We had previously written about a court case relating to a $75 million class action that was brought after a password-protected portal was hacked, resulting in a leak of confidential information online.
In a 2021 Alberta decision, the court heard an application to certify a class action against Uber after a cloud computing personal data breach. Ultimately, the court refused to certify the proposed class action, finding no evidence of provable harm or damages as a result of the breach.
Uber Users and Drivers’ Personal Data Hacked
In October 2016, Uber was the subject of an attack by two hackers, who illegally accessed electronic personal data, which was collected and stored in the “cloud” by Uber.
Subsequently, a representative plaintiff commenced aproposed class proceeding against Uber on behalf of herself and a proposed national class, who were either users of or drivers for its online transportation services. The plaintiff argued that Uber had failed in its “contract, common law and statutory obligations to protect the personal [data] … and [to] ensure it is not accessed by unauthorized parties” and sought personal and punitive damages as a result.
Specifically, the plaintiff alleged that:
- After accessing the personal data, the hackers had made a ransom demand of Uber in 2016;
- Uber had identified two hackers;
- Uber had not notified any of the class members, regulators, or police for over a year, instead paying the two hackers $100,000, on the promised “guarantee” that they would destroy the personal data, and;
- The class had only learned of the hack in November 2017 after it was discovered by third parties and exposed in the media.
Court Refuses to Certify Class Action
At the outset, the court narrowed the issue to that of determining whether there was “some evidence” of or “some basis in fact” for any real resulting common harm, loss or damagefrom the alleged common law or statutory breaches.
While Uber submitted that there must be proof of harm or loss for a successful action in negligence, the plaintiff asserted that in contract there was no requirement of proof of harm, loss, or resulting damages.
After reviewing the facts and relevant legal principles, the court ultimately held that the plaintiff had not provided any evidence of class-wide harm. More specifically, the court stated:
“I not only find no evidence of any actual harm or loss, but do find evidence of no actual harm or loss, in relation to the common law or statutory breaches, including what is called “significant harm”….
More specifically, I find that [the plaintiff] has provided no evidence, on this record, to show a breach of any truly confidential information, or either “first loss” (at the time of or directly related to or coincident with breach) or any of “additional loss”, “consequential loss”, “future loss”, “enhanced loss”, or any otherwise categorized significant consequential losses following the Hack and resulting alleged breach(es).This alone may not be sufficient to deny certification, because of what may have become (in retrospect) a flawed legal presumption of deemed fact by pleading, in the context of class actions. Nevertheless, I do find, in all the circumstances, that [the plaintiff] has not established that a class proceeding is a preferable procedure on this record.“
As a result, the court refused to certify the proposed class action.
Get Help
At Bader Law, we have been successfully advising tech start-ups and business owners for a number of years. In that time, we have built a reputation for our forward-thinking guidance and sound legal advice. We regularly help companies in up-and-coming areas including cloud computing, blockchain, other crypto-currency, and FinTech. We are familiar with the various challenges that start-ups face, particularly in the tech sector, and understand that entrepreneurs need a law firm that is going to be able to prioritize the most critical aspects of their venture with them.
The business law team at Bader Law has decades of experience in helping tech start-ups grow and expand, including negotiating licensing agreements and preparing companies for exit events. We are thorough, efficient, and focused on delivering the best possible outcome for every single client. Contact us online or at (289) 652-9092 to discuss your matter with a member of our team.