Addressing the Harms of Data Security Breaches

Dr. Teresa Scassa’s work examines the intersection of law, technology, privacy, and AI regulation, with a particular focus on how privacy law responds to the challenges of a data-driven society. Her research considers the growing collection, use, and analysis of personal information, and the implications these practices have for individuals, groups, and communities. She is especially interested in how privacy protections can evolve as technologies, business practices, and legal interpretations continue to change.

A central focus of this work is the role of data breach litigation, particularly class action lawsuits, in shaping organizational behaviour. Dr. Scassa argues that while Canada’s privacy and data protection laws remain limited in important ways, class actions have become a powerful mechanism for raising the financial, reputational, and operational consequences of privacy failures. Because these lawsuits can be costly to defend and can attract public attention, they help push privacy and data protection higher on corporate risk agendas.

Her research also explores how future privacy law reform should balance access to legal remedies with manageable risks for organizations. While she initially expected to argue for a broader private right of action, her analysis led her to support a more carefully limited approach. The work offers insights for policymakers considering privacy law reform, while also highlighting the continuing importance of individual and collective legal action in seeking redress for privacy harms.

The work was published as a chapter of The Security of Self: A Human-Centric Approach to Cybersecurity, available as an open-access PDF.