Skip to content

LifeLabs personal data breach leads to multiple class action suits

Competing law firms want case involving 15 million Canadians
cyberattack

The medical lab company that experienced a cyberbreach of 15 million patients’ personal information nationwide is facing multiple class action suits in two provinces.

Privacy commissioners in Ontario and B.C. revealed last year cyber criminals penetrated the LifeLabs’ systems, extracting data and demanding a ransom.
LifeLabs CEO Charles Brown said the company retrieved the data by making payment.

“We did this in collaboration with experts familiar with cyberattacks and negotiations with cyber criminals,” he said in an open letter released in December 2019.

Now, BC Supreme Court Justice Nitya Iyer Nov. 6 declined to stop two suits against LifeLabs in B.C. after Ontario Supreme Court awarded responsibility – or carriage - for Ontario suits to one of three competing groups of class action law firms.

There are nine proposed actions in B.C. and four in Ontario. One B.C. suit proposes a single national action.

The judge said the fact that parallel class actions have started does not make them duplicates of each other.

Further, Iyer said, “Although I appreciate that the multiple carriage motions are inefficient, this must be balanced against the interests of putative B.C. class members to have their best interests considered by a B.C. court.”

Iyer explained in the ruling that awarding of carriage of a suit to a law firm or group of firms can result in competition between firms when more than one class proceeding is brought regarding the same defendant and the same subject matter.

Legislation allows courts to make decisions on how cases move forward in a fair and expeditious way.

“When the court awards carriage to one action, it stays the competing action until certification has been determined,” Iyer said. “If the court refuses to certify the proposed class proceeding, it may lift the stay on one of the other proceedings.”

The privacy commissioners have attempted to release a full report on the breach but said in June they are being thwarted by the company.

They said LifeLabs claims information provided to the commissioners is privileged or otherwise confidential.

As such, the company is seeking a court order to prevent publication of the full report.

"LifeLabs' failure to properly protect the personal health information of British Columbians and Canadians is unacceptable. LifeLabs exposed British Columbians, along with millions of other Canadians, to potential identity theft, financial loss and reputational harm,” B.C. Information and Privacy Commissioner Michael McEvoy said in a statement earlier this year.

[email protected]

@jhainswo