No Action for Theft of Personal Information Without Loss

In Canada, as in many other jurisdictions, data breaches that pose a real risk of harm to individuals must be reported. Apart from class action liability, data breaches can trigger large fines and important reputational consequences. While the recent court decisions in Canada—where theft of personal information does not by itself entitle the victim to damages—are favorable for firms that suffer data breaches, firms still need robust cybersecurity safeguards to lessen their changes of being hacked, as data breaches have other costly consequences.