British Columbia Court of Appeal Sets Landmark Privacy and Cybersecurity Precedent

According to an article by Blake, Cassels & Graydon, a significant decision for privacy and cybersecurity law was made when the British Columbia Court of Appeal upheld a class action judgment on April 23, 2025, awarding C$15,000 in aggregate damages to each class member without requiring proof of consequential loss. 

The ruling in Insurance Corporation of British Columbia v. Ari arose from a case involving a rogue employee at ICBC who sold customer data to criminals, leading to targeted violence, including shootings and arson. The case tested whether general damages can be awarded under British Columbia’s Privacy Act for breach of privacy alone, even without demonstrable harm. In affirming the lower court’s decision, the Court expanded the legal framework for privacy protections in Canada and underscored the importance of recognizing privacy rights as “quasi-constitutional.”

The trial court found ICBC vicariously liable for the employee’s unauthorized access to and sale of 45 customers’ personal data. Although only 13 were directly targeted in violent incidents, the class included all whose information was accessed and their cohabitants. 

ICBC argued for a nominal damages award of C$500 per person, but the court awarded C$15,000, citing the gravity and intentional nature of the breach. The Court of Appeal affirmed this, reasoning that the violation itself harmed the plaintiffs’ right to control access to their personal data — a harm distinct from any emotional or financial impact.

This ruling has clear implications for privacy and cybersecurity professionals. It signals that organizations can face significant liability for privacy breaches even in the absence of quantifiable harm. The decision reinforces the necessity of robust internal controls and accountability mechanisms to guard against insider threats and affirms that courts are willing to impose meaningful consequences for the failure to protect personal data.