Ruling shows certification ‘meaningful screening device’ in privacy class actions, says lawyer

The dismissal of class certification in a claim arising out of the Facebook-Cambridge-Analytica data breach demonstrates the role of the certification motion as what the Courts call a “meaningful screening device” in proposed privacy class actions, says Emily Assini, a class actions lawyer at McKenzie Lake Lawyers LLP.

The plaintiff, Jessica Simpson of Toronto, was granted carriage in 2018 on behalf of Canadians who had information associated with their Facebook accounts shared with Cambridge Analytica, the data analytics firm. Simpson relied on the tort of intrusion upon seclusion and asked for total damages of $684 million. On Feb. 16, Superior Court Justice Edward Belobaba dismissed the motion for lack of evidence on the core allegation, stating there was “no evidence in the record” that any Canadian’s personal data was shared with Cambridge Analytica.

“The dismissal of this certification motion is simply a reminder to class counsel that while certification remains a low hurdle it is nonetheless a hurdle,” said Belobaba.

The ruling arose out of “one of the largest and most publicized privacy breaches in modern times,” said Belobaba. A British academic, Dr. Aleksandr Kogan, created an app called “thisisyourdigitallife,” which disguised itself as a personality quiz collecting data for academic research. The real purpose was to harvest the personal data of Facebook users and sell it to Cambridge Analytica, which used it for targeted campaign advertising during the 2016 U.S. general election.

More than 622,000 Canadians were among the 87 million around the world who may have had their personal data compromised, according to Facebook’s estimates.

“To state the obvious, privacy breaches continue to occur more frequently in both Canada and the U.S. And as that happens, class actions seeking damages on behalf of those class members whose information has been breached, will continue to follow,” says Assini.

“In denying certification in this action, it's an example of the court emphasizing that the certification motion is an opportunity for the court to utilize its ‘gatekeeper’… role with respect to proposed privacy class actions.”

Simpson’s was one of two carriage motions granted in Ontario for claims against Facebook stemming from the Cambridge Analytica affair. Douglas Donegani, also of Toronto, represents Facebook users world-wide who had their personal information improperly obtained, directly or indirectly, by third parties.

As evidence that Facebook had shared the personal information with Cambridge Analytica, Simpson referred to a Facebook notification that Kogan’s app “may have misused” user information by sharing it with the data analysis firm. Simpson also pointed to the 2019 report from the Office of the Privacy Commissioner of Canada which stated there was “no assurance that Canadians’ personal information was not shared.” She also relied on public apologies by Facebook officials before U.S. Congressional and Canadian Parliamentary committees in which they said they “didn’t do enough” to protect users’ personal information.

“But that's not actual evidence that the information was shared,” says Assini.

“The case illustrates that speculative evidence in support of certification, and specifically in support of the proposed common issues, can be fatal to certification,” she says.

Osler Hoskin and Harcourt LLP represented Facebook, with a team led by Mark Gelowitz, Robert Carson and Lauren Harper. In an article written by the team, the authors state that a key takeaway from the decision is that, as “certification remains a meaningful screening device… depending on the facts of the case, there are a variety of strategies that defendants facing putative privacy class actions may be able to use to successfully defeat class actions at a preliminary stage.”