The B.C. Supreme Court recently certified a class action proceeding against Hyp3R Inc. (“Hyp3R”),[1] a U.S.-based marketing firm that collected Canadian Instagram users’ personal information in breach of the platform’s policies. The Court also ordered Hyp3R to pay more than $24 million in damages.
Background
Instagram permits users to share posts, including texts, photos, and videos, with other members and the public. It makes available tools that allow third parties to interact with Instagram, but requires third parties to adhere to certain policies, including the prohibition of “scraping” or improper collection and retention of users’ personal information.
In April of 2018, Instagram made changes such that it would not be possible to access or collect all public posts from specific locations or collect and retain users’ Instagram stories through those tools. After these changes were made, the defendant Hyp3R carried out “scraping” of personal information from users’ profiles on Instagram up until about August 2019, at which time Instagram announced that Hyp3R’s actions were in violation of its policies and that it was removing the company from its platform.
The plaintiff sought to hold Hyp3R accountable for this conduct to Instagram users in Canada (other than Quebec). It was alleged that Hyp3R’s actions constituted a breach of the privacy statutes of four provinces as well as the tort of intrusion upon seclusion (in the remaining provinces and territories).
The Decision
The Court noted that the plaintiff had served Hyp3R with the notice of civil claim, but that Hyp3R had failed to respond, resulting in the plaintiff obtaining a default judgment for damages to be assessed. After reviewing applicable case law, the Court concluded that it was appropriate to proceed with certification and determination of the issues notwithstanding the defendant’s default. The Court went on the address the following matters:
Certification
The plaintiff argued that all of the certification requirements for a class action were met. The Court accepted this argument for the reasons set out below…
EU court lowers requirements for imposing fines for data protection breaches
The European Court of Justice issued a landmark ruling on Tuesday (5 December) that is set…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
