ARTICLE
12 November 2024

Privacy Class Actions: Biometric Data

OH
Osler, Hoskin & Harcourt LLP

Contributor

Osler is a leading law firm with a singular focus – your business. Our collaborative “one firm” approach draws on the expertise of over 400 lawyers to provide responsive, proactive and practical legal solutions driven by your business needs. It’s law that works.
The petitioner, an individual whose personal data was collected, sought the authorization of the Court to institute a class action against the respondent, Google.
Canada Privacy

Homsy c. Google,2024 QCCS 1324

Read the case details

Facts

The petitioner, an individual whose personal data was collected, sought the authorization of the Court to institute a class action against the respondent, Google. The petitioner claimed that the respondent had been extracting, collecting, storing and using facial biometric data of Québec residents via the Google Photos application, without providing sufficient notice, without obtaining informed consent and without publishing biometric data retention policies.

The petitioner sought compensatory damages under the Act respecting the protection of personal information in the private sector (Private Sector Act) and theCCQ. The petitioner was also seeking punitive damages under section 272 of the Consumer Protection Act (CPA) and section 49 of the Charter of Human Rights and Freedoms (Québec Charter).

Decision

The Court authorized the class action against Google.

The Court found that facial biometric data qualified as personal information under section 2 of the Private Sector Act. Therefore, Google's practice of extracting, collecting, storing and using facial biometric data of Québec residents and sharing the data to third parties without consent could be argued to breach sections 8, 10, 13, 14 and 17 of the Private Sector Act, as well as articles 35 and 37 of the CCQ.

According to the Court, Google's practice may be argued to have constituted a civil fault under article 1457 of the CCQ. The Court also authorized the common issue of determining whether Google voluntarily violated section 5 of the Québec Charter, which provides for the right to privacy. The petitioner was therefore authorized to seek punitive damages pursuant to section 49 of the Québec Charter, in addition to compensatory damages.

Finally, Google's Terms of Services showed that there was no mention of the extraction, collection, storage and use of members' facial biometric data. By making this omission, the respondent may have overlooked an important fact in its representations to consumers.

Key Takeaway

Given plaintiff's low burden at the authorization stage of a Québec class action, allegations of use without a person's consent of biometric information may be sufficient to allow class action authorization claiming a violation of the right to privacy. When such alleged breach is done willfully, it may give rise to punitive damages, in addition to compensatory damages.

Lam v. Flo Health Inc., 2024 BCSC 391

Read the case details

Facts

The British Columbia Supreme Court certified a class action lawsuit against Flo Health Inc. (Flo), a company that makes an app for tracking women's reproductive health. The plaintiff alleges that Flo violated the privacy of its users by disclosing sensitive personal information to third parties without consent. The proposed class included all users across Canada, excluding Québec.

Decision

The Court-certified common issues relating to breach of statutory privacy legislation, intrusion upon seclusion (except for class members residing in B.C. and Alberta), breach of confidence, and the Personal Information Protection and Electronic Documents Act(PIPEDA). The Court, however, struck the claims of negligence, unjust enrichment, breach of provincial consumer protection legislation, conversion, and for B.C. and Alberta residents, intrusion upon seclusion.

The Court rejected Flo's arguments that the plaintiff's claims were barred by exclusion of liability and waiver of class actions clauses in its terms of use, because these provisions were unconscionable and contrary to public policy.

Key Takeaway

The decision affirms that class action waiver clauses in consumer contracts will generally be unenforceable in British Columbia.

Breach of confidence uses a broad concept of detriment and does not require a plaintiff to plead an economic loss or a serious and prolonged psychological upset.

While a breach of PIPEDA does not in itself create a cause of action, such breaches may be relevant context for other causes of action.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Find out more and explore further thought leadership around Privacy Law and Privacy Regulations

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More