Local governments, take note: your exposure to liability arising from a data breach might be greater than you think. In G.D. v. South Coast British Columbia Transportation Authority, 2024 BCCA 252, the Court of Appeal for British Columbia held that an application to certify a class proceeding against a public body whose computer system had been penetrated by hackers should not have been struck for failure to disclose a cause of action. In so doing, the Court recognized that data custodians’ obligation to protect personal information they hold is not limited to that set out in the Freedom of Information and Protection of Privacy Act (“FIPPA”).