A B.C. Supreme Court judge has ordered ICBC to pay $15,000 to each person affected by a privacy breach after a claims adjuster leaked their personal data leading to a series of attacks across Metro Vancouver.
Justice Nathan Smith’s June 3 decision came in a class-action suit affected people filed.
He said electronically stored information may be easily accessible to many people within an organization and vulnerable to misuse.
“The court must stress the need for protection of that information and make clear there will be consequences for any failure to do so,” Smith said.
He ruled in August 2022 that ICBC was liable for some but not all damages resulting from employee Candy Elaine Rheaume giving driver information to others that resulted in a series of shootings and arsons.
What happened?
As a result of a 2011 police investigation, ICBC discovered Rheaume wrongfully accessed the files of at least 79 of its customers.
Between April 2011 and January 2012, houses and vehicles belonging to 13 customers were targeted in arsons and shootings.
All the victims of the attacks were identified because they had parked their vehicles at or near the Justice Institute of British Columbia.
The customers’ personal information had been sold to an associate of the United Nations gang which was responsible for arranging the attacks.
In 2017, Rheaume, a New Westminster resident, pleaded guilty in provincial court to unauthorized use of a computer. She received a suspended sentence of nine months’ probation with an order to do 40 hours of community service.
“It was motivated by personal financial gain and resulted in distribution of information to third parties, including criminals,” Smith said.
The new court decision
The judge said an investigation revealed that the 13 people targeted in the attacks were among 79 ICBC customers whose licence plate numbers Rheaume had searched in the corporation’s databases without an apparent business purpose.
Such a search would reveal, among other things, the name and address of a vehicle’s owner, Smith said.
ICBC admitted in the class action that Rheaume sold some of the information she obtained to Aldorino Moretti for $25 or more per licence plate number, and some of that that information was used by Vincent Eric Gia-Hwa Cheung, Thurman Ronley Taffe and others to carry out the attacks.
ICBC fired Rheaume and notified 78 customers that their information had been wrongly accessed.
“It is not known how many of the 78 customers’ information Ms. Rheaume sold. ICBC admitted she sold the information of 45 customers, based solely on what was particularized by the Crown in subsequent criminal proceedings against her,” Smith said.
The main plaintiff in the class action, known as the representative plaintiff, was Ufuk Ari. He received a $10,000 honorarium for filling that role.
The case had initially sought $25,000 per class member. ICBC suggested $500. The judge said the latter amount was an insufficient penalty to make it clear that those storing people’s data must protect it. He said organizations such as ICBC that have “vast amounts of personal information about people must be accountable for how that information is handled.”
“The people who provide that information often have no meaningful choice about whether to do so,” Smith ruled.
