Canada revenue agency faces class action lawsuit over 2020 data breaches

In early 2020, during heightened financial stress for many Canadians due to the COVID-19 pandemic, a series of data breaches compromised thousands of Canadians’ personal and financial information. These breaches impacted the Canada Revenue Agency (CRA) and My Service Canada, exposing sensitive details such as Social Insurance Numbers, tax records, and banking information. Hackers subsequently used the stolen data to commit fraud and identity theft.

The CRA Privacy Breach Class Action Lawsuit alleges that the government failed to adequately protect its data. This lawsuit, now certified as a class action, consolidates the claims of those affected into a single legal proceeding. The representative plaintiff, Todd Sweet, supported by the law firm Rice Harbut Elliott LLP, argues that the breaches were a significant violation of privacy and that the government’s security measures were insufficient.

This class action includes all individuals whose personal or financial information was accessed without authorization from their Government of Canada Online Accounts after March 1, 2020. This encompasses compromised CRA My Account users, My Service Canada account holders, and other accounts accessed using the Government of Canada Branded Credential Service (GCKey). Individuals affected by these breaches are automatically included in the class unless they opt-out.

The legal process is ongoing, with steps including collecting evidence, notification of potential class members, and scheduling hearings or settlement discussions. Notices are being distributed to all impacted individuals, detailing their inclusion in the lawsuit and their rights and options.

Recipients of the notice are advised to read the notice thoroughly to understand the lawsuit’s implications, decide whether to remain part of the class action or opt-out to pursue independent legal action, and follow any provided instructions, such as submitting required forms by specified deadlines. Individuals are encouraged to contact the law firm managing the case for further questions or clarifications.