Class-action lawsuit launched against Uber in Alberta over data privacy breach

The same law firm that won a Supreme Court decision granting the right to sue Facebook in a B.C. court has now launched a class-action lawsuit against Uber on behalf of Albertans whose personal information was compromised in the company's recently revealed data breach.

The international ride-hailing company admitted last week that personal information belonging to 57 million of its customers had been stolen in 2016.

Rather than disclose the breach, the company's new CEO said its former chief security officer — who has since been fired — agreed to pay the hackers who stole the data $100,000 to destroy it.

Uber's handling of the whole affair was "willful, reckless, wanton, negligent, callous and in total disregard for the security and rights of the plaintiff and class members," according to a statement of claim filed in Calgary this week by Branch MacMaster LLP.

None of the allegations in the statement of claim has been proven in court.

For now, the lawsuit names an Alberta woman who was affected by the data breach as the plaintiff and seeks to have the class action certified to apply to a broader group of people.

"When there is an alleged wrong on the part of a defendant that affects a great number of people, it's typically ideal for prosecution as a class action," said Luciana Brasil, a partner with Branch MacMaster LLP.

"If the court does certify the case, then everyone who is a member of the class, who fits in that definition, will be able to participate in the case," Brasil said.

"And the rule, actually, is that they automatically participate unless they take steps to exclude themselves."

Damages sought

In addition to a host of general damages, the lawsuit seeks special damages for costs related to credit counselling, compensation for the plaintiffs' lost time and income, as well as costs for credit monitoring and other services to protect them against identity theft.

The stolen data included customers' email addresses and mobile phone numbers as well as driver's licence numbers of some 600,000 Uber drivers in the United States.

The lawsuit alleges Uber had a duty to inform both customers and regulators in Alberta.

"At no time did Uber notify the Office of the Privacy Commissioner, the plaintiff, class members or other affected individuals," reads the statement of claim.

"Had it not been for recent media exposure of the Uber hack, class members would to this day remain unaware that their personal information had been compromised."

CBC News asked Uber for comment on Wednesday morning but has yet to receive a reply.

Uber has not yet filed a statement of defence.

Branch MacMaster LLP fought a high-profile, years-long battle on behalf of a B.C. woman who wanted to sue Facebook over its use of her name and photo in advertising for a company that she had "liked" on the social media service.

Facebook argued the case should be heard in a California court but the Supreme Court ruled in June that the matter could proceed in B.C.

Brasil expects it could take between six months and a year for an Alberta court to decide on class-action certification in the Uber case.