Limited rights to discovery prior to certification did not lead to production of full database of affected users.

Once again, privacy class action lawyers have suffered a setback on their path to certification in privacy breach cases. This time, it’s in Karasik v. Yahoo Inc. where plaintiffs’ counsel were rebuffed in their attempt to obtain access to the database of all of Yahoo!’s sixteen million customers in Canada. The case is rooted in the infamous data breaches of 2013 – 2016 and a putative class action was commenced in 2016 in the Ontario courts. Prior to certification, the plaintiff brought a motion to compel the production of Yahoo’s Canadian user database.

The motion was made after Yahoo! Inc. delivered multiple affidavits on the hearing of the certification motion. One affidavit was a statement by Dr. Ghose, an expert in information systems. The expert had been given access to the database in order to prepare the affidavit. Prior to the cross-examination, the plaintiffs requested the production of the database and Yahoo! refused.

Prior to certification, production of records and evidence is generally limited. For documentary discovery at this stage, the judge required that the party making the request must demonstrate that the demand is proportionate, fair, and necessary for the certification motion.

In light of the significant evidence adduced by Yahoo! Inc, the judge concluded that the request was disproportionate to the needs of the certification motion. In addition, the plaintiffs did not successfully displace the burden of proving why the database would be necessary, other than a statement that the database would be necessary for cross-examination of the witness. There was no evidence to suggest that the database may be inaccurate. As a result, the plaintiffs’ motion was denied.