In a major win for merchant privacy, the Canadian Federal Court has rejected the Canada Revenue Agency’s (CRA) attempt to compel Shopify to hand over six years’ worth of sensitive data on Canadian merchants.
The CRA’s request, which sought details including names, social insurance numbers, bank information, and total transaction values, was aimed at investigating undeclared income and tax compliance. But the court dismissed the request, describing it as “unintelligible, incoherent, or otherwise beyond its understanding,” and criticising the agency for failing to identify a clear, ascertainable group of merchants.
Shopify CEO Tobi Lütke responded publicly, writing on social media:
CRA demanded six years of Canadian merchant data from us. This felt like blatant overreach. We took them to court, and last Friday Justice Régimbald agreed with us. The court dismissed the request and called it ‘unintelligible, incoherent, or otherwise beyond its understanding.”
This court decision followed a two-year legal battle, with Shopify standing firm in its efforts to protect its merchants. Lütke had made it clear early on that while Shopify does not wish to fight the tax authority, the company saw the request as low-key overreach and was determined to resist.
The ruling not only shields Shopify merchants from broad, unstructured government demands but also sets a legal precedent for how third-party platforms handle government requests for user data. Notably, the court also dismissed an application to share Shopify merchant data with Australia’s tax authority, ordering the Canadian government to cover $45,000 of Shopify’s legal costs for each application.
While Shopify provides tools to help merchants manage their tax obligations, it is not responsible for filing or remitting taxes on their behalf. This distinction has been crucial in the legal debate, underscoring Shopify’s role as a platform rather than a regulatory or tax authority.
For Shopify’s vast community of Canadian merchants, this outcome reinforces trust in the platform’s commitment to safeguarding their business interests and data privacy, a stance that Lütke and his team show no signs of backing away from.
