Notice of Proposed Settlement and Settlement Approval Hearing
Your legal rights may be affected.
Did you receive notice or have reason to believe that you may have experienced a privacy breach between and with respect to your personal or financial information while using a Government of Canada Online Account (Canada Revenue Agency’s “My Account”, “My Services Canada” account, or other online government accounts where the account is accessed using a GCKey)?
Why did I get this Notice?
All persons whose personal or financial information in their Government of Canada Online Account was disclosed to a third party without authorization between , and (the “Data Breach”) have the right to know about a proposed settlement that has been reached in Sweet v. His Majesty the King, Federal Court File No. T-980-20 (“Sweet Class Action”).
“Government of Canada Online Account” means:
- Canada Revenue Agency account;
- My Service Canada account; or
- another Government of Canada online account, where that account is accessed using the Government of Canada Branded Credential Service (GCKey).
On , the Federal Court certified the Sweet Class Action.
Obtain a copy of the Court’s order on the Sweet Class Action.
The proposed settlement of the Class Action must be approved by the Court to become legally binding. The proposed settlement is a compromise of disputed claims and is not an admission of liability or wrongdoing or fault by any of the Defendants.
A hearing to determine if the proposed settlement is fair, reasonable, and in the best interests of the Class Members (“Approval Hearing”) is scheduled to take place on , at 9:30 a.m. PT at the Federal Court in Vancouver, BC, and by videoconference via Teams. At the Approval Hearing, the Court will also determine whether the fees and disbursements sought by class counsel and the honoraria payments proposed for the current and former representative plaintiffs (discussed below under the heading, “What are the legal fee arrangements?”) are fair and reasonable.
The Plaintiff who filed the lawsuit on behalf of the Class Members is Todd Sweet (called the “Representative Plaintiff”).
The lawyers for the Class are Rice Harbut Elliott LLP (“Class Counsel”).
What is the Class Action about?
Among other things, the Plaintiff alleges that the Government of Canada breached class members’ privacy by not properly safeguarding confidential personal and financial information accessed electronically using various online government portals. The Plaintiff alleges that these inadequate safeguards allowed bad actors to access the online accounts of Canadians absent their consent, view confidential and private details and, in some cases, apply for CERB benefits. The Government of Canada denies that it did anything wrong.
The Plaintiff is asking the Court to approve the proposed settlement agreement reached between the parties.
Who are the Class Members affected by the proposed settlement?
The Class consists of:
All persons whose personal or financial information in their Government of Canada Online Account was disclosed to a third party without authorization between , and , including Excluded Persons.
“Government of Canada Online Account” means:
- Canada Revenue Agency account;
- My Service Canada account; or
- another Government of Canada online account, where that account is accessed using the Government of Canada Branded Credential Service (GCKey).
“Excluded Persons” means all persons who contacted Murphy Battista LLP about the CRA privacy breach class action, with Federal Court file number T-982-20 prior to .
If you meet the definition above, you are a Class Member. For greater clarity, even if you meet the definition of “Excluded Persons” in the definition above, you are a Class Member and your rights are affected by the proposed settlement.
You can also visit www.breachsettlementcanada.kpmg.ca/ for more information, send an email to breachsettlementcanada@kpmg.ca or call 1-833-724-6160.
Will I receive compensation from this settlement if it is approved?
Whether you are eligible to receive compensation and the amount of compensation you may be entitled to receive depends on whether you qualify to be a Class Member and on the particular circumstances of the Class Member and will be determined by reference to the terms of the settlement agreement and a settlement distribution protocol to be approved by the Court.
The Proposed Settlement Agreement contemplates payments as follows for Eligible Claimants:
- Access Claims: class members whose personal information was accessed (but not used for fraudulent purposes) are eligible to receive compensation for the loss of time and inconvenience incurred (if any) communicating with government officials, law enforcement officials or credit agencies addressing issues related to the Data Breach, at a rate of $20 per hour for a maximum of four hours ($80 maximum total compensation).
- Fraud Claims: class members whose personal information was accessed and used for fraudulent purposes – for example, if fraudulent applications were made in the class member’s name for CERB benefits, CESB benefits and/or EI benefits, or if payments for legitimate CERB, CESB or EI claims were diverted to an unauthorized bank account – are eligible to receive compensation for the loss of time and inconvenience incurred (if any) communicating with government officials, law enforcement officials or credit agencies addressing issues related to the Data Breach, at a rate of $20 per hour for a maximum of 10 hours ($200 maximum total compensation).
- Special Compensation Fund: class members who have incurred out-of-pocket expenses relating to the Data Breach are eligible to apply for reimbursement of up to $5,000. Eligible out-of-pocket expenses include unreimbursed fraud losses or charges, professional or other fees incurred in connection with identify theft, and fees or penalties resulting from credit freezes.
The precise amount of compensation may be reduced depending upon the number of claims that are made.
It is important to understand that not all class members will be entitled to payments under the Proposed Settlement Agreement. Only those class members who were victims of unauthorized access by third parties to Class Members’ personal information contained in Government of Canada Online Accounts during the Credential Stuffing Attack directed at the Government of Canada Online Accounts between and (the “Credential Stuffing Attack”), and whose personal information was accessed, or accessed and used for fraudulent purposes, are entitled to payments under the Proposed Settlement Agreement.
If you received an e-mail with this Notice from the Claims Administrator, KPMG, you are eligible to apply for a payment under the Settlement Agreement. You can verify whether you are an eligible claimant on or after .
Because only Class Members who were victims of the Credential Stuffing Attack are entitled to compensation under this Proposed Settlement Agreement, you should opt out of this action if:
- A. Either of the following applies to you:
- (1) You experienced a privacy breach to your Government of Canada Online Account(s) that was not connected to the Credential Stuffing Attack;
or
- (2) An unauthorized person acquired and used log-in credentials for your Government of Canada Online Account(s) as part of the Credential Stuffing Attack but the information in your Account(s) was not accessed or compromised.
(In either case, your name will not appear as an eligible claimant. You can verify whether you are an eligible claimant on or after .
AND
- (1) You experienced a privacy breach to your Government of Canada Online Account(s) that was not connected to the Credential Stuffing Attack;
- B. You wish to pursue an individual claim for compensation for any losses you claim.
For additional information on the process to opt-out and the consequences of doing so, see below under the heading, “What if I do not want to participate in the proposed settlement?”
If you do not wish to advance an individual claim, you do not need to opt out.
If the Court approves the proposed settlement, it will be binding on all Class Members who do not opt out of the proceeding.
How do I participate?
If you are a Class Member and you want to participate in the proposed settlement, if eligible, you do not need to do anything. You are automatically included as a Class Member unless you opt out of the applicable proceeding.
After the Court approves the proposed settlement, you will be notified in writing regarding how to apply for compensation.
You may contact Class Counsel if you would like to be notified when this information becomes available. Do not contact the CRA, ESDC or other Government of Canada department.
What if I do NOT want to participate in the proposed settlement?
If you do not want to participate in the proposed settlement and want to advance your own individual claim, or if you are not eligible and you wish to maintain your own individual claim against the Defendant, you may exclude yourself (“Opt Out”).
If you choose to Opt Out in order to maintain your own claim against the Defendant at your own expense, you may do so. Your individual claim will be subject to any applicable limitation periods. You will no longer be represented by Class Counsel.
In order to Opt Out, you must complete and sign an Opt-Out form and deliver it to the Claims Administrator (KPMG) by pre-paid mail, courier, fax or email no later than the Opt-Out deadline, which is .
The Opt-Out form must be emailed to optout.breachsettlementcanada@kpmg.ca, or faxed to 514-840-2390, or mailed or couriered to:
KPMG
600, de Maisonneuve Blvd. West
Suite 1500, Tour KPMG,
Montréal, Quebec H3A 0A3
Attention: Canada Privacy Breach Class Action Administrator
E-mail transmissions will be deemed to be received based on time stamp.
Mail submissions will be deemed to be received as of the date of the postmark. If the postmark is illegible, any Opt-out Form received by mail within 7 business days after the Opt-out deadline of , will be accepted, subject to verification by the Claims Administrator.
Courier submissions will be deemed to be received on the date that the courier marks the package as received from the Class Member. If the marking is illegible, any Opt-out Form received by courier within 7 business days after Opt-out deadline of , will be accepted, subject to verification by the Claims Administrator.
Fax transmissions will be deemed to be received on the date the fax is received.
What are the legal fee arrangements?
Under the terms of their retainer agreement with the Representative Plaintiff, Class Counsel will seek approval of a legal fee of 33.33% of the net settlement proceeds payable to the Class Members, plus disbursements, applicable taxes, and administration expenses. Class Counsel will also seek an honorarium payment of $5,000 for the Representative Plaintiff Todd Sweet, and of $1,500 each to Anne Campeau (who was originally the representative plaintiff in this class action) and Tanis Seminoff (who acted as representative plaintiff on behalf of those who meet the definition of “Excluded Persons” in the Class definition above).
Class Counsel fees, disbursements and any payments to the Representative Plaintiff are also subject to Court approval to ensure fairness.
What if I want to object to the proposed settlement or legal fee?
All Class Members have the right to let the Court know of any objection they have to the approval of the Proposed Settlement Agreement, claims administration and distribution protocol, Class Counsel fees, disbursements, administration expenses or the payment of an honorarium to one or more of the Representative Plaintiffs. To make an objection, you must deliver a letter or written objection by pre-paid mail, courier, fax, or email to the Claims Administrator (KPMG) no later than .
The written objection must be emailed to objection.breachsettlementcanada@kpmg.ca, or faxed to 514-840-2390, or mailed or couriered to:
KPMG
600, de Maisonneuve Blvd. West
Suite 1500, Tour KPMG,
Montréal, Quebec H3A 0A3
Attention: Canada Privacy Breach Class Action Administrator
E-mail transmissions will be deemed to be received based on time stamp.
Mail submissions will be deemed to be received as of the date of the postmark. If the postmark is illegible, any submission received by mail within 7 business days after the objection deadline of , will be accepted, subject to verification by the Claims Administrator.
Courier submissions will be deemed to be received on the date the courier marks the package as received from the Class Member. If the marking is illegible, any submission received by courier within 7 business days after the objection deadline of , will be accepted, subject to verification by the Claims Administrator.
Fax transmissions will be deemed to be received on the date the fax is received.
If a Class Member wishes to object, the following information must be included in the letter or written objection delivered to the Claims Administrator:
- The objector’s full name, current mailing address, telephone number and email address;
- A brief statement of the nature and reasons for the objection;
- A declaration that the person believes they are a member of the Class and the reason for that belief; and
- Whether the objector intends to appear at the Approval Hearing or intends to appear by counsel, and if by counsel, the name, address, telephone number, fax number, and email address of counsel.
For more information, go to the following website:
www.breachsettlementcanada.kpmg.ca/
You may also contact Class Counsel at classactions@rhelaw.com or via mail at:
Rice Harbut Elliott LLP
980 Howe Street, Suite 820
Vancouver, BC V6Z 0C8
This notice has been authorized by the federal court of Canada.