Canada Approves $10M Settlement for Government Online Account Privacy Breach
Event summary
- Federal Court approved a $10M settlement for the Sweet class action over unauthorized disclosures of personal/financial data from Government of Canada Online Accounts between March 2020 and December 2020.
- Settlement covers breaches in CRA's My Account, Represent-a-Client accounts, My Service Canada accounts, and GCKey-accessed accounts.
- Claims submission period runs from August 4, 2026 to February 3, 2027 via www.breachsettlementcanada.kpmg.ca.
The big picture
This settlement marks one of Canada's largest privacy breach-related payouts, reflecting growing legal and public scrutiny over digital security in government services. The case highlights systemic risks in centralized identity management systems like GCKey, which serve as gateways to multiple sensitive accounts. Similar breaches have prompted regulatory reviews in other jurisdictions, signaling potential for broader policy shifts in digital governance.
What we're watching
- Government Accountability
- How this settlement may impact public trust in digital government services and drive future cybersecurity investments.
- Regulatory Compliance
- Whether similar class actions emerge targeting other government digital platforms with potential vulnerabilities.
- Operational Risk
- The pace at which the Canadian government can implement stronger safeguards to prevent future breaches of sensitive citizen data.