A B.C. court has ordered ICBC to pay $15,000 in damages to each of nearly 80 people whose personal information was accessed by a former employee and sold to a criminal group more than a decade ago.
The award concluded a long-running class-action lawsuit related to the so-called Justice Institute attacks, in which people associated with the school that does police and security training were targeted with firebombings and shootings in 2011 and 2012.
The lawsuit was launched after police discovered in 2011 that former ICBC claims adjuster Candy Rheaume had accessed 79 people’s files, including licence plate numbers and addresses. She sold some of that information, which was ultimately used to target the homes and vehicles of 13 people who had parked near the school.
Rheaume was fired and ultimately pleaded guilty to unauthorized computer use, but in 2022, the B.C. Supreme Court ruled that the public insurer was still liable for her actions.
Rheaume believed the information was being used by a man running a grow-op to check if police were watching him, according to court documents. Instead, the man passed it on to Vincent Eric Gia-Hwa Cheung, who orchestrated the Justice Institute attacks as a part of a “drug-induced paranoid belief that he was being targeted and controlled” by the school.
Get daily news
The class-action suit sought damages of $25,000 per person. ICBC wanted to pay $500 per class member, with any claims to greater awards to be raised on an individual basis, based on the argument that the data of every person was accessed not sold or used improperly.
On Monday, B.C. Supreme Court Justice Nathan Smith ruled the $15,000 award, less a 35 per cent lawyer fee, was appropriate for those whose data was accessed, ruling the breach was “serious.”
Smith noted that it remained unclear how many people had their information sold, though Rheaume admitted it was at least 45 customers.
But the judge found the risk existed for everyone whose data was accessed and that none of them have any way of knowing if it was passed on to to others. Indeed, he noted, the man who bought it from Rheaume did just that.
“It was motivated by personal financial gain and resulted in distribution of information to third parties, including criminals,” Smith ruled. “Its impact was not limited to a single individual, and the full extent of the distribution of information and the risks it created at the time will never be known.”
He added the court had to stress the need to protect the public’s private information and enforce consequences for the failure to do so.
“I find that public purpose and need for accountability is of particular importance at a time when large organizations—public and private—routinely collect and electronically store vast amounts of personal information about everyone they deal with,” Smith ruled.
“The people who provide that information often have no meaningful choice about whether to do so. In this case, anyone in British Columbia who wishes to own or drive a motor vehicle must provide information to ICBC.”
In a statement, ICBC said it was reviewing the court decision and couldn’t comment further on it.
But it said it had taken immediate action in the case back in 2011, including firing Rheaume, and had since updated its privacy processes to further safeguard customer information.
Rheume ultimately received a suspended sentence for her role in the incident, with nine months probation.
Cheung pleaded guilty to 18 of 23 charges against him and was sentenced to 13.5 years in prison in 2016, while a man he hired as a part of the plot was sentenced to time served.