Canada will see its first class action lawsuit based on the new tort of invading another’s privacy, after a Bank of Nova Scotia employee leaked customers’ personal information to his girlfriend for personal gain. At least 138 customers were subsequently defrauded. Ontario’s Superior Court accepted that the employer was vicariously liable for the employee’s actions and certified the class of 643 customers whose files the employee had accessed and potentially leaked.
Intrusion upon seclusion
Intruding upon a person’s seclusion means intentionally or recklessly invading her or his private affairs without justification, causing the person distress, humiliation or anguish. This tort of intrusion upon seclusion is only a recent creation. In 2012:
The Ontario Court of Appeal reversed an established principle that there is no such thing as a tort of invasion of privacy… the Court decided that it was now appropriate to confirm the existence of a tort of invasion of privacy called ‘a right of action for intrusion upon seclusion.’
The customers didn’t argue that the bank itself intentionally leaked the information, but that the employee did, and the employer is responsible for the employee’s intentional wrong actions.
Vicarious liability
To be vicariously liable for an employee’s actions, the employer must tacitly condone the conduct by creating or enhancing the risk that it may happen. In this case, the bank admitted to “a complete lack of oversight” of employees’ access to customer personal and financial information.
The Superior Court didn’t have to determine whether the Bank of Nova Scotia was vicariously liable for the employee’s actions, only that it was not “plain and obvious” that the customers’ vicarious liability argument would fail in court.
Regardless of the outcome of the class action to come, the certification proceeding is instructive. Employers must implement sufficient safeguards to protect customer and employee personal information. Policy should prohibit the unauthorized access, use and disclosure of confidential information. Practice should allow only necessary access to confidential files.
Read the Superior Court’s decision in Evans v. The Bank of Nova Scotia, 2014 ONSC 2135 on CanLII.
