Court File No.: ONTARIO SUPERIOR COURT OF JUSTICE Plaintiff - and - FAMILY AND SERVICES OF LANARK, LEEDS AND GRENVILLE, also known as the AID SOCIETY OF LANARK, LEEDS AND GRENVILLE, RAYMOND LEMAY, EXECUTIVE DIRECTOR FOR FAMILY AND SERVICES OF LANARK, LEEDS AND GRENVILLE, THE HONOURABLE TRACY MACCHARLES IN HER CAPACITY AS MINISTER OF CHILDREN AND YOUTH SERVICES, HER MAJESTY THE QUEEN IN RIGHT OF THE PROVINCE OF ONTARIO - AND JOHN DOE Defendants Proceeding under the Class Proceedings Act, 1992 STATEMENT OF CLAIM TO THE DEFENDANTS: A LEGAL PROCEEDING HAS BEEN COMMENCED AGAINST YOU by the plaintiff. The claim made against you is set out in the following pages. IF YOU WISH TO DEFEND THIS PROCEEDING, you or an Ontario lawyer acting for you must prepare a statement of defence in Form 18A prescribed by the Rules of Civil Procedure, serve it on the plaintiff's lawyer or, where the plaintiff does not have a lawyer, serve it on the plaintiff, and file it, with proof of service in this court office, WITHIN TWENTY DAYS after this statement of claim is served on you, if you are served in Ontario. If you are served in another province or territory of Canada or in the United States of America, the period for serving and filing your statement of defence is forty days. -If you are served outside Canada and the United States of America, the period is sixty days. Instead of serving and filing a statement of defence, you may serve and file a notice of intent to defend in Form 183 prescribed by the Rules of Civil Procedure. This will entitle you to ten more days within which to serve and file your statement of defence. 2 IF YOU FAIL TO DEFEND THIS PROCEEDING, JUDGMENT MAY BE YOU IN YOUR ABSENCE AND WITHOUT FURTHER NOTICE TO YOU. IF YOU WISH TO DEFEND THIS PROCEEDING BUT ARE UNABLE TO PAY LEGAL FEES, LEGAL AID MAY BE AVAILABLE TO YOU BY CONTACTING A LOCAL LEGAL AID OFFICE. (Where the claim made is for money only, include the following.) IF YOU PAY THE CLAIM, and for costs, within the time for serving and filing your statement of defence you may move to have this proceeding dismissed by the court. If you believe the amount claimed for costs is excessive, you may pay the plaintiff's claim and $400 for costs and have the costs assessed by the court. - TAKE NOTICE: THIS ACTION WILL AUTOMATICALLY BE DISMISSED it it has not been set down for trial or terminated by any means within ?ve years after the action was commenced unless otherwise ordered by the court. Date . ..Issued by .. . - JIM {ikoqu?on I Local Registrar 10th Floor, 393 University Avenue Toronto, Ontario M5G 1E6 T0: FAMILY AND SERVICES OF LANARK, LEEDS AND GRENVILLE, also known as the AID SOCIETY OF LANARK, LEEDS AND GRENVILLE 438 Laurier Brockville, 0N K6V 605 AND TO: RAYMOND LEMAY Executive Director of Family and Children's Services of Lanark, Leeds and Grenville 438 Laurier Brockville, ON K6V 605 3 AND TO: THE HONOURABLE TRACY MACCHARLES IN HER CAPACITY AS MINISTER OF CHILDREN AND YOUTH SERVICES Ministry of Children and Youth Services 77 Wellesley Street West PO Box 156 Toronto, ON M7A 1N3 AND TO: HER MAJESTY THE QUEEN IN RIGHT OF THE PROVINCE OF ONTARIO c/o Ministry of the Attorney General Crown Law Office - Civil 720 Bay Street, 8?1 Floor Toronto. ON M5G 2K1 AND TO: JOHN DOE 4 CLAIM 1. The plaintiff claims on behalf of herself and other individuals whose personal, confidential, and identifying information (?personal information") was in the possession of Family and Children?s Services of Lanark, Leeds and Grenville (hereinafter referred to as which information was later stolen or released by the defendant, for the following relief: a. An Order pursuant to the Class Proceedings Act, 1992, SO 1992 6, amended, certifying this action as a Class Proceeding and appointing M.M. to act as the representative of the Class; b. General damages in the amount of $25,000,000.00 or in such other amount as this Honourable Court deems appropriate; 0. Special damages in the amount of $25,000,000.00 or in such other amount as this Honourable Court deems appropriate; d. Punitive, aggravated, and exemplary damages in the amount of $25,000,000.00 or in some other amount as this Honourable Court deems appropriate; e. Such further and other damages as may be proven at trial; f. Pre-judgement interest on the foregoing sums pursuant to section 128 of the Courts of Justice Act, RSO 1990, 0-43; 9. Post?judgement interest on the foregoing sums pursuant to section 129 of the Courts of Justice Act, RSO 1990, 0-43; h. Costs of this action on a substantial indemnity scale; and i. Such further and other relief as counsel may advise and/or this Honourable Court may permit. THE REPRESENTATIVE PLAINTIFF 2. The plaintiff, MM, is the mother of WP. and resides in the Province of Ontario and was at all material times, and for a brief period in April 2015, the subject of an investigation by the 5 The class members are clients of or subjects of investigations and, as such, their personal, confidential, and identifying information was collected, held, maintained, or otherwise in the possession of The representative plaintiff submits that for the purposes of this action, she shall be identified by her initials, M.M., to prevent further undue invasion of privacy. ONTARIO CLASS MEMBERS This action is brought on behalf of the plaintiff in her own right, and pursuant to the Class Proceedings Act, 8.0 1992, c. 6, on behalf of all persons resident throughout Ontario whose personal, confidential, and identifying information ("personal information?) was in the possession of which information was later stolen or released by the defendant, John Doe, and/or other unauthorized third parties. Included in the class are individuals who could be identified as family members of persons whose personal information was disclosed without authorization. The plaintiff is representative of a class of persons more particularly described as-follows: "All persons resident or situated in Ontario (including their families, estates, executors, or personal representatives), whose personal and confidential information was in the possession of which information was later stolen or released or obtained by unauthorized third parties on or about April 18, 2016." The plaintiff and other class members were clients of or were the subject of investigations. They provided their personal information to or it was obtained through other means without their knowledge. At all material times they believed their personal information was to be held securely and in confidence by the and that same would certainly not be subjected to exposure and theft. The confidential information was communicated to or otherwise in possession for the restricted purpose of fulfilling mandate and was not to be utilized for any purpose other than for that which it was originally provided or obtained. NON-RESIDENT CLASS MEMBERS The plaintiff also makes this claim on behalf of all Members of a Non-Resident sub-class of persons (including their estates, executors or personal representatives), corporations, and other entities, not resident or situated in the Province of Ontario, but resident or situated in another Canadian province or Territory or abroad, more particularly described as follows: 6 ?All persons not resident or situated in the Province of Ontario, but resident or situated in another-Canadian province or Territory or abroad (including their families, estates, executors, or personal representatives) whose personal, confidential, and identifying information was in the possession of which information was later stolen or released or obtained by unauthorized third parties. (Hereinafter both resident and non-resident class members are collectively referred to as the "plaintiffs", ?class members?, or the ?class"). THE DEFENDANTS 9. The defendant, also known as the Children?s Aid Society of Lanark, Leeds and 10. 11. 12. 13. Grenville, is an organization that is approved by the Ontario Minister of Children and Youth Services to provide services pursuant to and as defined in the Child and Family Services Act, RSO 1990 0 C11. operates in the Lanark, Leeds and Grenville region and, inter alia, provides child welfare services on behalf of the Government of Ontario for the following jurisdictions: Almonte, Athens, Augusta, Bathurst, Burgess Sherbrooke, Beckwith, Brockville, Caleton Place, Cardinal, Drummond-North Elmsley, Edwardsburgh, Elizabethtown, Front of Escott, Front of Leeds and Lansdowne, Front of Yonge, Gananoque, Kemptville, Kitley, Lanark, Leeds and Grenville, Merrickville-Wolford, Montague, Newboro, North Grenville, Perth (town), Prescott(separated town), Rear of Leeds and Lansdowne, Rideau Lakes, Smiths Falls (separated town), and Westport. The defendant, Raymond Lemay is the Executive Director for the The defendant, the Honourable Tracy MacCharIes in her capacity as the Minister of Children and Youth Services, is the Ontario minister responsible for the Ministry of Children and Youth Services, which administers, inter alia, the Child and Family Services Act, RSO 1990, Chap C11. The defendant, her Majesty the Queen in Right of the Province of Ontario is the provincial Government of Ontario and is responsible at law for the acts and omissions of the Raymond Lemay and the Honourable Tracy MacCharIes. The defendant, John Doe, is an individual who intentionally and without colour of right obtained an electronic file containing the names of 285 families involved with and disclosed said information without authorization. 14. 15. 16. 17. 18. 7 OVERVIEW OF THE CLAIM operates in the Lanark, Leeds and Grenville region and provided child and family welfare services with the approval of the Minister of Children and Youth Services pursuant to the Child and Family Services Act, RSO 1990 C11. In the course of proViding said services, requested, collected, and obtained the personal information of clients and families that it investigated and served. The personal information of 285 clients and subjects of investigations was contained in an electronic file forming part of a confidential statistical report (?report?) prepared for board of directors on new cases arising between April and November of 2015. The report was held electronically in a portal for board members. On or about April 18, 2016 a client of discovered that the report wasposted on Smith?s Falls Swapshop Facebook page and the Facebook page of Families United. The plaintiff pleads that John Doe illegally hacked the portal, which portal was not secure, and made said report public by posting it on Smith's Falls Swapshop Facebook page and/or other public websites thereby disclosing personal and highly sensitive information of the plaintiff and class members. CAUSES OF ACTION The plaintiffs plead the following causes of action: a. Negligence; b. Breach of fiduciary duty; 0. Breach of confidence; d. Negligent Misrepresentation; e. Intrusion upon seclusion; f. Breach of statutory duty, misfeasance, andior failure to act; 9. Breach of section 7 of the Canadian Charter of Rights and Freedoms. Particulars With Respect to Negligence, Breach of Fiduciary Duty, Breach of Confidence, Negligent Misrepresentation, Intrusion Upon Seclusion 19. The defendants: a. Owed the plaintiff and each class member a duty of care to ensure that their personal, confidential, and identifying information remained confidential and was not disclosed; b. knew that a breach of their duty would cause damage to the plaintiff and class members; and c. Knew, or ought to have known, that their substandard method of the maintenance of the confidential information and the security of same were such that it was inevitable, or at least probable, that the confidential information would likely be stolen or otherwise disclosed, in breach of their duty. 20. The defendants were required to meet a reasonable standard of care because: a. The confidential information communicated by the plaintiff and each of the class members was unique to the plaintiff and each class member; b. The confidential information communicated by the plaintiff and each class member or otherwise obtained by was of a highly sensitive nature such that its disclosure would be humiliating and distressing to the plaintiff and class members; 0. The confidential information pertained to the identity and personal interests of the plaintiff and each of the class members; and d. The confidential information was communicated to the defendants under circumstances where the plaintiff and each class member had no choice in the communication. 21. The defendants had a duty to protect the confidential information of class members, which duty they have negligently breached. The particulars of the defendants' negligence are as follows: a. They knew or ought to have known that the of their computer systems, if any, was inadequate to protect against breach and compromise by computer hackers and they failed to take any or sufficient steps to remedy same; 9 b. They employed computer personnel and/or computer contractors who lacked the necessary skills, education, training, and expertise in computer data and security and 0. They failed to warn the plaintiff and class members that their website lacked security and was therefore susceptible to breach and compromise by hackers. The defendants owed a duty of care to warn the plaintiff and class members of this lack of security and susceptibility to breach; d. They failed to take any or sufficient steps to ensure the security of their computer systems, including: the use of adequate firewallsup?to-date hardware, software and security protocols, and the protection against known vulnerabilities; a. They failed to heed warnings about the inadequate security of their computer systems and about how same could be breached and compromised by computer hackers; f. They failed to follow or in fact violated industry standards or similar guidelines that govern the safe storage of clients' personal information; 9. They failed to immediately notify the plaintiff, class members, and law enforcement agencies immediately upon discovery of the theft of class members' personal information thereby preventing class members from immediately taking steps to protect their financial interests; h. They failed to have security measures in place sufficient to prevent the theft of the plaintiff and other class members' personal information; i. They failed properly or at all to educate, instruct, and supervise their personnel on security conduct and procedures; j. They failed to have in place a computer security conduct and procedural protocol to be adhered to and followed by their personnel; and k. If they had in place a computer security conduct and procedural protocol, they failed to ensure same was adhered to and followed by their personnel. 22. The plaintiff and class members plead that the defendants are liable for the damages suffered by her and the class members resulting from loss and disclosure of personal information belonging respectively to her and to the class members. 23The plaintiff and class members provided their personal information to the defendants with a reasonable expectation that the plaintiff and class members? privacy would be maintained. Alternatively, the plaintiff and class members information was obtained without their knowledge. Through the defendants? wrongdoing, as aforesaid, the plaintiff?s and class members? personal information became available and was deliberately and unlawfully accessed by third parties, without the plaintiff?s and class members? knowledge or consent. By permitting third parties to access the plaintiff's and class members? personal information, the defendants breached the plaintiff and class members? common law and statutory rights to privacy, including, but not limited to the tort of intrusion upon seclusion and the Freedom of Information and Protection of Privacy Act, RSO 1990, 0 F31. - There is a clear statutory link between the defendants and the plaintiffs. The applicable statutes are the Freedom of Information and Protection of Privacy Act, RSO 1990, F31 and the Child and Family Services Act, RSO 1990 0 C11 ("applicable statutes?). The defendants collected, used, or disclosed the personal information of the clients in the course of its activities. The defendants are subject to the applicable statutes. Under the applicable statutes, the class members have a right to privacy and security of their personal information. The defendants are under a duty to protect their clients? rights to privacy as well as their personal information. The personal information of the class members has now been made readily available to any unauthorized third party who accessed the information, bought the information, or found the information posted on the Internet. The defendant did not protect the personal information of the class members with security safeguards appropriate to the sensitivity of the information. The breach of class members? privacy by the defendants constitutes a breach of the Freedom of Information and Protection of Privacy Act, RSO 1990, F31 for which damages may be awarded. The loss of the plaintiff?s and class members? personal and private information occasioned by the defendants? lax security measures was highly offensive to the plaintiff and class members, causing them distress, anxiety, shame, humiliation, and anguish. The defendant was 'in a fiduciary relationship with the plaintiff and class members by reason of their entrustment with personal information belonging to the class members that was of a 34highly sensitive nature. By virtue of this fiduciary relationship and the vulnerability of the plaintiff and class members, the defendants had a duty of care to use reasonable means to keep the said information strictly confidential and secure. The defendants unlawfully breached this duty. By virtue of the trust reposed in the defendant by the plaintiff and class members, there existed a special relationship between the parties giving rise to a duty of care owed by the defendants to the plaintiff. The defendants represented to the plaintiff and class members that any personal information provided by the plaintiff and class members to the defendants would be secure and protected from unauthorized access by third parties. The defendants ought reasonably to have foreseen that the plaintiff and class members would reasonably rely on that representation. The defendants? representations that information received by them from the plaintiff and class members was secure was untrue, inaccurate, or misleading. The representations were made negligently. The plaintiff and class members reasonably relied on these misrepresentations to their detriment. ParticUlars Respect to Breach of Statutory Duties . The plaintiff and class members plead and state that the defendants are agents of the Queen in Right of Ontario. . The plaintiff and class members plead that in disclosing the report or allowing it to be disclosed through negligence the defendants breached their duties under the Freedom of Information and Protection of Privacy Act, RSO 1990 F31, including, inter alia, section 42. . The plaintiff and class members plead that in disclosing the report or allowing it to be disclosed through negligence the defendants breached their duties under the Freedom of Information and Protection of Privacy Act, RSO 1990 0 F31, including, inter alia, sections 45 and 78. Particulars With Respect to Violation of Section 7 of the Charter of Rights and Freedoms The plaintiff and class members also plead and rely upon the Canadian Charter of Rights and Freedoms, 1982 (?the Charter?). 12 42. The plaintiffs specifically plead and rely on Section 7 of the Charter. 43. The plaintiffs plead, and the fact is, that the Charter applies to the Defendants by operation of Section 32(1)(b) of the Charter. 44. The plaintiff and class members plead that the defendants' failure to properly collect, store, transfer and maintain the personal and confidential information was the result of operational negligence, including a failure to implement adequate security policies at an operational level. This operational negligence exposed the class members to harm, which was a reasonably foreseeable consequence of the defendants? operational negligence. This loss and the resulting exposure constitutes a breach of the security of the person pursuant to Section 7 of the Charter. DAMAGES 45. As a result of the defendants' negligence, breach of duty, breach of confidence, breach of privacy, negligent misrepresentation, intrusion upon seclusion, breach of statutory duty, and violation of section 7 of the Canadian Charter of Rights and Freedoms, the plaintiff and class members have suffered damages including: a. Costs incurred to ensure personal security; b. Costs incurred to ensure financial security; c. Mental distress; d. Damage to reputation; e. Loss of employment; f. Reduced capacity for employment; 9. Out-of-pocket expenses; h. Humiliation, inconvenience, frustration, and anxiety; and i. Such further and other damages as counsel may advise. 46. The defendants? conduct as particularized above was high-handed, outrageous, reckless, wanton, entirely without care, deliberate, callous, disgraceful, willful and/or in complete disregard for the rights of the plaintiff and other class members, and as such renders the defendants liable to pay punitive damages. 47PREFERABLE PROCEDURE The identities of the class members will be easily ascertained using the defendants' records. All of the class members have in common that they suffered a loss as a result of the Defendants' failure to protect their personal and confidential information. Members of the class are numerous suchthat joinder of individual claims in a single action is not practical. Accordingly, a Class Proceeding is superior to other available methods for the fair and efficient adjudication of these issues. Additionally, because the damages suffered by individual members of the class may in some circumstances be relatively small, and likely identical, the expense and burden of individual litigation makes it impossible for such class members individually to address the wrong done to them. A Class Proceeding is the most efficient and economical method of proceeding. Once the identity of all the class members is known, they can be notified of the commencement of this Class Action through a mass mail out and through advertisements in newspapers and magazines, and such other methods for providing notice as this Honourable Court may require. The plaintiff and the class members shall request that the defendants pay for this notice program. This Class Proceeding is an appropriate method for the fair and efficient adjudication of the issues and of achieving fairness and justice without over-burdening the Court's system with a multiplicity of individual claims. The prosecution of separate actions would create the risk of conflicting decisions on the same facts and issues. REPRESENTATIVE PLAINTIFF AND COMMON ISSUES The plaintiff is committed to prosecuting this Class Proceeding and has retained competent counsel experienced in Class Action litigation. The plaintiff?s claim is typical of the claim of the other class members and on the common issues, she has no interest which is in conflict with other the class members. The plaintiff will fairly and adequately protect the interests of the other the class members. GENERAL The plaintiff pleads and relies on the Class Proceedings Act, 1992, 8.0. 1992 c. 6, as amended, the Freedom of Information and Protection of Privacy Act, R80 1990, 0 F31 ., Child and Family Services Act, R80 1990, Chap C11, Ministry of Community and Social Services Act, R80 1990, 0 M20, or similar legislation where applicable. 54. There is a real and substantial connection between the subject matter herein and the Province of Ontario for, inter alia, the following reasons: a. The defendants? conduct is governed by Ontario provincial legislation; b. The defendants carry on business in Ontario; and c. The plaintiff and numerous putative class members reside in Ontario. 55. If issue is taken with the service of documents upon any defendant, the Plaintiff and the class members seek leave to have service on any defendant or defendants be accepted as valid service against all defendants. THE PLACE OF TRIAL 56. The Plaintiff proposes that the Trial in this action take place in Toronto, in the Province of Ontario. Date: 4" Eric FLAHERTY LLP Barristers and Solicitors Toronto-Dominion Centre 95 Wellington Street West 10th Floor, Suite 1000 Toronto, ON M5J 2N7 SEAN A. BROWN (LSUC No. 42202W) TODD J. (LSUC No. 29984F) Tel: (416) 368-0231 Fax: (416) 368-9229 Solicitors for the plaintiff and the class members MM. -and- et al Court File No.: v~ gig??313 (03'0?3510 ONTARIO SUPERIOR COURT OF JUSTICE Proceeding commenced at TORONTO STATEMENT OF CLAIM FLAHERTY MCCARTHY LLP Barristers Solicitors 95 Wellington Street West, Suite 1000 Toronto, Ontario M5J 2N7 SEAN A. BROWN (LSUC 42202W) TODD J. MCCARTHY (LSUC 29984F) (416) 368-0231 (416) 368-9229 - FAX Solicitors for the Plaintiff and Class Members