Retail giant Shopify secures another triumphant victory.
Turned Up the Volume on Privacy
Shopify has emerged victorious in a legal tussle against the Canada Revenue Agency (CRA). A federal court ruling, led by Judge Guy Régimbald, supports the Canadian tech giant which challenged the CRA's insistence on obtaining six years' worth of Shopify's records.
The CRA aimed to scrutinize these records to determine if Canadian merchants using Shopify's software were adhering to the Income Tax Act and the Excise Tax Act. However, their request stretched far, seeking account holders' personal details such as names, birthdates, addresses, and phone numbers, along with financial information like bank branch and account numbers [1][2][4].
The CRA also demanded Shopify IDs, the type of store, activation/closure dates, and transaction data during the six-year period in question. Interestingly, some data was requested by the Australian tax regulatory body, aiming to ensure Shopify merchants were complying with their local laws [1][2].
Addressing the situation, CRA spokesperson Sylvie Branch stated that they were reviewing the details of the case. Shopify's CEO, Tobi Lütke, criticized the CRA's methods, labelling them as "flagrant abuse" in a tweet sharing the outcome of the legal battle [2].
In 2023, Shopify opposed the CRA's demands, arguing that the group of merchants the agency wanted information on was "too broad and inconsistently defined." Furthermore, the company argued that a multilateral tax treaty used to obtain information for Australia, when used for anonymous individuals, "has no domestic effect" [2].
Judge Régimbald refused to order Shopify to hand over the records, stating that the CRA had failed to specify an identifiable group of individuals whose data it wanted. Régimbald's order required the CRA to foot a bill of $45,000 in legal fees for each case, totaling $90,000 for the government [1][2].
While Shopify did not dispute its general obligation to share information, it challenged the scope, necessity, and justification of this specific bulk data request from the CRA, igniting a conversation around privacy and data protection [2].
Shopify, with its roots in the French-speaking business community, contests the notion of allowing the CRA access to its extensive financial records related to six years of transactions, arguing this could potentially expose sensitive technology-based business details.
In a tweet expressing his sentiments, Shopify's CEO, Tobi Lütke, called the CRA's methods a "flagrant abuse," suggesting possible implications for finance and technology sectors globally.
