The sign for a LifeLabs location in North Vancouver, B.C., pictured in October 2021. The company said most of its customers affected by the data breach were in British Columbia and Ontario. (Darryl Dyck/The Canadian Press)
Canadians who joined the class-action lawsuit against LifeLabs Inc. are now receiving their compensation in the form of cheques and e-transfers. The financial services firm KPMG, responsible for administering the claims, announced on the class-action website that over 900,000 valid claims were filed.
Due to the high volume of claims, each claimant will receive an e-transfer of $7.86. Those opting for a cheque will get $5.86 after a $2 processing fee is deducted.
The class-action lawsuit was initiated following a significant data breach in 2019, where hackers gained access to the personal information of up to 15 million customers. The lawsuit claimed that LifeLabs failed to adequately protect sensitive health information.
Craig Jones, a law professor at Thompson Rivers University in Kamloops, British Columbia, noted that the judge approving the settlement found no evidence that the stolen data was misused or that any claimants suffered harm. The judge also assessed that the likelihood of success at trial was low, and thus deemed a settlement ranging between $4.9 million and $9.8 million as appropriate.
When the settlement was approved last fall, potential claimants were initially informed they could receive about $50, up to a maximum of $150, before legal fees and taxes were deducted. However, the actual amount depended on the total number of claims filed. The unexpectedly high number of claims significantly reduced the compensation amount per person.
Jones emphasized that this outcome does not reflect a failure of the class-action system. He explained that class actions serve dual purposes: providing compensation where harm has occurred and deterring companies by penalizing inadequate protections. Although no direct harm was proven in this case, the settlement serves as a deterrent to encourage better data security practices in the future.
Most of the affected LifeLabs customers were from Ontario and British Columbia. In response to the breach, privacy commissioners from these provinces ordered LifeLabs in 2020 to enhance their data protection measures and reduce the amount of personal information they collect from customers.
The LifeLabs data breach and subsequent class-action lawsuit highlight the importance of robust cybersecurity measures for companies handling sensitive personal information. Although the financial compensation for claimants was lower than initially expected, the case underscores the need for companies to take data security seriously to prevent similar incidents in the future.
