A B.C. Supreme Court judge has ruled that ICBC is liable for some of the damages stemming from an employee giving driver information to others — a move that resulted in a series of shootings and arsons.
The court said Candy Elaine Rheaume improperly accessed customers’ information and that the attacks could not have taken place without it.
“I find that ICBC is vicariously liable for Ms. Rheaume’s conduct and for any damages that may be awarded,” Justice Nathan Smith said in his Aug. 24 decision. “I find the use of the information for some illegal purpose was among the entirely foreseeable consequences of distributing the information to someone outside ICBC. It was also foreseeable that people being identified would be the targets of any illegal purpose.”
As a result of a 2011 police investigation, ICBC discovered an employee wrongfully accessed the files of at least 79 of its customers.
Between April 2011 and January 2012, houses and vehicles belonging to 13 people were targeted in arson and shooting attacks. All of the victims were identified because they had parked their vehicles at or near the Justice Institute of British Columbia (JIBC) in New Westminster.
The customers’ personal information had been sold to an associate of the United Nations Gang, who was responsible for arranging the attacks, the decision stated.
In 2017, Rheaume, a New Westminster resident, pleaded guilty in provincial court to unauthorized use of a computer.
She received a suspended sentence of nine months’ probation with an order to do 40 hours of community service. But that wasn’t the end of the case as victims sought compensation for the fallout from Rheaume’s actions.
Class-action suit
B.C.’s Court of Appeal ruled in May 2019 that a privacy class-action suit against ICBC by those targeted could proceed in the case.
The initial suit resulted from Rheaume selling the information of 79 people who had been at or near the JIBC — very often members of police forces. That personal information included names, addresses, driver’s licence numbers, vehicle descriptions and identification numbers, licence plate numbers and claims histories.
Rheaume gave the information to an acquaintance involved in the drug trade, and received $25 per name provided.
She pleaded guilty to a charge of fraudulently obtaining a computer service for illegally accessing customer information at work, the court said.
Representative plaintiff Ufuk Ari alleged he was told by ICBC in 2012 that on June 17, 2010, an ICBC employee viewed Ari's personal information "without an apparent business purpose.”
The information was used to target 13 people whose information had been handed over, the appeal court said.
Lawyer Guy Collette represented Ari in the class-action suit.
“This is a significant victory for all the individuals who had their personal information wrongfully accessed by ICBC’s employee and their families,” Collette said. “ICBC not only has to compensate all of the individuals whose files were unlawfully accessed and everyone residing with them at the time of the breaches, but additional compensation is awarded for property damage, and physical and psychological injury sustained due to the privacy breaches.”
ICBC admitted Rheaume, a claims adjuster, used its databases to access personal information of some of its customers without authorization and in a way that exceeded the purpose of the database access she was given as part of her job. ICBC admitted that she sold information that was used in the attacks.
The court said ICBC admitted Rheaume sold some information she obtained to Aldorino Moretti and some of that that information was used by Vincent Eric Gia-Hwa Cheung, Thurman Ronley Taffe and others to carry out the attacks.
“There was a direct connection between the information supplied by Ms. Rheaume and the attacks carried out by Mr. Cheung. He could not have carried out the attacks without it,” Smith said, adding ICBC is vicariously liable for general damages and pecuniary damages caused by Rheaume’s actions.
“The attacks were not unforeseeable intervening acts, and liability extends to the property damage that the subclass members suffered as a result of the attacks,” the judge said.
Smith directed lawyers to schedule case management meetings for assessment of class-wide damages and appropriate procedures for determination of individual issues.
In a statement to Glacier Media, ICBC said it is reviewing the decision to determine next steps.
“We took immediate action when the privacy breach related to this case was uncovered in 2011, including terminating the employment of the person involved for inappropriately accessing customer information,” the statement said. “ICBC takes the protection of customers’ personal information very seriously, and our actions in this matter make that evident.”
