In early 2020, as Canadians faced financial challenges during the COVID-19 pandemic, multiple data breaches targeted the Canada Revenue Agency (CRA) and My Service Canada accounts. These breaches exposed personal and financial details, including Social Insurance Numbers, tax records, and banking information, leading to cases of identity theft and fraud.
The CRA Privacy Breach Class Action Lawsuit alleges that the government failed to safeguard sensitive data effectively. This article explores the origins of the case, the claims made by those impacted, and the broader consequences of this significant breach of privacy.
Origins of the CRA Privacy Breach Class Action
The Class Action Lawsuit
The class action was initiated to address the unauthorized access to sensitive information stored in CRA and My Service Canada accounts. Todd Sweet, the representative plaintiff, helped establish that the breach impacted a large group of individuals, justifying collective legal action.
Represented by Rice Harbut Elliott LLP, the case is moving forward as a certified class action. The lawsuit encompasses all individuals whose personal or financial data was disclosed to unauthorized parties through their Government of Canada Online Accounts on or after March 1, 2020. This includes compromised CRA accounts, My Service Canada accounts, and accounts accessed via the GCKey platform.
The case is currently in the evidence-gathering phase, with notifications being sent to potential class members and preparations underway for hearings or settlement discussions.
Who Is Receiving the CRA Notice?
Affected Groups
The notice is being issued to individuals whose information was compromised in the breaches that began in March 2020. The affected groups include:
- Users of CRA My Account whose personal or financial information was accessed without authorization.
- My Service Canada account holders who experienced unauthorized access to their accounts.
- Users of other Government of Canada accounts accessed via GCKey that were affected by the breaches.
Automatic Inclusion
Individuals meeting these criteria are automatically included in the class action unless they choose to opt out. Opting out allows individuals to pursue separate legal claims if they wish.
What to Do If You Receive the Notice
Steps to Take
If you have received a notice related to this class action, it is important to:
- Carefully review the notice to understand its implications.
- Decide whether to remain part of the class action or opt out.
- Follow any specific instructions provided, such as submitting forms by stated deadlines.
- Contact the law firm handling the case if you have questions or need additional information about your rights.
What Is a Notice of Clarification?
Purpose of the Notice
In class action lawsuits like the CRA privacy breach case, a Notice of Clarification is issued to ensure affected individuals understand the key details of the lawsuit. This document outlines:
- The reasons for the lawsuit and its legal foundation.
- The criteria defining who is included in the class.
- The rights and options available to class members, including the ability to participate or opt out.
- Potential outcomes and remedies sought, such as compensation for damages.
The Notice of Clarification ensures that all impacted individuals are informed about the class action’s purpose and their role within it, enabling them to make knowledgeable decisions about their involvement.
Conclusion
The CRA Privacy Breach Class Action underscores the importance of robust data protection and the consequences of inadequate security measures. For those affected, understanding their rights and options within this legal process is essential as the case progresses.
