Law firms line up class action over NWT health privacy breaches

Three law firms are filing the equivalent of a class action against the NWT government over recent health privacy breaches, one of the lawyers involved confirmed.

Steven Cooper, partner at Cooper Regel, said the firms are currently representing “tens of residents” whose health information may have been exposed.

In May 2018, an unencrypted laptop potentially containing the health information of more than 30,000 NWT residents was stolen in Ottawa.

That fall, health documents relating to 134 residents were found at Fort Simpson’s dump.

“The claim is seeking damages on two fronts,” Cooper told Cabin Radio. “Principally among all of this – though we will be seeking individual damages – we will be seeking punitive damages … for the GNWT to have the necessary incentive to ensure this doesn’t happen again.

“The GNWT just doesn’t get it. They are not doing what is necessary to protect some of the most critical personal information that a person may be forced to disclose.

“Whatever they are doing is not working. This is not a one-off. Leaving a laptop with critical information in a vehicle is absolutely insane.”

In theory, given the territory has already admitted around three-quarters of its residents had some form of information on the stolen laptop, tens of thousands of people are in some way linked to the prospective suit.

The suit will take the form of a representative action, which shares some features with a class-action suit.

The territorial government told Cabin Radio it had yet to receive notice of the firms’ claim and would not comment.

In a June 2018 apology to residents following the laptop incident, the NWT’s Department of Health and Social Services said there was no evidence, at the time, that the unencrypted data had been accessed or used since the theft.

The department promised to ensure all its devices were encrypted, provide additional training for staff, and strengthen departmental privacy policies.

When unrelated health documents subsequently turned up at Fort Simpson’s dump, the territory’s health authority launched an investigation. The documents ranged in date from the 1980s to 2010. How they arrived at the dump remains unclear.

Cooper Regel said it wants to hear from residents who have been affected, particularly those who received a letter from the NWT’s privacy commissioner suggesting their information was involved in a breach.

Cooper, the partner, compared the action to the lawsuit in which Bell Mobility was forced to pay $1 million having charged northerners a fee for a 9-1-1 service that did not exist.

Range of class actions

Cooper Regel, which is working with Guardian Law and James H Brown and Associates, has involvement in a number of ongoing class actions or similar suits.

In December last year, the firm was one of two launching a class action against the RCMP alleging negligence and discrimination in the North.

It is also involved in a forced sterilization suit in Alberta, a suit against the federal government over the operation of “Indian hospitals,” a claim regarding experiments conducted on the people of Igloolik and nearby communities in the 1960s and 70s, and a possible class action over alleged “discrimination in the provision of medical services against Inuit, First Nations, and Métis people” across Canada.

Cooper could not immediately specify what value the health privacy suit might assign to the proposed punitive damages and the damages sought for each individual, saying the figures at the start would be “arbitrary” as the firms do not yet know the number of people affected.

“We’ll be looking for compensation in monetary terms as well as potential credit monitoring and that sort of thing, because you can imagine the sort of information that’s contained in health records – probably far more information than you would find in a banking disclosure or a more generic Facebook breach or Amazon breach,” said Cooper.

“When you look at the numbers, I understand that in excess of 80, maybe 90, maybe 100 percent of people that went to see a doctor in the Northwest Territories during the relevant period may have been affected.

“This will, I presume, include people who simply were visiting or temporary residents in the territory and went to see a doctor or ended up in the hospital. So we could be talking about international travellers, we could be talking about people from other parts of Canada.”

Various kinds of health information were believed to form the Fort Simpson breach. The stolen laptop contained basic information like names, dates of birth, healthcare card numbers, and home community data for most patients, with more detail on infectious diseases and conditions for some.

Class actions are not known for their speedy progress through the courts. The Bell Mobility settlement, for example, took nine years.

“Once the claim is filed, in the next three to four months, I expect to have the representative action recognized by the court … after that’s done, it really depends on whether the government wants to sit down with us or not,” said Cooper.

“It’ll take at least another six months to a year to get to the point where we’re actually thinking about trial time. Realistically, if a trial does proceed, we’re probably talking a few years.”