Court denies use of class members’ data unintentionally made available via legacy link

In a matter arising from a class proceeding, the Ontario Superior Court prevented an individual claimant from using Correctional Services Canada (CSC) information on all persons in administrative segregation within the class period, regardless of whether they were class members. 

In a joint order dated Feb. 20, 2025, the Ontario and Quebec courts approved an amended distribution and individual issues protocol in the underlying class proceeding in Brazeau v. Attorney General of Canada, 2026 ONSC 3068. 

Epiq Class Action Services Canada Inc., the claims administrator, developed and maintained the administration (admin) system, which had a “Show All” link, a legacy filtering button implemented at a time when counsel outside class counsel could not yet access the system. 

Epiq accidentally left the Show All link on the admin system after the system opened to outside counsel, even though the protocol limited such counsel’s access to information only about their client. 

R. Pine, the individual claimant, moved for an order to use certain information based on: 

• the Personal Information Protection and Electronic Documents Act, 2000 (PIPEDA) 
• the Privacy Act, 1985 
• r. 30.02 of the Rules of Civil Procedure, RRO 1990, Reg 194 
• the court’s equitable jurisdiction 

Specifically, Pine asked the court to approve the restricted and anonymized use of information his counsel downloaded from the admin system by clicking the Show All link. Pine wanted to use the data in his individual “Track 3” claim under the protocol. 

The confidential and personal information from CSC included placement data that Epiq had stored on an inmate placement page and an electronic spreadsheet that listed specific personal data for all individuals placed in administrative segregation during the class period. 

Epiq, the representative plaintiffs, and the defendant federal attorney general opposed Pine’s motion. They alleged that no evidence supported the placement data’s relevance to Pine’s Track 3 claim. 

They also asserted that the court lacked any basis to issue an order removing the protection of the personal information under the PIPEDA, which bound Epiq, or under the Privacy Act, which covered CSC as a government institution. 

Data use disallowed

The Ontario Superior Court of Justice dismissed Pine’s motion. First, the court addressed Pine’s arguments regarding PIPEDA and the Privacy Act. Pine cited ss. 7(3)(c) and 7(3)(i) of PIPEDA as a basis for his requested relief. 

The court noted that those provisions allowed the disclosure of personal information only if necessary to comply with a court order under s. 7(3)(c) of PIPEDA or if the law required it under s. 7(3)(i) of PIPEDA. 

The court determined that the disclosure here arose from the intentional act of the claimant’s counsel in downloading the placement data, not under a court order or law. 

Pine contended that the court could issue an order under s. 12 of Ontario’s Class Proceedings Act, 1992 (CPA), to allow a disclosure of personal information otherwise prohibited under PIPEDA or the Privacy Act. 

While it could make such an order, the court did not consider this an appropriate case to do so. The court explained that the disclosure to Pine of the data, including confidential information on incarceration and administrative segregation: 

• would not benefit the class members 
• would breach their privacy rights, even if the disclosure was on an anonymized basis 
• would achieve none of the CPA’s goals 

Second, the court addressed Pine’s argument regarding r. 30.02(1), which permitted the production of pertinent information in discovery in counsel’s possession, regardless of whether the law of privilege applied. 

While it could issue an order under s. 12 of the CPA to advance class members’ access to justice, the court did not deem this an appropriate case to vitiate the protocol and use civil procedure rules when the disclosure would not meet the CPA’s goals. 

Third, the court rejected Pine’s argument that equitable factors favoured the use of the placement data due to an alleged “mass breach” of personal information and Epiq’s misconduct in responding to the breach. The court saw no evidence to find that: 

• A mass breach occurred 
• Any outside counsel apart from the claimant’s counsel accessed or downloaded the placement data of inmates they were not representing 
• The technical issue that enabled the claimant’s counsel to view other inmates’ placement data was “pervasive and not easily cured” 
• Epiq acted improperly in addressing the breach 

The court ruled that Epiq: 

• immediately notified the claimant’s counsel that it was not “usual” for him to be able to view other inmates’ personal information 
• promptly prevented outside counsel from accessing the Show All link after learning that the claimant’s counsel had used the link to access the full inmate placement page 
• swiftly shut down access for outside counsel, then restored access after the legacy link’s removal 

Lastly, the court refused to order production, given the lack of relevance of the placement data to Pine’s Track 3 claim.