Décision

Zuckerman c. Target Corporation					2017 QCCS 110
JH5439    SUPERIOR COURT
(Class Action)
CANADA
PROVINCE OF QUÉBEC
DISTRICT OF		MONTRÉAL
No:	500-06-000686-143
DATE:	January 18, 2017
______________________________________________________________________
PRESIDED BY			THE HONOURABLE	STEPHEN W. HAMILTON, J.S.C.
______________________________________________________________________
EVAN ZUCKERMAN
Petitioner
v.
TARGET CORPORATION
Respondent
______________________________________________________________________
JUDGMENT ON RESPONDENT’S MOTION FOR FORUM NON CONVENIENS AND PETITIONER’S AMENDED MOTION TO AUTHORIZE THE BRINGING OF A CLASS ACTION AND TO ASCRIBE THE STATUS OF REPRESENTATIVE
______________________________________________________________________

INTRODUCTION

[1]       The petitioner seeks the Court’s authorization to bring a class action on behalf of all Canadians whose payment card data and/or personal information was lost by and/or stolen from the respondent as a result of a breach of its computer network by unknown hackers.

[2]       The respondent asks the Court to decline jurisdiction over this matter in favour of the United States District Court for the District of Minnesota. It also contests the petitioner’s motion.

 

CONTEXT

[3]       Target is one of the largest discount retailers in the United States, with approximately 1,800 retail stores across the United States and estimated annual sales of US$73.8 billion. Its head office is located in Minneapolis, Minnesota.

[4]       Between 2013 and 2015, Target had a Canadian subsidiary which operated retail stores in Canada. The present proceedings do not relate to the Canadian subsidiary.

[5]       On December 19, 2013, Target publicly acknowledged that there had been “unauthorized access to Target payment card data”, including customer name, credit or debit card number, and the card’s expiration data and security code. Target indicated that customers who had made credit or debit card purchases in their U.S. stores from November 27, 2013 to December 15, 2013 might be impacted.[1] It was later established that data with respect to 40 million credit or debit cards may have been taken.[2]

[6]       On December 20, 2013, Target stated in a press release and mailing to its customers that there was no indication that PIN numbers had been compromised. Further, Target stated that it will offer free credit monitoring services for everyone impacted, with details to follow.[3]

[7]       On December 27, 2013, Target announced that strongly encrypted PIN data was removed from their system during the data breach, but that PINs were safe and secure.[4]

[8]       On January 10, 2014, Target announced that in addition to the payment card data described in the preceding paragraphs, certain personal information, such as names, mailing addresses, phone numbers and email addresses, for up to 70 million customers had also been taken.[5]

[9]       As a result, the data breach affected:

·        The holders of 40 million credit or debit cards (including Target REDcard and Target Visa) that had been used in a U.S. Target store between November 27, 2013 and December 15, 2013; and

·        70 million individuals who had provided personal information to Target prior to December 15, 2013 and whose information was held in the Target guest contact database.

[10]        Target does not know how many of the 40 million cardholders are resident in Canada. It has such information only with respect to Target REDcard and Target Visa cards, and it states that the number of holders of these cards with Canadian addresses is 5,111, including 234 in Quebec.[6]

[11]        With respect to the 70 million customers with data in the Target guest contact database, Target estimates that 263,465 are resident in Canada.[7]

[12]        On January 10, 2014, Target extended its offer of one year of free credit monitoring to all customers who shopped in its U.S. stores.[8]

[13]        Target provided details of the free credit monitoring on January 13, 2014.[9]

[14]        The next day, a class action was filed against Target in the U.S. District Court for the Northern District of California on behalf of all persons and entities in the United States who used a credit or debit card at Target.[10] Over the next few weeks, more than 80 similar consumer class actions were filed against Target in the United States.[11] The consumer class actions were ultimately consolidated in a single proceeding before the U.S. District Court for the District of Minnesota.[12] The consolidated consumer class action covered only residents of the United States.

[15]        Class actions were also filed on behalf of financial institutions that were required to cancel and re-issue credit and debit cards, monitor customer accounts and reimburse customers for fraudulent charges.[13] The financial institution class actions were also consolidated in a single proceeding before the U.S. District Court for the District of Minnesota.[14] The consolidated financial institution class action only covered financial institutions in the United States.

[16]        The petitioner, Evan Zuckerman, is a resident of Quebec. He alleges that he used a credit card issued by a U.S. bank to shop at a Target store in the United States prior to November 27, 2013,[15] such that his personal information may have been stolen.

[17]        On January 20, 2014, Zuckerman[16] received an email from Target Canada advising him that his personal information may have been taken. Target Canada said that Target was working on a credit monitoring service for impacted Canadian customers and that they would send information when it became available in the coming days.[17]

[18]        Zuckerman states that on January 23, 2014, he purchased a credit monitoring package from Equifax Canada at a price of $19.95 per month and that he made the first payment of $19.95.

[19]        The next day, Zuckerman received an email from Target Canada in which Target Canada offered one year of free credit monitoring.[18] Zuckerman signed up for the free credit monitoring and cancelled the credit monitoring package that he had purchased. He states that he did not recover the $19.95 he had paid for the first month.

[20]        On March 13, 2014, Zuckerman instituted the present proceedings against Target. He described the proposed class as follows:

All persons in Canada (subsidiarily in Quebec and subject to Article 999 C.C.P.), whose personal and/or financial information was lost by and/or stolen from Respondent as a result of the data breach that occurred between at least November 27, 2013 and December 15, 2013 (hereinafter the “Data Breach”), and as a Sub-Group, all other persons, businesses, entities, corporations, financial institutions or banks who suffered damages or incurred expenses as a result of said data Breach, or any other Group(s) or Sub-Group(s) to be determined by the Court;

[21]        Zuckerman asked for authorization to claim compensatory and/or moral damages on behalf of the class members for:

·        Fear, confusion, inconvenience or loss of time;

·        Need to closely monitor their accounts;

·        Costs or fees for additional credit monitoring services;

·        Possible fraud or identity theft;

He also claimed punitive damages flowing from Target’s “malicious, oppressive and high-handed conduct”.

[22]        Target responded with a motion for declinatory exception and subsidiarily for forum non conveniens. Target alleged that the Quebec courts lacked jurisdiction or should decline jurisdiction in favour of the U.S. District Court for the District of Minnesota.

[23]        Zuckerman amended his motion on November 14, 2014 to add some details but he did not change the substance of the motion.

[24]        On March 23, 2015, Mr. Justice Pinsonnault of this Court held that the damages alleged by Zuckerman were insufficient to give the Quebec courts jurisdiction under Article 3148 of the Civil Code of Québec and he dismissed Zuckerman’s motion. He did not deal with the forum non conveniens argument.[19]

[25]        The Court of Appeal allowed the appeal on November 5, 2015, on the basis that the expense of $19.95 that Zuckerman incurred for credit monitoring was prejudice suffered in Québec for the purposes of Article 3148 C.C.Q. and was sufficient to establish the jurisdiction of the Québec courts.[20] The matter was returned to this Court to deal with the forum non conveniens argument and the authorization. The undersigned was designated as the case management judge on April 4, 2016.

[26]        Meanwhile, the U.S. class actions were settled. The U.S. District Court for the District of Minnesota approved the settlement of the consolidated consumer class action on November 17, 2015[21] and the settlement of the consolidated financial institution class action on May 12, 2016.[22] In December 2015, four individuals appealed the judgment approving the consumer settlement.[23] The appeals were scheduled to be heard on November 16, 2016.[24] The Court has not been advised of the outcome of that hearing.

[27]        A number of Canadian financial institutions that issue Visa credit and debit cards also settled with Target.[25]

[28]        The Court heard the parties on the forum non conveniens argument and the authorization on December 6 and 7, 2016. On the morning of the second day of the hearing, Zuckerman amended the proposed class description to (1) remove the reference to Article 999 of the Code of Civil Procedure, which he said was no longer relevant after the new Code of Civil Procedure came into force on January 1, 2016, and (2) remove the subclass of financial institutions.

ANALYSIS

[29]        The Court must deal with two proceedings: Target’s motion for forum non conveniens, and Zuckerman’s motion to authorize the bringing of a class action.

1.            Forum non conveniens

[30]        The concept of forum non conveniens is described in Article 3135 C.C.Q.:

3135. Even though a Québec authority has jurisdiction to hear a dispute, it may, exceptionally and on an application by a party, decline jurisdiction if it considers that the authorities of another State are in a better position to decide the dispute.

[31]        Target raises forum non conveniens before the class action has been authorized. As a result, the only “dispute” that exists at this stage is the motion to authorize the bringing of a class action, and not the class action itself. The class action will not exist unless and until it has been authorized. At this stage, the forum non conveniens argument must therefore be considered with respect to Zuckerman’s individual claim and his request for authorization to bring a class action.[26]

[32]        If the Court dismisses the forum non conveniens argument and authorizes the class action, the Court will consider the jurisdiction and forum non conveniens arguments in relation to the other potential class members when it defines the class.

[33]        The question at this stage is therefore whether the Court should decline jurisdiction over Zuckerman’s claim and his request for authorization to bring a class action on the basis of forum non conveniens.

[34]        The criteria that the Court should apply in the forum non conveniens analysis are quite well established:

37           The doctrine of forum non conveniens confers on the court a supplementary power to decline to exercise a jurisdiction that is otherwise granted to it by one of the conflict of laws rules provided for in the C.C.Q. The law attaches an exceptional character to this power, although the exercise of the power is not regarded as unusual (Spar Aerospace Ltd. v. American Mobile Satellite Corp., [2002] 4 S.C.R. 205, 2002 SCC 78, at paras. 77 and 81; GreCon Dimter inc. v. J.R. Normand inc., [2005] 2 S.C.R. 401, 2005 SCC 46, at para. 33). Furthermore, the judge may exercise it only at the request of a party, and not on his or her own initiative. The application of this doctrine requires a review of various, and variable, criteria. On the basis of the Quebec Court of Appeal’s decision in Lexus Maritime inc. v. Oppenheim Forfait GmbH, [1998] Q.J. No. 2059 (QL), at para. 18, Professor J. A. Talpis enumerated the most important factors as follows:

The criteria most commonly used in the Quebec jurisprudence on forum non conveniens include: 1) the residence and  domicile of the parties, 2) the location of the natural forum, 3) the location of the evidence, 4) the place of residence of the witnesses, 5) the location of the alleged conduct and transaction, including the place of formation and execution of the contract, 6) the existence of an action pending in another jurisdiction between the same parties (in an imperfect lis pendens situation) and the stage of such proceeding, 7) the law applicable to the dispute, 8) the ability to join all parties, 9) the need for enforcement in the alternative court, 10) the juridical advantages for the plaintiff, and 11) the interests of justice. As the Quebec Court of Appeal observes in Oppenheim Forfait G.M.B.H. v. Lexus Maritime inc., these and other less frequently used criteria, have evolved from the jurisprudence in Quebec as well as in the common law jurisdictions. [Footnotes omitted.][27]

[35]        Target argues that the Court should decline jurisdiction in favour of the U.S. District Court for the District of Minnesota on the basis of the following factors:

(a)  Target is domiciled in the United States, as admitted by Petitioner;

(b)  The Data Breach and the alleged faults, which Target expressly denies, would have occurred in the United States;

(c)  Eighty-two (82) proposed class actions related to the Data Breach had been centralized in the United States District Court for the District of Minnesota making that Court the natural forum to hear the dispute;

(d)  The relevant evidence is located in the United States and, more particularly, at Target’s headquarters in Minneapolis, Minnesota;

(e)  The majority of the witnesses reside in the United States; and

(f)    There remains a risk that this Court and the United States District Court for the District of Minnesota will render contradictory judgments.

[36]        The argument was much more convincing before the settlement of the U.S. class actions, when the arguments regarding parallel proceedings and the risk of contradictory judgments were much more powerful. Now, Target is reduced to arguing that four individuals appealed the judgment approving the consumer settlement in December 2015 and it is therefore possible that the Eighth Circuit Court of Appeals will reverse the judgment and that the consumer class actions might ultimately proceed in the U.S. District Court for the District of Minnesota.

[37]        The Court considers that possibility to be sufficiently remote that it will assume for the purposes of the forum non conveniens argument that there are no proceedings in Minnesota and therefore no parallel proceedings or risk of contradictory judgments. If the Court is wrong and the proceedings resume in Minnesota, that might justify a new forum non conveniens motion.

[38]        Without the concurrent Minnesota proceedings, there is not much left to Target’s argument. It is clear that it is more convenient for Target to be sued in Minnesota: its head office is in Minnesota, its witnesses are in Minnesota, and its evidence is in Minnesota. The U.S. courts decided that with respect to the class actions instituted in the United States, Minnesota was the appropriate forum.

[39]        However, the reverse is true for Zuckerman: he is in Québec, his witness is in Québec and his evidence is in Québec. Moreover, if the class action is authorized, there will be some 60,000 class members in Québec.[28]

[40]        In the circumstances, the Court cannot say that the courts in Minnesota are in a better position to decide this dispute. The Court will not force a Québec resident who has suffered damage as the result of the fault of a large U.S. corporation to sue in Minnesota to recover his damages.[29]

[41]        The motion in forum non conveniens will therefore be dismissed.

[42]        As mentioned above, if the Court authorizes the class action, it will consider jurisdiction and forum non conveniens arguments in relation to the other potential class members when it defines the class.

2.            Authorization of the class action

[43]        The test for authorizing a class action is set out in Article 575 C.C.P.:

575. The court authorizes the class action and appoints the class member it designates as representative plaintiff if it is of the opinion that

(1)  the claims of the members of the class raise identical, similar or related issues of law or fact;

(2)  the facts alleged appear to justify the conclusions sought;

(3)  the composition of the class makes it difficult or impracticable to apply the rules for mandates to take part in judicial proceedings on behalf of others or for consolidation of proceedings; and

(4)  the class member appointed as representative plaintiff is in a position to properly represent the class members.

[44]        Target contests each of the four conditions. The contestation of each condition relates essentially to the issue of damages.

[45]        Before considering the four conditions, it is useful to review the parties’ positions on damages.

[46]        Zuckerman seeks to institute a class action in which he would claim the following damages on behalf of the class members:

·        Compensatory damages for fear, confusion, inconvenience or loss of time;

·        Compensatory damages for any costs or fees incurred;

·        Compensatory damages for any losses incurred as a result of fraud or identity theft; and

·        Punitive damages.

[47]        Zuckerman alleges that he suffered inconvenience and that he incurred an expense of $19.95 for the credit monitoring service. He does not allege that he was the victim of fraud or identity theft. He produces emails from individuals who purport to be members of the proposed class.[30] They allege fraud or identity theft, stress, fear, anxiety, loss of sleep, feelings of insecurity, and the inconvenience of changing their bank account or credit card.

[48]        Target argues as follows with respect to the damages:

·        The alleged inconveniences are not compensable damages;

·        The expense of $19.95 incurred by Zuckerman for the credit monitoring service does not constitute a direct, logical and immediate consequence of the alleged fault by Target. Further, there is no evidence that anyone else incurred any expense whatsoever;

·        Zuckerman was not the victim of fraud or identity theft. His payment card data was not compromised and it is only those class members whose payment card data was compromised who might be the victims of fraud or identity theft. The evidence of the other class members that they were the victims of fraud or identity theft is weak. In any event, even if there were instances of fraud or identity theft, consumers are not liable for the unauthorized use of their credit card; and

·        There is no appearance of right with respect to punitive damages.

[49]        The arguments put forward by Target must be analyzed in light of the conditions of Article 575 C.C.P.

(1)   Whether the claims of the members of the class raise identical, similar or related issues of law or fact

[50]        Based on the arguments set out above, Target argues that this condition is not met because there is no identical, similar or related issue with respect to damages.

[51]        Even assuming that the damages issue is not common, Target overstates the burden on the petitioner under Article 575(1) C.C.P. Article 575(1) requires only one question of law or fact that is identical, similar or related, not all the questions.[31]

[52]        It is clear that the issue of Target’s fault with respect to the security of its system is identical for all of the class members. Target’s fault is a significant issue in this litigation. If this Court authorizes the class action and concludes that Target either was or was not at fault, that conclusion will apply to the claims of all class members and will advance the resolution of the litigation with respect to all class members in a significant way. That is sufficient to satisfy the condition in Article 575(1).[32]

[53]        Zuckerman raises a second issue, whether Target is at fault for failing to notify some members of the class. Since Zuckerman was notified, he is not affected by this issue and it cannot justify the class action. It is however an identical issue for those class members (other than Zuckerman) who were not notified, and it is closely related to the first issue. If the Court authorizes the class action, it will consider whether the class action should include this second issue.

[54]        Some but not all of the issues with respect to damages are common:

·        The issue of inconvenience is common to all class members, although not all will have suffered exactly the same inconvenience;

·        The issue of punitive damages is in all likelihood identical for all class members; and

·        The issues of identity theft and out of pocket expenses affect only those class members who were victims of fraud or identity theft or who incurred out of pocket expenses.

[55]        The Court concludes that there are sufficient common questions to meet the condition in Article 575(1) C.C.P.

(2)   Whether the facts alleged appear to justify the conclusions sought

[56]        This tends to be the most contentious issue at the authorization stage. The recent jurisprudence of the Supreme Court of Canada and the Court of Appeal suggests that it should not be.

[57]        The recent jurisprudence of the Supreme Court of Canada and the Court of Appeal makes it very clear that the role of the Court at the authorization stage with respect to the merits of the proposed class action is very limited: the Court is acting as a filter and should refuse authorization only where the proposed class action is frivolous and has no chance of success.[33] In that analysis, the burden on the petitioner is to demonstrate a prima facie or arguable case in light of the facts and the applicable law. This means that the petitioner must allege, with sufficient precision and with some supporting evidence, all of the elements of a valid cause of action. The Court is to assume that the petitioner will be able to prove the allegations at trial, unless they are too vague, general or imprecise to amount to anything more than speculation or hypotheses on the petitioner’s part or they are clearly contradicted by uncontroverted evidence. The Court must then assess whether the allegations are sufficient for a valid cause of action.

[58]        The Court will therefore find that the petitioner has not met the condition in Article 575(2) in the following circumstances:

·        The petitioner fails to allege an essential element of the recourse that he or she seeks to institute;[34]

·        The allegations are too vague to amount to anything more than supposition on the petitioner’s part;[35]

·        Allegations which are essential to the recourse are clearly contradicted by uncontroverted evidence;[36] or

·        The recourse that the petitioner seeks to institute is not valid as a matter of law.[37]

[59]        The failure to adequately protect personal information can be a fault under Quebec law.[38] In the present case, the allegations of fault are clear and detailed. They are supported by evidence. They are clearly sufficient for the authorization stage.

[60]        Target focuses instead on the issue of damages. Damages are an essential element of the cause of action. Zuckerman must demonstrate an arguable case that he and the other members of the proposed class suffered a loss as the result of Target’s alleged fault.[39] Target argues the allegations with respect to damages are insufficient in that:

a)    The allegations of inconvenience are too vague and do not in any event constitute damages that are recoverable at law;

b)    The expense of $19.95 incurred by Zuckerman for the credit monitoring service does not constitute a direct, logical and immediate consequence of the alleged fault by Target and cannot be the basis of a class action;

c)    Zuckerman was not a victim of fraud or identity theft and the evidence that anyone else was the victim of fraud or identity theft is weak; and

d)    There is no basis for punitive damages.

[61]        The Court will therefore review the damages claims. Any one damage claim would be sufficient to complete the cause of action.[40]

a)   Inconvenience

[62]        With respect to inconvenience, Zuckerman alleges:

75.        The Petitioner and the Class Members have suffered certain inconveniences including but not limited to the following:

a)         Having to set up the proper credit monitoring and security alerts on their credit files;

b)         Delays in the processing of any future requests or applications for credit in the future;

c)         The obligation to closely monitor their accounts looking for possible fraud for all periods subsequent to the loss of information;

d)         The obligation to be even more attentive than normally necessary concerning the communication of their personal information, due to the higher possibility of fraudulent activity caused by Respondent’s loss of the information;

e)         The obligation to inform certain financial institutions or credit card companies of the loss of the information by the Respondent and to deal with said financial institution in order to reduce risk of fraud as much as possible;

f)          Obtaining their credit report in order to look for unauthorized transaction or fraud;

[63]        More specifically, Zuckerman alleges that he cancelled his credit card and had a new card issued, and that he called Equifax to have a fraud alert posted on his credit file for a period of six years. He concludes:

98.        Therefore, as a result of the loss of his information by Target, Petitioner has experienced fear, inconvenience, loss of time and expenses dealing with the issues stemming from the loss of information in question and said inconvenience and loss of time will continue in terms of monitoring his accounts and the delays involved with the security measures posted on his credit file (as detailed above);

[64]        Several potential class members describe similar steps that they were required to take with respect to their bank accounts or credit cards.[41] In its communications, Target apologized for the inconvenience and the concern, stress, anxiety and frustration that the data breach might cause.[42]

[65]        Target cites the Supreme Court decision in Mustapha, where the Court makes a distinction between compensable damages and ordinary annoyances which are not compensable:

[9]      This said, psychological disturbance that rises to the level of personal injury must be distinguished from psychological upset.  Personal injury at law connotes serious trauma or illness: see Hinz v. Berry, [1970] 2 Q.B. 40 (C.A.), at p. 42; Page v. Smith, at p. 189; Linden and Feldthusen, at pp. 425-27.  The law does not recognize upset, disgust, anxiety, agitation or other mental states that fall short of injury.  I would not purport to define compensable injury exhaustively, except to say that it must be serious and prolonged and rise above the ordinary annoyances, anxieties and fears that people living in society routinely, if sometimes reluctantly, accept.  The need to accept such upsets rather than seek redress in tort is what I take the Court of Appeal to be expressing in its quote from Vanek v. Great Atlantic & Pacific Co. of Canada (1999), 48 O.R. (3d) 228 (C.A.): “Life goes on” (para. 60).  Quite simply, minor and transient upsets do not constitute personal injury, and hence do not amount to damage.[43]  

(Emphasis added)

[66]        Although Mustapha is a common law case, the distinction described by the Supreme Court is applicable in Québec:

[61]        While the appeal in Mustapha was from a judgment of the Ontario Court of Appeal and while there may be differences in the contractual and delictual (tort) rules of both jurisdictions, the Court finds no reason to conclude that the distinction between a compensable damage as opposed to an ordinary "annoyance" of life should not apply in Quebec Law.[44]

[67]        There are class actions in Québec that go either way on whether it is sufficient for the petitioner to allege that the class members have suffered inconvenience.

[68]        In Sofio, an appeal heard at the same time as the appeal in the present matter on the jurisdiction issue, the Court of Appeal dismissed the appeal from the refusal to authorize a class action in a data loss case because the petitioner had failed to allege sufficient damages. The Court of Appeal concludes:

[25]        Ce n’est pas dire, précisons-le, qu’en matière de perte ou de vol de renseignements personnels, dans un contexte comme celui de l’espèce ou celui de l’affaire Zuckerman, il n’y aurait de préjudice indemnisable que si la perte ou le vol en question entraîne de facto l’usurpation ou la tentative d’usurpation de l’identité du requérant ou la commission d’une fraude ou tentative de fraude à son endroit. Ce n’est pas le cas. Le problème, en l’espèce, tient cependant au fait que les allégations de la requête en autorisation, tenues pour avérées, ne révèlent tout simplement pas de préjudice, même simplement moral : on invoque un stress dont la nature, l’ampleur, l’intensité ou les effets ne sont nullement détaillés et l’on décrit comme un préjudice des activités de vérification tout à fait routinières et habituelles, voire banales, chez la personne raisonnable qui est titulaire d’un compte bancaire ou détient une carte de crédit ou de débit. S’il y a plus, la requête ne le dit pas. Certes, il ne s’agit pas d’inviter ici les requérants ou les demandeurs à dramatiser la présentation de leurs allégations ou gonfler le descriptif de leur préjudice, mais il faut néanmoins un minimum factuel, qui n’est pas présent ici.[45]

(Emphasis added)

[69]        In other words, it is not necessary in a data loss case for the petitioner to allege that he or she has been the victim of fraud or identity theft. Other damages may be sufficient, but there must be something more than a mere allegation of stress and of taking routine steps.

[70]        In Mazzonna, the Court concluded that the alleged damages were not sufficient to support a class action:

[56]        In the Court's view, the Petitioner fails to meet the test that she has suffered damages.

[57]        She did indeed suffer anxiety; she has had to change, minimally, some of her habits. However, these inconveniences were negligible, so much so that she ever felt the need to take any steps to alleviate her anxiety. The most she did was to keep the minimum amount of money in the account from which her lease payments were made and to check, twice a month, rather than once a month, on the Internet, whether her account had been tampered with.

[58]        This is not enough to meet the threshold, however prima facie, of the existence of "compensable" damages.

…

[62]        In the Court's view, the damages alleged by the Petitioner are prima facie of the nature of ordinary annoyances and anxieties and do not constitute "compensable" damages.[46]

(Emphasis added)

[71]        Following the dismissal of the motion to authorize a class action in Mazzonna, a new motion was filed by another person whose personal data was lost in the same incident, and this time the class action was authorized.[47] The new petitioner, Belley, was the victim of identity theft, but as stated by the Court of Appeal in Sofio, that is not necessary. The Court concluded in Belley:

[64]        TD Auto adds that, in the absence of financial loss caused by fraud or identity theft, the law does not recognize claims for damages unsubstantiated by objective medical and other evidence, such as anxiety, fear, inconvenience and loss of time.

[65]        Once again, the Court is of the view that it would be unfair and premature to conclude from an analysis of comments of purported Group members gathered on a list that members of the Group have not suffered damages similar to those alleged by Petitioner.

 [66]        In the Mazzonna Judgment, the Court held that Ms Mazzonna had not suffered “compensable” damages and that, therefore, her individual claim could not serve as a basis for authorizing a class action.  In this instance, the Court does not reach this conclusion with respect to the Petitioner and cannot, from a cursory look at comments on a list of potential members, conclude that the members of the Group have not suffered damages as a consequence of the Data Tape Loss.[48]

(Emphasis added)

[72]        The allegations with respect to inconvenience in Belley are very similar to the allegations in the present case.

[73]        The Court concludes that the monitoring of bank accounts and credit cards constitute normal activities and not inconveniences for which the account or card holder can recover damages. However, other matters such as setting up credit monitoring and security alerts, obtaining credit reports, and cancelling cards or closing accounts and replacing them are not “ordinary annoyances, anxieties and fears that people living in society routinely, if sometimes reluctantly, accept” but may amount to something more. These are potentially matters for which class members would be entitled to compensation.

b)   Credit monitoring services

[74]        Further, Zuckerman incurred an expense of $19.95 for credit monitoring services. Target asks the Court to conclude that this expense was unnecessary given that Target was “working on a credit monitoring offer” and would be sending information about the offer “in the coming days”.[49] As a result, it pleads that the expense does not constitute a direct, logical and immediate consequence of its alleged fault.

[75]        In Belley, the petitioner alleged that he had been the victim of fraud or identity theft and the defendant argued that the petitioner had failed to establish a causal link between the loss of his personal data and the alleged fraud and identity theft. In that case, the Court held that it was premature to rule on that issue and that the allegations were therefore sufficient for the class action to be authorized:

[59]        It may or may not be that the identity theft and fraud alleged by Mr Belley are a result of the loss of the Data Tape.  TD Auto invites the Court to decide, at this stage of the proceedings, that they are not.

[60]        With all due respect, the Court is of the view that this is a question to be determined on the merits.  The Petitioner has alleged in detail the facts which occurred as of April 29, 2008.  They took place shortly after the Data Tape loss.  The Court ought not to rule on the question of the causal link between said loss and the alleged identity theft and fraud without more evidence and testimony on the subject.

[61]        The time link between the Data Tape loss and the alleged identity theft and fraud allow the Court to conclude to an arguable case for the Petitioner.[50]

(Emphasis added)

[76]        The Court comes to the same conclusion in the present case: it is premature to conclude that the expense of $19.95 incurred by Zuckerman for credit monitoring services does not constitute a direct, logical and immediate consequence of the alleged fault. The Court should be very cautious about deciding issues on the merits with incomplete evidence.

c)    Fraud or identity theft

[77]        Zuckerman does not allege that he was the victim of fraud or identity theft. It is possible that he was the victim of fraud or identity theft and does not know it or that he will be the victim of fraud or identity theft in the future, but those possibilities seem increasingly remote with the passage of time.

[78]        Zuckerman cannot found the class action on damages that he did not suffer. He must allege that he suffered damages personally. Whether he can include in the class persons who suffered damages different from those that he suffered is a matter that the Court will consider, if it authorizes the class action, in the description of the class and the identification of the issues and the conclusions. 

d)   Punitive damages

[79]        Finally, Zuckerman claims punitive damages. Target argues that Zuckerman has not alleged anything that would entitle the members to punitive damages.

[80]        Under Québec law, punitive damages can only be awarded when such damages are provided for by law.[51] The law which Zuckerman invokes is the Québec Charter of Human Rights and Freedoms,[52] which provides for punitive damages in the following circumstances:

49. Any unlawful interference with any right or freedom recognized by this Charter entitles the victim to obtain the cessation of such interference and compensation for the moral or material prejudice resulting therefrom.

In case of unlawful and intentional interference, the tribunal may, in addition, condemn the person guilty of it to punitive damages.

(Emphasis added)

[81]        The Charter right at issue in the present case is the right to privacy guaranteed by Section 5.

[82]        The Supreme Court has held that the notion of “intentional interference” requires more than simple negligence but is satisfied “when that person acts with full knowledge of the immediate and natural or at least extremely probable consequences that his or her conduct will cause.”[53]

[83]        Zuckerman does not mention the Charter in his proceeding. After setting out the alleged faults of Target, he concludes:

104.      Considering the above, Respondent is liable to pay punitive damages to all of the Class Members due to the loss of private information itself, aside from any other compensable damages suffered by the Class Members;

105.      Respondent’s above detailed actions qualify its fault as intentional which is a result of wild and foolhardy recklessness in disregard for the rights of the Class Members, with full knowledge of the immediate and natural or at least extremely probable consequences that its action would cause to the Class Members;

106.      Respondent’s negligence has shown a malicious, oppressive and high-handed conduct that represents a marked departure from ordinary standards of decency. In that event, punitive damages should be awarded to Class Members;

(Emphasis added)

[84]        The fact that Zuckerman does not mention the Charter should not be fatal to the claim. He does mention “loss of private information” and intentional fault, and he clearly brings himself within the Supreme Court’s definition of intentional interference.

[85]        The Court in Belley, faced with similar allegation, concluded as follows:

[67]        Finally, TD Auto claims that Petitioner cannot ask for punitive damages.  Essentially, it argues that the Motion does not contain specific facts that would show that TD Auto intentionally interfered with the fundamental rights of its customers.

[68]        Once again, it is premature, based on the allegations of the Motion, to rule that Petitioner, or members of the Group, would not be entitled to punitive damages.

[69]        The facts alleged in the Motion provide an arguable case that TD Auto’s negligence in the handling of the delivery, the loss and the consequences of the loss of the Data Tape might constitute an illicit and intentional violation of a right, the right to respect for one’s private life, protected by the Charter of Human Rights and Freedoms.[54]

(Emphasis added)

[86]        The Court agrees that Zuckerman has met the relatively low standard. Any award of punitive damages must be based on an analysis of the whole of the defendant’s conduct.[55] It would clearly be premature at this stage of the proceedings to decide that there was no possible basis for an award of punitive damages.

[87]        For all of these reasons, the Court concludes that the allegations of damages are sufficient at this stage of the proceedings and that the condition in Article 575(2) C.C.P. has been met.

(3)   Whether the composition of the class makes it difficult or impracticable to apply the rules for mandates or for consolidation of proceedings

[88]        The argument put forward by Target on this condition again relates to the issue of damages.

[89]        Target assumes that the only damages which are recoverable in the class action are out of pocket expenses such as the $19.95 paid by Zuckerman for credit monitoring services, and it argues that there is no reliable evidence as to the number of Canadian or Québec residents who incurred any expense whatsoever in relation to the data breach. Target goes further and suggests that Zuckerman is likely the only person in Canada who voluntarily purchased credit monitoring services in the small window between Target announcing the data breach and Target providing credit monitoring services. Target therefore concludes that there is no class and that the class action should not be authorized.

[90]        Target’s argument is based on a false premise, namely that only the out of pocket expenses are recoverable damages. As soon as the analysis is extended to include inconvenience and punitive damages, the potential class includes as many as 263,465 Canadians including approximately 60,000 residents of Québec.

[91]        It is clear with a class that large that the condition in Article 575(3) C.C.P. is met.

(4)   Whether the class member appointed as representative plaintiff is in a position to properly represent the class members

[92]        Target raised two objections to Zuckerman as representative.

[93]        First, Target argued that Zuckerman did not suffer any compensable damage caused by the data breach and therefore has no legal interest in the suit. That argument is dismissed for the reasons set out above.

[94]        The second argument is moot. Target argued that Zuckerman was not an appropriate representative for the claims of the financial institutions. That issue was resolved when Zuckerman amended his motion during the hearing to exclude the financial institutions.

[95]        The Court concludes that the condition in Article 575(4) C.C.P. is met.

[96]        As a result, the Court concludes that the four conditions of Article 575 C.C.P. are met and that the class action should be authorized.

 

3.            Other matters

[97]        The Court must therefore consider the following issues:

1.    Description of the class whose members will be bound by the class action judgment and any sub-class;

2.    Identification of the issues to be dealt with collectively and the conclusions sought in relation to those issues;

3.    Determination of the district in which the class action is to be instituted;

4.    Publication of a notice and other dissemination of information to the members;

5.    Time limit for opting out.

(1)   Description of the class and subclasses

[98]        Zuckerman proposes the following description of the class:

All persons in Canada (subsidiarily in Quebec…), whose personal and/or financial information was lost by and/or stolen from Respondent as a result of the data breach that occurred between at least November 27, 2013 and December 15, 2013 (hereinafter the “Data Breach”) … or any other Group(s) or Sub-Group(s) to be determined by the Court;

[99]        Target raises three issues with respect to the class description:

a)    The class should be limited to Québec residents;

b)    The class should not include legal persons, partnerships and associations that employed more than 50 people in the previous 12 months; and

c)    The class should be limited to persons who disbursed amounts for a credit monitoring service prior to receiving the free monitoring offer from Target

a)    Geographic scope of the class

[100]     The issue of the geographic scope of the class raises again the arguments put forward by Target on jurisdiction and on forum non conveniens.

[101]     The current state of the law in Québec is as follows:

[70]       En conséquence, une personne ne peut être membre du groupe visé par une action collective au Québec que si les tribunaux québécois ont compétence pour entendre sa réclamation individuelle. La procédure de l’action collective ne lui donne pas le droit de poursuivre au Québec si elle n’avait pas déjà ce droit.

[71]             Conformément à ce principe, la jurisprudence est à l’effet suivant :

·                   Si le défendeur a son domicile ou sa résidence au Québec, ou un établissement au Québec et la contestation est relative à son activité au Québec, les tribunaux québécois ont compétence sans égard au domicile du demandeur et ils peuvent donc autoriser une action collective avec un groupe qui inclut des membres non-résidents du Québec; et

·                   Si le défendeur n’a pas son domicile, sa résidence ou un établissement au Québec, les tribunaux québécois ne sont pas compétents à l’égard des non-résidents et ne peuvent pas les inclure dans le groupe à moins que les faits générateurs (faute, préjudice, fait dommageable, ou une des obligations du contrat) se sont produits au Québec.[56]

(References omitted)

[102]     In the present case, the Court of Appeal confirmed the jurisdiction of the Québec courts based on damages having been suffered in Québec.[57]

[103]     Zuckerman argues that the Court also has jurisdiction under Article 3148(2) C.C.Q.:

3148. In personal actions of a patrimonial nature, Québec authorities have jurisdiction in the following cases:

…

(2)   the defendant is a legal person, is not domiciled in Québec but has an establishment in Québec, and the dispute relates to its activities in Québec;

[104]     The Court of Appeal interpreted this provision very broadly in Interinvest (Bermuda) Ltd. c. Herzog:

… il suffit que l'activité en litige ait lieu au Québec et que le défendeur y ait un établissement.[58]

[105]     The evidence is that the Target stores and other establishments in Québec belonged to Target Canada Co., an indirect wholly owned subsidiary of Target.[59] There is no evidence that Target itself had any establishment or any activities in Québec.

[106]     Moreover, the evidence is that the data was collected and held in the United States and that the breach occurred in the United States. There is no evidence of any relevant activity in Canada.

[107]     The Court concludes that the conditions for Article 3148(2) C.C.Q. are not met.

[108]     As a result, the Court only has jurisdiction with respect to persons who suffered damages in Québec. The class must therefore be limited to Québec residents.

b)        Legal persons

[109]     With respect to the inclusion of legal persons, Target pleads that the Court should apply the second paragraph of Article 999 C.C.Q. as it stood when the motion for authorization was filed:

999. …

A legal person established for a private interest, partnership or association may only be a member of a group if at all times during the 12-month period preceding the motion for authorization, not more than 50 persons bound to it by contract of employment were under its direction or control and if it is dealing at arm’s length with the representative of the group.

[110]     That limitation was abolished when the new Code of Civil Procedure came into force on January 1, 2016 and Article 571 replaced the former Article 999. The second paragraph of Article 571 now provides as follows:

571. …

In addition to natural persons, legal persons established for a private interest, partnerships and associations or other groups not endowed with juridical personality may be members of the class.

[111]     Because the new Code of Civil Procedure came into force with immediate effect, there is no reason not to apply the new Article 571 and include legal persons, partnerships and associations that employed more than 50 people in the previous 12 months.

 

c)   Type of damage

[112]     Finally, as to whether the class should be limited to persons who disbursed amounts for a credit monitoring service prior to receiving the free monitoring offer from Target, that again is based on the false premise that the only recoverable damages are the out of pocket expenses. Again, once the class is extended to include all those who suffered inconvenience or who may be entitled to punitive damages, it effectively covers every person whose payment card data or personal information was lost.

d)   Description of class

[113]     The Court therefore describes the class as follows:

All persons in Quebec whose payment card data and/or personal information was lost by and/or stolen from Respondent as a result of the data breach that occurred between at least November 27, 2013 and December 15, 2013;

e)   Subclasses

[114]     Based on the evidence and arguments submitted to the Court to date, the class could be divided in different ways:

·        The class could be divided between persons whose payment card data was lost or stolen as opposed to persons whose personal information was lost or stolen;

·        There could be a subclass of persons who were not notified of the data breach; and

·        The class could be divided according to the type of damage suffered.

[115]     It might be appropriate to create subclasses and to name additional representatives for those subclasses to ensure that the rights of each subclass are protected. However, neither party urged the Court to divide the class into subclasses, and there does not appear to be any pressing reason to do so at this stage. The issue can be revisited later if there is a reason to do so.

(2)   Issues and conclusions

[116]     Zuckerman proposes the following questions and conclusions:

IDENTIFY the principle questions of fact and law to be treated collectively as the following:

a)             Was Respondent negligent in the storing and safekeeping of the personal and financial information of the Class Members whose information was ultimately lost and/or stolen between at least November 27, 2013 and December 15, 2013 (hereinafter the “Target Data Breach”)?

b)             Is Respondent liable to pay damages to the Class Members as a result of the Target Data Breach, including actual monetary losses or expenses incurred, loss of time, inconvenience, moral damages, and/or punitive damages caused by the loss of said information, and if so in what amounts?

IDENTITY the conclusions sought by the class action to be instituted as being the following:

                         GRANT Plaintiff’s action against Defendant;

CONDEMN Defendant to pay to the Group Members compensatory damages for all monetary losses or expenses caused as a result of Defendant’s loss of said Group Member’s personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay to the Group Members compensatory and/or moral damages to every Group Member in the amount to be determined by the Court as a result of Defendant’s loss of said member’s personal information, and ORDER collective recovery of these sums:

CONDEMN Defendant to pay an amount in punitive/exemplary damages to every Group Member, in the amount to be determined by the Court, and ORDER collective recovery of these sums;

GRANT the class action of Plaintiff on behalf of all the Group Members;

THE WHOLE with interest and additional indemnity provided for in the Civil Code of Quebec and with full costs and expenses including experts’ fees and publication fees to advise members;

[117]     The question with respect to fault is clear. During the hearing, Zuckerman asked the Court to add a question with respect to the failure to notify.

[118]     On the issue of damages, the question is whether the class action should cover damages that may have been suffered by other class members but not by Zuckerman, such as damages flowing from fraud or identity theft.

[119]     In Marcotte, the Supreme Court held that the petitioner could include in the class action defendants with respect to whom he did not have a lien de droit, provided that there are identical, similar or related questions of law or fact and the representative can represent the class adequately.[60]

[120]     In the circumstances of the present case, it is appropriate to deal with all of the related issues in a single proceeding. It does not make sense to allow this class action to go forward on the issue of Target’s fault in relation to the data breach and its liability for damages for inconvenience and out of pocket expenses and for punitive damages, and then have separate class actions on the failure to give notice and fraud or identity theft. The question of Target’s fault in relation to the data breach is a common issue and is central to these recourses and it appears that Zuckerman can represent the class adequately. As mentioned above, if any doubts arise as to Zuckerman’s capacity to represent the class as a whole, subclasses can be created and additional representatives named.

[121]     On the issue of fraud or identity theft, Target pleaded that there were no damages because the consumer is not liable for the unauthorized use of his or her credit card.[61] Target adds that it obtained releases from three Canadian financial institutions that issue Visa credit and debit cards.[62]

[122]     Zuckerman challenges the assertion that consumers have no liability for unauthorized use of their card. Moreover, even if the consumer is not liable to pay the unauthorized charges, it does not mean that the consumer has not suffered any damages. The Court is not prepared to dismiss that part of the claim at this stage.

[123]     As a result, the Court will identify the issues to be dealt with collectively as follows:

1.    Did Target commit a fault in the storing and safekeeping of the payment card data and personal information of the class members whose information was ultimately lost and/or stolen between at least November 27, 2013 and December 15, 2013?

2.    Did Target commit a fault in the way in which it notified the class members about the data breach?

3.    Whether the inconvenience suffered by the class members is compensable and if so, which inconveniences are recoverable and how much compensation is payable;

4.    Whether class members who incurred out of pocket expenses are entitled to compensation and if so, which expenses are recoverable;

5.    Whether class members who suffered identity theft are entitled to compensation and if so, what damages are they entitled to recover;

6.    Whether the class members are entitled to punitive damages and if so, what is the appropriate measure of punitive damages.

[124]     The conclusions sought in relation to those issues should be stated as follows:

GRANT the class action of Plaintiff on behalf of all the class members against Defendant;

CONDEMN Defendant to pay to the class members compensatory damages for the inconvenience caused to the class members as a result of Defendant’s loss of said class member’s payment card data and/or personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay to the class members compensatory damages for all expenses incurred by each class member as a result of Defendant’s loss of said class member’s payment card data and/or personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay to the class members compensatory damages for any loss suffered by the class members as a result of fraud or identity theft resulting from Defendant’s loss of said class member’s payment card data and/or personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay punitive damages to every class member, in the amount to be determined by the Court, and ORDER collective recovery of these sums;

THE WHOLE with interest and additional indemnity provided for in the Civil Code of Quebec and with full costs and expenses including experts’ fees and publication fees to advise class members;

(3)   District

[125]     The motion was filed in the district of Montréal, where it is likely that most of the class members are resident.

[126]     In the absence of any argument by either party that the class action should be instituted somewhere else, the Court will authorize the bringing of the class action in the district of Montreal.

(4)   Notice and other dissemination of information

[127]     The parties proposed to deal with notice at a subsequent hearing. The Court notes that information about the class action is available on Zuckerman’s lawyer’s website. The sufficiency of that information can also be reviewed at the subsequent hearing.

(5)   Opting out

[128]     Zuckerman asks that the delay to opt out be fixed at 30 days from the date of publication of the notice to the members. That delay is within the range provided for by Article 576 C.C.P. and is not contested by Target. The Court will accept the delay proposed by Zuckerman.

FOR THESE REASONS, THE COURT:

[129]     GRANTS the present motion;

[130]     AUTHORIZES the bringing of a class action in the form of a motion to institute proceedings in damages in the district of Montréal;

[131]     ASCRIBES the Petitioner the status of representative of the persons included in the class herein described as:

All persons in Quebec whose payment card data and/or personal information was lost by and/or stolen from Respondent as a result of the data breach that occurred between at least November 27, 2013 and December 15, 2013;

[132]     IDENTIFIES the issues to be dealt with collectively as follows:

1.    Did Target commit a fault in the storing and safekeeping of the payment card data and/or personal information of the class members whose information was ultimately lost and/or stolen between at least November 27, 2013 and December 15, 2013?

2.    Did Target commit a fault in the way in which it notified the class members about the data breach?

3.    Whether the inconvenience suffered by the class members is compensable and if so, which inconveniences are recoverable and how much compensation is payable;

4.    Whether class members who incurred out of pocket expenses are entitled to compensation and if so, which expenses are recoverable;

5.    Whether class members who suffered identity theft are entitled to compensation and if so, what damages are they entitled to recover;

6.    Whether the class members are entitled to punitive damages and if so, what is the appropriate measure of punitive damages.

[133]     IDENTIFIES the conclusions sought by the class action to be instituted as being the following:

GRANT the class action of Plaintiff on behalf of all the class members against Defendant;

CONDEMN Defendant to pay to the class members compensatory damages for the inconvenience caused to the class members as a result of Defendant’s loss of said class member’s payment card data and/or personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay to the class members compensatory damages for all expenses incurred by each class member as a result of Defendant’s loss of said class member’s payment card data and/or personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay to the class members compensatory damages for any loss suffered by the class members as a result of fraud or identity theft resulting from Defendant’s loss of said class member’s payment card data and/or personal information, and ORDER collective recovery of these sums;

CONDEMN Defendant to pay punitive damages to every class member, in the amount to be determined by the Court, and ORDER collective recovery of these sums;

THE WHOLE with interest and additional indemnity provided for in the Civil Code of Quebec and with full costs and expenses including experts’ fees and publication fees to advise class members;

[134]     FIXES the delay of exclusion at 30 days from the date of the publication of the notice to the members and DECLARES that all members of the class who have not requested their exclusion from the class in the prescribed delay will be bound by any judgment to be rendered on the class action to be instituted;

[135]     ORDERS the publication of a notice to the class members in accordance with Article 579 C.C.P., pursuant to a further order of the Court, and ORDERS Respondents to pay for said publication costs;

[136]     THE WHOLE with costs including the costs related to preparation and publication of the notices to class members.

 

		__________________________________ Stephen W. Hamilton, J.S.C.
Mtre David Assor Mtre Charlotte Grenier
LEX GROUP INC.
For the Petitioner
Mtre Sylvain Lussier Mtre Jessica Harding
OSLER, HOSKIN & HARCOURT, LLP
For the Respondent
Dates of hearing:	December 6 and 7, 2016