Appeal Denied In 2019 LifeLabs Data Breach Case

Angelica Dino writes in Canadian Lawyer that the Information and Privacy Commissioners of Ontario and British Columbia released their investigation report on the 2019 LifeLabs data breach. The release came after the Ontario Court of Appeal dismissed LifeLabs’ appeal to block its publication (LifeLabs LP v. Information and Privacy Commissioner of Ontario).

The breach exposed the personal and health information of millions of Canadians and revealed LifeLabs’ failure to meet data protection obligations under Ontario’s Personal Health Information Protection Act and British Columbia’s Personal Information Protection Act.

LifeLabs, a diagnostic and health testing services provider, experienced a major cyberattack in 2019, compromising sensitive data. The joint investigation by Ontario and British Columbia commissioners found LifeLabs did not implement adequate safeguards to protect personal health information and breached legal requirements. 

LifeLabs attempted to suppress the report, claiming solicitor-client and litigation privilege. However, in 2020, the commissioners rejected these claims. Ontario’s Divisional Court upheld this rejection, and the Court of Appeal dismissed LifeLabs’ final motion, leading to the report’s publication.

The courts consistently sided with the commissioners, ruling that LifeLabs’ claims of privilege lacked sufficient evidence. The decisions reinforced the principle that public interest in transparency and accountability outweighs corporate attempts to shield investigative findings.

The published report criticized LifeLabs for its insufficient data security measures, over-collection of personal information, and delays in notifying affected individuals.

Law firms advising healthcare and tech clients should emphasize compliance with privacy laws, robust cybersecurity protocols, and clear contractual terms. Transparency and prompt breach notifications are essential to rebuild public trust and demonstrate accountability.