Shopify was a Canadian corporation providing a software platform for online e-commerce transactions. The Minister issued a requirement to Shopify pursuant to s. 231.2 for information identifying listed particulars for all Canadian-resident merchant customers of Shopify. The requested particulars were more extensive than in the companion 2025 FC 968 case. The Ministers sought judicial authorization of such requirement pursuant to s. 231.2(3).
Régimbald J found that although the target group would have been "ascertainable if the requirement had been restricted to Canadian "merchants," it was unclear (due to contradictory CRA wording) whether the requirement also extended to persons, whether individual or business entities, associated with Shopify accounts. This had the effect of "rendering the target group unduly vague and diffuse, and leaving Shopify in a conundrum as to what to provide in response to the [requirement]” (para 97).
Although the request for authorization thus failed on s. 231.2(3)(a) grounds, for completeness, Régimbald J. went on to consider (i) s. 231.2(3)(b) and (ii) whether it would have been appropriate for him to exercise his residual discretion to restrict or deny the request for authorization.
Regarding (i), the potential inclusion in the requirement of persons associated with Shopify accounts (described above) violated s. 231.2(3)(b) because the Minister's evidence did not identify any intent to verify the compliance of those additional individuals and business entities with any duty or obligation under the ITA.
Regarding (ii), he indicated (at para. 255) that he agreed “with the broad idea that the Court has a residual discretion to consider privacy issues if reliable evidence demonstrates that the CRA is not able to protect the private information of taxpayers.” However, here, there was "no evidence that the CRA system is susceptible to systemic hacking so as to affect any and all information obtained by the CRA," so that his discretion should not be so exercised on that ground.
However, Shopify had brought uncontradicted evidence that complying with the requirement would take eight person-years of work. Accordingly, the proposed requirement was "disproportional," and he indicated that he would have been inclined to authorize a more limited requirement in similar terms to what was proposed in the companion case, i.e., limited to the total sales revenues and a limited list of identifying particulars (para. 268).
However, he noted (at para. 273) that after obtaining the information sought in an authorized requirement, the Minister could seek another authorization from the court for additional information if the disclosure originally obtained did not allow the CRA to conduct the compliance review it had intended to undertake. He also noted (at para. 275) that Shopify was not expected to provide information that it did not have, so that if the evidence demonstrated that it purged information two years after an account became inactive, it would not be obliged to provide that purged information. It might also adduce evidence that other information sought, such as SINs, was not available.