Alberta Court Denies Certification of Privacy Breach Class Action Against Uber

On January 8, 2021, the Court of the Queen’s Bench of Alberta (the Court) in Setoguchi v Uber B.V., 2021 ABQB 18, denied certification under Alberta’s Class Proceedings Act of a proposed privacy breach class action on behalf of customers of Uber and its drivers (Class Members) whose personal information was subject to unauthorized access.

The proposed class action arose following a data breach in 2016 where malicious external actors accessed Class Members’ names, phone numbers and email addresses collected and stored on the cloud by Uber. In response, Uber paid the ransom demand in exchange for a guarantee that the information would be destroyed and did not initially notify Class Members or government regulators pursuant to statutory obligations under the federal and provincial privacy protection legislation. The data breach incident was ultimately discovered by third parties in 2017 and reported in the media.   

The representative plaintiff alleged that Uber breached contractual, common law and statutory obligations to protect personal information from unauthorized parties and sought personal and punitive damages as a result of the hacking. Uber argued that certification should not be granted since there was no proof of fraud, identify theft or other economic loss suffered as a result of the data breach incident.  The key issue before the Court was whether there was some evidence or basis in fact for any real resulting harm, loss or damage from the alleged common law or statutory breaches.

The Court found that the representative plaintiff had failed to establish any evidence of harm or loss suffered by Class Members, and that compensable harm or loss was wholly non-existent. Furthermore, the Court determined that there was no evidence or basis in fact that any Class Member had, or would have had, any reasonable expectation of privacy in the information subject to the data breach (i.e. names, phone numbers and email addresses) as it was not necessarily confidential.

In refusing certification of the class, the Court exercised its gatekeeping function and emphasized the importance of certification as a “meaningful screening device” to weed out unmeritorious claims at an early stage. The Court held that the proposed class action was not the preferable procedure for the fair and efficient resolution of the common issues, thus leaving individual Class Members to pursue a personal action for damages.

Summary By: Anna Troshchynsky