Docket: T-226-13
Citation: 2023 FC 715
Ottawa, Ontario, May 23, 2023
PRESENT: Associate Chief Justice Gagné
PROPOSED CLASS PROCEEDING
BETWEEN: |
JOHN MARK JACQUES, GORDON ALBERT MEHEW, and CRAIG ROBAR |
Plaintiffs |
and |
HIS MAJESTY THE KING |
Defendant |
ORDER AND REASONS
I. Overview
[1] The Plaintiffs commenced this proposed national class proceeding on behalf of individuals whose personal information was stored on an unencrypted USB key that was misplaced by a Government of Canada employee in November of 2012. They now bring a Motion for leave to file the Affidavit of cyber security expert, Nicholas Scheurkogel, sworn January 31, 2023, as reply evidence on the certification motion.
[2] The Plaintiffs’ Statement of claim was filed in January of 2013. However, the file was held in abeyance until a final decision/settlement occurred in the related file T-132-13, which did occur in May 2018 by judgment of the Court in Condon v Canada, 2018 FC 522.
[3] The Plaintiffs served their certification motion record on November 24, 2021 (three and a half years after the Court’s final decision in Condon) and the Defendant served its responding materials on November 30, 2022.
[4] The Plaintiffs state that although they had previously requested that the Defendant disclose “all internal documents with respect to all of the defendant’s internal investigations into the lost USB key”
, the Defendant ignored those requests until it delivered its responding materials.
[5] The Defendant replies that the Plaintiffs’ motion lacks merit and should be dismissed because the proposed evidence was available – and ought to have been anticipated – at the time the Plaintiffs filed their affidavits in chief.
II. Proposed Reply Evidence
[6] The expert report of Nicholas Scheurkogel, annexed to his affidavit, purports to answer a series of questions posed to him by Plaintiffs’ counsel, which can be grouped into three categories.
[7] The first category of questions relates to the existence of government policies and practices surrounding USB keys:
(1) What protections should have been applied to prevent the information being downloaded onto the USB key?
(2) Were there any policies in place prohibiting employees from downloading confidential data onto a USB key and/or downloading it without password protection?
(3) Were there any policies preventing an employee from removing the data from the offices/taking it off premises to the employee’s home?
[8] The second category of questions relates to the Defendant’s internal investigations into the missing USB Key:
(4) What investigations appear to have been conducted into whether it was an employee who placed the data on a USB key?
(5) What investigations appear to have been conducted into what happened to the USB key?
(6) Based on your experience what do you make of the Defendant’s conclusion about what happened to the USB key? Is the conclusion reliable? Is it supported by facts and industry practice in investigating a privacy/cyber security type breach?
(7) Overall, in answering these questions please comment on the thoroughness of the Crown’s investigation. For instance, does it meet their internal requirements for this type of data?
(8) What additional documents would you need to see or persons to interview in order to provide a more informed analysis of the risk that the USB was stolen or misused, rather than simply lost? Do you have access to enough information to reach a conclusion on what likely happened to the USB key?
[9] The third category of questions concerns the risk of harm to the Plaintiffs:
(9) Whether the claimed results of the Defendant’s investigations and the free credit monitoring effectively eliminate the potential risk of harm to individuals since the Breach occurred.
(10) In terms of assessing whether there has been any actual harm to individuals, whether the Crown has included any reliable data in their materials in support of there being no harm to the Class?
(11) What investigations can be conducted to ascertain whether the class is exposed to a real risk of harm? Has the Crown conducted any such investigations?
(12) What information would your firm require from the Crown to conduct internet or dark web searches for a period of the last 10 years, while the Crown has apparently chosen not to? What information would you be looking for?
III. Issue
[10] The single issue raised by this motion is whether the Plaintiffs should be granted leave to file the proposed affidavit. However, should the Court grant the Plaintiffs’ motion, it will likely also necessitate a review of the schedule issued on October 25, 2022.
IV. Analysis
[11] Rule 312 of the Federal Courts Rules, SOR 98/106 permits parties to seek leave to file additional affidavits on an application, while Rule 84(2) governs the filing of affidavits after cross-examination has occurred. Mindful that they should yield similar interpretations (Salton Appliances (1985) Corp v Salton Inc (2000), 4 CPR (4th) 491, 181 FTR 146, 2000 CarswellNat 155), I have considered jurisprudence regarding both Rules.
[12] The test for granting leave to file reply evidence was set out Amgen Canada Inc. v Apotex Inc., 2016 FCA 121, where the Federal Court of Appeal stated that the filing of reply evidence on a motion is permitted in “unusual circumstances”
where certain principles of procedural fairness apply [Amgen, at para 11]. In order to reach its decision, the Court must have regard to whether:
a. the evidence will assist the court (in particular, its relevance and sufficient probative value);
b. admitting the evidence will cause substantial or serious prejudice to the other side;
c. the evidence was available when the party filed its affidavits or it could have been discovered with the exercise of due diligence.
[Amgen at para 13]
[13] The Plaintiffs state that the proposed expert affidavit is intended to address the two affidavits filed by the Defendant in their responding motion record for certification. The Defendant’s affiants essentially state that the results of their internal investigations show that the USB key was never stolen and class members are not at risk of future harm, nor have they sustained any damages to date. Since the Plaintiffs did not know of any investigation or result of any investigation prior to receiving the Defendants’ responding material, they argue they could not have provided their expert evidence at an earlier date.
[14] I agree with the Plaintiffs. I also agree with the Plaintiffs that Mr. Scheurkogel’s opinion evidence is very likely to assist the court at certification in determining what weight to give to the Defendant’s investigations, by providing the perspective of an experienced third-party cyber security expert who is frequently retained by organizations to investigate data breaches.
[15] In Sweet v Canada, 2022 FC 1228, Justice Richard Southcott was seized with a motion, heard at the certification hearing, to strike expert evidence filed in reply to the Government of Canada’s material detailing the results of their investigation. He dismissed the motion and made the following observation:
[53] The Defendant’s materials responding to the certification motion describe the February and March 2021 measures as demonstrating proactive steps taken by CRA to contain and eradicate the cyber security incident. This evidence therefore relates to a matter arising in defence, and it is appropriate for the Plaintiff to reply with evidence on what he would characterize as adverse effects of those measures and potentially linking those measures to the 2020 data breaches. I therefore find that the paragraphs of the Second Emery Affidavit and related exhibits, offered in reply to paragraphs 66 to 71 of the Rae Affidavit, are admissible.
[16] As to the Defendant’s argument that the content of the expert’s affidavit is outside his knowledge and that it has no probative value, I leave the determination of it to the merits of the Certification Motion.
[17] Finally, there is little to no prejudice in admitting the reply evidence as the Defendant’s counsel is free to cross-examine the Plaintiffs’ expert on his evidence and/or, the Defendant will be permitted to file their own expert evidence, should they choose to do so. This, of course, may disrupt the agreed-upon schedule, but any such delay will be relatively limited when compared to pre-existing delays in the case already noted above.
[18] While the Plaintiffs’ motion was successful, the evidence adduced by the Defendant shows that they were led to think that cross-examinations would occur during the week of January 16, 2023, with only a slight reworking of an agreed-to schedule. Instead, without prior notice, new evidence was raised by the Plaintiffs on January 18, 2023, thus forcing the postponing of all the scheduled cross-examinations. For this reason, costs will be granted to the Defendant.
V. Conclusion
[19] For the above reason, the Plaintiffs’ motion is granted and the affidavit of Nicholas Scheurkogel can be filed as reply evidence.
[20] The Defendant is also granted leave to file a sur-reply affidavit and the parties are to confer and provide the Court, within two weeks of the date of this Order, with a proposed revised schedule.
[21] Costs for $1,500 are granted to the Defendant.
Email this Content