Background:
The appellants—G.D., Allan Smith, Christopher Holt, James Thom, and Brent Johnston—were former employees of the South Coast British Columbia Transportation Authority (TransLink). In 2020, a cyberattack on TransLink compromised their personal information, including social insurance numbers and banking details. The appellants sought to certify a class action, representing affected individuals whose personal data was breached.

Legal Issues:
The appellants claimed:

• Violation of Privacy under the British Columbia Privacy Act, arguing that TransLink failed to adequately safeguard sensitive personal information, violating their reasonable expectation of privacy.
• Negligence, asserting that TransLink had a duty of care to protect their data and breached that duty by failing to implement proper security measures.

The lower court dismissed the certification application, ruling that the claims were bound to fail because the privacy breach was caused by third-party hackers, not TransLink.

Appeal Decision:
The Court of Appeal found the claims were arguable and allowed the appeal, stating that TransLink might still be liable for failing to safeguard personal information. It was held that a breach of the Privacy Act and negligence claims were not bound to fail.

Costs:
The decision did not mention specific monetary awards or costs, as the court remitted the certification issue back to the trial court for further proceedings.