On March 26, 2021, the Superior Court rendered a decision dismissing a class action against the Investment Industry Regulatory Organization of Canada (“IIROC”) on the loss of personal information of thousands of Canadian investors.1 The lack of evidence of compensable injury and IIROC’s diligent behaviour are the main reasons for the dismissal of the class action. The Facts On February 22, 2013, an inspector working for IIROC forgot his laptop computer in a public place. The computer, which contained the personal information of approximately 50,000 Canadians, was never found. The information had originally been collected by various securities brokers who were under inspection by IIROC. Mr. Lamoureux, whose personal information was on the computer, brought a class action on behalf of all persons whose personal information was lost in the incident. He claimed compensatory damages for the stress, anxiety and worries associated with the loss of personal information, as well as compensation for the injury associated with the identity theft or attempted identity theft of members. He also claimed punitive damages for unlawful and intentional infringement of the right to privacy protected by the Quebec Charter of Human Rights and Freedoms. On this point, the members claimed that IIROC had been reckless and had delayed in notifying affected persons and brokers, as well as relevant authorities. Decision The class action is dismissed in its entirety. Compensatory damages The Superior Court started by acknowledging IIROC’s admission that it was at fault for the loss of the computer, and that the computer was not encrypted as it should have been to comply with IIROC policies. With respect to compensatory damages, the Court reiterated the principle according to which the existence of fault does not presume the existence of injury; each case must be analyzed on the basis of the evidence.2 In this case, the injury alleged by the members can be summarized as follows: They suffered worry, anger, stress and anxiety about the incident. They were forced to monitor their financial accounts, and in particular their credit cards and bank accounts. They were inconvenienced and wasted time in having to deal with credit agencies and ensuring that their personal information was protected. They felt shame and suffered delays caused by identity checks on their credit applications attributable to flags on their files. In its analysis, the Court held that, apart from the fact that the members were generally troubled by the loss of their personal information, there was no evidence of any particular and significant difficulties related to their mental state. Relying on Mustapha v. Culligan of Canada Ltd.,3 the Court reiterated that “the law does not recognize upset, disgust, anxiety, agitation or other mental states that fall short of injury.” If the injury is not serious and prolonged, and is limited to ordinary discomforts and fears that are inherent to life in society, it does not constitute compensable injury. In this case, the Court found that the negative feelings experienced as a result of the loss of personal information did not rise above the level of ordinary discomforts, anxieties and fears that people living in society routinely accept. Having to monitor one’s personal accounts more closely does not qualify as a compensable injury, as the courts equate this practice with that of [translation] “a reasonable person who protects their assets.”4 The Court also considered the fact that IIROC provided members with free credit monitoring and protection services. It thus concluded that, in this respect, there was no injury to compensate. Finally, the experts who were mandated to analyze the circumstances and wrongful use of the investors’ personal information found that there was no clear indication of wrongful use of the information by a person or group of persons, although evidence of wrongful use of personal information is not necessary to assert a claim. Punitive damages The plaintiff, on behalf of the members of the class action, also sought punitive damages on the grounds that IIROC had been reckless in its handling of the incident. To analyze IIROC’s diligence, the Court noted the following facts.  IIROC launched an internal investigation in the week that followed that of February 22, 2013, the date on which the computer was lost. On March 4, 2013, the investigation revealed that the computer likely contained the personal information of thousands of Canadians. IIROC filed a police report. On March 6, 2013, it mandated Deloitte to identify what personal information was lost and who were the affected persons and brokerage firms, and to help it manage the risks and obligations associated with the loss of the personal information. On March 22, 2013, Deloitte informed IIROC that the computer contained “highly sensitive” and “increased sensitivity” information about thousands of Canadian investors. On March 27, 2013, IIROC notified the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada. On April 8 and 9, 2013, IIROC met with representatives of the affected brokerage firms, and simultaneously mandated credit agencies to implement safeguards for investors and brokerage firms. IIROC also set up a bilingual call center, issued a press release about the loss of the computer and sent a letter to affected investors. The Court also accepted expert evidence according to which IIROC’s response was consistent with industry best practices, and that the measures put in place were appropriate in the circumstances and consistent with other responses to similar incidents. In light of the evidence, the Court concluded that the loss of the unencrypted laptop computer and the resulting violation of the right to privacy were isolated and unintentional. It therefore dismissed the claim for punitive damages. The outcome is that IIROC was not reckless: it rather acted in a timely manner. Comments This decision introduces a basis for analyzing the diligent conduct of a company should the personal information that it holds be compromised, and confirms that a prompt and diligent response to a security incident can safeguard against a civil suit. It also confirms that the mere loss of personal information, no matter how sensitive, is not in itself sufficient to justify financial compensation, and that it must be proven that injury was suffered. Furthermore, ordinary annoyances and temporary inconveniences do not constitute compensable injury, and monitoring financial accounts is not exceptional, but is rather considered the standard practice expected of a reasonable person protecting their assets. At the time of writing this bulletin, the time limit for appeal has not expired and the plaintiff has not announced whether he intends to appeal the judgment. Lamoureux v. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), 2021 QCCS 1093. Sofio v. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), 2014 QCCS 4061, paras. 21 and 22. Mustapha v. Culligan of Canada Ltd., 2008 SCC 27 [2008] 2 SCR 114. Lamoureux v. Organisme canadien de réglementation du commerce des valeurs mobilières, 2021 QCCS 1093, para. 73.

Is an event organizer responsible for an artist’s late appearance? Context is key, answers the Superior Court’s, as it dismisses the application for authorization to institute a class action against Gestion Evenko Inc.1 regarding Travis Scott’s late appearance at the Osheaga Music and Arts Festival in the summer of 2018. Overview of the first class action on this topic in Quebec. Background The Osheaga Festival, organized by the defendant, Evenko, is a huge celebration dedicated to music and visual arts where artists of all genres perform for three days on the many outdoor stages set up in Parc Jean-Drapeau on Notre-Dame Island. Rapper Travis Scott was on the lineup for the evening of August 3, 2018. His performance was scheduled from 9:45 p.m. to 10:55 p.m. on the River stage. Wishing to attend this performance, the plaintiff, who had purchased a weekend pass, went to the venue at 8:45 p.m. Unfortunately, Travis Scott was held up at customs that evening. The sequence of events can be summarized as follows. At 9:55 p.m., Evenko displayed a first message on the site’s giant screens indicating that the show was delayed for a reason beyond its control. At 10:15 p.m., Evenko broadcast a second message, both on the giant screens and on Twitter, indicating that Travis Scott had been delayed at customs and was on his way to Notre-Dame Island. At 10:30 p.m., the plaintiff left the premises; she claimed that she did not believe Evenko's messages, feared a curfew and found the crowd aggressive. At 10:40 p.m., Evenko broadcast a third message on the giant screens confirming that Travis Scott had arrived on the island. At 10:55 p.m., Evenko broadcast a fourth message announcing to festival-goers that the show was about to begin. The show started at 11:00 p.m. and ended around 11:40 p.m. An application for authorization to institute a class action was filed the next day. The plaintiff sought to represent nearly 50,000 festival-goers who, in her opinion, suffered prejudice attributable to Evenko. She claimed that Travis Scott’s 90-minute delay constituted a breach of contract by Evenko such that all members of the group should obtain a refund equivalent to the value of a daily pass. The Decision In carrying out the analysis required by section 575 of the C.C.P., Justice André Prévost concluded that the alleged facts did not appear to justify the conclusions sought. The application for authorization to institute a class action was therefore dismissed. From the outset, the Court questioned some of the allegations in the application: for example, the plaintiff’s assertion that [translation] “Travis Scott’s performance was the main consideration in the contract with Evenko” seems incompatible with the fact that she purchased a three-day pass (paras. 51, 56); similarly, there was no evidence to support her claim that the crowd was aggressive (para. 54). However, it is mainly two deficiencies in the legal syllogism that led the Court to conclude that the application for authorization did not establish an arguable case or a reasonable prospect of success (para. 66). First, the Court refused to reduce the Osheaga Festival experience to a single performance, even that of a headliner. Rather, it described the event as [translation] “a comprehensive experience [...] whose interest lies in the multiplicity and simultaneity of cultural experiences” (para. 48). In fact, in addition to the invited musical, cultural and circus artists, there are various activities, fairs, cruises and awards ceremonies, to name but a few (para. 48). The Court pointed out that all documents relating to Osheaga’s programming and schedule contain one or more of the following warnings: “Schedule and lineup subject to change” or “Artists and schedule subject to change” (para. 47). These warnings are a strong indication that such delays are far from unusual or, in the words of the Court, [translation] “this is not exceptional for those acquainted with the cultural milieu” (para. 57). In this context, Evenko cannot be found to be at fault. The Court continued its analysis, adding that, even if it were found to be at fault, which is not the case, the situation did not result in any compensable damage: Citing Sofio2 and Mustapha3, the Court pointed out that mere annoyance is not prejudice, and that, in fact, [translation] “there is no evidence that Travis Scott’s delayed performance caused a more serious inconvenience than what is usual for people attending festivals of this nature” (para. 65). In short, in the context of a multi-genre festival, an artist appearing late does not necessarily constitute compensable prejudice and does not automatically amount to the promoter’s failure to fulfil its obligations. What It Means The decision is important to the entertainment industry in that it recognizes that major event organizers sometimes deal with unforeseen circumstances and they are allowed reasonable leeway to adapt to them. Of course, each situation will be particular, but a well-informed promoter will make sure to indicate that changes are possible in its documentation. The decision also recognizes that a comprehensive cultural experience is more than the sum of its parts: a single artist appearing late does not cast a pall on the entire event. This conclusion is likely to apply to many other industries: Osheaga is a typical example of a set of distinct and simultaneous performances, but the same characterization can be given to all the rides in an amusement park or all the individual sections of a zoological garden. Our partners, Myriam Brixi and Laurence Bich-Carrière have successfully represented Evenko's interests in this case.   Le Stum c. Gestion Evenko inc., 2019 QCCS 2422. The time limit for appeal expired on July 22, 2019. Sofio c. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), 2015 QCCA 1820. Mustapha v. Culligan of Canada Ltd., [2008] 2 SCR 114, 2008 SCC 27.

The Superior Court of Québec dismissed an application for authorization to institute a class action against Yahoo! Inc.1 (hereinafter “Yahoo!”) seeking damages as a result of cyberattacks that compromised the confidentiality of user data. Context In September 2016, Yahoo! issued a press release announcing that nearly 500 million users were reportedly victims of a cyberattack in 2014. In December 2016, the company informed its users of another cyberattack that it claims took place in 2013. In February 2017, users were informed that the use of cookies apparently allowed a third party to access information contained in their accounts between 2015 and 2016. While a class action was brought in Ontario in December 2016, an application for authorization to institute a class action was filed in Québec the following month seeking compensation for users who were victims of one or more of these cyberattacks. The decision No arguable case After limiting the class to Québec residents whose information was lost and/or stolen between 2013 and 2019, the Court addressed the test set forth in paragraph 2 of article 575 of the Code of Civil Procedure. According to this criterion, the plaintiff must demonstrate that the alleged facts appear to justify the conclusions sought. The Court must distinguish factual allegations from arguments, opinions, unsupported inferences and hypotheses, as well as assertions that are implausible or false. This analysis is carried out in light of the plaintiff’s cause of action. In this case, the plaintiff had a Yahoo! email account. She alleged having suffered harm because her account may have been hacked during the 2013 cyberattack, although the nature of the compromised information is not yet known. She added that she suffered additional harm due to the “imminent” and “certainly impending” threat of identity theft and fraud resulting from the sale of her information on the black market and its use by criminals. She was also embarrassed because some of her friends received spam emails from her account in her name. As a result, she must now take steps to protect her personal and financial information. Building on the principles set out in the Sofio2 and Mustapha3 decisions, the Court reiterated that the demonstration of an alleged fault does not presuppose the existence of prejudice and that the latter must be serious and prolonged. Embarrassment and temporary inconveniences of an ordinary nature do not constitute compensable damages. Contrary to the allegations in the application, the Court considered that the plaintiff’s answers during her examination demonstrated that she has no reason to believe that she was a victim of identity theft or fraud, since she did not identify any suspicious charges and did not receive a poor credit report. In addition, she continued to use her Yahoo! account and admitted that she did not purchase any identity protection services, such as credit monitoring. Thus, the only prejudice the plaintiff suffered is the fact that she had to change her passwords for all of the accounts associated with her Yahoo! email address and the embarrassment she suffered because of the spam emails that were sent to her friends. On this point, the Court noted that none of the spam emails were filed into the Court record and that none of the recipients of the spam emails suffered harm. Consequently, the Court concluded that the plaintiff had not demonstrated the existence of an arguable cause. The Court distinguished the facts in this case from those in Zuckerman4 and Belley5, in which the plaintiffs had incurred expenses to protect their information or had been victims of fraud or identity theft. Inadequate representation Adequate representation implies that the representative plaintiff has a valid personal cause of action. However, a civil liability action requires the demonstration of a legal basis for the claim of damages, which was not achieved in this case. To summarize: It is not enough to claim the existence of a fault: damage must result therefrom. The notion of “compensable harm” must go beyond mere annoyance. Conclusion Legal action brought as a result of data breaches has increased exponentially in recent years. Cybercrime has become the second most common type of financial fraud. Any company that retains client data should be aware of the risks associated with cyberattacks and the potential lawsuits. To minimize risks, several measures can be implemented, such as adopting a response plan for cyberattacks, training employees and regularly updating security measures. For example, the PCI DSS (Payment Card Industry Data Security Standard) provides a detailed framework that allows companies to implement secure transaction processes. It is recommended that companies consult an IT specialist or hire an internal expert for guidance. It is also recommended that companies contact their insurers to verify their insurance policy coverage and, if necessary, obtain cyber risk insurance coverage. For class action practitioners, this decision once again demonstrates the importance of bearing in mind the impact that the examination of the representative plaintiff could have on the outcome of a case.   Bourbonnière v. Yahoo! Inc., 2019 QCCS 2624. Sofio c. Organisme canadien de réglementation du commerce des valeurs mobilières (OCRCVM), 2015 QCCA 1820. Mustapha v. Culligan of Canada Ltd., 2008 SCC 27. Zukerman v. Target Corporation, 2015 QCCA 1809. Belley v. TD Auto Finance Services Inc./Services de financement auto TD inc., 2015 QCCS 168/2015 QCCA 1255.

Introduction Although 24 years of jurisprudence have gone by since its codification in article 1375 of the Civil Code of Québec, the notion of good faith remains a vague concept whose incidence on the performance of contracts is still unclear.  Although it is increasingly evident that good faith is not a mere interpretive concept without substantial meaning, the most fundamental uncertainty remains— or rather, remained, until the Supreme Court of Canada rendered the decision that is the subject of this bulletin. This uncertainty has to do with knowing to what extent the general obligation of good faith can change the content of a contract duly entered into by the parties. In other words, could the judge, on the basis of article 1375 CCQ, intervene in the contract, the “law for the parties,” to remodel it according to the judge’s understanding of good faith? Context In this matter, the plaintiff, Churchill Falls, argued that the other contracting party, Hydro-Québec, had an obligation to renegotiate the price in a contract under which the latter had undertaken to purchase most of the electricity produced by the Churchill Falls power plant at a fixed price for a period of 65 years. According to Churchill Falls, this obligation to renegotiate the price was a matter of good faith and was required of Hydro-Québec due to the changes in the electricity market that meant that the fixed price in the contract had become too low compared to the prices paid on this market. The Court thus had to decide whether it could, on the basis of the notion of good faith, add an obligation to renegotiate the price to the fixed price contract. Decision The Supreme Court of Canada responded to this question in the negative, as had the Superior Court and Court of Appeal of Quebec. To do this, it analyzed and rejected each of the arguments submitted by Churchill Falls. We will briefly examine these arguments and the way in which the Supreme Court rejected them. The contract is not a joint venture contract Churchill Falls initially claimed that the contract that it had signed with Hydro-Québec was a joint venture contract, which, by its very nature, implies an equitable sharing of risks and profits, and therefore entails an obligation to renegotiate the price in order to better share the profits generated from the sale of electricity. The legal nature of a joint venture contract is disputed since some authors, looking to Quebec jurisprudence, are of the opinion that it consists of an undeclared partnership, while others defend the existence in Quebec law of a sui generis contract of joint venture.  Without getting into this debate, the majority of the Court was of the opinion that the contract in question fulfilled neither the criteria of an undeclared partnership contract, nor those of a sui generis contract of joint venture. In fact, regarding the undeclared partnership, the evidence showed no common intention to form a partnership (animus societatis) nor any combining of resources. Regarding the sui generis contract of joint venture, the majority of the Court identified from authors who defend this unnamed legal form the determining factor of “an intention to jointly assume the responsibility involved in carrying out the proposed project.” However, the contract in question clearly defined and divided the responsibility of each party to the contract in such a way that no intention to share responsibility for the project could be deduced. The contract is not a relational contract Churchill Falls then claimed that the contract that it had signed with Hydro-Québec was a relational contract that, by its very nature, entailed a stricter obligation of good faith, including, given the change in circumstances, the obligation for the parties to renegotiate the price in order to better share the profits from the sale of electricity. The majority of the Court rejected this argument because they were of the opinion that the contract in question was not a relational contract. They did not rule on the second part of this argument, regarding the scope of a good faith obligation if it were a relational contract. Regarding the definition of relational contracts, the position of the majority of the Court sets a precedent. In fact, while jurisprudence and authors have defined the relational contract in a variety of somewhat eclectic ways, the majority of the Court accepted only the definition proposed in 1998 by Professor Belley: “a relational contract can roughly be defined as a contract that sets out the rules for a close cooperation that the parties wish to maintain over the long term.” In essence, relational contracts provide for economic coordination as opposed to setting out a series of defined prestations. It is a corollary to the emphasis on the parties’ relationship that their respective prestations are not defined in much detail. The contract in question here clearly quantified and defined each party’s prestations, so that no important prestations were left undefined. According to the majority of the Court, this shows that the parties intended the project to proceed according to the words of the contract at face value, not on the basis of their ability to agree and cooperate from day to day to fill any gaps in the contract: “The Power Contract sets out a series of defined and detailed prestations as opposed to providing for flexible economic coordination. It is not therefore a relational contract.” No implied obligation to renegotiate the price Churchill Falls (CFLCo) also claimed that an implied obligation to collaborate and renegotiate the price is incident to the contract according to its nature, under art. 1434 CCQ. The majority of the Court dismissed this argument. On this subject also, the position of the majority of the Court sets a precedent. In fact, to a certain degree, the judges strengthened and shed light on the concept of implied contractual obligations under article 1434 CCQ. According to them, an implied duty may be incident to a contract according to the nature of the contract if the duty is consistent with the general scheme of the contract and if the contract’s coherency seems to require such a duty. However, such an implied clause must not merely add duties to the contract that might enhance it, but must fill a gap in the terms of the contract such that it can be presumed that the clause reflects the parties’ intention, which is inferred from their choice to enter into a given type of contract. The majority of the Court noted that in this case, there is nothing to suggest that the parties’ prestations would be incomprehensible and would have no basis or meaningful effect in the absence of an implied duty according to which Hydro-Québec must either exceed the usual requirements of good faith in cooperating with CFLCo or redistribute windfall profits: “The Contract governs the financing of the Plant and the sale of electricity produced there, and also strictly regulates the quantity of electricity to be provided by CFLCo and the price to be paid by Hydro-Québec. The meaningful effect of the sale for the parties is clearly identifiable: Hydro-Québec obtains electricity, while CFLCo receives the price paid for it. The fact that the price might not be in line with market prices does not destroy the very logic behind the sale or deprive it of any meaningful effect. Furthermore, the benefits each party derives from the sale are related to the other prestations associated with the construction of the Plant. There is no gap or omission in the scheme of the Contract that requires this Court to read an implied duty into the Contract in order to make it coherent.” The limits of good faith and the rejection of the doctrine of unforeseeability Finally, Churchill Falls argued that independently from the nature of the contract, Hydro-Québec was nonetheless obliged to renegotiate because, in Quebec civil law, the concepts of good faith and equity condition the exercise of the rights created by any type of contract. It argued that these concepts prevent Hydro-Québec from relying on the words of the Contract, because to do so in circumstances in which the Contract effectively provides for disproportionate prestations would be contrary to its duty to act in good faith and in accordance with equity. And given that the prestations owed by the parties have been disproportionate since the changes in the market occurred, it argued that Hydro-Québec has been violating its duties related to good faith since then by refusing to renegotiate the Contract.  In this regard, the majority of the Court began by categorically affirming that the doctrine of unforeseeability, which Churchill Falls seemed to rely on indirectly, was not part of Quebec civil law. The majority of the Court noted that Churchill Falls was seeking to use the concepts of good faith and equity in a manner that goes beyond the limits of the doctrine of unforeseeability even though the Quebec legislature has refused to incorporate that doctrine into the province’s civil law. They added that, “If unforeseeability itself has been rejected, a protection analogous to it that would be linked only to changes in circumstances without regard for the core conditions of the doctrine as recognized in other civil law jurisdictions could not become the rule in Quebec law.” The majority of the Court rejected equity as a basis for a possible obligation to renegotiate the price, because “its effect would then be to indirectly introduce either lesion or unforeseeability into our law in every case.” They added that the equity provided in article 1434 as a source of implied obligations “is not so malleable that it can be detached from the will of the parties and their common intention as revealed in and established by a thorough analysis of the whole of the relevant evidence.” In fact, the evidence revealed that both parties to the contract were experienced, and they negotiated its clauses at length and intended one of them to bear the risk of fluctuations in electricity prices. The majority of the Court also rejected the argument of good faith as a basis for a possible obligation to renegotiate the price. Their analysis in this regard is based on the following two assumptions, which clarify the concept of good faith. Firstly, according to them, good faith is a standard associated with the parties’ conduct; it cannot be used to impose obligations that are completely unrelated to their conduct. In other words, for good faith to be invoked with success, unreasonable conduct by one of the parties must be shown. In this case, Hydro-Québec did nothing but demand the performance of the contract as it had been agreed upon. The second assumption is that good faith serves to maintain the relevance of the prestations that form the basis of the contract even if the words of the contract do not specifically prohibit the parties from doing something that would impede its fulfilment. The majority of the Court adds that, “if the main prestations of a contract are renegotiated and modified, they will rarely remain relevant.” In other words, “Because good faith takes its form from the terms of the contract, it cannot serve to undermine the contract’s paradigm. But in the view of the Superior Court and the Court of Appeal, that is exactly what CFLCo is arguing for in this case: CFLCo is demanding that Hydro-Québec renounce its access to a source of electricity production at a stable cost, that is, to the principal benefit it derives from the Contract.” Commentary This decision sheds a very useful light on the relationship between good faith and the contents or scheme of a contract. Closing the door to the general application of the doctrine of unforeseeability, the Court instead favoured the binding force of contracts and contractual stability. Contrary to the claims of Churchill Falls, the obligation to act in good faith cannot oblige the parties to renegotiate the fundamental terms of the contract, but aims rather to enable the performance of the prestations under the contract. However, although in principle it is legitimate to demand adherence to a contract, a party’s rigidity must not reach the point of abuse of rights, in which case it could be sanctioned for its conduct and held responsible if there is resulting damage. Moreover, various judicial instruments can help palliate the unforeseeable. If the unforeseen situation is severe enough to be qualified as superior force under the Civil Code, in that it prevents a party to the contract from fulfilling its obligations, said party could be released from them. The parties are also free to define the concept of superior force in their relationship through a contractual clause. Similarly, the parties can limit the risks associated with the unforeseeable in long-term contracts through adjustment clauses, which can take several forms (indexing clauses, revaluation clauses, renegotiation clauses, etc.). This could be especially useful in a fixed-price contract where the risks are usually attributed to the service provider ahead of time. However, as the matter of Churchill Falls clearly shows, a party that has agreed by contract to assume a risk without providing for such adjustment mechanisms will have to assume the consequences.