And the lawyer representing the students says that decision could have far-reaching implications for other similar cases.
The appeal court this week overturned a prior decision limiting the avenues the students had to pursue their case, on the grounds that they had failed to prove they actually suffered certain kinds of damage when the data was lost.
A portable hard drive with information on 583,000 Canada Student Loans Program borrowers from 2000 to 2006 went missing in 2013 and has still not been found.
But the appeal court overturned the decision, saying that in negligence and breach of confidence matters the specific details of damages don't need to be proven before a class action can go ahead.
Lawyer Ted Charney called the decision pioneering because for the first time the court has laid down legal markers for certifying class action lawsuits around privacy breaches.
The students are also suing for breach of contract and warranty, and the tort of intrusion upon seclusion — basically, invasion of privacy.
The lost files include student names, social insurance numbers, dates of birth, contact information and loan balances, as well as the personal contact information of 250 department employees.
The department has said there's no evidence the data was ever used fraudulently.
While the appeal court decision may not change the amount of damages the students could one day win, it does mean there are now four ways for students to potentially recover damages, Charney said.
But there also other implications.
"The whole area of privacy class actions and digital litigation over privacy breaches is in its infancy in Canada," he said.
"This is a pioneering decision in terms of what you need to establish at certification."
Among the cases that could be impacted is a lawsuit being brought by users of a medical marijuana program who had their identifies exposed in a government mailing.