Canada privacy commissioners investigated into LifeLabs data breach

Nov/25/2024, Ontario and British Columbia Information and Privacy Commissioners (IPC) have published the 2020 investigation report into the LifeLabs privacy breach affecting millions of Canadians, after the Ontario Court of Appeal dismissed LifeLabs’ motion for leave to appeal the Divisional Court’s decision in LifeLabs LP v. Information and Privacy Commissioner of Ontario (IPC).

The joint investigation report concerning the 2019 cyberattack on LifeLabs’ computer systems was completed in June 2020. The investigation revealed that LifeLabs failed to comply with its obligations under Ontario’s Personal Health Information Protection Act and British Columbia’s Personal Information Protection Act. Specifically, LifeLabs did not take reasonable steps to safeguard the personal information and personal health information of millions of Canadians.

LifeLabs claimed that the joint investigation report could not be released to the public as it contained solicitor-client and litigation-privileged information. In 2020, the IPC and OIPC found that LifeLabs had not provided sufficient evidence to establish that the facts contained in the joint investigation report were protected by either privilege.

LifeLabs subsequently sought judicial review of the IPC and OIPC’s decision on its privilege claims, but the Divisional Court dismissed their application. The Court upheld the IPC and OIPC’s findings, ruling that privilege did not protect the facts related to the cyberattack, including those facts that must be determined or produced as part of LifeLabs’ legal obligations to investigate and remediate the privacy breach.  LifeLabs then sought leave to appeal the Divisional Court’s decision, which the Ontario Court of Appeal has now dismissed.

In Jul/3/2024, IVD giant Quest Diagnostics acquired 100% shares of LifeLabs for the price of CAD$1.35 billion including net debt.