Privacy law at the boiling point
IN Partnership with
Ronald D. Davis was building expertise in privacy and data security law before the practice area had a name. Four decades on, peer-recognized and newly at Diamond & Diamond, his most consequential work is just beginning
More
RONALD DAVIS has been on the inside of the technology that created privacy and data security law since before the practice area had a name. When he was called to the Ontario bar in 1984, it didn't exist; nor in 1994, 2004, or even 2014, though by then it had begun to emerge.
Today, Davis has built a practice at the crossroads of privacy law, cybersecurity, and complex class action work; he has been recognized in Best Lawyers in Canada for Privacy and Data Security Law every year since 2023 – a notable achievement for a lawyer who spent decades gaining expertise in a space that had no formal category. Davis says his life’s work has never been more relevant.
“I would say it’s been the boiling frog phenomenon,” he explains.
Diamond & Diamond Lawyers LLP is a Canadian law firm representing clients in class actions, personal injury, medical malpractice, privacy and data security, and complex litigation. Its lawyers combine courtroom experience with accessible client service and strategic advocacy in emerging areas of law. The firm handles significant matters across Canada, supported by a national network of offices and multidisciplinary legal talent. Diamond & Diamond’s team includes lawyers recognized by Best Lawyers through its peer-review process, including Ronald D. Davis in Privacy and Data Security Law. The firm remains focused on protecting clients, advancing complex claims, and delivering practical legal solutions nationwide.
Breach reporting
by the numbers
Office of the Privacy Commissioner of Canada, fiscal 2025–2026:
“It’s an intriguing area, hugely interesting and partly frustrating, and one I hope to see greater awareness of, investment, and involvement in by the public”
Ronald Davis,
Diamond and Diamond lawyers
“We were all in the water from the beginning, and then the heat started to turn up. Now, the temperature is definitely at the boiling point with cybersecurity and data breaches.”
Davis, who works on the litigation side, knows what that looks like up close – a client’s company suffered a ransomware cyber breach that completely took over the Christmas holiday – and his takeaway over four decades may sound counterintuitive, but “nothing would please me more than to have less work in this area,” he says.
“When I’m called in on a matter, it’s because somebody has been breached, possibly not observed best practices, or potentially made a terrible error from which they didn’t have proper recovery – and it’s often hard to remedy fully because of the nature of what law has to offer. It’s an intriguing area, hugely interesting and partly frustrating, and one I hope to see greater awareness, investment, and involvement in by the public at large.”
Technology: where the law is always playing catch up Privacy and data security law has transformed dramatically even within the past decade. Beginning with the Cambridge Analytica scandal around 2018 – widely misunderstood, Davis notes, as a data breach when the central wrong was actually a breach of Facebook’s platform rules and users’ privacy expectations – awareness has accelerated and authorities have responded. New torts have been recognized by the Ontario courts since, including intrusion upon seclusion and internet harassment, and a recent trilogy of cases has begun to address cyber breach liability.
Davis argues the most consequential legal moment in the space is still ahead: there’s yet to be what he calls “a Donoghue v. Stevenson moment, when the courts define the tort or the wrong that is compensable to those who have suffered injury because of the fault of another.”
“You often can’t find the bad actor who instigated the breach. They’re on some remote shore counting the money they’ve
stolen, or holding key data to ransom, and there are few good options,” he says. “The law is always behind technology; it’s always catching up. Everybody is figuring it out in real time.”
It’s the threat landscape that makes it difficult. Actors are financially motivated, politically motivated, or both, and some are after ransom, others after business intelligence. Hospitals have been shut down, financial centres paralyzed, and government institutions – including the Canada Revenue Agency and the FBI – have suffered cybersecurity breaches. No sooner does the legal world get a handle on one dimension of the problem than a new one emerges.
Davis recalls his experience as an early adopter of the internet in 1985 and one of the first webmasters in the 1990s at the University of Toronto. The idea that technology could move from benign to weaponized, let alone become so advanced it could make its own nefarious moves, wasn’t yet a concept.
“The only thing you worried about was losing data because you didn't back it up," he says, pointing to this past summer's incident in which an OpenAI agent broke out of a sandboxed test — with the company's own safety guardrails switched off — and used the exploit paths it had been tasked with finding to breach a separate company's live systems, as an example of how far things have come, and how fast.
From Bay Street to Diamond and Diamond After more than 40 years on Bay Street, Davis joined Diamond & Diamond Lawyers LLP in June 2026 as senior counsel in the firm’s class action group. The working relationship was already well established through ongoing collaboration on class action files, or, as Davis puts it, “we’d been dating at a distance and consecrated the marriage by joining the firm.”
Class actions serve two goals Davis returns to consistently: access to justice and behaviour modification. Diamond and Diamond’s contingency-fee model and its broad reach into the general population tie in directly with the first. The second pillar is where Davis is most emphatic.
“If corporations don’t have the threat of some penalty for being lax about their standards, they’re just going to keep doing what they’re doing; with the prospect of a class action hanging out there for wrongdoing, society benefits,” he says. “We step up because the argument is they’re not doing everything right and people are being harmed.”
Davis was equally drawn to the firm’s diversity, not as a stated policy but as a daily reality. He connected with lawyers at the firm from around the world, including parts of India, Africa, Asia, and Europe. A recent conversation with a colleague trained in New Delhi opened his eyes to a court system he had never encountered.
Published September 28, 2026
Share
“I’m lucky that I get to work in this space, and I hope to continue bringing about results not only for the people we represent but for the broader legal community at large”
Ronald Davis,
Diamond and Diamond lawyers
Almost 700 breach reports from businesses under PIPEDA
More than 20 million Canadians affected by those business breaches
451 breach reports from federal institutions, affecting 48,159 Canadians
3,044 PIPEDA complaints received, up 109 percent over the previous year
3,146 Privacy Act complaints received, up 62 percent
Source: OPC news release, June 4, 2026, accompanying the annual report Championing Privacy in the Age of AI.
1984
Davis called to the Ontario bar. No privacy and data security practice area exists
A practice taking shape
1985
Davis is an early internet adopter, later among the first webmasters at the University of Toronto
1993
CERN puts the World Wide Web software in the public domain on April 30, and the web spreads past the research community
2000
PIPEDA receives royal assent on April 13
2004
PIPEDA comes fully into force on January 1, covering all commercial activity
2012
Jones v. Tsige, 2012 ONCA 32 recognizes intrusion upon seclusion. Davis co-founds a digital forensics company the same year
2018
Breach reporting becomes mandatory under PIPEDA on November 1
2022
The Ontario Court of Appeal releases its data breach trilogy on November 25
2026
Davis joins Diamond & Diamond as senior counsel, class actions, with the BC political parties case before the Court of Appeal
“That diversity by practice, not by publicity, means we can be sensitive and open to a broader range of class actions than firms that are more monocultural,” Davis says.
As one of Canada’s largest personal injury firms, Diamond & Diamond’s sheer scale makes the pursuit of class actions possible. Inherently labour and resource intensive, Davis says he “tips his hat” to the firm’s founding and managing partners for dedicating the time and personnel to the cause. It’s also where he’s continuing as co-counsel in “the case of a lifetime.”
Davis is part of a team representing three complainants in British Columbia who allege that federal political parties are not observing best privacy practices under provincial law. Six years in, the team has prevailed at the BC Privacy Commissioner level and at the BC Supreme Court on whether provincial privacy laws apply to federal political parties. As of May 2026, the case was before the BC Court of Appeal and still awaiting a decision. The significance of the case extends well beyond the immediate outcome.
“There is still a long way to go in this case, but whatever the result – favourable or unfavourable to us – the constitutional issue this case addresses could have a broader impact on the division of powers landscape in Canada,” Davis says. “Given the importance of federal political parties in this country, and the practices of their providers and suppliers from private industry, this case will have a knock-on effect on privacy.”
‘All of one piece’ The breadth Davis brings to his work is expansive. He was appointed assistant professor, pursued a parallel career as a jazz musician and prolific author and editor, co-founded a digital forensics company in 2012, and then stepped away from music in 2020 to move to full-time practice. Throughout, the law ran underneath everything.
When he left the partnership at Fogler Rubinoff LLP, colleagues presented him with a graphic of a Kool-Aid jug – a tribute to his reputation for backing novel and unconventional litigation theories with full conviction.
It’s “all of one piece” for Davis. “Those skills really do translate into law, especially the creativity part,” he says.
As for his consecutive Best Lawyers in Canada for Privacy and Data Security Law nods, it’s not something Davis takes lightly. Yet, he’s quick to note that his passion for the practice area exists entirely independent of his career, noting that he’d be keeping up with developments even if he was retained on a single file.
“I’m grateful for the recognition, especially in this fascinating, fast-moving, expanding space of tech liability, cyber, and personal information; in many instances, I don’t feel the work to be work,” he explains. “I’m lucky that I get to work in this space, and I hope to continue bringing about results not only for the people we represent but for the broader legal community at large.”