VANCOUVER — ICBC has been ordered to pay $15,000 each to 79 people — 13 of whom had their homes targeted with arsons and shootings after the privacy breach — as part of a class action judgment involving a former employee who improperly accessed and sold their personal information to third parties.
The Insurance Corporation of B.C. was judged vicariously liable for the privacy breaches after a summary trial in 2022 and an appeal by the provincial insurer was dismissed a year later. ICBC had sought to pay just $500 to each class member, but a B.C. judge ruled that would have served to trivialize the seriousness of the breach.
Those who were targeted in the attacks and suffered property damage are still able to seek relief for individual damages in the case.
According to court documents published online Tuesday, the homes and vehicles of 13 people were targeted between April 2011 and January 2012. They were among 79 ICBC customers whose licence plates and related personal information were pulled from corporation databases by adjuster Candy Elaine Rheaume.
“ICBC admitted in this action that Ms. Rheaume sold some of the information she obtained to Aldorino Moretti for $25 or more per licence plate number, and some of that information was used by Vincent Eric Gia-Hwa Cheung, Thurman Ronley Taffe and others to carry out the attacks,” said the ruling.
Rheaume was fired and all the customers were notified of the privacy breach, though it hasn’t been established exactly how many had their data sold to third parties.
The class action stems from the June 2012 privacy breaches and has been the subject of four judgments by the B.C. Court of Appeal since — one of which pointed to a history of similar breaches by ICBC employees.
In 2017, Rheaume pleaded guilty to selling the information to a gangster, who targeted homes with vandalism, drive-by shootings and arson because of their links to the Justice Institute of B.C.
“I concluded that the privacy breach was complete when Ms. Rheaume improperly accessed customer information, whether or not she passed the information to a third party,” wrote Supreme Court Justice Nathan Smith in the ruling.
Although dozens of the clients weren’t targeted, “I find that risk existed for all class members, whether they were individually aware of it or not,” said Smith. “Many class members have no way of knowing whether their information was disclosed to anyone, to whom it was disclosed or the specific risk that may have created.”
Earlier rulings have concluded that the Privacy Act makes a breach actionable without proof of direct damage or actual harm, he noted.
He said the need for accountability “is of particular importance at a time when large organizations — public and private — routinely collect and electronically store vast amounts of personal information about everyone they deal with. The people who provide that information often have no meaningful choice about whether to do so.”
Smith noted anyone who wants to own or drive a vehicle must provide detailed personal information to ICBC, and that many people in the organization have access, so the need for protecting that information is vital.
It said the breach in this case is more serious than in others cited because it was “motivated by personal financial gain and resulted in distribution of information to third parties, including criminals.”
Lawyers who worked on the class action will receive 35 per cent of the total of damages to class members, fees that Smith deems appropriate because the action was not settled after certification, but rather was “hard-fought for 12 years, including four separate appeals.”
A representative plaintiff, Ufuk Ari, who provided information and retained legal counsel over those dozen years, will get an added $10,000 honorarium.
>>> To comment on this article, write a letter to the editor: [email protected]
