Alberta Court of Appeal Dismisses Appeal For Class Action Certification Related To Uber Data Breach

On February 7, 2023, the Alberta Court of Appeal (the Court) issued its decision in Setoguchi v Uber BV, 2023 ABCA 45, upholding  the lower court’s dismissal of a class certification motion for a data breach that impacted personal information collected by Uber.

As previously reported by the E-TIPS® Newsletter here, in 2016, an unknown third-party hacker accessed personal information, including names, phone numbers and email addresses, that Uber had gathered from its drivers and users. In response to a ransom demand, Uber paid the hackers $100,000 USD in exchange for an assurance that the hackers “would destroy and not disseminate” the data.

The proposed class representative, Dione Setoguchi (the Appellant), sought class action certification on the basis that Uber failed to protect the personal information that it collected, which led to hackers accessing and downloading the information. Following the lower court’s dismissal of the Appellant’s certification motion, the Appellant abandoned certain claims and sought to only certify the claims of negligence and breach of contract on appeal. The Court noted that the central issue for these claims related to whether the (i) claim of negligence outlined a viable cause of action under s 5(1)(a) of the Alberta Class Proceedings Act (the CPA); and (ii) the breach of contract claim met certain preferability requirements under s 5(1)(d) of the CPA.

In considering the negligence claim, the Court found that the certification judge erred in requiring the Appellant to provide evidence of loss or harm to meet the threshold under s 5(1)(a) of the CPA. However, the Court noted that negligence still requires the element of proof of harm and that a claim for nominal or symbolic damages could not ground such a claim. The Court also stated that it is inadequate for the Appellant to plead “damages” or “injury”, since both are “bare legal conclusions” that still require sufficient facts to sustain them. With this rationale in mind, the Court found that the Appellant failed to meet the requirements for s 5(1)(a) of the CPA as it did not particularize the harm or damages resulting from the hack or how such loss or damage was caused by Uber.

For the Appellant’s breach of contract claim, the lower court had previously found that all criteria were met, except for the preferability requirement under s 5(1)(d) of the CPA, which examines whether a class proceeding is a fair and efficient method for advancing the claim; and the preferable option for resolving the class members’ claim. The Court agreed with the lower court’s decision, stating that the lower court decision was “entitled to particular deference because it involves weighing and balancing a number of factors” and the Appellant “failed to demonstrate any error in principle by the certification judge or that his decision was clearly wrong”.

Summary By: Sharan Johal