N.S. laws make class action unlikely in wake of NS Power data breach, expert says

Experts say a class action lawsuit is unlikely to succeed against NS Power.

A legal expert said the chances of launching a successful class action lawsuit against Nova Scotia Power over a recent data breach are low due to gaps in provincial legislation.

Wayne Mackay, professor at the Schulich School of Law at Dalhousie University said the lack of specific legal tools in Nova Scotia makes it difficult to sue companies when hackers are responsible for privacy violations.

“In this particular case, the main invader of the privacy is the hacker and not Nova Scotia Power itself,” explained Mackay. “You’d need added legislation, like they have in B.C., that specifically allows them to sue the holder of the information in a class-action way.”

Unlike British Columbia and a few other provinces, Nova Scotia does not have statutes that permit class action claims for privacy breaches tied to data custodians. As a result, people who believe NS Power should be held accountable face a high legal bar.

Individuals could argue that NS Power was negligent in its handling of sensitive information, such as social insurance numbers but Mackay said that type of civil claim would also be challenging.

“They have to prove the injury and the damages and that’s quite difficult,” he said. “Even tying it to a particular hacker may be hard – you know you’ve been fraudulently victimized, but you don’t necessarily know exactly who or how they got the information.”

Mackay notes that provinces like Ontario have taken a more restrictive approach in the courts, requiring proof of damages for privacy lawsuits to proceed. By contrast, B.C.’s more permissive legislation allows class actions without the same evidentiary burden.

Though class action lawsuits have followed some cyberattacks in the past, Mackay said he’s not aware of any major ones related to power utilities or similar private companies outside the health sector. He said it’s possible other factors contributed to successful lawsuits in previous data breaches, such as the one involving the MOVEit software.

“There must’ve been some kind of statutory base,” Mackay said. “Because common law actions of this kind are very difficult.”

Mackay says one of the stronger legal arguments could focus on collection and storage of social insurance numbers – which federal officials have repeatedly said should be limited to only cases where absolutely necessary. “is it negligent to acquire that SIN kind of information in the first place?” he said. “And even if it’s acceptable in some cases, not destroying it as quickly as possible -that may be one of the stronger issues to raise.”

He adds that Nova Scotia Power has said it will no longer ask for social insurance numbers going forward and plans to destroy those already collected.

Although it may be possible to pursue an individual civil suit, Mackay says the cost and complexity of proving damages could deter most.

“You’d be hiring a lawyer, paying lawyer fees, and perhaps you could get an adventurous lawyer to take it on a contingency basis,” he said. “But the costs would be quite high and the chances of success still pretty low.”

One challenge for both individuals and regulators is the lack of clarity around what information was actually taken. Mackay says Nova Scotia Power and the federal privacy commissioner are both investigating, but it’s not yet known exactly what was compromised.

“There’s also some possibility that the credit agencies like TransUnion or Equifax may be able to use some of their resources to find out which particular bits of information have been compromised,” he said.

Mackay recommends that affected individuals notify both their banks and credit reporting agencies to help monitor suspicious activity. “This is a growing problem that’s only going to get larger, unfortunately. Many times, the people doing this are ahead of the regulators and other trying to control them.”

He says Nova Scotia would be wise to follow British Columbia’s lead and introduce legislation to give more legal recourse in future breaches.

For more Nova Scotia news, visit our dedicated provincial page