Do government agencies generally have that kind of liability in the first place?
not exactly the same thing, but this is a $500,000 class action lawsuit for losing a USB Key containing patient data:
https://www.thestar.com/news/gta/2012/05/28/durham_region_he...
The expectation is that the government protect your privacy or pay if they fail to do so.. as with any private data.
If you can show that they didn't have audits, protections against their DB, etc. then I can imagine they'd be as liable as a private entity.
But as is mentioned, this is all but demanded of Canadians to use this service, and yet the government is absolving itself of liability.