language of the various privacy policies expressly permitted Flo to disclose some information to the third-party analytics providers. It is not sufficient to revert to

boilerplate pleadings that "it is an express or implied term that ". Specific references to the express and implied terms of the privacy policies must be clearly made. It is inappropriate to plead implied terms in the alternative as a safeguard if express terms are not found to exist. In these circumstances, the starting point must be the express contractual terms themselves--clearly set out and identified within the Privacy Policy--to determine whether there was, in fact, any ultimate breach of the express contractual terms. The pleading must also clearly set out the alleged implied contractual terms, and the material facts relied upon to establish the existence of these implied terms. [101] Only after the express and implied terms are fully and properly pleaded is it possible to consider whether the alleged cause of action for breach of contract is not bound to fail. This is not a matter of inappropriate contractual interpretation at the time of hearing a certification application, but rather a matter of determining, on the material facts pleaded, whether a cause of action is disclosed. [102] Further, in the likely event that some of the express and implied contractual terms may contradict or conflict with each other, it is only after being clearly pleaded that any necessary contractual interpretation may occur. [103] During oral argument, the plaintiff sought leave, to the

extent I concluded the current FANOCC did not disclose a cause of action in breach of contract, to amend the pleadings in the manner they advanced in oral submissions, to account for the two core breaches of contract they set out in oral argument. [7] In response, the plaintiff has filed the Amended FANOCC, which she says pleads the express and implied contractual terms that disclose a cause of action in breach of contract, and in breach of the duty of good faith and honest performance. A. Section 4(1)(a) [8] In my 2024 Reasons I set out the applicable legal principles for the analysis pursuant to s. 4(1)(a) of the Class Proceedings Act, R.S.B.C. 1996, c. 50 [CPA] at paras. 26-29 and 51-54. I will not repeat them here. [9] In summary, s. 4(1)(a) of the CPA requires that the proposed causes of action be properly pleaded and that there is some prospect that they might succeed at trial. The legal adequacy of a proposed claim is determined by considering whether, assuming the facts pleaded to be true, it is plain and obvious that the claim cannot succeed. Pleadings are to be analyzed liberally, and without consideration of the evidence: Nissan Canada Inc. v. Mueller, 2022 BCCA 338 at paras. 37-38. [10] Sufficient material facts must be pleaded to support each element of the cause of action: Hollick v. Toronto (City), 2001 SCC 68 at para. 25; Pro-Sys Consultants Ltd. v. Microsoft Corporation, 2013 SCC 57 at para.

63. Documents referred to in a pleading are incorporated into the pleading by reference: Campbell v. Capital One Financial Corporation, 2022 BCSC 928 [Campbell BCSC] at para. 30, aff'd 2024 BCCA 253 [Campbell BCCA]. [11] The Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 [PIPEDA] likewise applies where there is a real and substantial connection to Canada. PIPEDA requires organizations who collect personal information in Canada to obtain meaningful consent before they share data with third parties. It is mandatory legislation which applies to the collection of personal information by the private sector in Canada: Canada (Privacy Commissioner) v. Facebook, Inc., 2023 FC 533 [Facebook] at para. 50. [12] PIPEDA is "quasi-constitutional legislation, as the ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity, and privacy": Facebook at para.

51. It applies where there is a "real and substantial connection to Canada", and that test is satisfied where there is a US company accessing the data of Canadian users: Facebook, Inc. v. Canada (Privacy Commissioner), 2023 FC 534 at paras. 84 and 86. Facebook was appealed, and since my 2024 Reasons were issued, the appeal decision was released: 2024 FCA 140 [Facebook FCA].

1. Breach of Express and Implied Contractual Terms [13] As noted above, the plaintiff now alleges two breaches of contract: a) a breach of a promise not to share personal information; and b) a lack of meaningful consent to the disclosure that Flo admits took place. [14] Turning first to the breach of the contractual terms not to share personal information, in Part 1 of the Amended FANOCC, the plaintiff sets out the alleged contracts the class members entered into with Flo: at paras. 8-16. [15] In Part 3, she has now amended her position on her breach of contract claim. As I noted in my 2024 Reasons, to use the App, users had to consent to a standard form agreement that incorporated Flo's privacy policy ("Privacy Policy"). The terms of the Privacy Policy changed 13 times during the class period, but each version maintained that Flo would respect the privacy of its users: Part 1 of the Amended FANOCC at para.

9. In my 2024 Reasons I described the Privacy Policy in the following manner: [10] In essence, the Privacy Policy informed users that it collected their name, email address, gender, date of birth, password, as well as information such as weight, body temperature, menstrual cycle dates, and other information about their health and activities that they chose to enter into the App. Flo also indicated that it collects some information automatically, including "information about the mobile device you use to access the App, including the hardware model, operating system and version, unique device identifiers and mobile network information." The plaintiff says the Privacy Policy either expressly or implicitly promised to users that Flo would keep some, or all, of that sensitive health information private. [11] In the Privacy Policy, Flo also informed users that it would share certain personal information with third-party vendors, who supply software applications, web hosting and other technologies for the App, in an aggregate and anonymous format. The Privacy Policy confirmed it would only provide the third-party vendors with information that was reasonably necessary to perform their work to help understand and improve the App. [16] In Part 3 of the Amended FANOCC, the plaintiff now pleads that the contracts were standard-form "click-wrap" agreements, and as contracts of adhesion, any ambiguity should be strictly interpreted against Flo: at para.

19. To use the App, users had to consent to a standard form agreement that incorporated Flo's terms of use and the Privacy Policy. As the Privacy Policy was amended 13 times during the class period, she then sets out in detail the express terms for each of the various iterations of the Privacy Policy that she relies upon, from 2016 to 2019, in support of her position that Flo expressly promised its users that it would keep sensitive health information private: at para. 20. [17] With respect to her position that there was either an express, or implicit, term in the contract that Flo would not share private information, she pleads in Part 3: Flo's Promise Not to Share Personal Information 21. The plaintiff pleads that throughout the class period it was an express term of the contract that Flo would not share, sell, barter, or rent, (hereinafter "share" or "sharing") class member personal information with or to third parties. Examples of this express term are found in the language which says, "YOUR PERSONAL INFORMATION WILL NEVER BE SOLD OR RENTED OUT TO THIRD PARTIES" and, in the later privacy policies, in the language which reads "We may share certain Personal Data, excluding information regarding your marked cycles, pregnancy, symptoms, notes and other information that is entered by you and that you do not elect to share " The other relevant statements are set out above in paragraph 20.

22. In the alternative, plaintiff pleads that, to the extent the term was not an explicit term of the contract as set out in paragraph 21, it was an implied term of the contract that Flo would not share personal information recorded on the App. When the contracts and privacy policies are read as a whole, and in particular the contractual language underlined above at paragraph 20, it is obvious that Flo was assuring class members that it would not share the personal information they recorded. Flo's intentions are confirmed by the fact that, immediately after the disclosure of class member personal information was reported in the Wall Street Journal, Flo amended the privacy policy to say, "We will never share your Personal Data with any third parties." 23. Flo breached the express or implied term of the contract by sharing personal information to third parties. The sharing of the information included providing the information to third parties in exchange for analytics or other services, a form of bartering.

24. More specifically, despite promising not to share personal information including health information as detailed above, Flo shared personal information with third parties regarding its users' marked cycles, pregnancies, and symptoms. As detailed in the fact section, Flo's app events revealed to third parties the fact that users were pregnant, as well as other personal information (date of last period, etc). Because Flo shared this data with unique device identifiers, Flo was revealing personal information to third parties, contrary to its contractual commitments. [18] As I set out in paras. 78-80 of my 2024 Reasons, for a party to properly plead a claim for breach of contract, they must plead the following requisite elements: (1) the nature of the contract; (2) the parties to the contract and the facts supporting privity of contract between the plaintiff and the defendant; (3) the relevant terms of the contract; (4) which term of the contract was breached; (5) the conduct that gave rise to the breach; and (6) the damages that flow from the breach: Matthews v. La Capitale Civil Service Mutual, 2020 BCSC 787 at para. 35. [19] Terms may be implied into a contract in certain circumstances, where: (1) there is an established custom or usage; (2) the term is incidental to a particular class of relationship; or (3) the term is "necessary to give business efficacy to a contract" and

it can be implied as a matter of presumed intention: M.J.B. Enterprises Ltd. v. Defence Construction (1951) Ltd., [1999] 1 S.C.R. 619 at para. 27, 1999 CanLII 677 [M.J.B. Enterprises]. The focus must be on the intentions of the actual parties, and there must be "a certain degree of obviousness to it": M.J.B. Enterprises at para. 29. [20] A plaintiff alleging an implied term must plead the material facts necessary to establish its existence, including the presumed intentions of the actual parties, not the presumed intentions of reasonable parties: Marshall v. United Furniture Warehouse Limited Partnership, 2013 BCSC 2050 at para. 72, aff'd 2015 BCCA 252. [21] Flo also argues that the court's power to imply terms in a contract on the basis of the first category (concerning an established custom or usage) must be used cautiously, and must not be used to rewrite the contract, nor to contradict the express wording of the contract: Elsser v. University of Victoria, 2022 BCSC 580 at para. 48. a) Alleged Breach of the Express Term [22] Turning first to the breach of the express term the plaintiff alleges--a breach of a promise not to share personal information--Flo argues the Amended FANOCC does not disclose a cause of action in breach of contract. Rather, they say it sets out an "absolutist" theory: that the Privacy Policy provided Flo would never share any personal information with

third-parties. They argue that the Amended FANOCC fails to set out an appropriately nuanced theory for the specific breach of the Privacy Policy: it fails to set out the particular personal information shared by Flo; the manner in which that information was shared; the particular parties to whom it was disclosed; or the purposes for which it was disclosed. Flo's position is that in each version of the Privacy Policy, Flo was permitted to disclose information to third-parties in certain circumstances. As the Privacy Policy allowed for Flo to disclose some information, in some circumstances, they say pleading this type of generalized obligation is not tenable. [23] Flo's argument is effectively asking that I interpret the Privacy Policy at this time, and conclude that they had the right to disclose personal information to third parties. To do so at the certification stage would not be appropriate, as it would require that I conclusively determine the proper interpretation of the language in the Privacy Policy in the absence of an appropriate evidentiary record: Situmorang v. Google, LLC, 2024 BCCA 9 at paras. 67-70 [Situmorang]. [24] The plaintiff's position is that Flo breached an express term of the contract that it would not "share, sell, barter, or rent" class member personal information with, or to, third parties. They have set out the express term, and their position is

that this term was breached by Flo disclosing such personal information in contravention of this contractual undertaking. [25] Specifically, the plaintiff pleads that Flo shared personal information with third parties regarding its users' marked cycles, pregnancies, and symptoms, and other personal information, in a manner contrary to the Privacy Policy. [26] The proper interpretation of the Privacy Policy, and, in particular, whether any of the information Flo shared was not in accordance with the express and implied terms of the contract, is properly a matter for trial. Flo's arguments will properly be raised as defences at that time, and, ultimately, the trial judge will have to determine whether the plaintiff has established that there was a transfer of personal information by Flo for which no consent was obtained. That will necessarily include an interpretation of the proper meaning of "personal information" for those privacy policies for which it was not a defined term. [27] I am satisfied that this breach of the express term in the contract is adequately pleaded and is not bound to fail. b) Alleged Breach of the Implied Term [28] I turn next to the alleged breach of the implied term in the contract--that Flo would not share personal information recorded on the App. The plaintiff now sets out an alternative pleading--that in the event the express term set out above is not

found to be a term of the contract, then it was an implied term of the contract. The plaintiff argues that when the contract and the Privacy Policy are read as a whole, it is obvious that Flo was assuring class members that it would not share the personal information they recorded. The plaintiff says Flo's intentions are confirmed by the fact that, immediately after Flo's disclosure of class members' personal information was reported in the Wall Street Journal, Flo amended the privacy policy to say, "[w]e will never share your Personal Data with any third parties". [29] Flo argues there is no basis upon which to read any implied term into the Privacy Policy. It says it is plain and obvious that the proposed implied term alleged by the plaintiff--that Flo would not share personal information recorded on the App--cannot be an implied term of the Privacy Policy for two reasons. First, as the Privacy Policy contains provisions relating to the disclosure of user information, they say implying this term into the contract "would contradict the express disclosure terms and would therefore rewrite the contracts between Flo and its customers". Second, they say the plaintiff fails to plead materials facts that would provide any reasonable basis for this term to be implied. [30] In Part 1 of the Amended FANOCC, at para. 9, the plaintiff includes the following quote from Flo's website: When

you use Flo, you are trusting us with intimate personal information. We are committed to keeping that trust, which is why our policy as a company is to take every step to ensure that individual user's data and privacy rights are protected and to provide transparency about our data practices. [31] The contract was a standard-form "click wrap" agreement, which included the various terms of use and privacy policies in force at the time the user agreed to the contract. [32] I find the plaintiff has properly pleaded the material facts that may provide a reasonable basis for this term to be implied. The actual parties to the contract--Flo and the class members--clearly anticipated that Flo would protect the personal information users input into the App. I am satisfied the implied term may be found to be based upon the presumed intentions of the actual parties as being necessary to give business efficacy to the contract, or having met the "officious bystander" test: M.J.B. Enterprises at para.

29. I am not persuaded by Flo's argument that to imply this term contradicts the express disclosure terms and would, therefore, rewrite the contracts. Rather, the proper interpretation of the Privacy Policy, including whether the evidence establishes the existence of the implied term, is also properly a matter for trial. [33] I cannot accede to Flo's argument that the plaintiff has failed to plead material facts that provide a reasonable basis for this term to be implied. For the reasons above, I am satisfied that the term may be implied as a matter of presumed intention of the actual parties. I am also satisfied that the term may be necessary to give business efficacy to the contract, because the App's business model and its privacy policies were predicated on the fact that users could trust Flo to keep their sensitive information private. [34] I am satisfied that this breach of the alternative implied term in the contract is adequately pleaded and is not bound to fail. c) Lack of Meaningful Consent to Disclosure [35] Finally, the plaintiff alleges that Flo breached the contract by failing to obtain meaningful consent to the disclosure that Flo admits took place. In Part 3 of the Amended FANOCC, at paras. 25-32, the plaintiff sets out their legal basis for their claim that Flo failed to obtain explicit or meaningful consent to the transfer or sharing of personal information to

third parties. [36] Counsel for the plaintiff notes that this is an "unusual" manner of pleading a breach of contract, as it anticipates Flo's defence. I accept his submission that given the way this proceeding has unfolded (in particular, the manner in which this certification application has proceeded), this pleading is an anticipation of Flo's clearly articulated defence that to the extent any disclosure of private information occurred, Flo had the consent of its users to that disclosure. [37] It is necessary to put the Amended FANOCC into the appropriate context. At the time of the initial certification application, the plaintiff raised in her reply, filed April 14, 2022 ("Reply"), and in oral argument, the argument that the Privacy Policy either expressly, or implicitly, incorporated PIPEDA; either through a reference to "applicable data protection laws" within the Privacy Policy, or through the proper application of PIPEDA. This was not pleaded in her FANOCC. Specifically, in her Reply, the plaintiff pleaded: 18. Further, or in the alternative, the plaintiff pleads and relies on the Protection of Personal Information and Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA"), compliance with which cannot be contracted out of by the parties. The plaintiff states that Flo collects, uses or discloses personal information in the course of its commercial activities and is

accordingly bound by PIPEDA. In the alternative, the plaintiff states that Flo's commercial activities have a real and substantial connection to Canada and Flo is bound by PIPEDA as a result. [38] In my 2024 Reasons, I noted that the plaintiff does not advance a cause of action based upon an alleged breach by Flo of PIPEDA, but rather argues it informs a number of the causes of action she does advance. I noted: [46] PIPEDA requires organizations who collect personal information in Canada to obtain meaningful consent before they share data with third parties. It is mandatory legislation which applies to the collection of personal information in Canada, by the private sector: Canada (Privacy Commissioner) v. Facebook, Inc., 2023 FC 533 at para. 50 [Facebook]. [47] PIPEDA is "quasi-constitutional legislation, as the ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity, and privacy": Facebook at para.

51. It applies where there is a "real and substantial connection to Canada", and that test is satisfied where there is a US company accessing the data of Canadian users: Facebook, Inc. v. Canada (Privacy Commissioner), 2023 FC 534 at paras. 84, 86. [48] Ms. Lam argues that PIPEDA is mandatory legislation which applies whether it was specifically incorporated as a term of the contract, and regardless of whether the parties purport to contract out of PIPEDA. She argues that PIPEDA was incorporated into the contract entered into by the parties by reference, notwithstanding there was no express incorporation. She notes that some of the policies clearly referred to applicable data protection laws. For example, the Privacy Policy dated May 25, 2018 provided: If the information covered by this Section is aggregated or de-identified so it is no longer reasonably associated with an identified or identifiable natural person, we may use it for any business purpose. To the extent information covered by this Section is associated with an identified or identifiable natural person and is protected as personal data under applicable data protection laws, it is referred to in this Privacy Policy as "Personal Data". We use pseudonymization for particular types of Personal Data. Please bear in mind that provisions of Section 3 do not apply to pseudonymized Personal Data. [Emphasis added.] [49] Ms.

Lam says it is not permissible to contract out of compliance with PIPEDA, and so says PIPEDA is relevant to her breach of contract claim. In addition, she says the standard of care for meaningful consent set out in PIPEDA informs a number of other causes of action she has pleaded: breach of privacy legislation, breach of confidence and negligence. [50] Flo argues Ms. Lam advances no civil cause of action pursuant to PIPEDA, and a breach of PIPEDA is neither a necessary nor sufficient element of any of the causes of action the plaintiff asserts, and so it is a "red herring". However, I am satisfied that it is appropriate to consider the provisions of PIPEDA when considering the causes of action advanced by the plaintiff, particularly the breach of contract, breach of privacy legislation, breach of confidence and negligence claims. PIPEDA informs and provides context to the necessary legal analysis, notwithstanding the plaintiff does not advance a civil cause of action based on PIPEDA. [39] Ultimately, at para. 242 of my 2024 Reasons, I certified four proposed common issues related to PIPEDA:

PIPEDA 1. Did the Defendant have a duty to obtain meaningful consent under PIPEDA Schedule 1,4.3 Principle 3 - Consent, from Class Members for the disclosure of some or all of their Personal Data to third parties and/or to make their Personal Data accessible to Third Parties?

2. If the answer is yes, with respect to each category of Personal Data, did the Defendant obtain meaningful consent, and, if so, how?

3. Did the Defendant have a policy or practice of disclosing users' Personal Data and/or making it accessible to Third Parties without obtaining meaningful consent under PIPEDA Schedule 1,4.3 Principle 3 - Consent? If so, what categories of Personal Data, and how?

4. If the answer to question 3 is yes, did the policy or practice continue from 2016 through to and including 2019? [40] In her Amended FANOCC, the plaintiff now sets out in Part 3, paras. 25-32, her claim that Flo breached its contract with its users by sharing their personal information with third parties without their consent. The plaintiff says PIPEDA is mandatory legislation and its provisions apply to the collection and use of information by Flo: at para.

26. She says to the extent the Privacy Policy "purport[s] to obtain consent, the information provided to class members was insufficient to satisfy the requirements of PIPEDA regarding meaningful consent": at para. 30. [41] Flo argues that the plaintiff seeks to treat the consent scheme set out in PIPEDA as part of the Privacy Policy, and, in doing so, alleges that a breach of PIPEDA is a breach of contract. They argue that the gravamen of this claim is that Flo's alleged failure to comply with PIPEDA was a breach of contract, and to be able to properly assert that position, the plaintiff must plead that PIPEDA was either expressly or implicitly incorporated into the Privacy Policy. Flo argues this claim is bound to fail, as the plaintiff does not plead that the PIPEDA regime is an express term, or an implied term, of the contract; nor does she plead the Privacy Policy incorporates PIPEDA. They rely on the analysis of Justice Iyer (as she then was) in Campbell BCSC and say, for the same reason, this claim is bound to fail. [42] However, the issue in Campbell BCSC was whether the agreement incorporated by reference the requirements of PIPEDA such that the breach of contract claim would include a breach of PIPEDA. Likewise, in Donegani v. Facebook, Inc., 2024 ONSC 7153 [Donegani] the plaintiff alleged that compliance with PIPEDA was either an express or implied term of the

contract. That is not the manner in which the plaintiff frames her claim. [43] Again, this is a case which centers on the complaint that Flo misused the personal information it was given by class members and unlawfully shared the same without proper consent to do so. The Amended FANOCC does not allege that the contract expressly incorporated PIPEDA; rather, it pleads that PIPEDA governs whether Flo obtained meaningful consent from class members for its data sharing practices. The plaintiff says if Flo was going to obtain consent to its sharing of personal information, "it had to do so according to the standard set in PIPEDA". The plaintiff says this is the proper approach in a data misuse case where the allegation is that Flo was unlawfully sharing the personal information with third parties. [44] In my 2024 Reasons, I referred to the decision of Facebook, from which an appeal was allowed by the Federal Court of Appeal in Facebook FCA, after my 2024 Reasons were issued. On appeal, the Court concluded that Facebook breached PIPEDA's requirement to obtain meaningful consent from users prior to data disclosure and failed in its obligation to safeguard user data. The Court confirmed that the meaningful consent clauses of PIPEDA, along with its purpose, pivot on the perspective of the reasonable person: at paras. 61-63. Meaningful consent "is based on a reasonable person's understanding of the nature, use and consequences of the disclosure": Facebook FCA at para.

83. The Court also commented on the importance of meaningful consent in the following manner: [123] Parliament inserted the word "meaningful" into clause 4.3.2 of PIPEDA, and when reading legislation it is understood that each word has to be given meaning. If pure, contractual consent alone was the criteria, then the outcome of this case may be different. But that is not what Parliament has prescribed. Put otherwise, the question is not whether there is a provision buried in the terms of service whereby a user can be said to have consented. There will almost always be a provision to this effect on which a respondent can rely. This question is relevant, but not determinative of compliance with the twin obligations of PIPEDA; rather the inquiry is broader and contextual. [124] Whether consent is meaningful takes into account all relevant contextual factors; the demographics of the users, the nature of the information, the manner in which the user and the holder of the information interact, whether the contract at issue is one of adhesion, the clarity and length of the contract and its terms and the nature of the default privacy settings. The doctrines of unconscionability and inequality of bargaining power may also be in play. All of these considerations form the backdrop to the perspective of the reasonable person and whether they can be said to have consented to the

disclosure. [45] The Amended FANOCC sets out clearly in Part 3, paras. 25-30, how the specific language in the Privacy Policy was insufficient to meet the standard for meaningful consent. Specifically, para. 32 pleads that, in sharing the personal information with third parties without such consent, Flo breached the contracts. The pleadings do not allege that PIPEDA formed part of the contract; rather, that PIPEDA governs whether Flo actually obtained proper consent to its data sharing practices. In oral argument, counsel for the plaintiffs confirmed their position is that as PIPEDA is mandatory legislation, to the extent Flo argues they had consent to such sharing, and to the extent such consent was not compliant with PIPEDA, then that sharing of personal information was made without consent. [46] While this formulation of the claim may be novel, I cannot find it is bound to fail. As noted by Justice Voith in obiter dicta in Campbell BCCA, it is possible that a failure to properly obtain "informed consent" may have some effect on the validity of the contract: at para.

68. As stated in Atlantic Lottery Corp. Inc. v. Babstock, 2020 SCC 19 [Atlantic Lottery], novel claims that may represent an incremental development in the law should be allowed to proceed to trial: at paras. 18-19. I find it is not plain and obvious that this cause of action is bound to fail.

2. Breach of the Duty of Good Faith and Honest Performance [47] In my 2024 Reasons, I declined to address the issue of whether the plaintiffs had properly pleaded that Flo performed its contractual obligations to the class members dishonestly and in contravention of the requirements of good faith contractual dealing. I agreed with Flo that the plaintiff failed to properly plead this claim, and, specifically, that she failed to plead either the material facts or the particulars of the alleged breach: 2024 Reasons at para. 106. [48] At that certification hearing, in oral argument, the plaintiff argued that Flo both induced class members to enter into the contract, and then continued to breach the contract throughout its performance. However, neither party spent any significant time addressing this issue, nor were any common issues proposed: 2024 Reasons at para. 107. [49] I identified the requirements to establish such a cause of action. I granted the plaintiff leave to further amend the FANOCC to clearly identify the alleged breaches of the duty of good faith and the duty of honest performance, and to amend the proposed common issues for the breach of contract claim to include these specific alleged breaches. [50] In Bhasin v. Hrynew, 2014 SCC 71 [Bhasin] the Supreme Court of Canada took the opportunity to clearly acknowledge that good faith contractual performance "is a general organizing principle of the common law of contract which underpins and informs the various rules in which the common law recognizes obligations of good faith contractual performance": at para.

33. This organizing principle requires parties to "perform their contractual duties honestly and reasonably and not capriciously or arbitrarily": at para. 63. [51] The Court recognized, as a manifestation of this organizing principle of good faith, a common law duty applicable to all contracts to act honestly in the performance of contractual obligations: at para.

33. The Court termed this manifestation the "general duty of honesty in contractual performance" and recognized it as a new common law duty under the broad umbrella of the organizing principle of good faith performance of contracts: at paras. 72-73. They characterized this duty as "a general doctrine of contract law that imposes as a contractual duty a minimum standard of honest contractual performance": at para. 74. [52] Six years later, in C.M. Callow Inc. v. Zollinger, 2020 SCC 45 [C.M. Callow], the Supreme Court again considered the duty of honest performance, and made clear that the dishonest or misleading conduct must be directly linked to the performance of the contract: at paras. 49-54. In Campbell BCSC, Justice Iyer described the cause of action as arising "only where a defendant engages in active dishonesty or deception that is directly related to the performance of the contract": at para. 87 (emphasis in original). [53] Recently, in Ocean Pacific Hotels Ltd. v. Lee, 2025 BCCA 57, our Court of Appeal confirmed that a breach of the duty of honest performance is not a distinct cause of action, but rather can ground a cause of action in breach of contract: at paras. 77 and 82. [54] To properly plead a breach of the duty of good faith, the plaintiff must set out the material facts as to how Flo failed to meet the minimum standard of honest contractual performance. For a

breach of the duty of honest performance, the plaintiff must set out material facts that Flo lied, or knowingly deceived, the plaintiffs: Bhasin at para. 73; C.M. Callow at para. 54. [55] In the Amended FANOCC, the plaintiff set out the legal basis for this alleged breach in Part 3, paras. 35-37. However, in oral argument, when asked for clarification as to whether the plaintiff took the position that Flo breached the duty of good faith, or whether they also argued Flo breached the contractual duty of honest performance, counsel for the plaintiff confirmed they took the position that Flo breached both, and acknowledged that the pleading should be reframed for clarity. He confirmed that the plaintiff's intention was to frame the cause of action in a manner similar to that framed in the claim in Donegani. In Donegani, Justice Akbarali noted: [86] The claim also pleads breach of the contractual duty of honesty. It claims that Facebook covertly entered into agreements with third parties in direct contravention of the spirit, purpose and intent of its contract with class members, in breach of its duty of good faith and honest performance. It alleges that Facebook failed to disclose to accountholders the existence of its Data Sharing Agreements in breach of its duty of honesty and good faith and fair dealing to the plaintiffs and class members. She concluded that the cause of action

was adequately pled, and found the proposed common issue was suitable. [56] With leave, after the oral hearing for this application, the plaintiffs filed further written submissions and a proposed fourth amended notice of civil claim, which proposed to plead the claim (in its entirety) as follows: Breach of the Duty of Good Faith and Honest Performance 35. The facts supporting the existence of contracts between Flo and class members and their terms are pleaded above at paragraphs 19 to 22.

36. The plaintiff pleads that Flo breached its contracts with class members when it shared class members' personal information with third parties while assuring them it would not do so. Despite promising in the contract that it would not share personal information (and that it would only share aggregated and de-identified information), Flo shared custom app events with descriptive titles in a manner that connected the personal information being provided with an identifiable person. This breach was a dishonest performance of its obligations under the contract (not to share identifiable personal information) and contrary to the spirit and intent of the contract, which was to protect individual's privacy while recording extremely personal events. This breach grounds a claim for breach of contract through breach of the duty of honest performance.

37. The same conduct was a breach of the duty of the common law organizing principle of good faith which is implied in all contracts. The breach of the duty consists of Flo's failure to be honest with class members about how it was using their personal information under the contract. The effect of this failure was to nullify one of the central purposes of the contract; the protection of class members' privacy.

38. Flo misled potential customers about its data sharing practices in order to grow its business by recruiting new customers. Class members personal information is highly sensitive. The majority of class members would never have signed up for the app if they knew the information they were sharing with Flo was being provided to third parties who could use it for their own purposes in a situation where class members had no control over how the third parties would use it. If they learned of this sharing after signing up for the app, users would have discontinued their accounts.

39. Flo knew that unless it assured applicants and users that it would never share their information its customer base would not have expended. This is demonstrated by the fact that Flo changed the language of the privacy policy the day after the Wall Street Journal article was published so that it read "We will never share your Personal Data with any third parties". [57] The plaintiff argues that, like in Donegani, the plaintiff properly pleaded that Flo shared class members' personal information with third parties in direct contravention of the spirit of its promise to class members. Specifically, the plaintiff says the breach of the duty of good faith can occur when one party exercises their discretion under a contract in a manner to substantially nullify the bargained objective or benefit contracted for by the other: Greater Vancouver Sewerage and Drainage District v. Wastech Services Ltd., 2019 BCCA 66 at para. 66, aff'd 2021 SCC 7. She argues that her pleading that Flo breached its obligation of good faith is properly pled. [58] The plaintiff also argues that the proposed fourth amended notice of civil claim clearly sets out the alleged dishonest act--the sharing of identifiable personal information through the custom event apps, while assuring class members that it would not share their identifiable personal information--which grounds the claim for breach of the duty of

honest performance. [59] Flo argues that a breach of the duty of good faith and honest performance requires some form of additional conduct outside non-performance of the contract. It maintains that the plaintiff has failed to properly plead a claim for a breach of the duty of good faith or honest performance. Specifically, Flo says that the plaintiff has failed to plead any materials facts about how Flo deceived or misled class members above and beyond its alleged failure to abide by its Privacy Policies. They say a mere breach of contract claim does not, by itself, give rise to a cause of action for breach of the duty of good faith, but requires some form of additional conduct outside non-performance of the contract. [60] Notwithstanding the plaintiff has not pleaded any additional material facts underlying these two causes of action, I cannot accept Flo's argument. The proposed fourth amended notice of civil claim makes clear that the plaintiff argues Flo failed to be honest with class members about how it was using their personal information, in breach of the duty of good faith. The plaintiff argues the effect of this failure was to nullify one of the central purposes of the contract; namely, the protection of class members' privacy. [61] Likewise, the plaintiff argues the same conduct was a breach of the duty of honest performance of Flo's obligations under the contract,

and contrary to the spirit and intent of the contract, which was to protect the individual's privacy while recording extremely personal events. [62] I am satisfied that the proposed fourth amended notice of civil claim adequately pleads material facts which, if proven at trial, may support the causes of action in breach of the duty of good faith and honest performance. That is, that the material facts pleaded may support not only a breach of contract, but may also support a determination that Flo breached its duty of good faith and honest performance. I cannot accept Flo's argument that the material facts "describe nothing more than an alleged breach of contract"; nor can I accept their position that "[t]he mere allegation that there was an intentional breach of contract is not and cannot be sufficient to ground a claim for the breach of the duty of good faith and honest performance; there must be some additional conduct beyond the mere breach of contract". In these circumstances, in which the plaintiff relies upon Flo's alleged commitment to protect each individual App user's privacy rights to their intimate personal information, I am satisfied that the material facts which underly the alleged breach of contract claim may also be sufficient to support the causes of action in breach of the duty of good faith and honest performance. [63] I find it is not plain and obvious that this cause of action is bound to fail.

3. Remedy of Disgorgement [64] In the Amended FANOCC, the plaintiff now seeks nominal damages and disgorgement for the alleged breach of contract. Specifically, in Part 3, she sets out: Damages for the Breach of Contract 33. As a consequence of Flo's breach of the contracts the class claim nominal damages for breach of contract or disgorgement of all profits obtained by Flo through sharing class member personal information to third parties for purposes including, but not limited to gaining access to third party analytics, which allowed Flo to exponentially grow their business and revenues from targeted advertisements directed to class members.

34. The plaintiff states that compensatory remedies alone are inadequate to address the harm occasioned on the plaintiff and the Class by Flo's breach of contract. The nature of the plaintiff's and the Class Members' interest in their personal information support their legitimate interest in preventing Flo's profit-making activity and, hence, in depriving Flo of its profits. Flo should be required to disgorge its financial gains realized from the breach of contract and its duties of honesty and good faith contractual performance. [65] To the extent class members establish a breach of contract at trial, but do not establish loss giving rise to compensatory damages, they may be eligible for nominal damages: Sharp v. Royal Mutual Funds Inc., 2021 BCCA 307 at para. 161 [Sharp]. The plaintiff acknowledged in oral argument that class members do not have strong claims in expectation or compensatory damages because many did not pay a fee for use of the App. In these circumstances, that acknowledgment does not defeat a potential claim for disgorgement. [66] The parties agree the remedy of disgorgement for breach of contract may be appropriate in exceptional circumstances: Atlantic Lottery at paras. 52-54. In Atlantic Lottery, the Supreme Court of Canada made clear that such exceptional circumstances will only arise where, at a minimum, the remedies of damages, specific performance, and

injunction are inadequate: at paras. 52 and 59. There are no fixed rules as to what types of circumstances will be considered exceptional. One important consideration is whether the plaintiff has a legitimate interest in preventing the defendants' profit-making activity: Atlantic Lottery at paras. 52-53; see also Campbell BCSC at para. 82. [67] In Hoy v. Expedia Group, 2024 ONSC 1462 [Hoy], at para. 68, the Court concluded that disgorgement is only available for breach of contract in those exceptional circumstances where: a) the nature of the plaintiff's interest is such it cannot be vindicated by other forms of relief; and b) the specific circumstances warrant making such an award. [68] With respect to the second factor, such specific circumstances could include those circumstances where a plaintiff has a legitimate interest in preventing the defendant's profit-making activity: Hoy at para. 68. [69] While disgorgement may be available in exceptional circumstances, our Court of Appeal has made clear "it is not a remedial vehicle that enables a plaintiff to sidestep the need to prove that its losses were caused by the defendant's breach of contract": Sharp at para. 100. [70] Flo says the plaintiff has failed to plead material facts to support its claim that compensatory remedies alone are inadequate to address the alleged harm suffered. It characterizes the Amended FANOCC as a

"boiler plate pleading" that cannot support the plaintiff's claim of disgorgement. Flo relies upon the decision of Justice Iyer in Campbell BCSC, in which she concluded that the plaintiff's claim for disgorgement damages for breach of contract could not succeed. [71] Flo also argues that even if exceptional circumstances are present, the plaintiff has failed to plead material facts setting out which profits were made as a result of the alleged breach of contract. It argues the plaintiff has failed to plead material facts to support her claim that Flo shared user information for profit. [72] I am satisfied that it is not plain and obvious the claim for disgorgement damages for breach of contract (and breach of the duty of good faith and honest performance) cannot succeed. The plaintiff has properly pleaded the necessary material facts. If these material facts are found to be supported by the evidence at trial, they may be sufficient to meet the requirements for the remedy of disgorgement. Specifically, the plaintiff has pleaded that Flo used the class members' personal information for profit, and shared that information with third parties for targeted advertising, commercial exploitation, and use in external analytics systems: Amended FANOCC at Part 1, paras. 4, and 17-22. She pleads that Flo's failure to warn its users about its use of their data for profit, in turn, allowed

Flo's user numbers to rapidly expand: Amended FANOCC at Part 1, paras. 27-28. [73] In Part 3 of the Amended FANOCC, the plaintiff properly identifies those profits she seeks to be disgorged, namely, " all profits obtained by Flo through sharing class member personal information to third parties for purposes including, but not limited to gaining access to third party analytics, which allowed Flo to exponentially grow their business and revenues from targeted advertisements directed to class members": at para.

33. She also pleads that compensatory remedies alone are inadequate, and explains how the class members' interest in their personal information " [supports] their legitimate interest in preventing Flo's profit-making activity": at para. 34. [74] As in Donegani, I accept that the class members may have a legitimate interest in preventing Flo from profiting from their personal information in circumstances where they have not agreed to the use of that information in that manner, which is what the plaintiff alleges Flo has done. The fact that class members also seek nominal damages does not mean the claim for disgorgement is bound to fail: Donegani at para. 122. [75] Flo points out that the plaintiff acknowledges that many users did not pay for their use of the App, and therefore do not seek expectation damages, and argues that alone cannot support the remedy of disgorgement. However, that is merely one factor to be considered at trial, when determining the appropriate remedy for any breach of contract which may be found. Whether other damages are inadequate will ultimately be a matter for trial. [76] In Donegani, Justice Akbarali concluded that the question of whether nominal damages are sufficient to "vindicate the nature of the class members' interest" is not one that ought to be determined at the certification stage: at para.

122. I find that analysis equally applicable here. [77] I find the Amended FANOCC properly pleads a claim for disgorgement, and, as a result, is not bound to fail. B. Section 4(1)(c) [78] I will use the same definition for the term "Personal Data" that I used in my 2024 Reasons: at para.

242. Specifically, "Personal Data" was defined "to mean information about an identifiable individual as defined in s. 2(1) of PIPEDA". For the purposes of the action, it was divided into two categories: "personal information" and "health information", both of which were then defined. [79] The plaintiff now seeks to certify the following additional common issues: Breach of Contract 18. Did Class Members enter into a standard form contract with the Defendant?

19. What are the relevant terms (express or implied) of the Class Members contract with the Defendant respecting the sharing, selling, renting and/or bartering of Personal Data to Third Parties?

20. Was it an express or implied term of the contract that the Defendant would not share, sell, rent, and/or barter some or all of the categories of Personal Data to Third Parties?

21. Was it an express or implied term of the contract that the Defendant would not share, sell, rent, and/or barter some or all of the categories of Personal Data to Third Parties without obtaining meaningful prior consent?

22. If the answer to questions 20 and/or 21 is yes, did the Defendant breach the contract? And, if so, how? Breach of the Duty of Good Faith and Fair Dealing 23. Did the Defendant lie or knowingly deceive the Class and therefore breach its contractual duty of good faith and fair dealing? Damages for Breach of Contract/Breach of the Duty of Good Faith 23. Is the Defendant liable for damages for breach of contract and/or breach of the duty of good faith and fair dealing, including: a. Nominal Damages b. Disgorgement of Profits [80] Flo argues that the breach of contract claim must fail for a lack of commonality. They argue that because the Privacy Policy was amended 13 times during the class period different class members are subject to different contractual regimes. They also argue that Flo shared different information with different third-party analytics providers over the class period. They say both of these require an individualized inquiry and so there is no way to determine the breach of contract claim in common across the class. [81] I am not persuaded by these arguments. The fundamental issue is whether the relevant privacy policies ought to be interpreted in a manner that condones the sharing of personal information by Flo to third parties. To the extent any of the nuances between the policies are material, that would merely lead to the existence of a number of subclasses (which is expressly not a bar to certification, see s. 7 of the CPA) and not to an analysis of individual claims. See also Hvitved v. Home Depot of Canada Inc., 2025 BCSC 18 at para. 72. [82] Further, I have already concluded in my 2024 Reasons that the nature of the information requested to use the App was similar for each user, and was inherently personal and sensitive: at para.

200. I found the evidence advanced to date provided some basis in fact that the parties all entered into similar contracts, and the users were asked to input a uniform set of personal and sensitive data: at para. 204. [83] I find that is sufficient to establish that the proposed common issues exist, and that the issues are framed in a way common to all class members. I certify the plaintiff's proposed common issues as set out above. III. CONCLUSION [84] The plaintiff is entitled to the orders she seeks in Part 1, paras. 1 and 2 of her notice of application. [85] The plaintiff is to file a further amended notice of civil claim, incorporating my 2024 Reasons and these reasons for judgment. That amended pleading is to be called the "Fourth Amended Notice of Civil Claim" and is to be blacklined and redlined in accordance with Rule 6-1(3) of the Supreme Court Civil Rules. "Blake J."