A British Columbia court has ordered ICBC to pay $15,000 in damages to each of nearly 80 individuals whose personal information was obtained by a former employee and sold to a criminal group more than a decade ago.
The ruling ends a long-running class-action lawsuit over the so-called Institute for Justice AttackIn 2011 and 2012, people associated with the school, which provides police and security training, were the targets of arson and shootings.
The case was brought in 2011 after police discovered that former ICBC claims adjuster Candy Rheaume had accessed files on 79 people, including license plate numbers and addresses. She sold some of the information, which was ultimately used to target the homes and vehicles of 13 people who parked near the school.
Rheaume was fired and eventually Admit unauthorized use of a computerBut in 2022, the BC Supreme Court ruled that the public insurer was still liable for her actions.
According to court documents, Roma believed a man running a drug dealing hub used the information to check if police were watching him. However, the man passed the information to Zhang JiahuaHe planned the attack at the School of Justice because he had “paranoid beliefs, fuelled by drug use, that he was being attacked and controlled by the school”.
Breaking news from Canada and around the world
Sent to your email, as it happens.
The class action lawsuit seeks $25,000 in damages per person. ICBC wants to pay $500 to each class member, with any higher damages sought to be made on an individual basis, arguing that each person’s data was accessed, not sold or used inappropriately.
On Monday, British Columbia Supreme Court Justice Nathan Smith ruled that $15,000 in damages, less 35 per cent in legal fees, was reasonable for victims whose data was breached because the breach was “serious.”
Smith noted that it was unclear how many people's information was sold, but Rohm acknowledged that it was at least 45 customers.
But the judge found that everyone whose data was accessed was at risk, and no one knew whether it was passed on to anyone else. In fact, he noted, the people who bought the data from Rheaume did just that.
“The conduct was motivated by personal financial gain and resulted in the disclosure of information to third parties, including criminals. The impact was not limited to the individual and the extent of the information disclosure and the risk posed at the time can never be known,” Smith ruled.
He added that the courts must emphasize the need to protect the public's private information and impose consequences for failing to do so.
“I find that the need for public purpose and accountability is particularly important when large organizations, whether public or private, routinely collect and electronically store large amounts of personal information about every person with whom they interact,” Smith ruled.
“The person providing this information generally does not have a choice as to whether or not to provide this information. In this case, any British Columbia resident who wishes to own or operate a motor vehicle is required to provide the information to ICBC.”
ICBC said in a statement it is reviewing the court's decision and has no further comment.
But the company said it took emergency action in the case as early as 2011, including firing Rheaume, and has updated its privacy processes since then to further protect customer information.
Ultimately, Rheume was sentenced to nine months' probation for his role in the incident.
Zhang pleaded guilty to 18 of the 23 charges against him and was sentenced to 13.5 years in prison in 2016, while a man he hired to take part in the conspiracy was also sentenced to time already served.
© 2024 Global News, a division of Corus Entertainment Inc.
