



COURT OF APPEAL FOR ONTARIO

CITATION: Family and Childrens Services of Lanark,
    Leeds and Grenville v. Co-operators General Insurance Company, 2021 ONCA 159

DATE: 20210315

DOCKET: C68449 and C68460

Hoy, Brown
    and Thorburn JJ.A.

BETWEEN

Family and Childrens
    Services of

Lanark,
    Leeds and Grenville

Applicant (Respondent)

and

Co-operators
    General Insurance Company

Respondent (Appellant)

AND BETWEEN:

Laridae
    Communications Inc.

Applicant
    (Respondent)

and

Co-operators
    General Insurance Company

Respondent (Appellant)

AND BETWEEN:

Co-operators
    General Insurance Company

Applicant (Appellant)

and

Laridae
    Communications Inc.

Respondent (Respondent)

Danielle Marks, Kenneth Gerry and Robert Dowhan for the
    appellant, Co-operators General Insurance Company

Timothy Hill and Brian Chung for the respondent, Laridae
    Communications Inc.

David Boghosian for the respondent, Family and Childrens
    Service of Lanark, Leeds and Grenville

Heard: November 13, 2020 by video conference

On appeal from the judgment of Justice Andra
    Pollak of the Superior Court of Justice, dated May 8, 2020, with reasons
    reported at 2020 ONSC 2198.

Thorburn
    J.A.:

OVERVIEW

[1]

In April 2016, someone hacked into a
    password-protected portal managed by the respondent Family and Childrens
    Services of Lanark, Leeds and Grenville (FCS). The hacker took a confidential
    report containing details about the case files and investigations of 285 people.
    A hyperlink to the report was posted on two Facebook pages.

[2]

Both FCS and Laridae Communications Inc.
    (Laridae) were insured by Co‑operators General Insurance Company
    (Co-operators).

[3]

FCS and Laridae claim Co-operators has a duty to
    defend against two claims: (i) a $75 million class action brought against FCS
    in which the representative plaintiff alleges that the leaked document
    contained defamatory material, and that FCS was negligent in securing its
    website; and, (ii) a third-party claim in that proceeding brought by FCS
    against Laridae for negligence and breach of contract.

[4]

Co-operators denies having any duty to defend
    FCS or Laridae, relying on policy exclusion clauses in the policies that
    exclude claims arising from the distribution or display of data by means of an
    internet website.

[5]

FCS, Laridae, and Co-operators brought
    applications to interpret the policies under Rule 14.05(3)(d) of the
Ontario
    Rules of Civil Procedure
, R.R.O. 1990, Reg. 194.

[6]

In her endorsement, dated May 8, 2020, the application
    judge found that the Co-operators had a duty to defend both claims. She held
    that:

a)

the applicability of the data exclusion clauses
    was a novel interpretation issue and accordingly the duty to defend should
    only be denied on a full record, not on an application;

b)

the data exclusion clause does not exclude
    Co-operators duty to defend the class action;

c)

the data exclusion clause does not exclude
    Co-operators duty to defend the third-party claim against Laridae; and,

d)

neither FCS nor Laridae has any reporting
    obligations to Co-operators, in light of the conflict of interest between the
    two insured and the insurer.

[7]

In these companion appeals, Co-operators claims these
    conclusions were wrong. Co-operators argues that the duty-to-defend issue can
    properly be determined on the application, and that the data exclusion clauses
    preclude coverage of both the class action against FCS and the third-party
    claim brought by FCS against Laridae. It also argues that, even if there was
    duty to defend, Co‑operators would have the right to participate in the
    insured parties defences.

[8]

For the reasons discussed below, I would allow
    the appeal. The existence of a duty to defend in this case can be resolved by
    application. Co-operators has no duty to defend FCS in the class action
    proceeding, and no duty to defend Laridae in the third-party claim. Even if
    such a duty did exist, it would not deprive Co-operators of its right to
    participate in the defence, including receiving reports from counsel.

[9]

Below, I set out (i) the terms of the contract
    between FCS and Laridae; (ii) the claims made in the class action against FCS,
    and by FCS against Laridae in the third-party claim; and (iii) Co-operators
    refusal to defend the claims. I then outline the relevant policy provisions, and
    summarize the application judges decision. Finally, I analyze and provide my
    conclusions regarding: (i) whether the duty to defend can be denied on the
    basis of the material before the application judge; (ii) whether Co-operators
    has a duty to defend; and (iii) whether, if Co‑operators had a duty to
    defend, it would have the right to participate in the defence.

BACKGROUND

[10]

FCS was a childrens aid society, authorized
    under the
Child and Family Services Act
, R.S.O. 1990, c. C.11 at the
    relevant times.
[1]
FCS serves several communities in Eastern
    Ontario. As an authorized childrens aid society, one of FCSs functions is to investigate
    allegations of child abuse.

(1)

The Contract between FCS and Laridae

[11]

In August 2015, FCS issued a request for
    proposals for communication services, in which it asked prospective bidders to,
    among other things, review and refresh [the FCS website] to ensure it remains
    functional to meet our communication needs now and going forward as well as to
    ensure we maintain compliance with applicable legislative requirements.

[12]

On October 22, 2015, FCS retained Laridae.

[13]

Under the October 2015 contract (the Contract)
    Laridae agreed to provide a range of communications and marketing services. Laridae
    agreed, among other things, to:

a)

Identify and implement recommendations to
    enhance the existing communication platforms/infrastructure of FCS;

b)

Create and implement communication protocols for
    delivery of internal and external communications including blogs, tweets,
    videos etc.;

c)

Review and refresh the [FCS] website to meet
    functionality and communication requirements, now and in the future, while
    maintaining compliance with applicable legislative requirements; and

d)

Provide training for FCS staff to enhance internal
    and external communications capacity.

[14]

The Contract required Laridae to obtain
    commercial general liability insurance coverage that would name FCS as an
    additional insured under its policy. Laridae obtained a policy for the period
    November 1, 2015 to November 1, 2016.

[15]

On May 25, 2016, Laridae and FCS entered into a
    subsequent scope of work agreement to provide enhanced strategic communications
    services including ongoing support with internal and external strategic
    communications; public relations; government relations; crisis communications;
    media management and training; liaison with legal counsel, insurance,
    associations and other organizations; branding; policy development; and board
    governance.

(2)

The Claims at Issue

(a)

The class action proceeding against FCS and
    others

[16]

On July 22, 2016, a proceeding was commenced
    under
Class Proceedings Act
, 1992, S. O. 1992, c. 6. against FCS, its
    executive director, and a number of other defendants, seeking general,
    specific, and punitive damages of $75 million.

[17]

In late 2015, FCS prepared a confidential
    statistical report (the Report) for its board of directors. The report was
    stored electronically in a portal  a
page in FCSs website providing access or links to another site
through a cloud website, for members of FCSs board of directors. The
    portal was supposed to be secure. The Report was part of a confidential
    statistical report prepared for FCS board of directors and contained personal
    information of 285 clients or subjects of FCS investigations. Specifically, the
    Report documented new FCS cases arising between April and November 2015.

[18]

M.M. claims that on or about April 18, 2016, a
    client of FCS discovered the Report posted on two public Facebook pages. M.M.
    alleged that one or more individuals illegally hacked the portal on FCSs
    website, which was insecure; stole the Report; and published the hyperlink to
    the Report, thereby disclosing personal and highly sensitive information of
    class members  some of which was untrue.

[19]

Paragraphs 15 through 19 of the amended statement
    of claim read as follows:

15.
The personal information of 285 clients
    and subjects of [FCS] investigations was contained in an electronic file
forming part of a confidential statistical report (report) prepared for [FCS]'s
    board of directors on new cases arising between April and November of 2015.
The
    report was held electronically in a portal
for board members.

16. Information contained in the report
    concerning some class members was untrue.

17. On or about April 18, 2016 a client of [FCS]
    discovered that the report was posted on Smith's Falls Swapshop Facebook page
    and the Facebook page of Families United.

18. The plaintiff pleads that Jane Doe and/or
    Kelley Denham illegally hacked the portal, which portal [sic] was not secure,
    and
made the report public by posting it on Smith's Falls Swapshop Facebook
    page and/or other public websites, thereby disclosing personal and highly
    sensitive information of the plaintiff and class members
.

19. As a result, the personal information of
    the class members has now been made readily available to any unauthorized third
    party who accessed the information, bought the information, or found the
    information posted on the internet, resulting in damages as set out below.
    [Emphasis added.]

[20]

On December 21, 2017, common issues were
    certified in relation to three of the ten causes of action set out in the amended
    statement of claim: negligence; intrusion upon seclusion; and breach of s. 7 of
    the
Canadian Charter of Rights and Freedoms
, arising

from a third
    partys unauthorized access to the portal and subsequent publication of the
    Report.

(b)

FCSs third-party claim against Laridae

[21]

On May 28, 2018, FCS commenced a third-party
    claim against Laridae, seeking general and special damages, and contribution
    and indemnity for liability arising from the class action. FCS alleges that
    Laridae was negligent in providing advice and professional services and
    breached its contractual obligations to FCS.

[22]

FCS claims its website was designed to be secure
    and password protected, so that FCS could upload documents intended for
    authorized users.

[23]

FCS alleges that on or about February 11, 2016,
    it learned that an unauthorized internet user obtained a number of non-public
    documents from the secure section of the FCS website. The unauthorized user
    posted screenshots of the confidential personal documents to a video on YouTube.

[24]

FCS alleges that Laridae advised FCS that it had
    enhanced the security features of the [w]ebsite and that it had added two
    additional security features to the [w]ebsite, which were sufficient to prevent
    Internet users from obtaining unauthorized access to documents in the secure
    section. Notwithstanding the repairs, in April 2016, a second incident took
    place whereby a hyperlink to the Report was posted on Facebook accounts.

[25]

FCS advanced both a breach of contract claim and
    a negligence claim. Particulars of the negligence claim advanced by FCS against
    Laridae, reproduced from para. 17 of the statement of claim, are as follows:

(a)

Laridae negligently represented that the Website
    was secure following the February Incident, when it was not;

(b)

Laridae failed to take the necessary steps to
    identify or repair the potential vulnerabilities prior to, or following, the
    February Incident;

(c)

Laridae failed to take reasonable or adequate
    care in all the circumstances in advising FCS on its response to the February Incident;

(d)

Laridae failed to warn [FCS] of any
    vulnerabilities in relation to the website or the Secure Section at any time
    prior to or until the February Incident; and

(e)

such further particulars as are in the knowledge
    of Laridae.

[26]

The breach of contract claims are, in essence, that
    Laridae failed to take the necessary steps to ensure that unauthorized internet
    users could not access non-public documents on the FCS website. FCS further
    alleges that Laridae advised that the website was secure, following the February
    2016 breach, when it was not.

(3)

Co-operators Refusal to Defend and the Relief
    Sought by FCS and Laridae

[27]

Laridae was insured under the terms of two
    policies of insurance issued by Co-operators: a commercial general liability
    policy (the CGL Policy) and the Professional Liability Policy. As required by
    the Contract, Laridae added FCS as an additional insured under the terms of the
    CGL Policy.

[28]

Several months after receiving the amended
    statement of claim, FCS requested that Co-operators defend and indemnify it
    with respect to the class action. In February 2018, Co-operators denied the FCS
    request, citing an exclusion in CGL Policy for data, and any personal injury
    arising from the distribution or display of data.

[29]

Laridae also requested that Co-operators defend
    and indemnify it with respect to FCSs third-party claim. In June 2018,
    Co-operators denied the Laridae request, citing the Data Exclusion in the
    Professional Liability Policy which provided that [t]here shall be no coverage
    under this policy in connection with any claim  arising directly or indirectly
    from the distribution or display of data by means of an Internet Website 
    designed or intended for electronic communication of data.

[30]

Both FCS and Laridae brought applications to the
    Superior Court. Laridae sought a declaration that Co-operators had a duty to
    defend it from FCSs third-party claim under both policies. FCS sought a
    declaration that Co-operators was obliged to defend it in the class action under
    the CGL Policy and that FCS may retain and instruct counsel of its choice to be
    paid by Co-operators and who would not have to report to Co-operators; and an
    order requiring Co-operators to reimburse FCS for the costs of defending the
    proceedings to date. Co-operators also brought an application, seeking a
    declaration that it did not have a duty to defend or indemnify Laridae or FCS under
    the CGL Policy, or Laridae under the Professional Liability Policy.

THE INSURANCE POLICIES

(a)

The Commercial General Liability Policy

[31]

The CGL Policy provides coverage for bodily
    injury and property damage liability. The relevant provisions of the CGL Policy
    are set out below. Significant clauses are underlined.

[32]

The CGL Policy provided for a range of coverage,
    including personal injury liability under Coverage B:

1.
Insuring Agreement

a.

We will pay those sums that the insured
    becomes legally obligated to pay as compensatory damages because of personal
    injury to which this insurance applies.
No other
    obligation or liability to pay sums or perform acts or services is covered
    unless explicitly provided for under SUPPLEMENTARY PAYMENTS  COVERAGES A, B AND
    D.
We will have the right and duty to defend any
    action seeking those compensatory damages but:



2. We may
    investigate and settle any claim or action at our discretion.

b.

This insurance applies to personal injury
only if caused by an offence:

1.

Committed in the coverage territory during the policy period; and,

2. Arising out of
    the conduct of your business,
excluding advertising, publishing,
    broadcasting or telecasting
done by or for you.

[33]

Personal injury is defined in the CGL Policy as:

[I]njury other than bodily injury, arising
    out of one or more of the following offences:



d.

Oral or written publication of material that libels or slanders a
    person or organization or disparages a persons or organizations goods,
    products or services; or

e.

Oral or written publication of material that
    violates a persons right of privacy.

[34]

The Common Exclusions provision in the policy,
    applicable to the personal injury provisions in Coverage B, provides that:

This insurance does not apply to:

4. Data

a.

Liability for:

1.

erasure, disruption, corruption, misappropriations,
    misinterpretation of data;

2.

erroneously creating, amending, entering, deleting or using data;
    Including any loss of use there from;

b.

Personal injury arising out of the distribution, or display of
    data by means of an Internet Website, the Internet, an intranet, extranet, or
    similar device or system designed or intended for electronic communication of
    data
.

[35]

Data is defined in the CGL Policy as representations
    of information or concepts in any form.

(b)

The Professional Liability Policy

[36]

The Professional Liability Policy provides that:

1. BASIC COVERAGE

The Insurer will pay on behalf of the
    Insured all sums which the Insured shall become legally obligated to pay as
    compensatory damages resulting from Claims first made against the Insured
    during the Policy Period by reason of liability for an error, omission, or
    negligent act in the course of Professional Services.



3. DEFENCE AND SETTLEMENT

With respect to each Insurance as is afforded
    by this policy the Insurer shall have the right and duty to defend any suit or
    arbitration proceeding against the Insured seeking compensatory damages
    payable under the terms of this policy, even if any of the allegations of the
    suit are groundless, false or fraudulent and investigate and negotiate the
    settlement of any claim or suit as it deems expedient.

[37]

The Professional Liability Policy included a
    data exclusion. The exclusion reads:

DATA
    EXCLUSION

There shall be no coverage under this policy
    in connection with any claim based on, attributable to or
arising directly
    or indirectly from the distribution, or display of data by means of an
    Internet Website, the Internet, an Intranet, Extranet, or similar device or
    system designed or intended for electronic communication of data
.

For the purposes of this endorsement, data
    means representations of information or concepts, in any form.

[38]

This wording is the same as the exclusion in the
    CGL Policy except that it adds the words directly or indirectly after the
    word arising. The definition of data is the same, except that it adds a
    comma before in any form.

THE APPLICATION JUDGES DECISION

[39]

On the application, Co-operators argued it had
    no duty to defend, because coverage was excluded by the data exclusion clauses.
    FCS and Laridae argued that the data exclusion clause did not exclude all the
    claims against them. In the alternative, FCS and Laridae argued that exclusion
    clauses which have the effect of nullifying the insurance the insurer undertook
    to provide, will not be enforced. They argued that this was an important issue
    that should not be determined on a duty to defend application.

[40]

The application judge concluded, at para. 28,
    that the claims in respect of which FCS and Laridae sought coverage are broad
    and comprehensive and not limited to the distribution of the Report on the
    internet. The Claims do include damages for non-electronic distribution (i.e.
    physical distribution) of the Report or other private information. In coming
    to that conclusion, she relied on para. 19 of the amended statement of claim in
    the class action, which asserts that the personal information of the class
    members can be accessed by any unauthorized third party who accessed the information,
    bought the information, or found the information posted on the internet.

[41]

However, although all three parties brought
    applications regarding the interpretation of the insurance policies, the
    application judge held that whether Co‑operators should be able to rely
    on the data exclusion clauses to deny a duty to defend was an important issue
    that should not be determined on an application. At para. 36, she held that:

[U]ntil the courts have had an opportunity
    to adjudicate the complex issues raised by these broadly worded data exclusion
    clauses, it would be improper for this court, having regard to present
    jurisprudence to uphold Co-operators denial of a duty to defend.

[42]

After making this remark, she went on to find
    there was a possibility of coverage:

Further, I can not find on these
    Applications that
Co-operators has not discharged its onus of establishing that the substance of
    the Claims clearly fall within the Data Exclusion Clauses and that there is no
    possibility of coverage under the Policies. Rather, in addition to the issue of
    the interpretation of the Data Exclusion Clauses, it is apparent that there are
    claims and allegations in the Class Proceeding and the Third-Party Claim that would
    not [be] excluded by the Data Exclusion Clauses. As there is at least some
    possibility that the Claims are covered under the Policies, I find that
    Co-operators owes a duty to defend Laridae and FCS.

[43]

Finally, the application judge held that if
    there is a conflict of interest due to competing interests as between FCS and
    Laridae, Co-operators must fund each defence with independent counsel, neither
    of whom reports to Co-operators. The judgment provides that FCS and
    Laridae are each entitled to appoint and instruct counsel, such instruction
    shall not include resolution or settlement of any part or portion of the
    litigation without the consent of Co-operators, and is without prejudice to the
    rights of Co-operators to bring a motion to vary the Order if the conflict of
    interest is resolved.

ANALYSIS

(1)

The First Issue: Whether the duty to defend
    could be addressed by way of application

[44]

The application judge erred in concluding that
    it would be improper to deny the duty to defend on the materials before her.

[45]

FCS, Laridae, and Co-operators all elected to
    proceed by way of application. Both FCS and Laridae argued that declarations in
    their favour could be made on their applications, but that a declaration
    against their interests could not.

[46]

The application judge remarked, at para. 32,
    that the novel interpretive issue of data exclusion clauses had not yet been
    judicially considered and should be considered on a full record and not by way
    of application. As noted above, at para. 36, she agreed with FCS and Laridae
    that it would be improper to uphold Co-operators denial of the duty to
    defend until the courts have had the opportunity to adjudicate the complex
    issues raised by these broadly worded data exclusion clauses. She therefore
    held that Co-operators had a duty to defend as it had not discharged its onus
    of establishing that the substance of the claims clearly falls within the data exclusion
    clause.

[47]

There was no basis for the application judges
    acceptance of this seemingly asymmetrical treatment of FCS and Laridae, on the
    one hand, and Co-operators, on the other.

[48]

Rule 14.05(3)(d) of the
Rules of Civil
    Procedure
, R.R.O. 1990, Reg. 194 provides that a proceeding may be brought
    by application where the relief claimed is the determination of rights that
    depend on the interpretation of a contract. An application will however be
    converted to an action where there are material facts in dispute, complex
    issues requiring expert evidence or the weighing of evidence, or other need for
    discoveries or further pleadings: see
Fort William Band v. Canada (Attorney
    General)
, 76 O.R. (3d) 228 (S.C.), at paras. 5 and 28-31.

[49]

This application involved the interpretation of the
    policy provisions and the application of those provisions to the claims as
    pleaded to see if there is a possibility that some of the claims may be covered
    by the policy.

[50]

The agreements, describing the services that
    Laridae was to provide FCS, were in the record before the application judge, as
    were the CGL Policy and the Professional Liability Policy. There were no
    material facts requiring a trial.

[51]

As discussed below, the policy provisions are
    clear and unambiguous and the application judge is presumed to know the law  even
    if the law is, in her view, unclear or unsettled. She could and should have, addressed
    both (i) the scope and effect of the data exclusion clauses in the policy, and
    (ii) FCS and Laridaes argument that giving effect to the exclusion clauses
    would nullify coverage under the policies.

[52]

She erred in failing to do so and I will
    therefore conduct the analysis.

(2)

The Second Issue: Whether Co-operators owed a
    duty to defend to FCS and Laridae

[53]

I begin my analysis of the duty to defend with a
    discussion of the applicable principles.

(a)

The principles applicable on a duty-to-defend
    application

The role of the insurance policy and its
    interpretation

[54]

The relationship between an insured and an
    insurer is a contractual one governed primarily by the terms
of
the insurance policy.

[55]

The language
of
the
    policy is construed in accordance with the usual rules
of
construction, rather than inferred expectations unapparent
    on a fair reading
of
the document. This is
    particularly so in the case of commercial insurance policies involving
    sophisticated parties. The insurer must explicitly state the basis on which
    coverage may be limited:
Hanis v. Teaven,
2008 ONCA 678, 92 O.R. (3d)
    594, leave to appeal refused, [2008] S.C.C.A. No. 504, at para. 2.

[56]

Where the language of the insurance policy is
    ambiguous, the courts rely on general rules of contract construction and should
    prefer interpretations of the policy that are consistent with the reasonable
    expectations of the parties. Courts should avoid interpretations that
    would give rise to an unrealistic result or one that would not have been in the
    contemplation of the parties at the time the policy was concluded. However, these
    rules of construction do not operate to create ambiguity where there is none:
Progressive
    Homes Ltd. v. Lombard General Insurance Co. of Canada
, 2010 SCC 33, [2010]
    2 S.C.R. 245, at para. 23.

[57]

In interpreting a policy to determine possible
    coverage, the process is as follows:

a)

When the policy language is unambiguous, the
    court should give effect to that language, reading the policy as a whole;

b)

Where the language of the policy is ambiguous,
    general rules of contract construction apply and the court should prefer
    interpretations of the policy that are consistent with the reasonable
    expectations of the parties. Courts should avoid interpretations that would
    give rise to a result that is unrealistic; and,

c)

Only when the rules of contract construction
    fail to resolve the ambiguity, courts will construe the policy against the
    insurer who drafted the policy. This means that coverage provisions are
    interpreted broadly, and exclusion clauses narrowly:
Progressive Homes Ltd.
,
    at paras. 22-24;
Simpson Wigle Law LLP v. Lawyers Professional Indemnity
    Co.
, 2014 ONCA 492,

120 O.R. (3d) 655, at para. 54.

The insurers duty to defend against
    claims

[58]

Whether there is a duty to defend is determined
    by the allegations pleaded in the underlying lawsuit read together with the terms
    of coverage provided in the insurance policy. The duty to defend is broader
    than the duty to indemnify. An insurer has a duty to defend where, on the facts
    as pleaded, there is a possibility that a claim within the policy may succeed:
Nichols
    v. American Home Assurance Co.
, [1990] 1 S.C.R. 801, at p. 810. The court
    must try to ascertain the substance and true nature of claims pleaded:
Tedford
    v. TD Insurance Meloche Monnex
, 2012 ONCA 429, 112 OR (3d) 144, at para.
    14;
Monenco Ltd. v. Commonwealth Insurance Co.
, 2001 SCC 49
, [2001] 2 S.C.R. 699
, at
    paras. 34-35
.

[59]

If the pleadings allege facts which, if true,
    would require the insurer to indemnify the insured for a claim, the insurer is generally
    obliged to provide a defence, even though the actual facts may differ from the
    allegations in the statement of claim:
Monenco
, at para. 28;

Alie v. Bertrand & Frère
    Construction Co.
(2002)
,
222 D.L.R. (4th)
    687
(Ont. C.A.)
, at
    para. 182.

[60]

The insurers defence obligation is not governed
    by facts outside of the pleaded allegations. Courts have been cautioned against
    referring to extrinsic evidence that is not explicitly cited by the parties in
    their pleadings, for fear of making findings binding on the parties that might
    be contrary to the evidence tendered on the full record at trial:
Monenco
,
    at paras. 36-37.

[61]

Where a loss arises from several causes, some of
    which fall within coverage and some of which are not covered, there is a duty
    to defend absent clear exclusory language denying coverage for multiple
    independent concurrent causes or mixed claims:
Derksen v. 539938 Ontario
    Ltd.
, 2001 SCC 72, [2001] 3 SCR 398, at para. 48. This is because, as
    noted by Doherty J.A. in
Hanis
, at para. 23:

I see no unfairness to the insurer in holding
    it responsible for all reasonable costs related to the defence
of
covered claims if that
    is what is provided for by the language
of
the policy. If the insurer has contracted
    to cover all defence costs relating to a claim, those costs do not increase
    because they also assist the insured in the defence
of
an uncovered claim. The insurer's exposure
    for liability for defence costs is not increased. Similarly, the insured
    receives nothing more than what it bargained for  payment
of
all defence costs related to a covered
    claim.

[62]

In the event of mixed claims, the insurer has a
    duty to defend against the entire claim, subject to an entitlement to recover
    all or an appropriate portion of their costs of the defence from the insured
    following the ultimate disposition of the underlying actions:
St. Paul Fire
    & Marine Insurance Co. v. Durabla Canada Ltd.
(1996), 137 D.L.R. (4th)
    126 (Ont. C.A.).

(b)

Analysis of the application judges decision
    respecting the duty to defend

[63]

Applying these principles to the claims and the
    CGL Policy and Professional Liability Policy, for the reasons that follow, I
    find that Co-operators owes no duty to defend either FCS or Laridae.

Is the data exclusion clause ambiguous?

[64]

The first step in the coverage analysis is to
    review the policy to determine whether it is ambiguous.

[65]

The application judge did not engage in an
    analysis of the policy provisions nor did she state whether the policy
    provision or the exclusion clause was ambiguous. She cited
Tedford
for
    the proposition that the usual principles governing the construction of
    insurance contracts apply to the interpretation of insurance polices,
    including the
contra proferentem
rule: see
Tedford
, at para.
    14. However, the
contra proferentem
rule applies to resolve
    ambiguities: see
Non-Marine Underwriters, Lloyd's London v. Scalera
, 2000
    SCC 24, [2000] 1 S.C.R. 551, at para. 71. It does not apply where, as in this
    case, the insurance policy is clear and unambiguous on its face.

[66]

Laridae is insured under the Professional
    Liability Policy, which provides coverage for all sums the Insured shall become
    legally obligated to pay as compensatory damages resulting from Claims by
    reason of liability for any error, omission, or negligent act in the course of
    Professional services.

[67]

Both Laridae and FCS are insured under the CGL
    Policy, which provides coverage for compensatory damages for personal injury
    [other than bodily injury]  caused by an offence that arises out of the
    conduct of [the insureds] business.

[68]

However, both the Professional Liability Policy
    and the CGL Policy contain exclusion clauses. The CGL Policy clearly excludes
    claims arising

out of the distribution or display of data by means
    of an Internet Website, the Internet, an intranet, extranet, or similar device
    or system designed or intended for electronic communication of data. The
    Professional Liability Policy is even clearer, as it excludes any claims that
    arise directly or indirectly from the distribution or display of data. Both
    policies define data as representations of information or concepts in any
    form.

[69]

Because these policy provisions are clear and unambiguous,
    the court need not consider the reasonable expectations of the parties in
    interpreting the exclusion provision in the policy, nor does the court need to
    make recourse to extraneous sources:
Allstate Insurance Co. of Canada v.
    Aftab
, 2015 ONCA 349, 335 O.A.C. 172, at para. 19.

Is there a possibility that some of these claims
    are covered by the policy?

[70]

The second step is to apply the policy
    provisions to the claims to see if there is a possibility that some of the
    claims may be covered by the policy. This is determined by ascertaining the
    substance and true nature of the claims pleaded.

[71]

In characterizing the class action and the third-party
    claims, the application judge stated, at para. 28, that:

The Claims in these Applications
are broad
    and comprehensive and not limited to the distribution of the Report on the
    internet
. The Claims do include damages for non-electronic distribution
    (i.e. physical distribution) of the report or other private information. Paragraph
    19 of the Amended Statement of Claim in the Class Proceeding asserts that the
    personal information of the class members can be accessed by any unauthorized
    third party who accessed the information, bought the information, or found the
    information posted on the internet... [Emphasis added.]

[72]

The application judge did not consider these
    claims at length in her analysis.

[73]

As noted above, she held, at para. 36, that, it
    is apparent that there are claims and allegations in the Class Proceeding and
    the Third-Party Claim, that would not be excluded by the Data Exclusion
    Clauses.

[74]

On appeal, FCS and Laridae take the position
    that the application judge was correct in holding that some claims extend
    beyond the policy exclusion and, thus, Co-operators has a duty to defend both because
    (i) the link to the Report is not a display of data within the meaning of the
    exclusion clauses; and (ii) the damages sought are broad enough to include
    physical, not just electronic, distribution of the personal information. In the
    alternative, (iii) they renew their argument before the application judge that
    the data exclusion clauses are unenforceable.

(i)

Is the link a display of data within the
    meaning of the policy exclusion?

[75]

In the third-party claim against Laridae, FCS alleges
    that
an image of a link to the Report was published on
    the Facebook page. On appeal, Laridae argues that one cannot click on an image
    to access the webpage or document directly. Instead, the text from the image
    must be typed into a separate webpage in order to access the content. Laridae claims
    that, strictly construed, such an image does not fit within the definition of data
    as representations of information or concepts in any form. Rather, the image
simply
    enables the user to obtain the information by taking further steps
.

[76]

The application judge makes no reference to this
    argument, and it is not clear that this argument was advanced below. In any
    event, I do not agree.

[77]

The definition of data is clear and
    unambiguous. Both a hyperlink and an image of a hyperlink constitute representations
    of information within the meaning of the policy exclusions. It is the representation
    of the source of the electronic file containing personal information.

[78]

In the class proceeding against FCS, M.M. as the
    representative plaintiff claims that the wrongdoers:

[H]acked the portal, which portal [sic] was
    not secure, and made the report public by posting it on Smiths Falls Swapshop
    Facebook page and/or other public websites, thereby disclosing personal and
    highly sensitive information of the plaintiff and class members.

As a result, the personal information of the
    class members has now been made readily available to any unauthorized third
    party who accessed the information, bought the information, or found the
    information posted on the internet, resulting in damages as set out below.

[79]

The damages resulted from hacking the portal using
    the hyperlink to connect one electronic document to another. This is a system
    designed or intended for the electronic communication of data. As such, the
    link to the Report is a display of data within the meaning of the policy
    exclusion.

(ii)

Is there a possibility some claims are covered
    by the policy notwithstanding the exclusion clause?

[80]

FCS and Laridae further submit that the trial
    judge correctly found that the claims are not limited to the distribution of
    the Report on the Internet and include damages for non-electronic
    distribution (i.e. physical distribution) of the report or other private
    information and accordingly some of the claims advanced against them are not
    covered by the exclusion clause.

[81]

FCS and Laridae argue that there are two concurrent,
    but discrete, claims advanced against the insured. They say that even if the
online
display or distribution of personal confidential information is not covered by
    the policy, Co‑operators owes a duty to defend if the
physical
display
    or distribution of the personal confidential information may be covered.

[82]

I do not agree. As I will explain, while the
    trial judge adverted to the requirement to ascertain the substance and true
    nature of the claims pleaded, she erred by failing to do so and as a result
    concluded that there are claims and allegations in the Class Proceeding and
    the Third-Party Claim that would not [be] excluded by the relevant exclusion
    clauses. FCS and Laridae rely on
Derksen
. In that case, adverse
    weather conditions developed at a construction site, so work was halted earlier
    than usual. During the cleanup, a sign, a shaft, and a steel baseplate were
    removed from the site and placed in the truck. The steel baseplate was not
    secured. The truck was later driven along the highway and the steel baseplate
    flew off the truck and went through the windshield of a school bus, killing one
    child and injuring others.

[83]

The policy in that case excluded coverage for
    bodily injury or property damage arising out of the ownership, use, or
    operation of an automobile. However, the Supreme Court held that the insurer
    had a duty to defend the action because, although the policy excluded coverage
    for the use or operation of the automobile, the underlying cause of the
    accident was the failure to clean up the work site by securing the items in the
    truck before driving the vehicle.

[84]

The Supreme Court held that this cause was unrelated
    to the use or operation of the motor vehicle as the defendant could be found
    liable for negligently loading and storing the steel baseplate on the truck even
    if there was no negligent use or operation of the motor vehicle.

[85]

However, in
CUMIS General Insurance Co. v.
    1319273 Ontario Ltd.
, 2008 ONCA 249, 91 O.R. (3d) 147 (
CUMIS

(ONCA)
),
    a decision rendered several years later by this court, a policy exclusion for
    bodily injury or property damage arising out of the ownership, maintenance,
    use or operation by or on behalf of the insured of any automobile was held to
    exclude all claims for damages arising from an incident in which a motorcyclist
    was struck by a ladder that fell off a truck, seriously injuring him. The
    motorcyclist claimed that in cleaning up the work site, one of the defendants employees
    negligently loaded and stored the ladder onto the truck. At paras. 36, Laskin J.A.
    distinguished
Derksen
and accepted the application judges reasoning that:

[T]he substance and true nature of the claim
    is that the Respondent's employee failed to load and properly secure the ladder
    to the company's vehicle. The Statement of Claim clearly suggests that the
    employee intended to clean up the work site by loading the ladder onto the
    truck and that he did so, but failed to secure the ladder properly to the truck:
CUMIS General Insurance Co. v. 1319273 Ontario Ltd.
(2006), 84 O.R.
    (3d) 113, at paras. 15-16.

[86]

Laskin J.A. agreed that the substance and true
    nature of the claim involves the allegations of negligently loading and
    storing the ladder on the truck, not a negligent cleanup of a worksite as was
    alleged in
Derksen
:
Cumis (ONCA)
, at para. 36.

[87]

In the amended statement of claim, M.M. as
    representative of the class claims:

a)

The personal information  was contained in an
    electronic file  held electronically in a portal;

b)

The portal was illegally hacked, the personal
    information was posted on Smiths Falls Swapshop Facebook page and/or other
    public websites; and,

c)

It was made readily available to an
    unauthorized person who accessed, bought or found the information on the
    internet resulting in damages to the Class.

[88]

In this case, contrary to the assertion made by
    the application judge, there is no claim in the class action that there was a physical
    display or distribution of the confidential personal information. The claim is
    that the confidential report was made public, 
by posting it on Smith's
    Falls Swapshop Facebook page
and/or other public websites, thereby
    disclosing personal and highly sensitive information of the plaintiff and class
    members and that, 
[a]s a result
, the personal information of the class
    members has now been made readily available  resulting in damages (emphasis
    added).

[89]

The pleading in the class action is that the
    damages arose from posting the Report on the internet. This is sufficient to
    conclude that there is no duty to defend the class action as this allegation
    fits squarely within the policy exclusion.

[90]

Moreover, even if the class action did include
    an allegation that physical copies of Report were taken or created, which it
    does not, the substance and true nature of the claim for damages
arises
from the wrongful appropriation of confidential personal information and
    posting it on the internet. There is only one chain of causation as all injury
    flows from the display or distribution of physical copies follows from the
    first wrongful act.

[91]

This is also true in the case of the third-party
    claim. In the third-party claim, FCS claims:

a)

Contribution and indemnity for any damages
    payable in the class action;

b)

Damages for negligent advice and representations
    in the course of providing general consulting services under its agreement with
    FCS;

c)

Damages for failing to adequately secure the
    website; and,

d)

Damages relating to reputational harm,
    investigation costs, and repair costs.

[92]

While I appreciate that Rule 29.01 of the
Rules
    of Civil Procedure
allows a defendant to commence a third-party claim
    against a person who is not a party to the action for an independent claim for
    damages or other relief arising out of  a related transaction or occurrence or
    series of transactions or occurrences, there is no independent claim for
    damages in this case.

[93]

The data exclusion clause excludes claims that
    arise from the display and distribution of the confidential personal information
    on the internet. All of the injuries pleaded in the third-party claim arise,
    ultimately, from the distribution of the Report on the internet. There is only
    one chain of causation. As in the class action, the substance and true nature
    of the claim for damages arises from the wrongful appropriation of confidential
    personal information and posting it on the internet.

[94]

Accordingly, the data exclusion clause excludes
    coverage for the defence of both the class action and the third-party claim
    and, on the facts as pleaded, there is no possibility that a claim within the
    policy may succeed.

(iii)

Would denial of coverage result in nullification
    of coverage under the policy?

[95]

The third point raised by FCS and Laridae is
    that, if the data exclusion clause in the policies applies in this case, giving
    effect to the data exclusion clause would impermissibly nullify coverage under the
    policy.

[96]

In
Zurich Insurance Co. v. 686234 Ontario
    Ltd.
(2002), 62 O.R. (3d) 447 (Ont. C.A.), leave to appeal to S.C.C. refused,

[2003] S.C.C.A. No. 33, Borins J.A.
    explained, at para. 28, that even a clear and unambiguous exclusion clause will
    not be applied where:

a)

it is inconsistent with the main purpose of the
    insurance coverage;

b)

the result would be to effectively nullify the
    coverage provided by the policy; and,

c)

to apply the exclusion clause would be contrary
    to the reasonable expectations of the ordinary purchaser of the coverage.

[97]

However, this case is distinguishable from
Zurich
.

[98]

First, unlike the decision in
Zurich
, the
    exclusion is entirely consistent with the main purpose of the insurance
    coverage, which is to provide compensatory damages for personal injury arising
    from the conduct of business except in accordance with specific exclusions
    under the policy. The policies provide coverage for a range of services
    provided by Laridae and specifically, its provision of Professional Services
    to FCS. Only one of those services was to update and secure the FCS website.

[99]

Second, given that the Co-operators policies
    provide coverage for a range of services which extend beyond the terms of this
    policy exclusion, the exclusion clause would not nullify the coverage provided under
    the policy.

[100]

Third, exclusion of these claims pursuant to the exclusion clauses
    would not be contrary to the reasonable expectation of the parties. The potential
    effect of the data exclusion clauses is apparent on the face of the policies. Unlike
Zurich
, where a reasonable policyholder would expect that the policy
    insured the very risk that occurred, a reasonable policyholder in this case would
    expect that the data exclusion clause would exclude the dissemination of a
    sensitive Report over social media:
Zurich
, at para. 39.

[101]

In
G & P Procleaners and General Contractors Inc. v. Gore
    Mutual Insurance Co.
, 2017 ONCA 298, 335 O.A.C. 172, at paras. 24-25
,
this court considered and rejected a similar nullification argument. This court
    observed that commercial general liability policies:

are not all-risk policies. They do not
    insure the manner in which the insured conducts its business. They do not
    generally cover the cost of repairing the insureds own defective or faulty
    work product. That is what the parties in the present case bargained for. To
    hold them to that bargain is entirely reasonable and does not render the
    coverage under the policy meaningless. [Citations omitted.]

[102]

Like the insurer in
G & P Procleaners,
the Co-operators
    policies do not insure against all risks. They clearly articulate what is and is
    not covered. Non-bodily injury arising from the display or distribution or data
    on the internet is not covered by their terms. To hold the parties to this
    bargain is consistent with the provisions in the policy, it does not nullify
    the effect of the policies, and it accords with the reasonable expectations of
    the parties.

Conclusion on the duty-to-defend issue

[103]

In summary, I find that Co-operators owes no duty to defend either
    FCS or Laridae because (i) the exclusion clauses are unambiguous, (ii) all
    claims asserted in these proceedings are covered by the clear language of the
    exclusion clauses, and (iii) denial of coverage would not nullify the policies.

(3)

The Third Issue: Removal of the Right to Participate
    in the Defence

[104]

Given my conclusion that Co-operators has no duty to defend, it is
    unnecessary to address the third issue.

[105]

However, I note that the parties agreed at the
    hearing that, if Co-operators did have a duty to defend, Co-operators should receive
    reports from counsel who have been acting for FCS and Laridae for the last four
    years, and have the ability to jointly instruct counsel.

[106]

They also agreed that, should Co-operators have a duty to defend, it
    would be appropriate to establish a joint protocol for the management of
    documents and the litigation, similar to that ordered by this court in
Markham
    (City) v. AIG Insurance Company of Canada
, 2020 ONCA 239
, 445 D.L.R. (4th)
    405, leave to appeal refused, [2020] S.C.C.A. No. 170.

[107]

The establishment of such a protocol reflects the balance between
    the insureds right to a full and fair defence of the civil action and the
    insurers right to control that defence because of its potential ultimate
    obligation to indemnify: see
Brockton (Municipality) v. Frank Cowan Co.
,
57 O.R. (3d) 447 (Ont. C.A.). It also reflects the
    fact that an insurer that has reserved its rights on coverage does not lose its
    right to control the defence and appoint counsel unless, in the circumstances, a
    reasonable apprehension of conflict of interest would arise if counsel were to
    act for both the insurer and the insured:
Brockton,
at paras. 39-40,
    43; citing
Zurich of Canada v. Renaud & Jacob
,
[1996] R.J.Q. 2160 (C.A.)
, per
Lebel J.A.

[108]

The onus is on the insured to establish such a reasonable
    apprehension of conflict of interest on the part of the insurer:
Brockton
, at para. 49
;
Wal-Mart Canada Corp. v. Intact
    Insurance Co.
, 2016 ONSC 4971, 133 O.R. (3d) 716; and
Brookfield
    Johnson Controls Canada LP v. Continental Casualty Company
, 2017 ONSC
    5978.

DISPOSITION

[109]

For the above reasons, I would allow the appeal and hold that Co-operators
    has no duty to defend either the class action or the third-party claim.

[110]

I would award costs to Co-operators in the amount of $15,000 for the
    appeals and $30,000 for the applications, as agreed by the parties.

Released: March 15, 2021 A.H.

J.A.
    Thorburn J.A.

I
    agree. Alexandra Hoy J.A.

I
    agree. David Brown J.A.





[1]
Today,
    FCS is authorized under the
Child, Youth and Family Services Act, 2017
,
    S.O. 2017, c. 14.


