Report on the 2025 shopify federal court decisions and the disclosure of information under unnamed persons requirements

The purpose of this report is to summarise the findings of both decisions and provide an informed opinion on whether the information sought in each case could be lawfully disclosed upon request. The analysis focuses on statutory requirements, the reasoning adopted by the Court, and the implications for future requests for data disclosure from digital platforms.

2. Summary of the Domestic Decision (2025 FC 969)

The domestic application concerned a UPR sought by the Canada Revenue Agency (CRA) to obtain extensive information on “Canadian‑resident merchants” who had used Shopify to sell goods or services over a period of six years. The Minister’s stated purpose was to verify compliance with the ITA and ensure that these merchants had properly reported taxable income and sales activity.

The Court dismissed the application on the basis that the Minister failed to meet the first statutory precondition—namely, identifying an “ascertainable group” as required under subsection 231.2(3)(a) of the ITA. This failure arose from inconsistencies in the Minister’s own definitions and descriptions of the target population. The evidence and application materials alternated between the terms “Merchant” and “Shopify Owner,” the latter being defined to include any person “associated with” an account. This definition could capture employees, contractors, former owners, or other persons who had no obligation under the ITA arising from business activity.

The application also suffered from inconsistencies regarding the geographical criterion for inclusion. Portions of the UPR referred to merchants who provided a Canadian address “when registering,” while others appeared to include accounts that had at any point been associated with a Canadian address. Shopify demonstrated that users can freely update addresses within their accounts, making the scope of the request unclear and impractical to implement with precision.

Although the Court recognised that verifying tax compliance is a legitimate and proper purpose under the ITA, the ambiguity surrounding the group defeated the Minister’s ability to satisfy the first legal requirement. Consequently, the Court did not authorize the UPR. The ruling emphasised that while information‑gathering powers are broad, they are constrained by strict statutory conditions that must be fully satisfied to protect taxpayer privacy and prevent open‑ended fishing expeditions.

3. Summary of the International Decision (2025 FC 968)

The second case arose from a request by the Australian Taxation Office (ATO), transmitted through the Multilateral Convention on Mutual Administrative Assistance in Tax Matters. Australia sought information on Shopify merchants who had made sales to Australian consumers, potentially triggering obligations under Australian Goods and Services Tax (GST) legislation. In response, the Minister applied for a UPR compelling Shopify to disclose merchant identities, contact details, URLs, and revenue attributable to Australian customers.

The Court dismissed this application on different grounds from the domestic case. The central issue was whether subsection 231.2(3)(b) of the ITA—requiring that the requested information be necessary to verify compliance “under this Act”—could be satisfied when the purpose of the request was exclusively to assist a foreign tax authority.

The Court held that the Convention has not been incorporated into subsection 231.2(3), and therefore cannot expand or modify the domestic statutory requirements governing UPRs. While the Convention is expressly incorporated into subsection 231.2(1), which governs named persons requirements, Parliament did not extend the same status to unnamed persons provisions. Further, Canada’s ratification of the Convention does not itself make it enforceable domestically; under Canada’s dualist legal system, treaties require explicit legislative implementation to have domestic effect.

Because the CRA acknowledged that the information was not being sought for any Canadian tax compliance purpose, the second statutory precondition was not met. As a result, the application had to be dismissed. The Court noted that the request could not be justified by treaty obligations, because the Convention itself permits countries to decline requests that would require measures not authorised under their domestic law.

4. Opinion on Whether the Information Could Be Disclosed

4.1 Disclosure in a Domestic Context

The Court’s reasoning in 2025 FC 969 confirms that Shopify can be compelled to disclose information pursuant to a UPR provided the statutory requirements are met. The failure in the present case was not due to an inherent defect in seeking information from Shopify, nor because the requested data was categorically protected. Instead, the request failed because it was drafted imprecisely, inconsistently, and in a manner that prevented Shopify from confidently identifying the affected individuals.

A revised UPR that clearly identifies the target group—using terminology consistent with Shopify’s internal structures—and restricts the scope to persons who actually conduct taxable activity could likely satisfy the statutory test. Therefore, disclosure is possible, but only with a properly drafted and legally compliant request.

4.2 Disclosure in an International Context

In contrast, the ruling in 2025 FC 968 establishes that Shopify cannot be compelled to disclose information through a UPR when the purpose is to fulfil an international tax information‑sharing request. Parliament has not expanded the UPR regime to include treaty obligations, and subsection 231.2(3)(b) expressly limits UPRs to verifying compliance under Canadian tax law. Until such time as Parliament amends the statute, the Minister cannot lawfully issue a UPR solely for the benefit of a foreign authority.

Nonetheless, Canada may still exchange information under the Convention where such information is already lawfully in its possession and disclosure is permitted under section 241 of the ITA. The limiting factor is that a UPR cannot be used to obtain the information in the first instance for foreign purposes.

5. Conclusion

The Shopify decisions reaffirm the strict statutory limits placed on unnamed persons requirements under Canadian law. The domestic decision underscores the necessity for clarity, precision, and consistency when defining the target group in a UPR. The international decision establishes that the UPR mechanism cannot be used to obtain information solely to satisfy foreign tax authorities, as the Convention has not been incorporated into subsection 231.2(3) of the ITA.

In summary, disclosure may be possible in the domestic context where the statutory criteria are met through careful drafting; however, disclosure is not currently permissible through a UPR for the purposes of fulfilling international treaty requests. Future legislative amendment could change this landscape, but until then, the boundaries established by the Court remain both clear and firm.