Intrusion upon seclusion
Recognized in Ontario by Jones v. Tsige (2012). The defendant must have intentionally (or recklessly) intruded on the plaintiff's private affairs or concerns, and the intrusion must be highly offensive to a reasonable person.
Damages are capped at around $20,000 without proof of actual harm, but can be higher for serious cases.
Public disclosure of private facts
Recognized in Ontario by Jane Doe 464533 v. N.D. (2016). The defendant must have publicized private information, where publication would be highly offensive to a reasonable person and the matter is not of legitimate public concern.
Statutory privacy torts
Several provinces (BC, Saskatchewan, Manitoba, Newfoundland and Labrador, Quebec) have statutory privacy torts. Quebec's Civil Code also provides a right to privacy in articles 3 and 35-41.
Class actions
Major data breaches often lead to class-action lawsuits. Canadian courts have certified classes in cases against Equifax, LifeLabs, Desjardins, and others. Settlements have ranged from modest per-person amounts to substantial total payouts.