When Hackers Strike: The Liability of Reckless Record Holders for Intrusion Upon Seclusion

• Author: Michael A Crystal and Jacob Medvedev
• Pages: 105-126

105

When Hackers Strike: The Liability of Reckless Record

Holders for Intrusion Upon Seclusion

Michael A Crystal and Jacob Medvedev

: The Ontario Court of Appeal’s decision in Jones v Tsige estab-

lished the intentional tort of intrusion upon seclusion, colloquially

known as invasion of privacy. Viewed as a powerful tool for the vindica-

tion of privacy rights, the tort has become a common cause of action in

the class-action context. It has been generally accepted that conf‌idential

record holders, like banks and hospitals, will be held vicariously liable

for intentional privacy breaches committed by their employees. However,

select critics have opposed holding record holders liable when third party

hackers gain unauthorized access to conf‌idential records. The resulting

gap in privacy right coverage leaves some plaintif‌fs, who have nonethe-

less had their privacy violated, without the necessary legal recourse to

obtain adequate compensation. To address this gap, we argue in favour of

holding record holders liable for intrusion upon seclusion if their reckless

conduct contributed to the occurrence of the third party privacy breach.