While class actions premised on privacy claims have gained some renewed traction in recent years, courts continue to show a willingness to take a hard look at these actions and refuse certification in appropriate cases. Three recent decisions demonstrate the challenges plaintiffs have faced in establishing a viable cause of action or providing some basis in fact of an identifiable class, common issues related to the alleged breach of privacy, or that a class action is the preferable procedure.
Cleaver v. The Cadillac Fairview Corporation Limited
The plaintiff's certification application in Cleaver v. The Cadillac Fairview Corporation Limited, 2025 BCSC 910 failed on the common issues, identifiable class and preferability criteria. The plaintiff alleged that the defendant "secretly mined biometric data from unsuspecting visitors" through wayfinding directories installed in Canadian shopping malls, breaching the privacy rights of all people who had viewed these wayfinding directories throughout the class period.
In 2020, the Privacy Commissioner issued a report finding that the defendant had collected "biometric information" (without retaining the original images) and that there was a "serious possibility" that an individual could be identified when that information was combined with other data, including location and timestamp. Consistent with Federal Court case law, the British Columbia Supreme Court found that the report was admissible only for context, but not as evidence that the defendant had collected images and biometric information without consent.
The Court preferred the evidence of the defendant's expert, who opined that the way the biometric data was processed and embedded (converted to a string of numbers) meant it could not be used to identify specific individuals, and that it was not possible to "reverse engineer" facial images. The Court disregarded the plaintiff's evidence as to how the impugned software worked in large part because neither of the plaintiff's experts had properly examined it. Beyond mere speculation, there was no basis in fact that class members would be able to self-identify from the data collected by the defendants, which was fatal to the requirement that the plaintiff establish an "identifiable class."
Because there was no evidence that the defendant recorded any facial images, there was no basis in fact for the existence of the proposed common issues, nor was there a rational relationship between the class definition and the common issues. These shortcomings led the Court to find that the proposed class action was not the preferable procedure and certification was denied.
Donegani v. Facebook Inc.
The lack of an identifiable class was also an insurmountable hurdle for the plaintiffs in Donegani v. Facebook Inc., 2025 ONSC 6020 The plaintiffs brought claims on behalf of a proposed class consisting of all Facebook users in Canada, excluding Quebec, whose Facebook friends downloaded and/or used a particular list of apps (Affected Friends), and any Facebook friends of Affected Friends. The plaintiffs alleged that Facebook misused proposed class members' data by making their data available to third parties, including messaging applications and device integration partners, without class members' consent.
In an earlier decision (part one of a two-part certification decision), the Court found some basis in fact for the common issues that Facebook had breached privacy legislation by failing to obtain meaningful consent to disclose class members' data. However, there was no evidence that Facebook had shared any one class member's data, and thus no basis in fact for the claims that Facebook had breached its contracts with class members or invaded class members' privacy. The Court took issue with the proposed class definition as it suffered from "technical challenges" and lacked precision.
In part two of the certification decision, the Court rejected the plaintiffs' revised class definition and their proposal to develop a "Master Class List" (based on information to be provided by the defendant) that would subsequently be narrowed and de-duplicated. The Court refused to certify the proposed class action because, among other problems, there was no guarantee that the "Master Class List" could be created, and it would be impossible for Facebook users to determine objectively whether they fell within the class based on the proposed definition alone. Instead, individual inquiries would be required to determine whether a particular class member was included in the "Master Class List", and thereafter to determine whether their data had been shared without their consent.
The Court also found that plaintiffs had not put forward any evidence that class members had suffered any compensable loss (e.g., fees charged, out-of-pocket expenses or damages for severe mental distress), leaving only claims for nominal damages. Without compensable loss, certifying the action would not meet the goal of promoting access to justice and would be a waste of judicial resources.
RateMDs Inc. v. Bleuler
In RateMDs Inc. v. Bleuler, 2025 BCCA 329, the British Columbia Court of Appeal overturned the lower court's certification of a proposed privacy class action, finding that the novel privacy claims were bound to fail. The plaintiff had alleged that use of health professionals' names and professional contact information to create profiles about them on its website, under which patients could post reviews, was a violation of the health professionals' privacy and an unauthorized use of their names for commercial purposes. The Court of Appeal held these claims were bound to fail, even assuming the pleaded facts to be true, because the information at issue was not information in which the proposed class members had a reasonable expectation of privacy.
The Court of Appeal also held that, although the defendants profited from the website, this was not in itself sufficient to make out the statutory tort of unauthorized use of a name for the purpose of advertising or promoting the sale of services. Here, the names were not being commercially exploited by the defendants for the purpose of increasing sales. Rather, the names were being used to provide information of value to the public. The situation was no different than any other for-profit website collecting and disclosing reviews about those who provide professional services to the public.
Significantly for defendants, Bleuler reaffirmed British Columbia courts' commitment to screening out claims that are bound to fail at certification, even if they are novel, reiterating that the "novelty of a claim is not a basis in itself to permit it to proceed to trial".
Looking Forward
Looking forward, these cases reaffirm the courts' commitment to their gatekeeping role at certification and illustrate that the factual context is often critical to the defence of proposed privacy class proceedings. An assessment of whether the alleged violation is legally tenable, what information is at issue, who is proposed to be in the class, and whether and how they are identifiable are some of the central questions the court must address at certification. If these types of questions cannot be suitably answered, certification should be refused.
If you have further questions about this update or class action litigation more generally, please contact the authors or a member of the Class Action Litigation group.
