The chief justice of B.C has dismissed ICBC’s appeal of a decision awarding $15,000 to class-action suit members in a privacy breach by a former claims adjuster.
The breach led to shootings and arsons involving gang members who targeted people using information vehicle insurers are obligated to give to ICBC.
“Where—as here—the breach is serious, deliberate, and for an improper purpose, it is entirely open to a judge to conclude more than technically nominal damages are required to compensate for the intrinsic damage to the privacy rights of the plaintiff,” said in his April 23 decision.
The decision, concurred with by two other justices, said the public insurer had been found vicariously liable for a serious breach by Candy Elaine Rheaume of the privacy of a number of its customers and others.
It was in June 2024 that B.C. Supreme Court Justice Nathan Smith ordered ICBC to pay $15,000 to each person affected by a privacy breach after Rheaume leaked their personal data leading to a series of attacks across Metro Vancouver.
The class action’s representative plaintiff, Ufuk Ari, had sought general non-pecuniary damages of $25,000 per class member.
Smith said electronically stored information may be easily accessible to many people within an organization and vulnerable to misuse.
“The court must stress the need for protection of that information and make clear there will be consequences for any failure to do so,” Smith said.
Smith ruled in August 2022 that ICBC was liable for some but not all damages resulting from Rheaume's actions.
“The underlying facts are not in dispute,” Marchand said. “Ms. Rheaume accessed the private information of 78 ICBC policy holders for nefarious purposes. She sold the information of at least 45 policy holders to criminals. Between 2011 and 2012, 13 of these 45 policy holders were targeted in arson and shooting attacks.”
United Nations gang arranged attacks
Marchand noted the court “had described the breach in this case as serious, deliberate, and for an improper purpose, exposing the property and personal safety of the class members to risk.”
As a result of a 2011 police investigation, ICBC discovered Rheaume wrongfully accessed the files of at least 78 of its customers.
Between April 2011 and January 2012, houses and vehicles belonging to 13 customers were targeted in arsons and shootings.
All the victims of the attacks were identified because they had parked their vehicles at or near the Justice Institute of British Columbia.
The customers’ personal information had been sold to an associate of the United Nations gang, which was responsible for arranging the attacks.
In 2017, Rheaume, a New Westminster resident, pleaded guilty in provincial court to unauthorized use of a computer. She received a suspended sentence of nine months’ probation with an order to do 40 hours of community service.
ICBC admitted in the class action that Rheaume sold some of the information she obtained to Aldorino Moretti for $25 or more per licence plate number, and some of that that information was used by Vincent Eric Gia-Hwa Cheung, Thurman Ronley Taffe and others to carry out the attacks.
Cheung subsequently pleaded guilty to numerous arson and firearm offences and on July 27, 2016, was sentenced, after credit for pre-trial custody, to 12 years in prison.
Taffe was sentenced to time served equalling one year and 145 days imprisonment and two years’ probation for his involvement in the offences.
ICBC fired Rheaume and notified 78 customers that their information had been wrongly accessed.
Smith found ICBC vicariously liable for the breach in 2022 and awarded damages in 2024.
In the 2022 ruling, Smith said, “the only thing the victims of those attacks had in common was that their vehicles had at some point been parked in the parking lot of the Justice Institute of British Columbia.”
The appeal
ICBC appealed Smith’s award decision. It claimed Smith erred in awarding compensatory damages without finding corresponding class-wide harm.
Marchand said ICBC raised three issues on appeal but found the only issue before the court was whether or not a judge could award an aggregate award of damages for a breach of privacy.
ICBC had suggested to Smith that each class member should be limited to a “baseline” award of $500.
“The judge (Smith) canvassed a number of cases involving breaches of the Privacy Act where far more than $500 had been awarded and noted the breach of privacy at issue in the case before him was much more serious than in those earlier cases,” Marchand wrote.
And, the chief justice said, Smith had also noted, “Rheaume’s breach was ‘motivated by personal financial gain and resulted in distribution of information to third parties, including criminals.’”
Marchand said Smith correctly concluded more than nominal damages were available to compensate and vindicate the serious breach of the class members’ privacy rights.
Marchand noted the damages award is for the breach of privacy alone.
“It provides no compensation for any mental distress, upset, property damage, loss of income, loss of opportunity, or any other kind of consequential harm that may have been suffered by the members of the plaintiff class,” he said.
Marchand said any further seeking of damages could be done by class members through individual litigation.
