Court blocks class action against bankrupt computer firm, citing 'unreliable' proof of data breach

A Vancouver software engineer's proposed class action suit alleging a massive personal data breach will not be allowed to proceed against the trustee for bankrupt computer retailer NCIX.

Late last month, a B.C. Supreme Court master described the various pieces of Kipling Warner's evidence against the defunct company as "inherently unreliable" and "bare allegations" not supported by fact.

Master Sandra Harper declined to grant Warner leave to sue the Bowra Group, the retailer's trustee in bankruptcy.

"Mr. Warner has not satisfied even the relatively low threshold required to justify the court exercising its discretion in favour of leave," Harper wrote in her Dec. 27 judgment.

Formally known as Netlink Computer Inc., NCIX was a B.C.-based firm that filed for bankruptcy on Dec. 1, 2017.

Warner drew up a proposed class action suit this fall, naming as defendants, NCIX, its landlord and the company responsible for auctioning off the computer firm's old equipment.

As a former NCIX customer, Warner says he gave the company his name, address and debit and credit card details. He claims the firm failed to properly encrypt that information and the personal data of at least 258,000 people.

Warner alleges that some of the NCIX servers containing private information were auctioned off to criminals, including identity thieves.

Lawyer disappointed by outcome

Because NCIX is bankrupt, the claim against it was stayed automatically. In situations like this, it's possible to sue the trustee instead, but only with the express leave of the court.

That extra step is necessary "to protect officers of the court, including trustees, from baseless, frivolous or vexatious lawsuits which would otherwise interfere with the due administration of the bankrupt's estate," Harper wrote.

In this case, she said, there simply wasn't enough admissible evidence to allow the claim to proceed.

Warner's lawyer, David Klein, said he was disappointed with the judgment and would be conferring with his client and co-counsel about whether to appeal.

No matter the outcome of that discussion, however, Klein said it's his intention to proceed with the proposed class action against the auctioneer and NCIX's landlord.

"People's privacy has been compromised. They have a legitimate claim and they should be allowed to pursue that claim," Klein said.

No charges in police probe

Richmond RCMP opened an investigation into the alleged data breach in September, but that ended without police recommending any charges, according to Harper's judgment.

The proposed lawsuit was filed after questions about an alleged breach began circulating in response to a post on the cybersecurity website PrivacyFly.

Author Travis Doering wrote that he'd met with a man named "Jeff" who claimed to be selling old NCIX hardware and offered information on millions of transactions. Doering alleged he'd seen customers' financial information and the personal tax details of former NCIX employees.

Doering filed an affidavit on behalf of Warner, but "it is very difficult to extract any admissible and reliable evidence" from that document, according to Harper.

That's largely because Doering admitted he didn't believe what "Jeff" told him about where the computers had come from.

'Belief' is not a fact

Warner also presented evidence information taken from blog posts and YouTube videos created by two people who said they attended the NCIX equipment auction. However, Warner did not obtain legal affidavits from those two people.

That evidence, according to Harper, is "inherently unreliable" and inadmissible because it amounts to double hearsay.

Finally, Warner submitted an affidavit swearing his belief that customer databases were mishandled during bankruptcy proceedings under the supervision of the trustee.

But, "Mr. Warner's 'belief' is not a fact," Harper wrote. "Further, bare allegations are not material facts."

In declining to grant Warner leave to sue, Harper also ruled he won't be allowed to reapply using a revised claim, saying he "has not acknowledged any deficiencies" in his evidence.

Another proposed class action over the alleged data breach has also been filed on behalf of former NCIX employees.