[1] Subsection 231.2(1) of the Income Tax Act, RSC 1985, c 1 (5th Supp) [ITA or the Act] and subsection 289(1) of the Excise Tax Act, RSC 1985, c E-15 [ETA] allow the Minister of National Revenue [the Minister or the CRA (Canada Revenue Agency)] to obtain any information or document from any person for any purposes related to the administration or enforcement of the ITA and Part IX (“Goods and Services Tax”) of the ETA, or for the enforcement of a “listed international agreement.” Requests for information under those provisions are colloquially known as “named persons requirements,” because the Minister knows and names the persons they target.

[2] Under subsection 231.2(3) of the ITA and its equivalent subsection 289(3) of the ETA, the Minister may request disclosure of information and documents from other persons, but instead of relating to persons known to the Minister under subsections 231.2(1) of the ITA or 289(1) of the ETA, this type of request relates to an “ascertainable” group of “unnamed persons.” This is what is colloquially known as an “unnamed persons requirement” [UPR], because the Minister targets persons that are not yet known to them. Unlike a “named persons requirement” under subsections 231.2(1) of the ITA and 289(1) of the ETA, the Minister does not have the unilateral power to obtain information through a UPR. Instead, the Minister must first obtain the authorization of the Court, pursuant to subsections 231.2(3) of the ITA or 289(3) of the ETA.

[3] The Court will only authorize a UPR when the preconditions set forth in subsections 231.2(3) of the ITA or 289(3) of the ETA are met, namely when (a) there is an “ascertainable” group of persons whose information is requested and (b) the request “is made to verify compliance by the person or persons in the group with any duty or obligation under [the ITA or Part IX of the ETA].” However, meeting these preconditions does not preclude the Court from exercising its residual discretion to deny authorization or impose “any conditions that the [Court] considers appropriate” in the circumstances (Canada (National Revenue) v Derakhshani, 2009 FCA 190 at para 19 [Derakhshani]; Canada (National Revenue) v RBC Life Insurance Company, 2013 FCA 50 at paras 23, 30 [RBCLIC]; Rona Inc v Canada (National Revenue), 2017 FCA 118 at para 7 [Rona FCA], leave to appeal to the Supreme Court of Canada dismissed, see Rona Inc v Minister of National Revenue, 2018 CanLII 3412 (SCC); Roofmart Ontario Inc v Canada (National Revenue), 2020 FCA 85 at para 56 [Roofmart]).

[4] While these reasons will refer solely to the ITA, they apply to the equivalent ETA provisions at issue (Roofmart at paras 1–2).

[5] In this case, the Minister seeks the authorization of the Court to issue Shopify Inc. [Shopify] a UPR, thus submitting that their Application meets the legislative preconditions set out in subsection 231.2(3) of the ITA. On the first precondition, the Minister claims to have identified a group of Shopify “Merchants” that are “ascertainable” by their sales or leases of products or services and use of Shopify’s platform. On the second precondition, they further contend that the information and documents are sought to verify the unnamed persons’ compliance with their duties and obligations under the ITA. Shopify contests these claims, insisting that the target group is both overly broad and inconsistently defined, and that the Minister has failed to establish a good faith audit purpose.

[6] For the reasons below, the Court cannot authorize the UPR proposed by the Minister.

[7] The UPR request does not clearly set out an “ascertainable” group. While the term “Merchant” as defined by the Minister is known and identifiable to Shopify, the Minister’s inconsistent use and scoping of the terms employed in their request renders their proposed UPR ambiguous and unworkable. Having failed to meet the precondition set under paragraph 231.2(3)(a), the Minister’s Application must fail. This is a threshold issue. It is therefore unnecessary to determine whether the target group meets the statutory precondition set out in paragraph 231.2(3)(b) of the ITA, and how this Court should exercise its discretion in the circumstances.

[8] However, for the sake of comprehensiveness and because the Minister has indicated that their Application would serve as a test case for future applications under subsection 231.2(3), I will conduct an analysis on those two further issues.

[9] In this vein, I find that the ambiguity of the target group undermines the Minister’s ability to establish that the Proposed UPR was made to verify the compliance of the unknown persons with their obligations under the ITA. The evidence is unclear as to what group the Minister seeks to target with their Application, which makes it equally unclear as to whether “the requirement is made to verify compliance by the person or persons in the group” (emphasis added) (see paragraph 231.2(3)(b) of the ITA).

[10] This Application arises in the context of a related but separate UPR application [File No. T-777-23], involving the same parties and a similar request. Although both applications were heard together, with some measure of overlap in the issues and arguments presented, they are meaningfully distinct. File No. T-777-23 concerns a different group whose information is being sought in relation to an Australian Tax Office request, pursuant to the Convention on Mutual Administrative Assistance in Tax Matters, 25 January 1988 (as amended on 27 May 2010), ETS 1988 No 127 (entered into force 1 June 2011, accession by Canada 21 November 2013). The present Application is purely domestic in nature, similar to other UPR applications that have previously come before this Court (see e.g. Canada (National Revenue) v Hydro-Québec, 2018 FC 622 [Hydro-Québec #1]; Canada (National Revenue) v Royal Bank of Canada, 2021 FC 830 [RBC]; Canada (National Revenue) v Bambora Inc, 2023 FC 980 [Bambora]). The reasons in this decision are accordingly distinct and independent from those in File No. T-777-23.

II. Context

[11] Shopify is a Canadian corporation offering a subscription-based software platform to build and run independent stores across multiple digital and physical sales venues, including online businesses. Through the popularity of its various services, it has become a leading provider of online e-commerce infrastructure.

[12] The software that Shopify offers its users is said to be content-neutral. It is not a marketplace for e-commerce in itself, but an integrated back-office system that enables its users to sell products and services online, or otherwise keep records and books. For Shopify users that do make sales, products and services may be sold over more than a dozen channels, including brick-and-mortar stores, e-commerce marketplaces such as eBay and Amazon, social media such as Instagram and Tik Tok, or through a public-facing website hosted by Shopify.

[13] Not all Shopify users sell products and services through an “online store” hosted by Shopify. However, users that do make sales through Shopify’s platform may rely on Shopify’s “Checkout” software [“Shopify Checkout”]. Shopify Checkout integrates several “payment gateways,” “payment processors,” and “payment aggregators,” which are required to complete online payments.

[14] A payment processor is an intermediary between a business selling a product or service and a customer (e.g., banks, credit card institutions, or other financial institutions involved in a transaction), meant to facilitate the transaction and transfer of funds. Many payment processors exist, such as PayPal and Authorize.net. Shopify has its own payment processor [“Shopify Payments”], which “white-labels” the services of Stripe Inc. [Stripe], meaning that Shopify offers Stripe services under its own brand “Shopify Payments” (Fazeli Affidavit at paras 22(e), 24–26, Respondent’s Record at 48–49 [RR]).

[15] Where an account uses Shopify’s financial services (Shopify Checkout or Shopify Payments), Shopify requires additional information to be disclosed such as date of birth, business number, business name and/or operating name, email and mailing address, telephone number, domain name and IP address, “payment gateways,” “payment processors,” banking information, total number and total value of transactions for each year, the date that the account was activated and/or closed, and in some cases the Know-Your-Customer [KYC] documentation (Fazeli Affidavit at paras 13, 18(b), 22(e), 23–26, 45, 47, 53–58, 60, 65, 70, 74, 78–80, 86–87, RR at 45, 46, 48–49, 52, 53, 54, 56, 58, 59, 60; Fazeli Cross-Examination at 31–34, 40–44, 98, 101–109, 113–126, Applicant’s Record at 74–77, 83–87, 141, 144–152, 156–169 [AR]; Lee Affidavit, RR at 98–99, Tab 4, Exhibit “B” – “Shopify Terms of Service”).

III. The Draft Requirement

[16] The authorization process provided under the ITA requires the Court to review the UPR requested by the Minister and the evidence supporting its various items. In the present case, the parties have agreed that the draft requirement contains twenty-one separate items, each of which must be duly considered in the Court’s ultimate determination. The draft requirement reads as follows:

Pursuant to subsections 231.2(1), (2), and (3) of the Income Tax Act (the “ITA”) and subsections 289(1), (2), and (3) of the Excise Tax Act (the “ETA”), Shopify is required to provide within sixty (60) days from the date of this notice of requirement, for the period of six years preceding the date of the Federal Court Order XXXXXX, the following information regarding Shopify merchants who gave a Canadian address when registering for a Shopify account and that have sold and/or leased products and/or services using Shopify:

A. A list of all Shopify Canadian-resident merchant accounts, both active and inactive, either alone or jointly with any other person(s) or business(es), that includes the following information associated with each account:

1)the Shopify ID number;
2)the name of each person(s) (whether individual or business entity) associated with the Shopify account (“Shopify Owner”);
3)the date of birth of each Shopify Owner;
4)Social Insurance Number of each Shopify Owner;
5)the Business Number, business name and/or operating name;
6)the full mailing address(es);
7)the telephone number(s);
8)the email address(es);
9)the banking account information (transit, institution, and account numbers);
10)the store(s) website (domain name) including IP address(es);
11)the Shopify store(s) type;
12)the name of the payment gateway(s)/processors used and/or listed;
13)the “know your customer” documentation;
14)the date the Shopify account was activated;
15)the date the Shopify account was closed.

B. Information on transactions made in the Canadian-resident merchant account:

1)The total number of transactions for each of the relevant years;
2)The total value of the transactions for each of the relevant years.

C. An appendix giving an explanation and/or definition for each abbreviation or symbol that may appear in the information provided.

(Kalil Affidavit, AR at 37–38, Tab 3.(b), Exhibit “B” – “Draft requirement”) [Proposed UPR]

IV. Issues

[17] The sole question is whether this Court should authorize the Proposed UPR, pursuant to subsection 231.2(3) of the ITA. The Application raises three issues in this respect: (a) whether the Minister has identified an “ascertainable” group of persons; (b) whether the Proposed UPR is made to “verify compliance by the persons in the group with any duty or obligation [under the ITA]”; and (c) whether this Court should exercise its residual discretion to deny the authorization, or provide any conditions in relation to the Proposed UPR.

V. Analysis

[18 ] Subsection 231.2(1) of the ITA enables the Minister to serve on any person a notice requiring them to provide any information or document for any purpose related to the administration or enforcement of the ITA, or of a listed international agreement or tax treaty with another country. This entitlement is subject to subsection 231.2(2), which provides that requirements relating to one or more “unnamed persons” must first be authorized by a judge of the Federal Court. To authorize the requirement, the Court must be satisfied that the Minister’s application meets the preconditions set out in subsection 231.2(3). Section 231.2 of the ITA provides as follows:

Requirement to provide documents or information

(1) Notwithstanding any other provision of this Act, the Minister may, subject to subsection (2), for any purpose related to the administration or enforcement of this Act (including the collection of any amount payable under this Act by any person), of a listed international agreement or, for greater certainty, of a tax treaty with another country, by notice sent or served in accordance with subsection (1.1), require that any person provide, within such reasonable time as is stipulated in the notice,

(a) any information or additional information, including a return of income or a supplementary return; or

(b) any document.

[…]

Unnamed persons

(2) The Minister shall not impose on any person (in this section referred to as a “third party”) a requirement under subsection 231.2(1) to provide information or any document relating to one or more unnamed persons unless the Minister first obtains the authorization of a judge under subsection 231.2(3).

Judicial authorization

(3) A judge of the Federal Court may, on application by the Minister and subject to any conditions that the judge considers appropriate, authorize the Minister to impose on a third party a requirement under subsection (1) relating to an unnamed person or more than one unnamed person (in this subsection referred to as the “group”) if the judge is satisfied by information on oath that

(a) the person or group is ascertainable; and

(b) the requirement is made to verify compliance by the person or persons in the group with any duty or obligation under this Act.

(c) and (d) [Repealed, 1996, c. 21, s. 58(1)]

(4) to (6) [Repealed, 2013, c. 33, s. 21]

Production de documents ou fourniture de renseignements

(1) Malgré les autres dispositions de la présente loi, le ministre peut, sous réserve du paragraphe (2) et, pour l’application ou l’exécution de la présente loi (y compris la perception d’un montant payable par une personne en vertu de la présente loi), d’un accord international désigné ou d’un traité fiscal conclu avec un autre pays, par avis signifié ou envoyé conformément au paragraphe (1.1), exiger d’une personne, dans le délai raisonnable que précise l’avis :

a) qu’elle fournisse tout renseignement ou tout renseignement supplémentaire, y compris une déclaration de revenu ou une déclaration supplémentaire;

b) qu’elle produise des documents.

[…]

Personnes non désignées nommément

(2) Le ministre ne peut exiger de quiconque — appelé « tiers » au présent article — la fourniture de renseignements ou production de documents prévue au paragraphe (1) concernant une ou plusieurs personnes non désignées nommément, sans y être au préalable autorisé par un juge en vertu du paragraphe (3).

Autorisation judiciaire

(3) Sur requête du ministre, un juge de la Cour fédérale peut, aux conditions qu’il estime indiquées, autoriser le ministre à exiger d’un tiers la fourniture de renseignements ou la production de documents prévues au paragraphe (1) concernant une personne non désignée nommément ou plus d’une personne non désignée nommément — appelée « groupe » au présent paragraphe —, s’il est convaincu, sur dénonciation sous serment, de ce qui suit :

a) cette personne ou ce groupe est identifiable;

b) la fourniture ou la production est exigée pour vérifier si cette personne ou les personnes de ce groupe ont respecté quelque devoir ou obligation prévu par la présente loi;

c) et d) [Abrogés, 1996, ch. 21, art. 58(1)]

(4) à (6) [Abrogés, 2013, ch. 33, art. 21]

[19] Subsection 231.2(3) of the ITA thus prescribes the test under which the Court must consider the Minister’s application.

[20] The Court must carry out this test in three steps. The first two correspond to the statutory preconditions set out in subsection 231.2(3), and must be undertaken on a balance of probabilities: on the first step, the Court must be satisfied that the group or person identified in the Minister’s application is “ascertainable” (see paragraph 231.2(3)(a) of the ITA); on the second, the Court must be satisfied that the Minister’s requirement is being made to verify the targeted persons’ compliance with any duty or obligation under the ITA (see paragraph 231.2(3)(b) of the ITA). The third step engages this Court’s residual discretion, granting it the authority to deny authorization even when the Minister meets the statutory preconditions, or to impose any conditions that the Court considers appropriate (Rona FCA at para 7). This is a deeply fact-specific exercise, one in which the Court may review all of the circumstances relevant to the application in deciding whether to grant the authorization or impose specific conditions (RBCLIC at paras 23, 30).

[21] There is no need for the Court to balance a person’s privacy rights with the Minister’s ability to administer and enforce the ITA: “Parliament has already done that balancing and made its decision” (Roofmart at para 21). The Court’s role rather lies in ensuring that the two factual preconditions set out in subsection 231.2(3) have been established. The fear of abuse, or the taxpayer’s right to privacy, cannot be “used to create an unexpressed exception to clear language,” or displace the principles governing the interpretation of taxation legislation (Roofmart at para 20, citing Placer Dome Canada Ltd v Ontario (Minister of Finance), 2006 SCC 20 at para 23).

[22] The unnamed persons provisions of the ITA are a limitation of the Minister’s otherwise extensive powers, guarding against undue encroachment into the lives of taxpayers. Yet the fear of undue encroachment is no license to read in additional conditions into the legislation (Roofmart at paras 20–21). The words of subsection 231.2(3) leave little ambiguity, specifying the exact conditions that must be satisfied for the Minister to obtain judicial authorization for a UPR request. They are precise and unequivocal (see Bonnybrook Park Industrial Development Co Ltd v Canada (National Revenue), 2018 FCA 136 at para 34 [Bonnybrook], citing Canada Trustco Mortgage Co v Canada, 2005 SCC 54 at para 10 [Canada Trustco]).

[23] In this vein, courts operate on the presumption of Parliament’s knowledge and competence. The legislature is presumed to know all that is necessary to produce rational and effective law (Willick v Willick, 1994 CanLII 28 (SCC), [1994] 3 S.C.R. 670 at 699; Canada (Canadian Human Rights Commission) v Canada (Attorney General), 2011 SCC 53 at para 45; see also 65302 British Columbia Ltd v Canada, 1999 CanLII 639 (SCC), [1999] 3 S.C.R. 804 at para 7, citing Ruth Sullivan, Driedger on the Construction of Statutes, 3^rd ed (Toronto: Butterworths, 1994) at 288), and is indeed presumed to be a skillful crafter of legislative schemes and provisions (Canada 3000 Inc, Re; Inter-Canadian (1991) Inc (Trustee of), 2006 SCC 24 at paras 36–37). Closely related is the presumption of perfection: Parliament says what it means and means what it says (Re Dillon and Catelli Food Products Ltd (and twenty-two other appeals), 1937 CanLII 107 (ON CA), [1937] OR 114 at 176 (Ont CA)).

[24] The history of the provision shows how Parliament balanced the rights and interests at issue.

[25] When Parliament first enacted section 231.2 in 1986, it required the Minister to meet two further statutory preconditions for the authorization of a UPR request. Beyond the group’s “ascertainable” nature and the purpose of the requirement being to “verify” compliance, the Minister was required to prove that it was reasonable to suspect that the unnamed persons may not comply with the ITA and that the information sought was not otherwise more readily available (Canada, Department of Finance, Technical Notes to a Bill Amending the Income Tax Act and Related Statutes, issued by the Honourable Michael Wilson (Ottawa: Department of Finance, November 1985) at 134–135).

[26] Parliament repealed these preconditions in 1996, intent on easing the Minister’s burden of proof to obtain authorization for the issuance of a UPR (Roofmart at para 26, citing Canada (National Revenue) v Greater Montréal Real Estate Board, 2007 FCA 346 at paras 36–38 [GMREB], leave to appeal to the Supreme Court of Canada dismissed, see Chambre immobilière du grand Montréal c Ministre du Revenu national, 2008 CanLII 18937 (SCC)).

[27] However, in 2013, the ITA was again amended to remove the ex parte stage of the authorization process, now requiring an application to the Court with the possible participation—and objection—of a third party (Economic Action Plan 2013 Act, No 1, SC 2013, c 33, s 21(1); see also Roofmart at para 51).

[28] The relative alleviation of the Minister’s justificatory burden speaks to the importance and breadth of their investigatory power. No proof of a “genuine and serious inquiry” is required on behalf of the Minister (Roofmart at para 26, citing eBay Canada Ltd v MNR, 2008 FCA 348 at paras 62, 68 [eBay, 2008 FCA 348]). Nor is there need for a “good faith” audit purpose, beyond what the words of the ITA already require (Roofmart at para 52). Parliament has granted the Minister broad powers to verify and test taxpayer compliance, and these powers are central to their ability to enforce the ITA (Roofmart at para 55; see also eBay Canada Limited v Canada (National Revenue), 2008 FCA 141 at para 39 [eBay, 2008 FCA 141]; RBC at paras 13–15).

[29] At this juncture, it is useful to note that under paragraph 231.1(1)(d) of the ITA (and paragraph 288(1)(c) of the ETA), a person authorized by the Minister may require a taxpayer or any other person to answer questions related to the administration or enforcement of the ITA. The Minister has no obligation to consult a person on whom a requirement to provide information would then be imposed, but inadequate consultation may lead to circumstances where the UPR request is not sufficiently clear or tailored to the procedures of the third party to allow it to properly respond. In such situations, the Court may have to reject the Minister’s application because the UPR request is unclear for the third party, in circumstances where adequate consultation under paragraph 231.1(1)(d) could have enabled the Minister and the third party to properly construe the wording of the proposed UPR for the Court’s approval. In other words, collaboration may be key in UPR requests.

[30] In this case, Shopify alleges that the Minister stated that they did not intend to issue any UPR without prior collaborative discussion with the company (Respondent’s Memorandum at paras 19–21). The Minister responded in their oral submissions that they were under no obligation to engage in such collaboration, but that they considered collaboration as part of their “best practices.”

[31] On a plain reading of the ITA, there is indeed no such obligation on the Minister to consult a third party prior to seeking the authorization of the Court to issue a UPR request. Though it is true that in past cases the Minister has collaborated with companies to obtain certain commitments as to the wording of the UPR request (see Rona FCA at para 6; Ministre du Revenu national c Rona Inc, 2016 CarswellNat 5372 [Rona FC]; RBC at para 2), communications with third parties are not a necessary step of the UPR process.

A. The Requirement of an “Ascertainable” Group

[32] Identifying an “ascertainable” group of persons is the first statutory precondition for the judicial authorization of a UPR request, pursuant to paragraph 231.2(3)(a).

[33] There are no fixed criteria in the ITA or case law to determine whether a group is “ascertainable” under paragraph 231.2(3)(a). At the very least, the jurisprudence suggests that it is not purely a question of size and precision: “[the] fact that the UPR may target an unspecified or large number of accounts or that a significant amount of financial information may be captured does not affect its validity” (Roofmart at para 39). It is open to the Minister to conduct “horizontal or sector wide assessments of tax compliance,” and permissible for a UPR to “inadvertently sweep” within its ambit some persons “who may be of no interest for the Minister for the purposes of verifying compliance” (Roofmart at para 40).

[34] A UPR request need not be perfectly tailored to the target group; “unnamed” means “not known to the Minister,” rather than “not named in the Requirement” (Ghermezian v Canada (Attorney General), 2020 FC 1137 at paras 67–74 [Ghermezian]). It is thus expected that in casting their net, the Minister will undoubtedly catch some information that they did not intend to see and for which they have no use: in amending subsection 231.2(3), “Parliament permitted a type of fishing expedition, with the authorization of the Court and on conditions prescribed by the Act, all for the purpose of facilitating the MNR’s access to information” (Roofmart at para 45, citing GMREB at para 45). The threshold of precision designated by the term “ascertainable” is accordingly low.

[35] A review of the relevant case law confirms the relative ease with which the Minister can identify an “ascertainable” group before the Court. In Roofmart (at paras 38–41) the Federal Court of Appeal upheld a UPR request targeting residential and commercial construction contractors who had accounts with the company and an annual total purchase and/or billed amount of $10,000 or $20,000 or greater, for two distinct periods respectively (see Roofmart at para 4; Canada (National Revenue) v Roofmart Ontario Inc, 2019 FC 506 at para 11), deeming a “total annual purchase requirement” to be a sufficient means of establishing a target group.

[36] Prior to Roofmart, the Federal Court of Appeal similarly upheld a request authorizing the Minister to issue a UPR targeting the commercial customers of fifty-seven large retail stores, allowing them to seek the name, address, and the total amount of annual transactions on each commercial account for a period of three years (Rona FCA at para 6).

[37] The Federal Court of Appeal likewise upheld a UPR authorization that would identify “PowerSellers” in Canada, meaning those who had sold more than a certain volume of items on eBay, the world’s then-largest global online marketplace (eBay, 2008 FCA 348 at para 11). The company would be required to release Canadian-address customer information to which it had access, though it did not own the data, which was available on servers outside Canada (eBay, 2008 FCA 348 at paras 47–51). To this effect, the Federal Court has since ruled on numerous occasions that if foreign-based information is also located in Canada, it can be compelled to disclose information under section 231.2, by virtue of its Canadian location (Ghermezian at para 99; Shokouhi v Canada (Attorney General), 2021 FC 1340 at paras 21–26 [Shokouhi]).

[38] In Canada (National Revenue) v PayPal Canada Co, 2017 CarswellNat 6671 [PayPal], Justice Gascon of the Federal Court found that four years’ worth of aggregated transaction information of corporations and individuals holding a PayPal Canada Co. Business Account was an “ascertainable” group and not overbroad (PayPal at paras 5–6). Of particular significance in that case was how PayPal itself indicated to the Minister that the information sought was available in its computer systems, and did not submit any evidence showing that it was not feasible for it to provide the information or that it was unable to comply with the proposed UPR (PayPal at paras 11, 14, 18).

[39] Since then, the Federal Court has authorized UPR requests of varying breadth and precision. In RBC, Justice Little authorized a UPR seeking the names and addresses of account holders, signing officers, and powers of attorney associated with a specified bank account at an RBC branch in Calgary. Referring to the guidance in Roofmart, the Court notably held that the group was “ascertainable” in light of RBC maintaining books and records with the information sought, thus giving the targeted entity the power to identify and list the unnamed persons associated to each account (RBC at para 16).

[40] Justice Little authorized a different UPR in Bambora, this time seeking the contact information, banking information, and total monthly aggregate of transactions information of all Canadian “merchants” (the same term used in the Proposed UPR) registered with and using Bambora Inc.’s mobile payment and processing products and services over a four-year period. The group was again deemed “ascertainable,” the merchants being customers of and registered with the company.

[41] Most recently, in Canada (National Revenue) v Helcim Inc, 2023 FC 1202 [Helcim], Justice McDonald authorized a UPR targeting the registered account holders of a mobile payment device company, citing the electronic records maintained by the company, which included the names, banking information, and sales history of the “merchants” (again, the same term used in the Proposed UPR) (Helcim at paras 16–22).

[42] To date, the sole occasion on which the Federal Court has deemed a group to be unascertainable was the UPR request denied by Justice Roy in Hydro-Québec #1. The group in question consisted of “legal or natural persons not subject to [Hydro-Québec’s] large-power or domestic rate,” which represented some 4.3 million customers (Hydro-Québec #1 at para 19). Finding the UPR overly broad, Justice Roy held that “[when] the group is generic and has no connection to the ITA, and information can be requested outside of the scope of the ITA (such as identifying the business clients of a public utility) there is no longer any limit on the fishing expedition” (Hydro-Québec #1 at para 78). This test for determining whether a group is “ascertainable” was relied upon by the appellants in Roofmart, and rejected by the Federal Court of Appeal in that same decision (Roofmart at paras 36–42). A “generic” group may nevertheless be considered “ascertainable,” and the availability of the information through other means is irrelevant to the analysis (Roofmart at para 37).

[43] A review of the relevant case law shows “ascertainable” to be a low threshold. In theory and in practice, the requirement of an “ascertainable” group is easily met by the Minister. However, in light of the arguments presented in this Application and its companion File No. T-777-23, it is worth expounding the conceptual contours of the “ascertainable” group requirement in more detail. The type of analysis required of the authorizing court involves a highly context-specific determination, but there is no doubt a set of minimal conditions that “ascertainable” groups will meet in the usual course of events—conditions that are self-evident within or inherent to the process itself, rather than additional criteria to be met by the Minister.

[44] In elaborating these minimal conditions, I am mindful that this Court’s approach remains grounded in the modern principle, according to which the words of the ITA are to be read in their entire context and in their grammatical and ordinary sense harmoniously with the scheme of the Act (Stubart Investments Ltd v The Queen, 1984 CanLII 20 (SCC), [1984] 1 S.C.R. 536, citing Elmer Driedger, Construction of Statutes, 2^nd ed (Toronto: Butterworths, 1983) at 87); Rizzo & Rizzo Shoes Ltd (Re), 1998 CanLII 837 (SCC), [1998] 1 S.C.R. 27 at paras 21–22 [Rizzo]; Bell ExpressVu Limited Partnership v Rex, 2002 SCC 42 at para 26; Piekut v Canada (National Revenue), 2025 SCC 13 at paras 42–49 [Piekut]; Telus Communications Inc v Federation of Canadian Municipalities, 2025 SCC 15 at paras 30, 43, 53, 104 [Telus]). This remains the case even if “the particular nature of tax statutes and the peculiarities of their often complex structures” impose a heightened emphasis on the actual words of the ITA, such that “[broad] considerations of statutory purpose should not be allowed to displace the specific language used by Parliament” (Imperial Oil Ltd v Canada, 2006 SCC 46 at paras 24–29 [Imperial Oil], citing Ludco Enterprises Ltd v Canada, 2001 SCC 62 at para 36).

[45] The Supreme Court of Canada has recently underscored the centrality of legislative text to the exercise of statutory interpretation, referring to text as the “anchor of the interpretive exercise” and “the focus of interpretation” that reveals “the means chosen by the legislature to achieve its purposes” (Quebec (Commission des droits de la personne et des droits de la jeunesse) v Directrice de la protection de la jeunesse du CISSS A, 2024 SCC 43 at para 24 [CISSS], citing Mark Mancini, “The Purpose Error in the Modern Approach to Statutory Interpretation” (2022) 59 Alta L Rev 919 at 927, 930–931). The Court’s interpretative task resides in ensuring a construction of the text that most faithfully ensures the “attainment of its object and carrying out of its provisions according to their true intent, meaning and spirit” (CISSS at para 24; see also Rizzo at paras 21–22).

[46] Just as with any other federal statute, the ITA must also be read in view of section 12 of the Interpretation Act, RSC 1985, c I-21 [Interpretation Act], such that paragraph 231.2(3)(a) must be “given such fair, large and liberal construction and interpretation as best ensures the attainment of its objects” (see Piekut at para 46; Onex Corporation v Canada (Attorney General), 2024 FC 1247 at para 50 [Onex], citing Canada (National Revenue) v ConocoPhillips Canada Resources Corp, 2017 FCA 243 at para 36).

[47] When the words of a provision are precise and unequivocal, the ordinary meaning of the words play a dominant role in the interpretive process. Of course, the apparent clarity of words taken separately does not suffice, because they “may in fact prove to be ambiguous once placed in their context. The possibility of the context revealing a latent ambiguity such as this is a logical result of the modern approach to interpretation” (La Presse inc v Quebec, 2023 SCC 22 at para 23, citing Montréal (City) v 2952-1366 Québec Inc, 2005 SCC 62 at para 10). On the other hand, where the words can support more than one reasonable meaning, the ordinary meaning of the words plays a lesser role (Bonnybrook at para 34, citing Canada Trustco at para 10).

[48] In this vein, it is further presumed that the legislature avoids superfluous words and that it does not pointlessly repeat itself or speak in vain (McDiarmid Lumber Ltd v God’s Lake First Nation, 2006 SCC 58 at para 36). Every word in a statute is presumed to have meaning and courts must construe statutes in a manner to ascribe some meaning to each and every word used by the legislature (Tower v MNR (FCA), 2003 FCA 307 at para 15, citing Economic Development Fund v Canadian Pickles Corp, 1991 CanLII 48 (SCC), [1991] 3 S.C.R. 388 at 408).

[49] Accordingly, this Court should also be mindful of the presumption of consistent expression, by which the meaning of the words used in statutes remains consistent, because “the legislature is presumed to use language such that the same words have the same meaning both within a statute and across statutes” (Canada (Minister of Citizenship and Immigration) v Vavilov, 2019 SCC 65 at para 44, citing Ruth Sullivan, Sullivan on the Construction of Statutes, 6^th ed (Markham: LexisNexis, 2014) at 217; see also Agraira v Canada (Public Safety and Emergency Preparedness), 2013 SCC 36 at para 81; Telus at para 55; Rio Tinto Iron and Titanium Inc v Canada (Attorney General), 2025 FC 311 at para 124 [Rio Tinto], citing R v Basque, 2023 SCC 18 at para 59; Pierre-André Côté and Mathieu Devinat, Interprétation des lois, 5^th ed (Montréal: Éditions Thémis, 2021) at Nos 1142–1143).

[50] Finally, a proper exercise of statutory interpretation requires due consideration of both the French and English versions of the provision. As recently explained by the Supreme Court of Canada in Piekut:

[53] [t]he interpretation of a bilingual enactment must begin with a search for the shared meaning between the two official language versions (R. v. Daoust, 2004 SCC 6, [2004] 1 S.C.R. 217, at para. 26, citing R. v. Mac, 2002 SCC 24, [2002] 1 S.C.R. 856, at para. 5). The shared meaning is generally preferred unless other indicators of legislative intent suggest that the shared meaning is inappropriate (Doré v. Verdun (City), 1997 CanLII 315 (SCC), [1997] 2 S.C.R. 862, at para. 25; Khosa, at paras. 38-40).

[…]

[59] Where one version of bilingual legislation is broader than the other version, the narrower version reflects the shared meaning (Canada (Transportation Safety Board) v. Carroll-Byrne, 2022 SCC 48, at para. 72, citing Medovarski v. Canada (Minister of Citizenship and Immigration), 2005 SCC 51, [2005] 2 S.C.R. 539, at para. 25, and Côté and Devinat, at para. 1131; see also Daoust, at para. 29; Sullivan, at § 5.03[6]). Here, the French text of s. 178(1)(g) is narrower than the English text. The entire French text is qualified by the words “au regard de la loi applicable”, while in the English text only s. 178(1)(g)(i) is qualified by the words “under the applicable Act or enactment”, leaving the possibility that the date in s. 178(1)(g)(ii) is determined on another basis. The narrower French text eliminates this possibility and hence reflects the shared meaning.

(Piekut at paras 53, 59).

[51] Applying these principles in the context of this Application, I note first that the term “ascertainable” appears twice in the ITA, outside of paragraph 231.2(3)(a). Its first appearance is in subparagraph 10.1(5)(b)(ii), which defines the term “eligible derivative” as a “swap agreement, a forward purchase or sale agreement, a forward rate agreement, a futures agreement, an option agreement or a similar agreement, held at any time in the taxation year by the taxpayer [if, among other conditions] the taxpayer has not produced audited financial statements described in subparagraph (i), [and] the agreement has a readily ascertainable fair market value” (emphasis added). The second appearance of the term is in subsection 248(1) of Part XVII of the ITA, which defines the term “office” as “the position of an individual entitling the individual to a fixed or ascertainable stipend or remuneration…” (emphasis added). The French versions of both these provisions translate “ascertainable” into “vérifiable,” whereas paragraph 231.2(3)(a) uses the word “identifiable.”

[52] The case law interpreting subparagraph 10.1(5)(b)(ii) sheds little light on the meaning of the term “ascertainable,” but the matters dealing with the term “office” under subsection 248(1) are more useful. As will be expounded below, there is some disagreement as to the degree of prior knowledge implied by the term “ascertainable,” i.e., what must be known a priori about the thing that must be ascertained.

[53] Of interest is the analysis undertaken by Justice Reed in Merchant v The Queen, 1984 CanLII 5359 (FC), [1984] 2 FC 197 [Merchant], a decision of the Federal Court on appeal from the former Tax Review Board. The core issue in that appeal was whether or not monies expended by the plaintiff taxpayer, for the purpose of seeking the leadership of the Saskatchewan Liberal Party, should be treated as a deduction for income tax purposes. The plaintiff argued that the income he received from the party was taxable, but that the start-up costs were validly deductible as a business expense—since he was attempting to get into the business of being a party leader, and not holding “office” as understood under subsection 248(1). In turn, he argued that the income he was receiving was not from an office because the remuneration was not of a “fixed or ascertainable nature” (Merchant at 199–200).

[54] Justice Reed rejected this argument and dismissed the appeal, finding the term “ascertainable [to] mean that the amount to be paid is capable of being made certain, or capable of being determined but not that a definite sum be known by the office-holder at the commencement of holding office” (emphasis added) (Merchant at 202). In other words, that which is “ascertainable” may not be exactly known or determined at the outset of the process, but it can be made certain through the process.

[55] A contrasting and narrower meaning of the term “ascertainable” was later advanced by Justice Dussault of the Tax Court of Canada [TCC] in Payette v MNR, 2002 CanLII 1202 (TCC) [Payette]. Assessing the term “office” as set forth in subsection 248(1), Justice Dussault discussed Merchant before ultimately rejecting its broader interpretive guidance: “the Court considers that the descriptor ‘ascertainable’ must refer to something that can be ascertained a priori; otherwise it would have no meaning since everything can be ascertained a posteriori. Thus if the ‘stipend’ or ‘remuneration’ is not fixed, it must still be ascertainable in advance with at least some degree of accuracy by using some formula or by referring to certain set factors” (emphasis added) (Payette at para 24).

[56] What Payette appears to emphasize is a sense of prior knowledge or understanding about the thing that can be ascertained through a given process. For instance, a corporation director with performance incentives built into their position might not know their exact gross income for the upcoming year, but they can ascertain it via a certain formula or set of factors known to them in advance. Similarly, a legal entitlement to a per diem rate of remuneration established in advance is sufficiently “fixed or ascertainable” to meet the statutory test, even if it is not possible to determine, at the beginning of a particular year, how many days of service will be required (Canada (National Revenue) v Ontario, 2011 FCA 314 at para 9 [Ontario]).

[57] The narrower interpretation of the term “ascertainable” advanced in Payette has since been followed in a set of cases from the TCC, all of which reject Merchant and its characterization of the word (see Guyard v MNR, 2007 TCC 231 at paras 24–30; Real Estate Council of Alberta v MNR, 2011 TCC 5 at paras 25–41 [RECA]; Her Majesty the Queen in Right of Ontario v MNR, 2011 TCC 23 at para 24; 9098-9005 Québec Inc v The Queen, 2012 TCC 324 at paras 10–15). The prevailing interpretation holds that “the ascertainable aspect must be a priori, meaning formed or conceived beforehand, relating to or derived by reasoning from a self-evident proposition, and not a posteriori, meaning relating to or derived by reasoning from observed facts” (RECA at para 41). An advance determination of the total remuneration for a particular year is not necessary, but there must be some knowable mechanism or set of factors whereby remuneration can be ascertained (Ontario at para 10).

[58] There are important contextual and purposive differences between paragraph 231.2(3)(a) and subsection 248(1). Within the former, the term “ascertainable” characterizes a person or group not yet known to the Minister, but whose relevant information will be disclosed to them via “a type of fishing expedition” (Roofmart at para 45, citing GMREB at para 45). In theory, the precise identities of the persons contained within the “ascertainable” group can be determined through the process of disclosure, even if some of these persons “may be of no interest for the Minister for the purposes of verifying compliance” (Roofmart at para 40). The term “ascertainable” serves the purpose of ensuring that the proposed requirement concerns real, identifiable persons whose information may be disclosed to the Minister for the purposes of compliance verification. It is therefore unsurprising that the term “ascertainable” in the French version of the provision should translate into “identifiable.”

[59] By contrast, the term “ascertainable” as employed in subsection 248(1) refers to a sum of money, more specifically gross income (see also subsection 5(1) of the ITA). For the purposes of calculating income from an office or employment, an exact number for that sum will necessarily exist, and that number must be known to the CRA at the end of the year. That number may not be known to the taxpayer at the outset of the year, but it can be known to them in the end. In the interim, should that taxpayer be holding an “office” in the sense of subsection 248(1), there must be a formula or set of factors enabling them to have some idea of what that number might be as a function of other variables. The term “ascertainable” serves the purpose of characterizing the remuneration or stipend received by a specific kind of subject of the ITA—it describes a number that can be verified by the CRA. It is thus expected that the term “ascertainable” in the French version of subsection 248(1) should translate into “vérifiable.”

[60] Although the contextual and purposive differences between the two provisions call for some measure of interpretive divergence, the presumption of consistent expression nevertheless favours a consistent interpretation of “ascertainable” between paragraph 231.2(3)(a) and subsection 248(1). The core reason why such an interpretation should be favoured is because of the similar conceptual role the term “ascertainable” fulfils in each provision.

[61] Within each provision, the term “ascertainable” ultimately fulfils a similar function: it serves to characterize a data point that is not yet exactly known by the Minister, but can be determined with certainty through a coherent set of factors or propositions. An advance determination of the exact data is not necessary; what matters is that the data can be made certain. The gross income of a given officer may be uncertain at the outset of a taxation year; but there must be some understanding of how that income will be made and evaluated, the factors or propositions according to which that specific income will be accrued (Ontario at paras 9–10). Likewise, an advance determination of the exact identities of those falling within the target group is not necessary; by definition, the persons targeted under paragraph 231.2(3)(a) are not known to the Minister (Ghermezian at paras 62–74). Who exactly will be swept up in the Minister’s investigation may be uncertain at the authorization stage; but there must be some understanding of how those identities will be determined, i.e., the factors tracing the exact contours of the target group.

[62] Concretely speaking, this understanding should matter to all involved in the proceedings. If ordered to comply, the third party must be able to understand who exactly is targeted by the UPR request and what information they must provide to the government; the Court will not authorize a UPR that is unintelligible, incoherent, or otherwise beyond its understanding. More fundamentally, the Court will not authorize a UPR request when it knows in advance that the third party cannot comply or understand what information is sought, and from whom. The importance of clarity for a third party to be able to respond to a request for information is all the more important given the potential issuance of a compliance order or even contempt of court if a third party fails to comply, under subsection 231.7(4).

[63] The function I have described here also works in a more text-focused frame of analysis. One legal dictionary entry for the verb “ascertain” defines it as “to identify,” or “to determine or make sure” (Nancy McCormack, ed, The Dictionary of Canadian Law, 5^th ed (Toronto: Thomson Reuters, 2019) sub verbo “ascertain”), another defines “ascertainability” as “the susceptibility of something to a definite and assured determination” (Bryan A Garner, ed, Black’s Law Dictionary, 12^th ed (St-Paul: Thomson Reuters, 2024) sub verbo “ascertainability”). Likewise, the Canadian Oxford Dictionary defines “ascertain” as “find out as a definite fact” (Canadian Oxford Dictionary, 2^nd ed (Toronto: Oxford University Press, 2024)). The conceptual core of these definitions essentially matches the interpretation set forth in Payette: “ascertainable” is the quality of something that can be made definite or determined.

[64] I do not find this core to be altered by the French version of paragraph 231.2(3)(a), which uses the term “identifiable,” (a term that also appears in subsection 264(2) in the context of U.S. reportable accounts, and which is directly translated to “identifiable” in English) nor subsections 5(1) and 248(1), which use “vérifiable.” One legal dictionary defines “identification” as the “action de reconnaître quelqu’un ou quelque chose,” and “vérification” as the “opération par laquelle une personne examine une chose en vue d’en contrôler l’exactitude ou la véracité” (Hubert Reid & Simon Reid, eds, Dictionnaire de droit québécois et canadien, 6^th ed (Chambly: Wilson & Lafleur, 2023) sub verbo “identification,” “vérification”). In turn, Le Petit Robert defines both “identifier” and “vérifier” as direct synonyms of “reconnaître” (Le Petit Robert (Paris: Dictionnaires Le Robert, 2021) sub verbo “identifier,” “vérifier”). These terms are reconcilable with both their English versions and each other, all of which connote the quality of something that can be intelligibly determined or made exact.

[65] What emerges from this analysis can be summarized as follows: a group will be “ascertainable,” for the purposes of paragraph 231.2(3)(a), upon the understanding that the identities of those within the target group can be readily made exact or determined with sufficient precision. This is a low threshold that does not necessarily become harder to meet as a function of the group’s size; it does not insist on any criteria beyond “ascertainability” itself. The Court and the third party should be able to understand who might be a part of the target group, even if their exact identities remain unknown to the parties at the outset of the process.

[66] The cases discussed above all complied with this principle. In some cases, prior collaboration between the Minister and the third party enabled the Court to authorize a UPR that a third party acknowledged was “ascertainable” or identifiable to them (see e.g. Rona FCA at para 6; Rona FC; RBC). In others, a dollar amount of sales or categories of rates allowed the third party to clearly focus its compliance efforts and respond (see e.g. Roofmart; La Ministre Du Revenu National et Hydro-Québec, T-1329-19, Order of Justice St-Louis (as she then was) dated June 10, 2024 [Hydro-Québec #2]). Following an unsuccessful UPR request in Hydro-Québec #1, the Minister refined its “ascertainable” group and eventually obtained authorization from this Court in Hydro-Québec #2, with Hydro-Québec electing to leave the issue of the “ascertainable” group to the discretion of the Court. There seem to be several paths to a successful UPR request, but they all involve clarity at the level of paragraph 231.2(3)(a).

[67] With these basic principles established, the Court may proceed to assessing the parties’ respective claims.

1) The Minister’s Argument: The Target Group Is “Ascertainable”

[68] The Minister claims to seek information about a subset of Shopify Merchants; namely those with a Canadian address associated with their Shopify account who have sold or leased products using Shopify’s services. This is a group that the Minister calls “Canadian-resident Merchants” (Kalil Affidavit at para 16, AR at 15). The term “Merchants,” as defined in a supporting affidavit, refers to “the persons (whether individuals or business entities) that use Shopify’s platform to operate their online stores” (Kalil Affidavit at para 12, AR at 14).

[69] In support of their application, the Minister contends that Shopify knows the precise number of “Canadian-resident Merchants.” They base this contention on the affidavit and cross-examination of Mr. Mani Fazeli, a Vice President of Product at Shopify, who claimed under oath that “there have been hundreds of thousands of Shopify accounts that have been associated with an address in Canada and that have been active at some point over the past six years” (Fazeli Affidavit at para 57, RR at 54). On cross-examination, Mr. Fazeli answered that a specific number of accounts had been communicated to his legal counsel, and that he “saw an exact number at one point” (Fazeli Cross-Examination at 98, RR at 337).

[70] On that basis, the Minister further claims that Shopify is able to identify and provide partial information for accounts in which certain information has been purged after two years of inactivity. They note in this regard that the company has kept books and records that include the identity, trading information, and other pertinent account details of its “Merchants” (Kalil Affidavit at para 18, AR at 15). As we shall see below, Shopify contests these claims in certain respects (Fazeli Affidavit at paras 60, 68, RR at 54–55, 58).

[71] What lies at the core of the Minister’s argument is the notion that the “size” of the group, in and of itself, does not matter. On this point, they cite Roofmart’s guidance in advancing that the large or unspecified nature of a group does not necessarily affect the validity of their proposed requirement (Roofmart at paras 39–41). The statutory criterion set out in paragraph 231.2(3)(a) is not size-dependent; it does not necessarily become harder to meet as a function of the numerical size of the target group. Nor is the fact that the group may include persons who may be of no interest for the Minister for the purposes of verifying compliance determinative. Parliament has granted the Minister the tools to conduct horizontal assessments of tax compliance, and such assessments will inevitably sweep up unwanted information. The target group is ascertainable despite its breadth.

2) Shopify’s Argument: The Target Group Is Not “Ascertainable”

[72] Shopify contends that the Minister has failed to identify an “ascertainable” group, thus failing to fulfil the statutory precondition in paragraph 231.2(3)(a). It supports this contention on four grounds: (1) the target group is imprecise and inconsistent; (2) the Minister provided no evidence that an ascertainable group exists; (3) the Minister’s definitions of “Merchants” and “Shopify Owner” are unworkable; and (4) the target group is large and overbroad.

a) The Target Group Is Imprecise and Inconsistent

[73] In advancing this first point, Shopify refers to an apparent inconsistency in the Minister’s Application. This is an apparent contradiction between the Proposed UPR and the Minister’s evidence as provided through the affidavit of Mr. Paul Kalil, a Senior Technical Specialist for the Digital Compliance Data and Tools Section of the Compliance Programs Branch of the CRA.

[74] On the one hand, Mr. Kalil’s affidavit asserts that the Minister is “seeking information and documents for all of Shopify’s Canadian-resident Merchants that have sold or leased products or services using any of Shopify’s services,” who are further defined as “Merchants that have a Canadian address associated with their Shopify account” (emphasis in the Respondent’s Memorandum at para 40, citing Kalil Affidavit at para 16, AR at 15). The term “Merchants” is defined as meaning those “that use Shopify’s platform to operate their online stores” (emphasis added) (Kalil Affidavit at para 12, AR at 14), suggesting that the Minister limits the meaning of the term to actual business owners, as opposed to being more inclusive and, for example, including managers and/or employees.

[75] On the other hand, the Proposed UPR seeks “information regarding Shopify merchants who gave a Canadian address when registering for a Shopify account and that have sold and/or leased products and/or services using Shopify” (emphasis in the Respondent’s Memorandum at para 40, citing Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”).

[76] Shopify argues that this inconsistency renders the Proposed UPR unworkable, because it is unclear what connection to a “Canadian address” is necessary for the purposes of inclusion in the target group. This leaves Shopify unable to identify the “merchant accounts” at issue, and therefore unable to provide a “list of all Shopify Canadian-resident merchant accounts.”

[77] For the group as defined by the Proposed UPR, the problem is that the UPR would not include “Store Owners” who provided a non-Canadian address when registering, but later added a Canadian address to their account. This is because a “Store Owner’s” address of record can be changed at any time. Conversely, the group as defined in Mr. Kalil’s affidavit would include these individuals, because they generally have a Canadian address “associated with” their Shopify account, even if that was not the case at the time of registration. In oral argument, Shopify maintained that the difference in scope between these two groups is substantial, and that the company cannot be expected to address one demand and not the other with the spectre of contempt hanging over it pursuant to subsection 231.7(4) of the ITA.

[78] Still on this first argument, Shopify raises what it considers to be a further lack of clarity regarding the proposed “ascertainable” group. The Proposed UPR seeks various information about “Shopify Owners,” which the Minister defines as “each person(s) (whether individual or business entity) associated with the Shopify account” (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”; Kalil Affidavit at para 19, AR at 16). However, Shopify attests that the nature of its software is such that persons “associated with” a Shopify account can include a wide range of individuals, such as anyone tasked with managing the account on behalf of the business. This might include employees, third-party contractors, former owners of the business, or the many persons who may have accessed Shopify through a Staff Account (Fazeli Affidavit at paras 13–15, 18, 20, 44, 76, RR at 45, 46–47, 52, 58–59; Lee Affidavit at para 38, RR at 77; Lee Affidavit, RR at 96, Tab 4, Exhibit “B” – “Shopify Terms of Service”). This lack of precision makes it difficult for Shopify to comply with the Proposed UPR.

[79] The Minister, to some extent, equates the term “Shopify Owner” (a term of its own creation) and “Store Owner” (a term defined in Shopify’s Terms of Service), implying that they are interchangeable. The term “Shopify Owner,” as defined by the Minister, includes individuals or businesses “associated with the Shopify account,” while the term “Store Owner” is defined by Shopify as “the designated representative of the account that contracts with Shopify under the Subscription Agreement” (Fazeli Affidavit at para 13, RR at 45). The problem remains that those “associated with the Shopify account” may include individuals who are not, in Shopify’s own terminology, “Store Owners.”

[80] The problem noted here is only compounded by the fact that, unless a financial services offering is activated on the account, Shopify does not require “Store Owners” to provide information about their relationship to the business. Therefore, Shopify does not have the information sought unless the user proceeded through “Shopify Checkout,” and cannot identify whether a user is a “Merchant” or a “Shopify Owner” (Fazeli Affidavit at paras 5, 18(b), 22, 53–57, 60, RR at 43, 46–48, 54–55).

[81] Briefly stated, the Minister’s notion of a “Shopify Owner” is inconsistent, overbroad, and foreign to Shopify’s organizational structure. It leaves the company to guess who is actually included in the target group, which in its view is decidedly not “ascertainable.”

b) The Minister Provided No Evidence That an “Ascertainable” Group Exists

[82] Shopify’s second argument is independent of its first. Even if the Minister succeeds in clearly defining an ascertainable group, Shopify maintains that the Minister has nonetheless failed to provide information on oath to establish its existence in fact. The Minister’s evidence is sparse, unsupportive of critical points, and fundamentally ignorant of how Shopify operates and collects information.

[83] For one, according to Shopify, the Court cannot accept much of the Minister’s evidence. Contrary to subsection 81(1) of the Federal Court Rules, SOR/98-106, Mr. Kalil’s affidavit is not confined to the facts within the affiant’s personal knowledge. Rather, it contains inadmissible hearsay evidence that fails to state the source of information and belief. This evidence should be struck.

[84] In support of this claim, Shopify cites specific passages in Mr. Kalil’s affidavit that it deems problematic. Most relevant is the passage in which the affiant notes that “Shopify maintains books and records that include the identity, trading information, and other pertinent account details of its Merchants, [and as such] the Merchants’ identities are known to Shopify and the Merchants’ information is available to Shopify” (Kalil Affidavit at para 18, AR at 15). Shopify takes issue with this passage because Mr. Kalil would not know the stated information about Shopify. He did not audit the company’s records, nor did he work at Shopify himself. Failing to specify how exactly he would know the stated information about Shopify is not a mere technicality, but a fundamental error that prevents the Court to assess the evidence for reliability. This error, according to Shopify, makes the offending passages worthless to the Minister’s application.

[85] Further still, this passage makes an assumption that is expressly refuted by Shopify, which claims that it “has not confirmed the identities of the ‘merchants’ about which the CRA is seeking information” (Fazeli Affidavit at para 28, RR at 49).

[86] In fact, Shopify claims that the language contained in Mr. Kalil’s affidavit is “boilerplate,” quasi-identical to what has been expressed in the Minister’s affidavits that were sworn in support of two prior, unrelated UPR applications (Kalil Affidavit at para 18, AR at 15; see also Affidavit of David Erwin affirmed November 23, 2022 in Court File T-2229-22 in support of Minister’s Application against Bambora Inc., Appendix D at para 17 [Bambora Affidavit]; Affidavit of David Erwin affirmed March 9, 2023 in Court File T-464-23 in support of Minister’s Application against Helcim Inc., Appendix E at para 17 [Helcim Affidavit]). Notably, the affidavit evidence filed in the other unrelated UPRs that were authorized by the Court states that the CRA affiants had charge of, access to, and carefully examined the CRA’s records relating to the third party from whom production was requested (Bambora Affidavit at para 3; Helcim Affidavit at para 3). This evidence is revealingly absent in Mr. Kalil’s affidavit, resulting in a lack of information as to the Minister’s knowledge of whether Shopify can identify the “Merchants” or even provide the requested information.

c) The Minister’s Definitions of “Merchants” and “Shopify Owner” Are Unworkable

[87] Shopify claims that it is unable to identify the persons meeting the Minister’s definitions of “Merchant” and “Shopify Owner.” It notably argues that the Minister misstates Shopify’s evidence when they claim that the company “knows the number of Canadian-resident Merchants” (Applicant’s Memorandum at para 43). Shopify’s affiant, Mr. Fazeli, attested on cross-examination that Shopify can tally the number of “accounts” associated with a Canadian address over a six-year period (Fazeli Cross-Examination at 98, RR at 337). However, this tally only represents the pool of accounts within which Shopify could search for those that may fit the description of “Merchant” and “Shopify Owner.” It is a mere starting point for any search within the purported ascertainable group—not the endpoint of the analysis.

[88] Shopify understands “Merchants,” as defined in paragraph 12 of Mr. Kalil’s affidavit (AR at 14), to refer to the individuals or business entities that (1) “use Shopify’s platform,” (2) “to operate their online store.” Yet it does not consider there to be any further elaboration of what these terms mean. This is problematic for Shopify insofar as this definition of “Merchant” does not correspond to any known category of Shopify user or business within its data universe. Unless a financial services offering like “Shopify Payments” or “Shopify Checkout” is activated, Shopify does not require its “Store Owners” to provide information about their relationship to the business, meaning that Shopify has no way of identifying whether the “Store Owner” is “[using] Shopify’s platform to operate their online store” (emphasis in the Respondent’s Memorandum at para 52). For instance, some accounts users may be employees or contractors of the business, who cannot refer to the stores as “theirs” because they are not the owner of the business for which the account is held. Other accounts use Shopify’s software for purposes other than operating “online stores,” and would thus similarly not be captured by the term “Merchants.”

[89] Overall, Shopify argues that it cannot identify the “Shopify Owners” who are “associated with” those accounts because it cannot identify the “Store Owners” that meet the Minister’s definition of “Merchants.” The broad use of the term “Shopify Owner” in the Proposed UPR would essentially encompass all of Shopify’s “accounts” associated with a Canadian address, whereas the actual “ascertainable” group that appears to be sought by the Minister at the outset of the Proposed UPR targets a narrower group, limited to “Merchants” (“persons (whether individuals or business entities) that use Shopify’s platform to operate their online stores”) with a Canadian address “when registering.”

[90] Shopify claims that the Minister has not defined the target group with terms that are clear, known to, or useable by Shopify, resulting in the establishment of a group that is not “capable of being made certain or capable of being determined” (see Merchant at 202).

[91] For Shopify, this result could have been avoided. Had the Minister chosen to collaborate with the company, it may have been able to advise the Minister as to what information it was able to identify, and help tailor the Proposed UPR to the terms most compatible with its information gathering practices. That way, Shopify could have clearly and properly identified the accounts that it could disclose, and been assured that its response would not result in later contempt proceedings under subsection 231.7(4) of the ITA. At this point, and with the terms used in the proposed UPR, there is no such assurance for Shopify.

d) The Target Group Is Large and Overbroad

[92] Shopify admits that there have been “hundreds of thousands” of Shopify subscription accounts that have been associated with a Canadian address and that have been active at some point over the past 6 years (Fazeli Affidavit at para 57, RR at 54). However, there have also been millions of “trial users” who, over the past 6 years, have stated that they are located in Canada (Fazeli Affidavit at paras 52, 57, 65(a), RR at 53–54, 56). To the extent that most Shopify accounts have many individuals “associated with” them, the number of persons whose information would be disclosed in response to the Proposed UPR is several times larger than the actual number of accounts.

[93] The relevance of group size to the UPR authorization process was at issue in Roofmart, a case on which the Minister relies in arguing that size, in and of itself, does not alter the UPR’s validity (Roofmart at para 39). Shopify responds by distinguishing the circumstances of the present case from those on which Roofmart is based. The target group in the present case ranges from the hundreds of thousands to several million. By contrast, the cases informing the Federal Court of Appeal’s comments in Roofmart involved much smaller groups—namely, the commercial customers of fifty-seven Rona stores, and an estimated ten-thousand users of eBay (see Roofmart at para 41, citing eBay, 2008 FCA 348 at para 11; Rona FCA at para 6). More comparable to the group in the present case is the estimated 4.3-million-person group targeted by the unsuccessful application in Hydro-Québec #1, which Justice Roy of the Federal Court held was a “fishing expedition” of “unprecedented magnitude” (at para 96). The case eventually resulted in the Minister reapplying for a different UPR, this time of a narrower scope (Canada (National Revenue) v Hydro-Québec, 2021 FC 1438; overturned on appeal in Canada (Revenu national) c Hydro-Québec, 2023 CAF 171 [Hydro-Québec FCA]; see also Hydro-Québec #2). Shopify asks that the Minister carry out an analysis of a similar type, tailoring their UPR with greater diligence.

3) Analysis: The Target Group Is Inconsistent and Not “Ascertainable”

[94] I find that the Minister’s target group does not qualify as “ascertainable” under paragraph 231.2(3)(a) of the ITA. As discussed above, the target group must be sufficiently clear to allow a third party to respond, because of the risk of contempt under subsection 231.7(4) of the ITA that might result from a failure to comply.

[95] The core issue is an inconsistency in terms. That inconsistency introduces vagueness into the target group, such that the identities of those within the target group cannot be readily made exact or determined with sufficient precision. Below, I explain this inconsistency and how it ultimately undermines the Minister’s Application.

[96] At the outset, I note that the term “Merchant” is sufficiently clear, and that it is known and identifiable to Shopify. In that specific sense, I find that a target group of “Merchants” as defined by the Minister would meet the precondition in paragraph 231.2(3)(a) of the ITA. However, this is not exactly the target group brought by the Minister in their Application. Rather, the Proposed UPR introduces—but does not otherwise define—the term “Shopify Owner” in its item A.2), upon which it proceeds to seek a plethora of information on “each person(s) (whether individual or business entity) associated with the Shopify account” (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”).

[97] On my review of the evidence, these persons are not necessarily encompassed by the term “Merchant” as used by either the Minister or Shopify. The term “Shopify Owner” in item A.2) introduces an inconsistency with the Minister’s narrower definition of “Merchant,” thus rendering the target group unduly vague and diffuse, and leaving Shopify in a conundrum as to what to provide in response to the Proposed UPR: a) information on “Merchants” only, as apparently requested by the CRA; or b) every additional individual or business entity “associated with” an account.

[98] This conundrum has real stakes for Shopify. If it only provides information on “Merchants,” it may then face contempt proceedings if that response is underinclusive; if it provides information on every additional individual or business entity “associated with” an account, it risks breaching its contractual obligations toward its account holders if indeed the Minister indeed only sought information relating to that narrower category of “Merchants.”

[99] In this same vein, I also find that the Application is unclear as to whether the Proposed UPR is only seeking accounts having a Canadian address upon registration (“when registering”), or if it targets all accounts with a Canadian address at any time. This inconsistency prevents the Minister’s Application from meeting the first legislative precondition under paragraph 231.2(3)(a) of the ITA.

[100] With my findings briefly summarized, I will now expound them below.

a) The Term “Merchant” Is Known and Identifiable to Shopify

[101] The Minister requests information relating to “Merchants,” who are defined in Mr. Kalil’s affidavit as “the persons (whether individuals or business entities) that use Shopify’s platform to operate their online stores” (emphasis added) (at para 12, RR at 14). More specifically, they seek “information and documents for all Canadian-resident Merchants that have sold or leased products or services using any of Shopify’s services [i.e.,] Merchants that have a Canadian address associated with their Shopify account” (emphasis added) (Kalil Affidavit at para 16, RR at 15).

[102] In my view, the term “Merchant” as defined by the Minister is both specific and known to Shopify, such that it allows it to properly identify the scope of the group within which the Minister is seeking information, i.e., “Merchants” who have sold or leased products or services for their own benefit and used Shopify’s platform to do so. In that sense, I reject Shopify’s arguments and evidence alleging the contrary.

[103] At paragraph 13 of Ms. Lee (Regulatory Analyst at Shopify) and Mr. Fazeli’s respective affidavits (RR at 45, 70), Shopify indicates that it uses the terms “Merchant” and “Account Owner” interchangeably to refer to the “Store Owner.” The “Store Owner” means “the designated representative of the account that contracts with Shopify under the Subscription Agreement” (Lee Affidavit at para 13, RR at 70). The “Store Owner” also refers to the “Owner of a Shopify account” (Fazeli Affidavit at para 13, RR at 45). Therefore, Shopify itself defines the term “Merchant” as including any “Store Owner” or “Account Owner” even if, as their own evidence demonstrates, the “designated representative of the account that contracts with Shopify” may not be the actual “owner” of the business, but may be an employee or a third party (Fazeli Affidavit at paras 18(c), 44, 76, RR at 46, 52, 58; Lee Affidavit at para 38, RR at 77).

[104 ] The Shopify Terms of Service support this finding. At the outset, they indicate that the account holder must “confirm that [they] are receiving any Services provided by Shopify for the purposes of carrying on a business activity and not for any personal, household or family purpose” (Lee Affidavit, RR at 98, Tab 4, Exhibit “B” – “Shopify Terms of Service”). The Terms of Service then indicate that while the “Store Owner” is usually the person signing up for the Shopify Service, “[if] you sign up on behalf of your employer, your employer is the Store Owner responsible for your account” (Lee Affidavit, RR at 100, Tab 4, Exhibit “B” – “Shopify Terms of Service”). In this same vein, “[if] you are signing up for the Services on behalf of your employer, then you must use your employer-issued email address and you represent and warrant that you have the authority to bind your employer to our Terms of Service” (Lee Affidavit, RR at 100, Tab 4, Exhibit “B” – “Shopify Terms of Service”). Lastly, the Shopify Terms of Service also indicate that one or more staff accounts may be created and that the Store Owner may determine the level of access associated to each account—meaning that these accounts remain linked to the Store Owner (Lee Affidavit, RR at 100–101, Tab 4, Exhibit “B” – “Shopify Terms of Service”).

[105] In addition, the term “Merchant” is used by Shopify in its own “Guidelines for Legal Requests for information” and is defined as including “businesses who use Shopify’s platform or services to power their stores in any capacity” (Lee Affidavit, RR at 183, Tab 4, Exhibit “E” – “Shopify Guidelines”). I find that Shopify’s definition of the term “Merchant” is sufficiently close to the Minister’s definition, which is “the persons (whether individuals or business entities) that use Shopify’s platform to operate their online stores” and “Canadian-resident Merchants that have sold or leased products or services using any of Shopify’s services [i.e.,] Merchants that have a Canadian address associated with their Shopify account” (Kalil Affidavit at paras 12, 16, AR at 14–15). This similarity is such that Shopify should be able to properly determine the group about whom the Minister is seeking information.

[106] To be clear, the Minister is under no obligation to define the “ascertainable” group according to Shopify’s preferred internal nomenclature, nor are they expected to track their vocabulary onto Shopify’s terms of service. As long as the identities of those within the target group can be readily made exact or determined with sufficient precision by the Court and the third party, the Minister will have met the legislative precondition in paragraph 231.2(3)(a) and identified a sufficiently clear “ascertainable” group. On the evidence adduced, that is the case here for the term “Merchant.”

[107] Consequently, I find that that the term “Merchant” as defined by the Minister is equivalent to the terms “Merchant,” “Store Owner,” and “Account Owner,” as defined by Shopify, and could be sufficiently precise to constitute an “ascertainable” group. The terms “Merchant,” “Store Owner,” and “Account Owner” relate to and identify the actual “individuals or business entities” that used Shopify’s platform to make leases or sales of products or services for their own benefit, and these “Merchants” are known to Shopify. The fact that staff and third parties may also have accounts linked to the “Merchant” or “Store Owner” does not affect this finding, because Shopify is always able to link accounts with the ultimate “Store Owner” or “Merchant,” regardless of the fact that it may have actually been opened by an employee. Indeed, the information on the Shopify Account, as indicated in the Terms of Service, always includes the information that will ultimately identify the “Merchant” as defined by both the Minister and Shopify.

[108] I reject Shopify’s contention that the Minister has not provided evidence that an “ascertainable” group exists, and that the definition of “Merchants” is unworkable. First, there is no shortage of evidence in this case, coming both from Mr. Kalil’s affidavit, but also the cross-examination of Mr. Fazeli and Ms. Lee. The evidence clearly demonstrates that Shopify can identify their clients and “Merchants,” including through the activation of Shopify’s financial services like “Shopify Payments” or “Shopify Checkout.” Therefore, the definition of the term “Merchant” is workable and there is evidence that the group exists.

[109] Shopify’s main contention is that it only has some portion of the information requested, and that the only information that could allow it to properly identify those “Merchants” requires the activation of a financial services such as “Shopify Checkout” or “Shopify Payments” (Fazeli Affidavit at paras 13, 18(b), 22(e), 23–26, 45, 47, 53–58, 60, 65, 70, 74, 78–80, 86–87, RR at 45, 46, 48–49, 52, 53, 54, 56, 58, 59, 60; Fazeli Cross-Examination at 31–34, 40–44, 98, 101–109, 113–126, AR at 74–77, 83–87, 141, 144–152, 156–169).

[110] If that is the case, then Shopify is able to respond to the Minister’s Proposed UPR. The ITA only requires a third party to provide information that it possesses. If the information sought by the Minister’s Proposed UPR is solely contained in “Shopify Checkout” or “Shopify Payments,” then the provision of that information only is acceptable to comply with the Proposed UPR. Shopify is not expected to give what it does not have.

[111] In responding to the UPR, Shopify is also entitled to rely on this Court’s past jurisprudence in relation to the term “merchant,” and can be satisfied that if it responds with information that is consistent with past UPRs authorized by this Court, its response cannot result in future contempt proceedings.

[112] In this regard, I pause to observe that the term “merchant” was used by the Minister and approved by the Court in both Helcim and Bambora, though the latter also used the term “vendors.” In any event, the use of the term “Merchant,” as defined by the Minister (Kalil Affidavit at paras 12, 16, AR at 14–15), is consistent with the CRA seeking to obtain information on individuals and business entities that actually made revenues and/or profit for their own benefit. This interpretation is further consistent with how the word “merchant” is commonly understood and defined: Black’s Law Dictionary defines the term as “one whose business is buying and selling goods for profit,” and the Canadian Oxford Dictionary defines it as “[a] person whose occupation is the purchase and sale of goods or commodities for profit.” There is nothing unseemly in the Minister’s use or understanding of the word in this context.

b) The Target Group Is Ambiguous Because the Proposed UPR Is Inconsistent

[113] While I find the term “Merchant” to be known and identifiable to Shopify, the Proposed UPR in this Application remains unacceptable. This is because the Minister introduced imprecise and inconsistent requests relating to their proposed “ascertainable” group, blurring the contours of their Proposed UPR.

[114] The Proposed UPR does not clearly, and more importantly, consistently identify the proposed group of “Merchants” for which the Minister requests information from Shopify. Even if the term “Merchant” on its own is properly defined and can be known and identified by Shopify, the Minister seems to have set out at least two different “Merchant” groups within their Application. The introduction of confusing terms expands the Proposed UPR beyond the scope of the initially intended search, resulting in the Proposed UPR being ambiguous as to the actual “Merchant” group targeted by the Minister.

[115] At the outset, the Proposed UPR requests information from “Shopify merchants who gave a Canadian address when registering for a Shopify account” (emphasis added) (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”). However, at item A.2), the Proposed UPR then requests “the name of each person(s) (whether individual or business entity) associated with the Shopify account (‘Shopify Owner’)” (emphasis added) (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”).

[116] The evidence demonstrates that the terminology used by the Minister is unworkable and inconsistent, because the Proposed UPR makes a distinction as to the group of “Merchants” for which it seeks information, by distinguishing those that included a Canadian address “when registering” from any other.

[117] Moreover, the Proposed UPR requires the disclosure of the names of additional individuals “associated with” the Shopify account who have not made leases or sales for their benefit, and who are not understood to be the “designated representatives” of the “Merchants.” Those individuals are not encompassed within the terminology of “Merchants,” “Store Owner,” or “Account Owner” as defined by Shopify, and that group would be plainly inconsistent with the term “Merchant” as defined by the Minister.

[118] I find that these inconsistencies leave Shopify unable to determine with sufficient precision the specific group the Minister is actually targeting. To this end, I accept Shopify’s evidence for two main reasons.

i. The Proposed UPR Is Inconsistent and Vague

[119] As discussed above, I take no issue with the notion of “Merchants” as characterized in paragraphs 12 and 16 of Mr. Kalil’s affidavit (AR at 14–15). In that respect, the Minister has set out a specific group and demonstrated their intention to obtain information about them.

[120] However, the Proposed UPR at item A.2) is much broader, and asks for more information than is contained in that narrower group of “Merchants”: “the name of each person(s) (individuals or business entities) associated with the Shopify account” (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”). Item A.2) also introduces a new term to define the scope of the Proposed UPR: “Shopify Owner.” Regrettably, Mr. Kalil’s affidavit neither discusses nor provides a definition to explain the meaning and intent of the term “Shopify Owner.”

[121] While at first glance the difference in wording ought not to be conclusive, I find that the evidence in this case demonstrates that the term “Shopify Owner” and the word “associated” are of the utmost importance. This is because the number of individuals affected by a request to produce the “name of each person(s) (whether individual or business entities) associated with the Shopify account” and defined by the term “Shopify Owner” is likely much higher than the number of people that would be affected by a request to provide only the names and addresses of the actual “Merchants” (“Merchants,” “Store Owners,” “Account Owners,” or their “designated representative,” if that is the only name on the account).

[122] I accept Shopify’s evidence and arguments that the Minister’s use of the term “Shopify Owner” in item A.2) is confusing and unworkable, for the following reasons.

[123] First, I reject the Minister’s attempt to equate the term “Shopify Owner” in item A.2) (even if undefined in the Kalil affidavit) with the term “Store Owner,” as defined by Shopify. Based on the evidence, I ruled above that the Minister’s term “Merchant” is equivalent to Shopify’s terms “Merchant,” “Store Owner,” or “Account Owner.” It follows that if the Minister’s term “Merchant” is equivalent to Shopify’s term “Store Owner,” then the Minister’s term “Shopify Owner” cannot also be equivalent to Shopify’s term “Store Owner,” as this would mean that the term “Shopify Owner” is also equivalent to the Minister’s term “Merchant,” making the term “Shopify Owner” redundant in item A.2).

[124] The use of different terms by the Minister in the same Proposed UPR must mean that the Minister intended item A.2) to apply to different persons or entities. Otherwise, item A.2) would not have introduced the new term “Shopify Owner,” and instead would have been drafted in the following manner: “the name of each Canadian-resident merchant(s) (individual or business entity) on a Shopify account” (with the consequential substitution of the term “Shopify Owner” with “Merchant” in items A.3) and A.4)). Had this been the case, item A.2) would have required the names of “Merchants” only, who for Shopify are also known as “Store Owners” and “Account Owners,” making that item ascertainable and consistent with the Proposed UPR read as a whole. The lack of clarity in the Minister’s evidence as to the meaning of the term “Shopify Owner” leaves the Court with only a vague idea of who is targeted by item A.2). This confusion undermines the Minister’s proposed “ascertainable” group.

[125] Second, because the term “Shopify Owner” differs from the term “Merchant,” the scope of the term “Shopify Owner” and the inclusion in item A.2) of the “name of each person(s) (whether individual or business entities) associated with the Shopify account” means that additional individuals or business entities other than “Merchants” must be targeted.

[126] To this effect, the evidence demonstrates that an account may be associated with many different names, including former “Store Owners,” additional employees, third parties, or other currently authorized staff users (Fazeli Affidavit at paras 18(c), 44, 76, RR at 46, 52, 58; Lee Affidavit at para 38, RR at 77). For example, per the Shopify Terms of Service, the “Store Owner” (or the designated employee responsible for the account on their behalf) may allow other people to access the account, in which case each person must give their full legal name and a valid email account; the “Store Owner” is responsible for ensuring that their employees, agents, and subcontractors, including via Staff Accounts, comply with the Terms of Service (Lee Affidavit, RR at 100–101, Tab 4, Exhibit “B” – “Shopify Terms of Service”).

[127] Clearly, the evidence demonstrates that many names may appear on an account and be “associated with” the “Merchant” or “Store Owner.” As provided in the Terms of Service, these names may include employees and even subcontractors. The information requested and included in the Minister’s term “Shopify Owner” in item A.2) is therefore much broader than what would be included in the narrower definition of the term “Merchant” (equivalent to “Store Owner” or “Account Owner”), which corresponds to the “persons (whether individuals or business entities) that use Shopify’s platform to operate their online stores” and “Canadian-resident Merchants that have sold or leased products or services using any of Shopify’s services” (Kalil Affidavit at paras 12, 16, AR at 14–15).

[128] The term “Merchant,” as originally defined by the Minister, is thus in conflict with the second term “Shopify Owner.” More importantly, the impact of this inconsistency, as demonstrated by the evidence, renders the group unworkable and no longer “ascertainable” in the context of the Proposed UPR.

[129 ] Consequently, I find that item A.2) and the Minister’s term “Shopify Owner” require the disclosure of information relating to individuals or business entities that are not “Merchants” as defined by the Minister, because some of these individuals and business entities may not have sold or leased products or services using any of Shopify’s services for their own benefit, but rather did so on behalf of and as employees or subcontractors of a “Merchant” (who is also captured in item A.2)). Thus, the Minister’s term “Shopify Owner” is not interchangeable with Shopify’s term “Store Owner” or with the term “Merchant” as defined by the parties, which is considerably narrower in comparison.

[130] The Minister’s inconsistent terminology muddles their target group, leaving Shopify and this Court uncertain as to what the Minister actually wants out of their Application. Had the Minister consistently used the same definition of the term “Merchant,” that confusion would not have arisen.

[131] Shopify is entitled to a relative degree of certainty when compelled to respond to a UPR. This certainty matters because Shopify must comply with the UPR, while upholding its contractual obligations toward its clients.

[132] Again, it is unclear whether the Minister is seeking disclosure of the more limited group of “Merchants” as defined above, or the broader group of “Shopify Owners” including all names of individuals and business entities “associated” with the account (and including potentially additional employees, third parties, subcontractors, former owners, etc.), which makes the Proposed UPR, as currently drafted, not sufficiently “ascertainable” for the purposes of subsection 231.2(3).

[133] In making this finding, I am mindful that it is permissible for a UPR to “inadvertently sweep” within its ambit some persons “who may be of no interest for the Minister for the purposes of verifying compliance” (Roofmart at para 40). Certainly, the names of employees and third parties could in theory fit in such category; and this could also apply to the “designated representative” if that was the only name of a person on the account.

[134] However, in this case, the Proposed UPR (through item A.2)) explicitly seeks disclosure of information on “additional” individuals and business entities that are outside of the definition of “Merchants.” Therefore, the Minister is “interested” in the information and its obtention is certainly not “inadvertent.”

[135] The exception discussed in Roofmart does not apply. Indeed, this is not a situation where the group is clearly “ascertainable,” but risks yielding some irrelevant information in the Minister’s “sweep.” In such a case, one would expect the CRA to disregard or show no interest in the information that happens to be “swept in.” Rather, this is a case where the Minister is specifically requesting information on additional individuals and business entities (through item A.2)) whose existence is demonstrated in Shopify’s own Terms of Service (Lee Affidavit, RR at 100–101, Tab 4, Exhibit “B” – “Shopify Terms of Service”), with the intent by the CRA to use that information to verify compliance of the “Merchants” with the ITA.

[136] In the end, paragraph 231.2(3)(a) of the ITA provides that the judge must be satisfied by information on oath that the group is “ascertainable.” As a result of the evidence adduced and the arguments of the parties, I find the Minister’s Proposed UPR is confusing and, therefore, I am not satisfied that they have established a target group that is sufficiently clear and “ascertainable” to meet the legislated precondition required under paragraph 231.2(3)(a).

ii. The Proposed UPR Is Unworkable

[137] The second reason why the Proposed UPR does not identify a properly “ascertainable” group is because it requests “information regarding Shopify merchants who gave a Canadian address when registering for a Shopify account and that have sold and/or leased products and/or services using Shopify” (emphasis added) (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”). This is problematic because “Merchants” are able to change their addresses on an account at any time. Therefore, the group of “Merchants” initially identified by the Minister would not include the “Merchants” who originally registered their Shopify account using a foreign address, but later added a Canadian address. On the other hand, as discussed above, the Minister’s request in item A.2) for names of individuals and business entities “associated with” the account (“Shopify Owners”) does not make that distinction, and could potentially include all accounts with a Canadian address, regardless of when the account was registered. If that is the case, Shopify would have to disclose all accounts with a current Canadian address, some of which would be outside of the initial scope of the Minister’s request in its Proposed UPR which was limited to only those “Merchants” with a Canadian address “when registering”.

[138] The Minister relies on Canada (National Revenue) v Miller, 2021 FC 851 [Miller] for the proposition that when a UPR request is imprecise, issues related to that imprecision may be addressed after the authorization of the UPR. In other words, weaknesses in the Minister’s application should not always be an impediment to authorization. The Minister also points to a response by Ms. Lee in her cross-examination (at 37, AR at 716), in which she says that she can ask for clarification from the lawyers on her team, should there be any uncertainty in the Proposed UPR.

[139] I reject the Minister’s argument. First, the Minister does not really explain how Miller applies in this case. For context, Miller dealt with a request for information under section 231.1, where requests are made by letter, without undergoing judicial authorization. Within this process, it is open to the Minister to send many letters to a taxpayer, and clarify any original imprecision in their request through an exchange of correspondence. There was such an exchange in Miller, resulting in the Court holding at paragraph 44 that: “[Mr. Miller was] under no misapprehension as to the information the Minister [had] requested.” The context of a UPR request under subsection 231.2(3) is different and, as noted, the terms used by the Minister are inconsistent.

[140] As for the answer provided by Ms. Lee in her cross-examination, it is important to understand it in context. Ms. Lee stated that she could ask for clarification with legal counsel, but this appears to be in a context that exists only after having received a court order or a similar legal obligation to disclose. Shopify’s evidence is that it simply does not disclose information without a court order or similar legal obligation, as this would be in breach of its contractual obligations to its clients (Lee Affidavit, RR at 183, Tab 4, Exhibit “E” – “Shopify Guidelines”). Ms. Lee’s evidence does not clearly establish that that she could, or does, ask for clarification before a UPR request is expressly authorized by the Court.

[141] The Minister initially sought information on “Merchants” who gave a Canadian address “when registering” their account. They later requested the names of each individual or business entity “associated with” the account. This inconsistency blurs and confuses the Proposed UPR, such that the target group is no longer “ascertainable” under paragraph 231.2(3)(a) of the ITA.

c) The Minister’s Request for the Court to Amend the Proposed UPR

[142] In oral argument, the Minister admitted to the inconsistencies in their Proposed UPR, but argued that they were not substantive, and invited the Court to cure the defects in their Application, if any. To this effect, the Minister argued that the Court could amend the Proposed UPR to reflect the fact that the Minister seeks information from all “Merchants” having used a Canadian address on a Shopify platform (regardless of the date of registration), and to limit the Proposed UPR to the information collected through “Shopify Checkout” and “Shopify Payments,” as the Minister recognized that Shopify only held responsive information through the activation of those financial services. The Minister then argued that it was acceptable for Shopify to simply respond that it did not have any other information pertaining to the Proposed UPR’s items, if that was indeed the case (for example, for the Social Insurance Number [SIN] of any individual).

[143] I agree with the Minister and find that the information sought, to the extent that it exists, can be obtained for those accounts having activated a financial service such as “Shopify Checkout” or “Shopify Payments” (Fazeli Affidavit at paras 5, 18, 22(e), 53–57, 60, 70, 74, 78–80, 84, RR at 43, 46, 48, 54–55, 58, 59; Fazeli Cross-Examination at 43–44, 101–106, 125–126, AR at 86–87, 144–149, 168–169). “Merchants” that do not make leases or sales through “Shopify Checkout” or “Shopify Payments” do not provide to Shopify the information sought by the Minister.

[144] However, even if the information in “Shopify Checkout” or “Shopify Payments” does exist and could be provided to the Minister, the target group as defined in the Proposed UPR continues to suffer from the same issues as discussed above. Indeed, it remains unclear which group using “Shopify Checkout” or “Shopify Payments” would actually be subject to the Proposed UPR. The Court does not have a reliable means of determining if the Minister’s request relates to: 1) only “Merchant” accounts that had a Canadian address “when registering”; 2) “Merchant” accounts that use Shopify’s platform to operate their online stores (not limited to those with a Canadian address “when registering”); or 3) each person(s) (whether individual or business entity) “associated with” the Shopify account (the broader group including employees, subcontractors, and agents, whose compliance may be verified alongside the “Merchants” on whose behalf they made leases and sales on Shopify’s platform).

[145] These issues could have perhaps been avoided had the Minister chosen to genuinely collaborate with Shopify on this UPR request, and tailor its terminology in a way consistent with a shared and reasonable understanding between both parties—even if the Minister had no strict obligation to do so. With that said, I make no finding on that basis.

[146] More importantly, I refuse to amend the Proposed UPR because the evidence is unclear as to the intent of the Minister in crafting their Application. It would not be appropriate for this Court to amend the Application without clear evidence of what the Minister is actually seeking.

[147] On the one hand, the Minister appears to have attempted to only request information on “Merchants” (individuals and business entities that made sales or leases of products or services for their benefit using Shopify’s platform), as they are the ones that would be subject to compliance verification under the ITA, and not employees or other third parties. On the other hand, it is possible that the Minister actually intended to capture everyone, including employees and third parties “associated with” the Shopify account. That would be understandable (and possibly valid), as the Minister may have wished to inquire with employees and third parties on the identity of the “Merchants” for whom they work, to then verify compliance of everyone with the ITA. However, without proper and cogent evidence as to the Minister’s intent regarding the “additional” names “associated with” the account, the Minister’s request incurs the risk that the UPR cannot be authorized at least for those “additional” names, as the Minister’s evidence does not establish that their intent is to also verify compliance of those persons with any duty or obligation under the ITA, pursuant to paragraph 231.2(3)(b) of the ITA. This latter point will be discussed in greater detail below.

[148] The Court cannot impute an intention or objective to the Minister on its own accord, and cannot conclusively determine how to amend the Proposed UPR in a manner that is faithful to the Minister’s objectives, without possibly imposing an obligation to disclose items (or a scope of items) that the Minister did not originally intend to request.

[149] The Minister must properly determine the scope of the proposed “ascertainable” group if it wishes to proceed and, of course, may seek the Court’s authorization in a second attempt as was done in Hydro-Québec #2.

[150] In this vein, I note that the UPR request in File No. T-777-23 is much narrower than the Proposed UPR in this Application. In File No. T-777-23, the UPR request only seeks (i) the “Merchant” store trading name; (ii) store legal name; (iii) contact names; (iv) contact number; (v) email address; (vi) postal code; (vii) ‘.myshopify.com’ URL; and (viii) total revenue for sales. The UPR request in File T-777-23 does not request disclosure of the names of any individual or business entities “associated with” the Shopify account, nor does it make a distinction as to whether the Canadian address was included on the account “when registering.” The UPR request in File No. T-777-23 also does not seek SINs, dates of birth, KYC documentation, or dates when a Shopify account was activated or closed.

[151] In that sense, the UPR request in File T-777-23 contains an “ascertainable” group (subject to the issue of its limitation to information contained in “Shopify Checkout” or “Shopify Payments,” which the Court could impose as a specific condition in the circumstances), and generally presents a request more consistent with the jurisprudence in eBay, 2008 FCA 348, Roofmart, PayPal, Bambora, Helcim, and Hydro-Québec #2 (where the Minister sought the merchants’ names, business or operating names and number, contact information, banking information, and monthly transaction amounts). Should the Minister wish to return to this Court with an amended UPR request, turning to the Proposed UPR in File No. T-777-23 may therefore be instructive.

d) Collaboration Between Shopify and the Minister

[152] The parties dispute the necessity for, and the conduct of the opposing party during, the months leading up to these proceedings. The Minister argues that no collaboration or consultation is required with a third party subject to a UPR request. Shopify argues that it was willing to collaborate, but that the Minister never properly attempted to consult it in order to craft a UPR request with which it could adequately respond.

[153] I agree with the Minister that there is no need to consult or collaborate with a third party subject to a UPR request before seeking the Court’s authorization. There is no such requirement in the applicable legal criteria for the Court to authorize a UPR, under subsection 231.2(3) of the ITA.

[154] However, as demonstrated in previous UPR requests authorized by this Court, consultation with a third party may help to properly frame a UPR request in a manner comprehensible to that third party. In other words, the Minister fails to consult with the third party at their own peril.

[155] In this case, the Minister’s evidence shows that they did not properly understand Shopify’s business model and organizational structure, which led to the Proposed UPR becoming unclear and confusing for Shopify.

[156] The facts of this case provide the context for my comment on collaboration. Shopify’s evidence shows that on December 16, 2022, there was a discussion between it and the CRA in relation to potential UPR requests. On January 12, 2023, the CRA sent a letter to Shopify referring to the December 16, 2022, meeting, and made several inquiries about information that Shopify collects and retains, and about its ability to satisfy certain requests for information. An informal meeting was then held on February 14, 2023. During that meeting, Shopify explained that its core offering was not a marketplace, and that Shopify did not sell goods or services. Also at that meeting, the CRA allegedly indicated that it would not submit a UPR request without prior collaborative discussion with Shopify and would contact Shopify if it needed any further clarification. On February 17, 2023, the CRA emailed Shopify and requested links to some information it published about what its affiliated entities possessed and controlled, to which Shopify responded on the same date. On April 14, 2023, Shopify received the Proposed UPR, without having had any further communication with the CRA (Lee Affidavit at paras 50–74, RR at 79–83).

[157] The evidence discussed is clear that in December 2022, and early January 2023, the CRA first approached Shopify in relation to UPR requests sought by foreign authorities. In its January 12, 2023, letter, which related to these foreign requests, the CRA asked Shopify if it retained or had access to information enabling it to identify “Merchants” by geographical region, if it had access to billing/accounting information in relation to “Merchants,” and whether Shopify had access to Shopify “Merchants’” store trading name, store legal name, contact name(s), contact number, email address(es), “myshopify.com” URL, and value-added tax number (items identified in File No. T-777-23). The CRA also asked, in that letter, for information regarding the nature and scope of the data retained by Shopify and/or its subsidiaries in relation to the sales and transactions of individual “Merchants,” as well as the relationship between Shopify and its payment processing subsidiaries (such as Shopify Payments). The letter requested a response by January 27, 2023 (see Lee Affidavit, RR at 218–219, Tab 4, Exhibit “K” – “Letter from N. Tremblay to D. Newman and J. Given dated January 12, 2023”).

[158] Shopify never responded to that letter.

[159] The evidence is also clear that during January 2023, what began as a UPR request for foreign authorities evolved into a second UPR request for the CRA’s purposes. Indeed, on January 23, 2023, the CRA requested an “informal meeting” and informed Shopify that the CRA also intended to issue a UPR request. Unfortunately, Shopify confused that request with the previous requests made by foreign states (which were subject to the December 16, 2022, meeting and the letter of January 12, 2023), and only realized that a Canadian UPR would also be sought about one week later on or about February 1, 2023 (Lee Affidavit at paras 56, 64, RR at 80–82).

[160] In any event, although there may have been confusion at Shopify in relation to the multiple UPR requests and the requirement to respond to the letter of January 12, 2023 (Lee Affidavit at para 65, RR at 82), a meeting was convened on February 14, 2023, to address all issues. Two CRA teams attended to address the two separate requests (the foreign request and the Canadian UPR request) (Lee Affidavit at para 67, RR at 82).

[161] Ms. Lee does not detail the information communicated to the CRA during that meeting, other than to state that Shopify explained its core offering and reiterated that affiliated legal entities held information about its clients. There is no evidence as to whether the requests made by the CRA in its January 12, 2023, letter were answered, and no minutes of the meeting were provided (Lee Affidavit at paras 69–72, RR at 83).

[162] The Minister argues that the evidence provided on oath by Ms. Lee in this regard is invalid hearsay, because it was made on information and belief and because Ms. Lee did not participate in any of the communications. I agree.

[163] However, the Minister failed to cross-examine Ms. Lee or file rebuttal evidence to establish that it did reasonably collaborate with Shopify before issuing the Proposed UPR request.

[164] This being said, it is also clear that Shopify did not respond in writing to the CRA’s letter dated January 12, 2023, and there is no evidence that the meeting of February 14, 2023, addressed these issues to the satisfaction of the Minister.

[165] Consequently, while I find that the Minister failed to properly communicate and follow up with Shopify, I also find that Shopify could have been much more forthcoming with its own information, and could have properly indicated to the Minister what it could provide to respond to the Minister’s request, in a detailed response to the January 12, 2023, letter, which it failed to do.

[166] I acknowledge that the CRA may have stated that it would not issue a UPR request before collaborating with Shopify, and that Shopify may have been surprised by the absence of further communication from the Minister. However, there is no evidence that Shopify reached out to clarify the miscommunication (if there was one) in an attempt to have the Proposed UPR amended according to the additional information that Shopify was able to share with the Court in this Application.

[167] Instead of providing additional information to the Minister in an attempt to preemptively conclude the issue of the “ascertainable” group (as was done for Rona FC, RBC, Bambora and Helcim), Shopify decided to fight the Proposed UPR with all of its strength. The fact that Shopify actually had information that could be responsive to the Proposed UPR, through “Shopify Checkout” and “Shopify Payments,” was detailed for the first time by Shopify in Mr. Fazeli’s affidavit and cross-examination—even if the Minister had previously asked Shopify for information specifically relating to “Shopify Payments,” for example, in their letter of January 12, 2023.

[168] To be clear, Shopify has the right to oppose the Minister’s Proposed UPR with all the tools at its disposal and mount the strongest defence possible. No criticism is made against Shopify on its defence. Likewise, the Minister is under no obligation to collaborate with Shopify.

[169] In the end, collaboration between the parties, or lack thereof, does not have a direct impact on the Court’s authorization process. The conduct of the parties does not change the legal criteria under subsection 231.2(3) of the ITA and, unless abusive (which is not the case here), does not affect the Court’s discretion. However, both parties must live with the consequences of their actions. For the Minister, a lack of collaboration may result in their UPR request not being sufficiently clear, as in this case.

B. The Verification of Compliance with the ITA

[170] The second statutory precondition for the judicial authorization of a UPR requires the Minister to demonstrate that the UPR’s purpose is to verify the target group’s compliance with any duty or obligation under the ITA (see paragraph 231.2(3)(b)).

[171] There are no fixed criteria to demonstrate if a UPR request is being made to “verify compliance” in the sense meant by paragraph 231.2(3)(b) (Roofmart at paras 43–45). Indeed, the Minister is not required “to demonstrate that a tax audit is underway and is conducted in good faith” (Roofmart at paras 43–45). As established in GMREB, the existence of a pending audit is not a precondition to the exercise of the Minister’s UPR powers (GMREB at paras 19, 42–43). The sole preconditions to judicial authorization are contained in the words of the ITA itself.

[172] In Roofmart at paragraph 48, the Federal Court of Appeal accordingly cautioned parties against “[reinserting] criteria into the legal test that are no longer in the legislation,” and this Court against “[converting] the application for an order into a judicial review of the reasonableness of the Minister’s decision to seek the information, which it clearly is not.” Parliament intended to permit a broad inquiry, subject to the Minister meeting the statutory preconditions (GMREB at paras 21, 45).

[173] A survey of the relevant case law illustrates how requirements can be tethered to the purposes of compliance verification without meeting a strict test.

[174] On the facts in GMREB, the Minister applied for a UPR to determine whether agents and brokers living in a specific area of Québec had properly completed their income tax returns and reported their commission-based earnings (GMREB at para 3). The CRA had received documents from the Real Estate Board while auditing one agent, and applied some months later for a requirement that the Board disclose more information (GMREB at para 50). That information included a list of the Board members, identification information about each member, and a list of properties sold by each individual over a period of three calendar years (see Canada (National Revenue) v The Greater Montréal Real Estate Board, 2006 FC 1069 at paras 6, 9–10). The affidavit supporting the application expressly stated that the objective was to determine whether the agents and brokers who earned commissions following the sale of immovable property had complied with all the duties and obligations of the ITA. The Federal Court of Appeal concluded that this evidence satisfied the requirements of paragraph 231.2(3)(b) (GMREB at para 50).

[175] Roofmart upheld a similar finding on paragraph 231.2(3)(b). Referring to the cross-examination of a witness supporting the application, Justice Rennie of the Federal Court of Appeal noted that it was sufficient for the witness to give a general sense of the purpose for which the information would be used by the CRA. The witness’s failure to explain precisely how the information would be used for verification purposes was not fatal to the application. Their testimony was sufficient to establish that the information sought would assist in determining whether the unnamed persons had filed their returns as required, made payroll, GST and HST remittances, reported all of the income earned on the sale or supply of roofing materials, or claimed the purchases as business expenses (Roofmart at para 46).

[176] The analysis carried out by Justice Little of the Federal Court in RBC is a further example of how to make determinations on paragraph 231.2(3)(b). The supporting affidavit in that case stated, under the heading “Purpose of Application,” that the Minister was seeking authorization for “purposes related to the administration and enforcement” of the ITA to determine, among other things, whether a particular account holder was associated with the taxpayer. The affidavit, as such, tracked statutory language contained in subsection 231.2(1) and paragraph 231.2(3)(b), but did not connect the dots between any of the facts set out in the affidavit and the compliance purpose required to meet the precondition of paragraph 231.2(3)(b) (RBC at para 21). The Minister’s written submissions similarly tracked language in the statute, not citing any provision in the ITA under which the account holder(s) would have owed duties or obligations that were the subject of compliance verification (RBC at paras 22–23).

[177] On the facts presented before the Court, Justice Little found that the evidence addressed and met the requirements of paragraph 231.2(3)(b) of the ITA, because some of the evidence suggested the CRA having a purpose of verifying compliance by the unknown account holder(s) relating to the proper preparation of tax returns in accordance with their duties and obligations in the ITA. Considering the evidence and submissions on the application, as well as the broad information-gathering purpose of section 231.2 of the ITA reaffirmed in Roofmart, Justice Little exercised the Court’s discretion in favour of the Minister. In doing so, he noted that “while the affidavit evidence in this case [did] not explain the purposes of the information requirement in the same manner or in the same detail as the evidence in Roofmart and Greater Montréal Real Estate Board, the Minister in this application also [did] not seek the same kind or scope of information, i.e., transaction information over several years, or copies of the unnamed persons’ personal or business documents” (RBC at para 29). Having established that distinction, the Court authorized the UPR.

[178] The most recent UPR analysis undertaken by this Court was in Helcim. In that case, the Minister sought to verify if the merchants had properly “(i) filed returns as and when required under the ITA and ETA; (ii) reported all or any of the income earned from sales or services as required under the ITA; (iii) claimed amounts as business expenses under the ITA; (iv) collected and remitted payroll tax under the ITA; (v) remitted net tax under the ETA i.e., whether they have collected, reported, and remitted all of the GST and/or HST imposed on the sale or supply of their goods and/or services; and (vi) claimed input tax credits” (Helcim at para 25). They submitted that upon receiving this information, the CRA would review the data provided to verify the merchants’ compliance. On this evidence, Justice McDonald found that the Minister had demonstrated a sufficient connection between the content of the requirement and its stated purpose (Helcim at para 27). The Court accordingly granted the application.

[179] Again, the lone occasion on which an applicant failed to meet this second statutory precondition was the UPR request denied by Justice Roy in Hydro-Québec #1. In that case, the Court notably concluded that the “information sought by the Minister, that is, the corporations or individuals subject to the business rate, [did] not correspond, in itself and according to a strict interpretation, with the production of information or documents [for the purposes of compliance verification]” (emphasis added) (Hydro-Québec #1 at para 79). Justice Roy noted further that “[the] contact information of Hydro-Québec’s business clients [was], at best, outside the scope of the information needed to verify compliance with the ITA” (Hydro-Québec #1 at para 79).

[180] However, Roofmart’s interpretive guidance is now clear on this point: the words of the statute do not set forth a strict test to be met by the Minister (Roofmart at paras 43–45).

[181] A review of the relevant case law thus shows the relative ease with which the Minister can demonstrate a compliance verification purpose under paragraph 231.2(3)(b) of the ITA: a strict test need not be met, and the Minister is entitled to track statutory language in their affidavit.

[182] Nevertheless, turning to RBC is particularly instructive. While there is no need to elaborate at length as to why the Minister is seeking the authorization to issue a UPR, it would be preferable for their affidavit to “connect the dots” between the facts they set out and the alleged compliance purpose (RBC at 21). For example, the Minister may do so by citing the provisions under which the target group “may owe duties or obligations that are the subject of verification for compliance, [and then by relating] those provisions to [evidence] in [their] affidavit” (RBC at para 23). Should the Minister put in this effort, it will support the evidence that the second precondition under subsection 231.2(3) of the ITA has been met.

[183] With these guiding principles in mind, this Court must assess the parties’ submissions and be satisfied that information or documents relating to the unnamed persons are required to verify compliance with the ITA.

1) The Minister’s Argument: The Proposed UPR Verifies Compliance with the ITA

[184] The Minister purports to verify whether Canadian-resident “Merchants” complied with their duties and obligations under the ITA. They claim that the information requested will serve to identify those “Merchants” and match them in the CRA’s internal systems. Once matched, the information will assist in understanding the non-compliance risk of each “Merchant,” which includes whether the “Merchants” filed their tax returns, remitted GST/HST, and reported the income earned on online sales. If the Minister determines that the “Merchants” have not complied with their duties and obligations under the ITA, the “Merchants” may be audited and, if appropriate, assessed or reassessed under the ITA.

[185] In the Minister’s view, the foregoing should be sufficient for this Court to authorize the UPR. Parliament intended to permit a broad inquiry, subject to the Minister meeting the statutory preconditions in subsection 231.2(3) (GMREB at paras 21, 45). The Minister is not required to give anything beyond a general sense of the purpose to which the information will be put, so long as the Court finds that it would assist in determining whether the Canadian-resident “Merchants” filed their returns as required, made GST and HST remittances, and reported the income earned on sales.

2) Shopify’s Argument: The Proposed UPR Does Not Verify Compliance with the ITA

[186] According to Shopify, the Minister has failed to prove that the proposed requirement will further a “good faith audit purpose” (Respondent’s Memorandum at para 5). This argument rests on three broad points: (1) the Minister’s evidence is conclusory and unsupported; (2) the Minister has not established an audit purpose for many members of the target group; and (3) the Minister has not established an audit purpose for much of the information sought.

a) The Minister’s Evidence is Conclusory and Unsupported

[187] Shopify claims that the only “information on oath” by which the Minister seeks to establish a “good faith audit purpose” are conclusory assertions from Mr. Kalil that: (a) “[the] underground economy—that is, the participation in commercial activity that is under or unreported for tax purposes—presents a compliance issue” (Kalil Affidavit at para 6, AR at 13); (b) the “underground economy is prevalent” in the “e-commerce” industry (Kalil Affidavit at para 6, AR at 13); (c) the recent pandemic “expanded” the “e-commerce landscape,” creating “challenges” for CRA (Kalil Affidavit at para 7, AR at 13–14); and (d) the CRA “has concerns that Shopify’s ‘Merchants’ may be participating in the underground economy and are not compliant with their Canadian tax obligations” (Kalil Affidavit at para 14, AR at 15).

[188] According to Shopify, these assertions are not sufficient to establish a “good faith audit purpose,” because they do no more than show the Minister’s interest in an “ordinary phenomenon, such as […] the underground market” (Hydro-Québec #1 at para 100). Shopify submits that Mr. Kalil’s affidavit fails to refer or attach any evidence supporting the assertion that an underground economy actually exists within the e-commerce industry. This is notably in contrast to the record in Roofmart, in which the Minister had placed detailed evidence before the Court, including studies on the extent of unreported economic activity in the construction sector, and the reasons for which the company in particular had been selected for the requirement (Roofmart at para 3; see also Bambora at para 2).

b) The Minister Has Not Established an Audit Purpose for Many Members of the Target Group

[189] Shopify argues that the Minister’s stated audit purpose is generic, merely parroting the language in paragraph 231.2(3)(b) and Roofmart. This is notably the case in Mr. Kalil’s affidavit, which states that the Minister seeks to verify “whether Shopify’s Canadian-resident ‘Merchants’ have complied with their obligations under the ITA and the ETA” (Kalil Affidavit at para 19, AR at 16).

[190] Moreover, Shopify claims that the Minister is seeking information about many people outside the purported target group without having attested to any audit purpose for that information. For instance, the Minister seeks the personal information of “Shopify Owners” without providing evidence as to how they intend to use the information of those merely “associated with” a Shopify account. The UPR request may thus sweep up employees, third party contractors, and others, without the Minister having demonstrated that the UPR request is sought to verify their compliance in particular. Simply stated, the Minister’s evidence does not match the breadth of their target group.

[191] This last point is important in light of the Federal Court of Appeal’s guidance in Roofmart, a case on which the Minister relies to argue that a UPR may “inadvertently sweep in some” persons who may be of no interest to the Minister for verifying compliance (emphasis in the Respondent’s Memorandum at para 66). On Shopify’s reading, this passage merely acknowledges that, within a group for which there is a good faith audit purpose, there may be some persons who are not of interest to the Minister. It does not remove the requirement to establish an audit purpose for a precise target group; nor does it support requesting sensitive personal information about entire categories of persons for whom there is no evidence of an audit purpose. Roofmart does not grant the Minister the right to conduct a full-fledged fishing expedition.

c) The Minister Has Not Established an Audit Purpose for Much of the Information Sought

[192] Shopify contends that the Minister has failed to establish how much of the information sought in the Proposed UPR will “actually advance” the purported audit purpose (Respondent’s Memorandum at para 67). A comparison with Roofmart underscores the Minister’s lack of evidence. In the present case, the Minister seeks fifteen types of information, claiming that each could be used to match “Merchants” to taxpayer numbers within the CRA’s systems (Kalil Affidavit, AR at 37, Tab 3.(b), Exhibit “B” – “Draft requirement”). By contrast, the Minister in Roofmart only required four pieces of information to perform the same exercise (at para 5). Shopify claims that the Minister has failed to demonstrate why all this additional information is now necessary.

[193 ] Specifically, Shopify submits that the Minister has not explained why they requested each type of information. For instance, Shopify claims that it is unclear how information like “Shopify store(s) type” and the “IP address(es)” associated with a “stores(s) website” could actually be used for matching purposes. If the Minister is in fact suggesting that the CRA is entitled to the private IP addresses associated with an account login, Shopify argues that the requirement would then engage the Charter right against unreasonable search and seizure (Canadian Charter of Rights and Freedoms, s 8, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11). As the Supreme Court of Canada recently held in R v Bykovets, 2024 SCC 6 at paragraph 87 [Bykovets], Canadians have a reasonable expectation of privacy in their IP addresses, such that the state is limited to searches motivated by legitimate concern. Arbitrary and discriminatory searches for IP addresses are impermissible. In the present case, Shopify argues that the Minister has not only failed to justify their arbitrary demand for IP addresses, but they have not even cogently explained what they are requesting.

3) Analysis: The Ambiguity of the Target Group Undermines Compliance Verification

[194] Although each legislative precondition operates independently from the other, the vagueness that assails the Minister’s Application under paragraph 231.2(3)(a) ultimately undermines their Application in relation to paragraph 231.2(3)(b).

[195] To be clear, I am satisfied by the evidence that the Proposed UPR is being made to verify the Shopify “Merchants’” compliance with any duty or obligation they have under the ITA. As stated in Roofmart (at paras 43–45), the words of the statute do not set forth a strict test to be met by the Minister, and the Minister is certainly not required “to demonstrate that a tax audit is underway and is conducted in good faith” (Roofmart at para 45; GMREB at paras 19, 42–43, 48). It is sufficient, as Mr. Kalil’s affidavit attests, to demonstrate a general sense of the purpose for which the information would be used by the CRA and establish that the information sought would assist the CRA in determining whether the “Merchants” have complied with the ITA (Roofmart at para 46). Indeed, as stated in RBC and Helcim, it may be sufficient in some circumstances to simply track the statutory language contained in paragraph 231.2(3)(b) and demonstrate that the CRA would review the data provided to verify the unnamed persons’ compliance with the ITA, without having to specifically connect the dots between any of the facts of the UPR request with the compliance purpose of the CRA (RBC at paras 21–23; Helcim at paras 23–27).

[196] In other words, I am satisfied that Mr. Kalil’s affidavit provides justification for the Proposed UPR as it relates to “Merchants,” insofar as it specifies that the CRA intends to verify their compliance by matching the “Merchants’” taxpayer number, address, or date of birth within the CRA’s system.

[197] Although the suspicion of non-compliance is no longer a relevant factor under paragraph 231.2(3)(b), I also accept that the “underground economy” might present a compliance issue for the Minister, and that e-commerce is an industry that is increasingly prevalent in the underground economy. With some variation, this is an issue that has already been recognized by this Court in its analysis of compliance verification, namely in eBay, 2008 FCA 348 (at paras 5, 9, 69), PayPal (at para 9), Bambora (at para 3) and Helcim (at paras 24–27).

[198] However, and as discussed above, the Proposed UPR is confusing as to the Minister’s intent regarding item A.2) and their request for the “name of each person(s) (whether individual or business entity) associated with the Shopify account (‘Shopify Owner’).” As the evidence demonstrates, this item requires disclosure of names that are not within the proposed group of “Merchants” (including designated representatives), and instead include other employees and third parties.

[199] The problem is that the Minister’s evidence does not identify any intent to verify the compliance of those “additional” individuals and business entities with any duty or obligation under the ITA, pursuant to paragraph 231.2(3)(b) of the ITA.

[200] As stated, a UPR request may “inadvertently sweep” some persons “who may be of no interest for the Minister for the purposes of verifying compliance” (Roofmart at para 40). In this case, however, the Proposed UPR is specifically seeking through item A.2) information on “each person(s) (whether individual or business entity) associated with the Shopify account,” and as demonstrated by the Shopify Terms of Service (Lee Affidavit, RR at 100–101, Tab 4, Exhibit “B” – “Shopify Terms of Service”), requires disclosure of the names of individuals and third parties that are outside of the definition of “Merchants” or their designated representatives. The Minister is therefore “interested” in that information and its obtention would not be “inadvertent.” Given that the Minister’s evidence does not establish any intent of verifying compliance of those “additional” individuals and business entities with the ITA, item A.2) is too broad and cannot meet the requirement under paragraph 231.2(3)(b). Item A.2) targets persons not for the purpose of their own compliance with the ITA, but to help the CRA verify the compliance of others—the “Merchants”—with the ITA.

[201] The Minister has not demonstrated with information on oath that their target group is “ascertainable,” because it reaches beyond “Merchants” to potentially include a broad set of additional individual or business entities, as discussed above. In these specific circumstances, the Minister’s failure to define an “ascertainable” group has also made it impossible to conclusively rule that the information sought is made to verify the compliance of persons within that group (“Merchants”) with their obligations under the ITA, which is the precondition under paragraph 231.2(3)(b).

C. The Exercise of Residual Discretion

[202] Even when the Minister meets the statutory preconditions on a balance of probabilities, judicial discretion remains a component of subsection 231.2(3) (RBCLIC at paras 23, 30; Rona FCA at para 7; Roofmart at para 56). This element of discretion is essential to the authorization process (Derakhshani at para 19).

[203] The precise confines of the Court’s discretionary authority are somewhat ill-defined. This is likely due to the relative scarcity of case law in the area, but also to the rarity with which the Court has been called upon to exercise its discretion under subsection 231.2(3) of the ITA, especially in cases where the third-party recipient of the UPR request has mounted a strong defence. It is thus unsurprising that a neat set of criteria does not emerge from an examination of the relevant jurisprudence.

[204] The Court’s discretionary authority is primarily remedial in nature, enabling it to remedy abuse (Derakhshani at para 19; RBCLIC at para 23; Rona FCA at para 7; Roofmart at para 56). It stems first from the permissive wording of the ITA which, importantly, uses “may” rather than “shall” in setting forth the Court’s power in the context of judicial authorization (see section 11 of the Interpretation Act). Discretion is further baked into the notion of granting authorization “subject to any conditions that the judge considers appropriate,” (emphasis added) a choice of words granting the Court considerable latitude in crafting its order.

[205] Yet this discretion is also rooted in the power of the Federal Court, independent of statute, to redress abuses of process (RBCLIC at paras 33–36). As noted by Justice Stratas of the Federal Court of Appeal in RBCLIC, “the Federal Courts’ power to investigate, detect and, if necessary, redress abuses of its own processes is a plenary power that exists outside of any statutory grant, an ‘immanent attribute’ part of its ‘essential character’ as a court, just like the provincial superior courts with inherent jurisdiction” (RBCLIC at para 36). These plenary powers are especially relevant in situations where the Court is exercising its “superintending power over the Minister’s actions in administering and enforcing the [ITA]” (Derakhshani at paras 10–11).

[206] However, this discretion is not without limits. Once the statutory preconditions have been met, the Court’s discretion “is not a means by which Parliament’s policy choices, as expressed in the subsection, are to be revisited” (Roofmart at para 56). Moreover, the Court cannot allow “[the] provisions Parliament deleted [to] be resuscitated or brought in through the back door in the guise of policy arguments pertinent to the exercise of the judge’s discretion whether to grant the order” (Roofmart at para 27). Those provisions historically required the Minister to demonstrate that (i) there be reasonable grounds to believe the subject of a UPR had not complied with the Act; and that (ii) the information or documents requested were not otherwise more readily available (Roofmart at para 23). The exercise of judicial discretion is limited by the objective of the statute, the nature of the order sought, and the circumstances in which that order would be made (see e.g. R v Lavigne, 2006 SCC 10 at para 27).

[207] A live issue in these proceedings has been whether this Court should consider taxpayer privacy interests in its discretion. This is conceptual terrain on which this Court must tread lightly.

[208] Case law suggests that there is a very low expectation of privacy for business records relevant to determining tax liability, because Canada has a self-assessment and self-reporting system that relies on integrity and honesty (Redeemer Foundation v Canada (National Revenue), 2008 SCC 46 at para 25 [Redeemer Foundation]; Roofmart at para 55). In the context of a UPR, Parliament has already done the balancing exercise between privacy rights and the need for the Minister to have the requisite tools to administer the ITA (Roofmart at para 21). Parliamentary intent favours “[the] broader public interest in the enforcement of our system of taxation [over the company’s] private and commercial interests in not disclosing its clients’ personal information” (Roofmart at para 55; see also Redeemer Foundation at para 25; eBay, 2008 FCA 141 at para 39). The concurring justices of the Federal Court of Appeal panel in Hydro-Québec FCA even distanced themselves from commenting on the scope of the Court’s residual discretion when Justice Goyette, in dissent on this point, noted the increased concern to be given for taxpayer privacy interests as expressed in R v McKinlay Transport Ltd, 1990 CanLII 137 (SCC), [1990] 1 S.C.R. 627 at page 649 [McKinlay] in a world where information is abundant, easy to transmit, and where no institution—not even the CRA—is immune from hacking (Hydro-Québec FCA at para 25).

[209] On the other hand, the guidance in Roofmart does not completely forswear the discretionary consideration of privacy concerns. In fact, such a reading would arguably sterilize the core purpose of this Court’s discretionary authority: remedying abuses of ministerial power (Roofmart at para 56). The Court rather understands Roofmart as warning judges against exercising their judicial discretion to impose conditions and hurdles on the authorization process beyond what is already set forth in statute—thus offsetting the balancing act already undertaken by Parliament (Roofmart at para 56). An authorizing Court cannot, on the basis of privacy concerns, demand a higher standard of disclosure or proof than what is already required on behalf of the Minister (Roofmart at paras 49–55). It cannot use taxpayer privacy as a ground upon which to demand a “good faith audit purpose” from the Minister (Roofmart at paras 43–45). However, it can impose “any conditions that the judge considers appropriate” to remedy abuses in crafting its order (see subsection 231.2(3) of the ITA).

[210] Another live issue in the present case is whether this Court should consider the “feasibility” of the proposed requirement in its residual discretion. This is conceptual terrain on which the Court has trod before, but it also presents its share of difficulties.

[211] To date, the issue of feasibility has been a consideration in two UPR applications before this Court. The first was Rona FC, in which Justice Martineau authorized a requirement targeting the commercial customers of fifty-seven large retail stores, allowing them to seek the name, address, and the total amount of annual transactions on each commercial account for a period of three years. The company in question conceded the existence of an “ascertainable” group but argued that the information requested by the Minister was not wholly pertinent to verify compliance with the ITA (Rona FC at paras 8–9). Justice Martineau found that Rona was not required to provide the total amount of transactions charged to each commercial client during the relevant period if it provided the Minister with statements of transaction for each commercial client instead, something which the company had already done following a prior ex parte motion granted by the Court (Rona FC at paras 20–21). This prior motion had authorized the Minister to issue UPRs to twenty hardware stores, six of which belonged to the company. These six stores complied within forty-five days of the Minister’s request (Rona FC at para 21).

[212] Justice Martineau relied on these latter findings, and others, when exercising the Court’s discretion in favour of the Minister’s application. In doing so, the Court noted first that the Minister had greatly reduced the scope of the proposed requirement over the course of the proceedings, going from nineteen to just three requirement items, and from eighty-five to fifty-seven targeted stores (Rona FCA at para 6; Rona FC at para 26). The Court then balanced this consideration against the fact that, even if this narrowed requirement would reduce the time needed to prepare and communicate the required information, it would nevertheless impose a considerable amount of work on the third party subject to the UPR request—notably due to it having no system for nationwide data storage, and the possibility of commercial clients using several of the company’s stores at a time (Rona FC at para 27).

[213] What ultimately tipped the balance in the Minister’s favour was Rona’s evidence showing that each store covered by the request possessed their own systems of information in place, each listing the relevant transaction statements for commercial clients (Rona FC at para 28). In other words, there was concrete evidence that Rona could provide the Minister with the requested information (Rona FC at para 29).

[214] As for the potential hardship faced by Rona, the Court found that it was unclear how much time and effort would actually be required on Rona’s behalf to fully comply with the proposed UPR (Rona FC at para 30). To this effect, the Court reiterated its authority to retain jurisdiction and extend the compliance deadline if it proved impossible for Rona to fully comply with its obligations in time, despite all reasonable efforts deployed (Rona FC at para 32).

[215] Justice Martineau’s analysis was affirmed on appeal, with the Federal Court of Appeal emphasizing the judge’s discretionary authority in the circumstances (Rona FCA at para 7).

[216] The second case discussing the issue of feasibility issues was PayPal, in which Justice Gascon authorized a UPR targeting four years’ worth of aggregated transaction information of corporations and individuals holding a PayPal Canada Co. Business Account (PayPal at para 20). After finding that the target group was “ascertainable” and that the UPR had been made to verify compliance with the ITA, the Court considered the feasibility of the proposed requirement within its residual discretion. In doing so, it noted “that PayPal [had] not filed any evidence to support a claim that the Unnamed Persons Requirement [was] overbroad or [reached] a disproportionate number of persons or transactions” (PayPal at para 17); “that PayPal [had] indicated to the Minister that the information sought in the Unnamed Persons Requirement [was] available in PayPal’s computer systems, and that PayPal [had] not submitted any evidence showing that it [was] not feasible to provide the information or that it [was] unable to comply with the proposed Unnamed Persons Requirement” (PayPal at para 18). Justice Gascon accordingly authorized the proposed requirement, satisfied that it was in the interests of justice for the Court to do so (PayPal at para 19).

[217] These two cases should inform the Court’s exercise of its discretion, and help establish what should be a basic principle at this stage of the analysis: the Court may consider the feasibility of the proposed requirement when presented with evidence that it would be impossible or unduly strenuous for the third party to comply with the UPR. The Court’s discretion enables it to remedy abuses of ministerial power, and it would be abusive on the Minister’s part to order a person to comply with an impossible or unfeasible UPR request.

[218] However, this discretion should be exercised with caution. Two considerations are worth bearing in mind.

[219] First, the exercise of discretion remains grounded in the evidence before the Court. Residual discretion under subsection 231.2(3) of the ITA is no license to subject every proposed UPR to an “undue hardship” analysis or “feasibility” inquiry. Parliament has not mandated such an exercise. There are no preconditions for the authorization of a UPR beyond those established in the ITA. The relevant question is whether the third party receiving the UPR request has presented evidence that compliance is impossible or unduly strenuous. In the absence of such evidence, there is no need for any kind of feasibility analysis from the Court.

[220] Second, the costs associated with tax compliance are part of a person’s basic public duties (Morguard Properties Ltd v City of Winnipeg, 1983 CanLII 33 (SCC), [1983] 2 S.C.R. 493 at 507). Giant corporations will tend to have complex internal structures, large customer bases, and various arrangements according to which they collect and store the data most relevant to their compliance with the ITA (see e.g. eBay, 2008 FCA 348; PayPal; Hydro-Québec #1). Smaller corporations can be simpler in structure, deal with a more limited set of customers, and maintain their books and records in a relatively straightforward fashion (see e.g. Rona FC). Each will face different challenges when it comes to complying with a UPR request under the ITA. But these differences are not—in and of themselves—bases upon which this Court should circumscribe the Minister’s power to ensure compliance with the ITA. The UPR provisions of the ITA do not vary according to the size or sophistication of the parties involved. All must comply with the law of the land. Feasibility should not be a trump card for giant corporations who seek to evade the Minister’s investigatory powers.

[221] However, case law has also noted that disproportionate costs may be taken into account in the exercise of the Court’s discretion (RBCLIC at para 30; Hydro-Québec #1 at paras 93, 104). In that sense, a UPR that would require massive investments in order to respond may be abusive, and demand the Court’s intervention to narrow it and impose stricter conditions, in appropriate circumstances.

[222] Discretionary intervention can also facilitate the non-abusive exercise of ministerial power. Consider a fictional UPR request consisting of nineteen items, that the Court finds unfeasible and abusive due to its breadth. In such a case, the Court could still make a finding that a UPR tailored to the three most essential items would not be unfeasible or abusive, and authorize a more tailored request. The Minister may find that upon receiving these three items, further information gathering is not necessary. A contrario, they might also find that these three items are not enough, and the Minister might seek the Court’s authorization to issue a second UPR concerning some of the other items left off the initial UPR. In other words, the Court’s discretion under subsection 231.2(3) enables the Minister to proceed in stages. This allows the Minister to obtain the information they require, but also allows the Court to mitigate the hardship that may be caused to the third party. Rona FC is a good example of this, for it shows that proceeding in stages may be appropriate, and that the Minister might not need all the items they initially required. In that case, as discussed above, the scope of the UPR request was reduced by the Minister from nineteen items to three.

[223] Overall, the Court’s residual discretion is guided by a broad sense of proportionality (see e.g. Apotex Inc v Janseen Inc, 2022 FC 1476 at paras 19–20; see also Canada v Lehigh Cement Limited, 2011 FCA 120 at paras 34–35; Hospira Healthcare Corporation v Kennedy Trust for Rheumatology Research, 2020 FCA 177 at paras 8–9). Judges retain discretion not to compel disclosure of information if the Minister is abusing the process, where disclosure would be impossible or unduly strenuous on the third party receiving the UPR request, or where the proposed UPR represents a full-fledged fishing expedition. Considerations such as the availability of the information sought and the burden required to obtain it can all be relevant in the Court’s exercise of discretion. However, these considerations cannot be taken as mandatory steps of the UPR analysis. They are not additional preconditions for the Minister to meet under subsection 231.2(3) of the ITA. The exercise of residual discretion remains a fact-driven, evidence-based process. When presented with relevant evidence on these fronts, the Court is entitled to consider it.

[224] With the foregoing principles in mind, this Court must exercise its discretion in relation to the Minister’s proposed UPR.

1) The Minister’s Argument: It Is in the Interests of Justice to Authorize the Proposed UPR

[225] The Minister claims that it is appropriate and in the interests of justice for this Court to exercise its discretion to authorize the Proposed UPR.

[226] At the outset, the Minister cautions this Court against revisiting Parliament’s policy choices with respect to privacy. Taxpayer privacy is a delicate matter to which Parliament is sensitive, having notably enacted section 241 of the ITA to prohibit the disclosure of records and information gathered by the Minister to other persons unless it is for the purposes of administrating or enforcing the ITA. While Parliament has put restrictions on the disclosure of taxpayer information, the Minister remains entitled to collect records, including those flowing from an online business. The broader public interest of enforcing the tax system outweighs the taxpayers’ private and commercial interests in not disclosing their personal information to the Minister (eBay, 2008 FCA 141 at para 39). The Minister submits that they may accordingly require Shopify to produce information, whether in writing or in any other form, including information stored on a server.

[227] While Shopify cites several internal policies and protocols (many of which concern user privacy) to argue that the proposed requirement is too burdensome upon the company (see e.g. Lee Affidavit at paras 40–49, RR at 77–79), the Minister reiterates that Parliament has already considered taxpayer privacy and set out a coherent regime that balances restrictions on disclosure with the Minister’s broad information gathering powers. For large corporations like Shopify, the costs associated with the Minister’s requirement are part of its basic public duties (Tele-Mobile Co v Ontario, 2008 SCC 12 at paras 50, 57 [Tele-Mobile]; Deegan v Canada, 2022 FCA 158 at paras 60–63). Shopify’s internal processes are not a basis upon which this Court should circumscribe the Minister’s information gathering powers.

2) Shopify’s Argument: The Proposed UPR is Unfeasible and Disproportionate

[228] Before setting forth its arguments on discretion, Shopify advances a more general claim about how this Court should understand its role under subsection 231.2(3); namely, that judicial oversight must be exercised in a “privacy-protective” manner (Respondent’s Memorandum at para 71). In crafting the statutory preconditions for the authorization of a UPR request, Parliament struck a balance between privacy rights, on the one hand, and the Minister’s need to administer the ITA, on the other. It is accordingly necessary for the Court to consider the privacy interests of those in the target group before granting authorization, as mandated by the authorizing provisions.

[229] Shopify argues that Bykovets supports its claim. Although not strictly relevant to the UPR authorization process, this recent Supreme Court of Canada decision emphasizes the importance of judicial oversight in the face of increased state power in digital spaces; the circumstances in which courts strike a balance between state and personal interests have changed. In an age of abundant and easily transmissible information, no institution is immune to cybersecurity threats. Disclosing sensitive information to the government has become a risky business.

[230] For Shopify, this risk is not merely hypothetical. It notes that in 2020, nefarious actors were able to exploit weaknesses in the CRA’s security safeguards and reach sensitive personal information held in its databases. Upon further investigation, the Office of the Privacy Commissioner of Canada found that the CRA did not take all reasonable steps to protect itself against unauthorized disclosures of personal information (Office of the Privacy Commissioner of Canada, Special Report to Parliament, Investigation of unauthorized disclosures and modifications of personal information held by Canada Revenue Agency and Employment and Social Development Canada resulting from cyber attacks (February 15, 2024) at paras 14–15, 112 [Privacy Commissioner Special Report]). Despite this, those at the CRA who are required to consider confidentiality and privacy concerns when issuing UPR requests, such as Mr. Kalil, were not made aware of the hacking or data-breach by the CRA, and did not receive guidance as to how to take reasonable steps to protect against unauthorized disclosures (see Kalil Cross-Examination at 18, 20, 24, RR at 978–980, 984). Shopify accordingly submits that the relative permeability of the CRA’s data-protection scheme should give this Court pause when considering its proposed requirement.

[231 ] It is important to note at this point that Shopify has filed a motion to introduce the Privacy Commissioner Special Report as evidence in the Application. The Minister opposes this motion. I rule below that the Privacy Commissioner Special Report is not sufficiently persuasive to enable the Court to refuse the Proposed UPR on that basis, as it does not demonstrate that the CRA systems are compromised at this time or that data-breaches are systemic within the CRA.

[232] Shopify then argues that the “unprecedented magnitude” of the Proposed UPR only underscores the privacy risk for Shopify and its clients (Respondent’s Memorandum at para 76). Although it is true that “[taxpayers] have a very low expectation of privacy” in a self-reporting system of taxation, Shopify argues that this kind of expectation is reserved for “business records relevant to the determination of their tax liability” (see Redeemer Foundation at para 25). The information sought in the proposed requirement goes well beyond such records. The Minister also seeks dates of birth, mailing addresses, bank account details, and KYC documentation, all of which is often associated with the Shopify Payments Account Holder, but not necessarily the business owner and their tax compliance. Moreover, to the extent that the Minister is seeking IP addresses associated with Account Owner logins, that sensitive information is not a “business record” and disclosure can expose “deeply personal information” (Bykovets at paras 10, 55, 60). The Court should be mindful of the breadth of the Minister’s proposal when exercising its judicial oversight over this disclosure.

[233] For Shopify, a careful exercise of this judicial oversight requires a “balancing of interests” (Respondent’s Memorandum at para 80). On one side, the Court weighs the persons’ right to privacy with respect to their personal information; on the other, it weighs the needs of both government and other commercial organizations to collect, use, and disclose personal information. In this respect, Shopify further submits that the Court should consider whether (1) the collection, use, or disclosure of personal information is directed to a legitimate need; (2) there are less invasive means of achieving the same ends at comparable cost and with comparable benefits; and (3) the loss of privacy is proportional to any benefit gained.

[234] In Shopify’s view, this balancing act should conclude that “there is no justification for this arbitrary disclosure” (Respondent’s Memorandum at para 79). This is because the Minister has failed to tether much of the information sought to an audit purpose, adduce any evidence of having considered less invasive means of achieving their audit goals, or whether disclosure of the requested information will actually further the goals. Shopify argues that the Court should accordingly exercise its judicial oversight to deny the proposed requirement, and thus prevent a full-fledged fishing expedition.

[235] With this overarching claim in mind, Shopify submits the following three arguments with respect to the Court’s residual discretion: (1) judicial discretion exists to prevent fishing expeditions; (2) it will take Shopify almost a decade to fulfill the proposed UPR; and (3) it is impossible for Shopify to comply with the proposed UPR.

a) Judicial Discretion Exists to Prevent Fishing Expeditions

[236] At the outset of its first argument, Shopify makes a claim about the scope and content of residual discretion, i.e., what exactly the Court can consider at this stage of the analysis. It submits in this respect that the Court may have regard to any relevant factor in the public interest, as long as this discretion is exercised in a manner that complies with Parliament’s policy choices.

[237] For Shopify, privacy is one such relevant factor. It is intrinsic to the Court’s analysis. Far from overriding or replacing due consideration of the statutory preconditions in subsection 231.2(3), the consideration of privacy interests is embedded in the requirements of the authorizing provisions themselves—it is implicit in Parliament’s decision to subject UPR requests to judicial oversight. To consider privacy at the discretionary stage of the analysis is not to revisit Parliament’s choices, but rather to give them effect.

[238] It is in this vein that Shopify argues that judicial authorization, with its inherent discretion, specifically exists to limit and govern fishing expeditions. Such a scheme would lose its meaning if it did not apply to a requirement like this, which Shopify characterizes as a fishing expedition of unprecedented breadth: “it is difficult to imagine a broader fishing expedition than requesting information about hundreds of thousands, if not millions, of persons simply because they are ‘associated with’ an arbitrarily and inconsistently defined group of Shopify accounts” (Respondent’s Memorandum at para 85). Giving effect to Parliament’s policy choices requires this Court to consider privacy in the exercise of its discretion. Due consideration of privacy interests militates in Shopify’s favour.

b) It Will Take Shopify Almost a Decade to Comply with the Proposed UPR

[239] In PayPal, Justice Gascon considered whether it was feasible for the third party subject to a UPR request to provide the requested information (at paras 5–6). Shopify asks this Court to again consider “feasibility” as a relevant factor in the exercise of its discretion, arguing that the proposed requirement will take it nearly a decade to fulfill; this Court should not ask Shopify to do the work of a decade within sixty days, especially with the spectre of contempt hanging over it pursuant to subsection 231.7(4) of the ITA.

[240] Shopify has provided evidence to the Court in support of its factual assertions, purporting to demonstrate why it would take approximately eight full-time working years to comply with the Minister’s Proposed UPR. To this effect, Shopify claims that it employs three Regulatory Analysts to respond to UPR requests. Historically, UPR requests have been satisfied for one or a small number of Store Owners at a time. It is estimated that—for a typical account that does not require special handling—it will take five to ten minutes per account to disclose the information sought in the Proposed UPR. Shopify’s evidence is that “hundreds of thousands” of subscription accounts are “associated with a Canadian address.” If one were to extrapolate the relevant data at its lowest range, interpreting “hundreds of thousands of accounts” at 200,000 accounts and the review period at five minutes per account, it would take—at a minimum—approximately 8 full-time working years to fulfil the Proposed UPR. If all three Regulatory Analysts were all assigned exclusively to the Proposed UPR, Shopify would need to work for almost three years to respond to it, leaving no time to complete the critical business functions for which Regulatory Analysts are employed by Shopify (Respondent’s Memorandum at para 91). In addition, if manual retrieval is required in order to satisfy other portions of the Proposed UPR (such as for KYC information), that process will add another five to ten minutes per account, which will only add to the estimated time period for compliance (Respondent’s Memorandum at paras 92–93).

[241] Shopify’s claim with respect to feasibility runs into the objection that, like any large corporation, the costs associated with the Minister’s requirement are part of Shopify’s basic public duties. In raising this very objection, the Minister partially relies on Tele-Mobile, a decision in which the central issue was whether a third party subject to a production order under the Criminal Code, RSC 1985, c C-46, could receive financial compensation for production costs. Shopify answers this objection by distinguishing the present case from Tele-Mobile, mostly because the burden of compliance in the latter was considerably lower. The two production orders in Tele-Mobile concerned, respectively, call data records of a single individual, and call data records relating to several telephone numbers as part of a drug investigation (Tele-Mobile at paras 5–6). The present case concerns sensitive information about hundreds of thousands (if not millions) of online accounts.

[242] Shopify argues that major differences in scale render Tele-Mobile somewhat inapposite in this case. Indeed, the Court held in Tele-Mobile that even in the criminal context, there can be exemption from production orders that present an “unreasonable burden” (at para 63). In other words, even if compliance with the order is a public duty, a judge may refuse to grant the order because the financial burden associated with compliance is unreasonable. Shopify asks this Court to make such a determination on the grounds that it would be unduly burdensome for it to devote all of its resources for answering requests for information—for several years—entirely to the Proposed UPR.

c) It Is Impossible for Shopify to Comply with the Proposed UPR

[243] Shopify submits that it simply cannot comply with the Proposed UPR, for one of two reasons: (1) it does not collect or (2) routinely purges the information sought by the Minister. This argument is related to but distinct from its point on feasibility. The claim here is not that it would be unreasonably burdensome for Shopify to comply with the requirement; it is rather that compliance is impossible, and that this Court should not authorize a UPR request when it knows in advance that Shopify cannot comply.

[244] Shopify’s evidence on this front is worth consolidating here. Overall, Shopify claims that it does not usually have:

a)Inactive account information for the entire six-year period, because Shopify purges personal information two years after an account becomes inactive (Fazeli Affidavit at para 68, RR at 58);
b)Store Owner (or other) date of birth, or business number, as this information is only collected if a financial services offering such as “Shopify Payments” is activated, and is only required to correspond to the Shopify Payments Account Holder (but not necessarily the Store Owner) (Fazeli Affidavit at paras 60, 70, 74, RR at 54–55, 58);
c)KYC documentation for all accounts, as Shopify only requires this information in certain cases (Fazeli Affidavit at paras 60, 84, RR at 55, 59);
d)SINs, as there is no evidence that Shopify collects this information (Fazeli Affidavit at paras 60, 72, RR at 55, 58);
e)Shopify store(s) type, as Shopify is unfamiliar with the term “store type” and the Minister’s record does not explain what that term means (Fazeli Affidavit at paras 60, 72, RR at 55, 58); and
f)Total number and total value of transactions for each year, as Shopify only has information about transactions that have occurred through “Shopify Checkout,” and there are channels through which a sale can be made that do not involve “Shopify Checkout” (Fazeli Affidavit at para 60, RR at 54–55). Further, the Minister’s exclusive focus on sales made through an “online store” means that any transaction total contained in Shopify’s records would need to be reduced to eliminate transactions that occurred through other sales channels (because, as explained above, Shopify is prohibited from disclosing information beyond that which is actually requested) (Kalil Affidavit at paras 11–12, AR at 14).

[245] The upshot of this evidence is to contradict one of the Minister’s core claims, namely that they can find all the information they seek in the “Checkout” feature of Shopify’s software (Applicant’s Memorandum at paras 35–36). Shopify’s claim here is that “Shopify Checkout” is used for “online store” sales, but not all sales using the software. As for the information that Shopify does indeed collect and retain, much of it is inconsistent and not tied to a specific, identifiable person (Fazeli Cross-Examination at 138–139, AR at 181–182). Shopify could, of course, provide some of the information requested, for at least some of the people involved. Yet the Minister has not proposed to modify the Proposed UPR to allow for such an outcome, and thus reduce the risk of non-compliance for Shopify.

[246] Shopify submits that it is not for this Court to remedy the shortcomings in the Minister’s Application. While the Court’s residual discretion allows it to authorize a requirement subject to any conditions that it deems appropriate, only the Minister can discharge their evidentiary burden with respect to the statutory preconditions. More should be required from the Minister before Shopify is required to disclose data about hundreds of thousands of individuals.

3) Analysis: The Evidence Does Not Favour the Authorization of the Proposed UPR

[247] As stated, even when the Minister meets the statutory preconditions, judicial discretion remains a component of subsection 231.2(3) and the Court may exercise its discretion to remedy abuse (Derakhshani at para 19; RBCLIC at paras 23, 30; Rona FCA at para 7; Roofmart at para 56).

[248] In Rona FC and PayPal, this Court considered the feasibility of a UPR request within the exercise of its discretion. I will do the same in this Application. If the request is too broad or disproportional, the Court can narrow the request as a “condition” to the authorization under subsection 231.2(3), in order to remedy abuse. In other words, a UPR request that is so broad as to create hardship for the third party may be “abusive,” and the Court is entitled to restrict its authorization to a narrower set of items. As long as the “conditions” imposed by the Court do not “revisit Parliament’s policy choices,” or allow for “[the] provisions Parliament deleted [to] be resuscitated or brought in through the back door in the guise of policy arguments pertinent to the exercise of the judge’s discretion whether to grant the order” (Roofmart at para 27), they can be validly imposed (Roofmart at para 56). If the Court was to unduly narrow a UPR requested by the Minister, under its discretion, the recourse may also be to seek the authorization of the Court on a second UPR, on additional items, if the CRA requires additional information after the implementation of the initial one.

[249] On this basis, and as a preliminary matter, Shopify’s argument that the Minister provided no evidence of having considered a “less invasive means” of achieving their audit goals must be dismissed. Accepting Shopify’s argument here would be tantamount to resuscitating an older provision subsequently repealed by Parliament, which required the Minister to demonstrate that the information or documents requested were not otherwise more readily available (Roofmart at para 23).

a) The Court’s Discretion to Consider Privacy Issues Is Very Limited

[250] Shopify argues that the Court should exercise its discretion and deny authorization of the Proposed UPR because the privacy rights of the “Merchants” (and potentially others) will be infringed.

[251] I disagree. Parliament has already done the balancing exercise between privacy rights and the requirement that the Minister have the requisite tools to administer the Act (Roofmart at para 21). In the tax context, there is a very low expectation of privacy for business records relevant to determining tax liability, because Canada has a self-assessment and self-reporting system that relies on integrity and honesty (Redeemer Foundation at para 25). As held in Roofmart at paragraph 55: “Parliament has granted the Minister corresponding powers to verify and test compliance. These powers lie at the heart of the Minister’s ability to enforce taxation legislation. The broader public interest in the enforcement of our system of taxation outweighs the appellant’s private and commercial interests in not disclosing its clients’ personal information” (relying on eBay, 2008 FCA 141 at para 39; see also McKinlay at 649; Redeemer Foundation at para 25).

[252] Shopify argues that the Supreme Court’s decision in Bykovets signals an evolving approach to that the balancing exercise between privacy rights and the state’s power of seizure. However, Bykovets did not relate to privacy rights in the taxation context. Bykovets relates to the seizure of an IP address in the context of a criminal investigation, which engaged section 8 of the Charter. In McKinlay at page 636, the Supreme Court of Canada held that a request under subsection 231(3) of the ITA (a predecessor section to the current subsection 231.2 scheme), coupled with enforcement under subsection 238(2), did not violate section 8 of the Charter because, even if the request for information constituted a “seizure” under section 8 of the Charter, the seizure was reasonable in the taxation context—taxation being a regulatory context as opposed to a criminal or quasi-criminal prosecution (see also Canada (Attorney General) v Chambre des notaires du Québec, 2016 SCC 20 at paras 27, 92). Indeed, a taxpayer’s expectation of privacy on information vis-à-vis the Minister is very low (as opposed to Bykovets, where it was held that there was a reasonable expectation of privacy on an IP address in the criminal context (at paras 28, 31)).

[253] Moreover, in Bykovets at paragraph 2 (see also paras 55, 60, 85–87), the Supreme Court held that when “clearly linked with a crime,” prior judicial authorization is required but also readily available in order to obtain an IP address. In this case, a UPR request is not linked with a crime but, in in any event, also requires judicial authorization to “narrow the state’s online reach” (see Bykovets at paragraph 87), and therefore preclude any broad fishing expedition that would unduly infringe on privacy rights. The requirement for judicial authorization under subsection 231.2(3) of the ITA, and the balancing exercise it represents, are therefore responsive to the privacy concerns arising in relation to IP addresses—as is the case in the criminal law context.

[254] Finally, in Redeemer Foundation, the Supreme Court of Canada reaffirmed that a very low expectation of privacy exists in the tax context for information concerning third parties under subsection 231.1(1) of the ITA (at para 25). The Supreme Court’s conclusion regarding subsection 231.1(1) likewise applies to subsection 231.2(3). It is also important to note that McKinlay and Redeemer Foundation were not specifically discussed nor overruled in Bykovets in relation to taxation matters.

[255] This being said, I do agree with the broad idea that the Court has a residual discretion to consider privacy issues if reliable evidence demonstrates that the CRA is not able to protect the private information of taxpayers.

[256] To this effect, Shopify has sought to introduce the Privacy Commissioner Special Report into evidence. Shopify argues that this Report demonstrates a serious breach of information security at the CRA in 2020, and is relevant insofar as it exposes the CRA’s inadequate information protection measures with respect to the sensitive information of taxpayers.

[257] In that sense, Shopify is raising a different type of privacy right than the one already considered and balanced by Parliament under subsection 231.2(3). The privacy right Shopify intends to protect for its clients is not vis-à-vis the Minister, as balanced by Parliament under subsection 231.2(3), but their privacy right in relation to unknown third parties, and the public at large, who may be able to hack into CRA databases and access private information.

[258] I agree with Shopify on this point. The privacy issue that arises in the context of the Privacy Commissioner Special Report is distinct from the privacy issue considered by Parliament under subsection 231.2(3), which only relates to privacy vis-à-vis the Minister. To the extent that reliable evidence could demonstrate that the CRA is incapable of protecting sensitive information, the balancing exercise made by Parliament in enacting subsection 231.2(3) is undermined. Parliament did not authorize the obtention of information from taxpayers by the CRA, for potential access to the public. The Court’s refusal to authorize a UPR request, on the basis of reliable evidence that the CRA’s systems are permeable and allow the public to access private information, does not constitute a rewriting of the test set out by Parliament under subsection 231.2(3) of the ITA. In that sense, evidence of privacy issues unrelated to the balancing exercise made by Parliament is relevant. These issues could affect the privacy rights of taxpayers, and could have an impact on the exercise of this Court’s discretion.

[259] However, even if I had accepted the Privacy Commissioner Special Report as evidence in this Application, it does not support the notion that a specific data-breach in 2020 jeopardizes the “Merchants’” (and others’) privacy interests today. The Privacy Commissioner Special Report does not conclude that the 2020 incident has compromised the CRA’s system at this time, or that it may affect the data obtained in this case. Moreover, there is no evidence that the CRA system is susceptible to systemic hacking, so as to affect any and all information obtained by the CRA.

[260] Therefore, Shopify’s request for the Court to exercise its discretion and deny the Proposed UPR on the basis of potential privacy issues is dismissed. The privacy rights of Shopify’s “Merchants” have already been balanced by Parliament, and there is no cogent evidence that the CRA is not able to protect the information disclosed. The Privacy Commissioner Special Report, even if it had been properly introduced into evidence, does not establish a systemic issue relating to the CRA’s systems, so as to justify the Court’s intervention.

[261] Finally, I decline Shopify’s invitation to weigh the privacy rights of individuals with respect to their personal information against the needs of both government and other commercial organizations to collect, use, and disclose personal information, given the magnitude of the Minister’s Proposed UPR. Again, this balancing has already been done by Parliament in subsection 231.2(3) of the ITA. Contrary to Shopify’s contention, the Minister did produce evidence tethering compliance verification with the information sought on the “Merchants,” explaining why and how each item would help the Minister determine whether “Merchants” making revenue on Shopify’s platform are complying with their obligations under the ITA (Kalil Affidavit at paras 22–30, AR at 17–19). This approach is consistent with the UPRs previously authorized by the Court (see e.g. PayPal, Bambora, Helcim).

b) The Feasibility and Proportionality of the Proposed UPR

[262] In Rona FC, PayPal, and Bambora, this Court considered the feasibility of a UPR request within the exercise of its discretion. I will do the same in this Application, in light of the principles elaborated earlier in these reasons.

[263] In Rona FC, Justice Martineau considered the Minister’s reduction from nineteen requested items to three, and from eighty-five target stores to fifty-seven, in ruling that the narrowed request would reduce the time necessary for compliance with the UPR, even if it did impose a considerable amount of work. The Court nevertheless retained jurisdiction to extend the time to respond, should Rona be incapable of producing the information in the timeframe initially set.

[264] In PayPal, Justice Gascon specifically noted that there was no evidence that the UPR request was overbroad or disproportionate, or that it was not feasible for PayPal to provide the information, implying that if such evidence had existed, he could have considered it in the exercise of the Court’s discretion.

[265] Finally, in Bambora, Justice Little also approved a UPR request, partly on the basis that while the UPR request would cover many thousands of merchants and would impact Bambora’s daily business operations, there was no evidence expressing concerns about the administrative burden resulting from complying with the UPR request.

[266] In this case, Shopify has brought significant evidence of unfeasibility, which was not contradicted nor tested in cross-examination. The uncontradicted evidence is that it would take eight full-time working years (for one employee) to comply with the Proposed UPR, meaning that it would take about three years of full-time work for all of Shopify’s three Regulatory Analysts to respond.

[267] Nothing before the Court (expert evidence or otherwise) suggests that it is unreasonable for a company of Shopify’s size and sophistication, dealing in a complex regulatory environment, to employ a mere three Regulatory Analysts. Evidence on this issue could have led this Court to conclude that companies of comparable size and sophistication, dealing in the same regulatory context, devote many more employees to this task and, therefore, that hiring more Regulatory Analysts to comply with a UPR request (and other regulatory obligations) should represent a “normal cost of business” or “public duty.”

[268] In this particular case, the Proposed UPR is disproportional. As discussed above, I would have been inclined to authorize a more “limited” UPR request, in similar terms as what was proposed in the companion File No. T-777-23. In that case, the items requested were (i) the “Merchant” store trading name; (ii) store legal name; (iii) contact names; (iv) contact number; (v) email address; (vi) postal code; (vii) ‘.myshopify.com’ URL; and (viii) total revenue for sales. In this regard, I pause to observe that the group sought by the Minister in File No. T-777-23 was more consistent with the requests authorized in eBay, 2008 FCA 348, Roofmart, PayPal, Bambora, Helcim, and Hydro-Québec #2. Most importantly, the other UPRs recently approved did not require disclosure of (i) any other individuals or business entities “associated” with the account; (ii) IP addresses; (iii) payment gateways/processors used and/or listed; (iv) KYC documentation; or (v) dates when an account was activated or closed. Finally, while Shopify argues that it would be impossible to respond to the proposed UPR in File No. T-777-23 within 45 days, it does not argue that it would require the equivalent of eight full-time working years (for one employee) to respond and comply with the UPR request (Shopify’s Memorandum File No. T-777-23 at para 87; Lee Affidavit at paras 48–49, RR at 79).

[269] In my view, restricting the Proposed UPR to similar items as sought in File No. T-777-23, and also in other UPR requests relating to e-commerce, would have been a proper exercise of the Court’s discretion. Such conditions do not constitute a rebalancing exercise of Parliament’s intent, nor introduce criteria previously excluded by Parliament in past amendments to subsection 231.2(3) of the ITA. Rather, the Court imposes conditions that are necessary to prevent abuse, and those conditions are based on the evidence and informed by UPR requests previously authorized by the Court in similar contexts.

[270] On this last point, two elements of nuance are perhaps warranted, for greater clarity.

[271] First, the distinction I make between these other cases (including File No. T-777-23) and the present case is not meant to encourage or discourage the Minister from seeking out a particular range of information in its future UPR requests. The Minister is entitled to seek out what they want to seek out, provided they fulfil the legislated preconditions in subsection 231.2(3) of the ITA. In other words, these other UPRs did not seek out the range of information sought by the Minister in this case because they were different files. The Minister can seek out information that it has never sought before, but it must respect the framework established in the ITA.

[272] Second, the notion of “proportionality” should not be understood as an additional requirement to be met by the Minister under subsection 231.2(3) of the ITA. In this case, the evidence before the Court has made it such that the availability of the information sought, and the burden required to obtain it, have become relevant in the Court’s exercise of discretion. Yet it might not always be the case. In a fact-driven, evidence-based process, the parties in this case have presented relevant evidence and arguments on the broad proportionality of the Proposed UPR, and the Court has accordingly considered it. However, there is no a priori requirement to do any kind of “proportionality analysis” within the UPR framework, or the Court’s residual discretion. It is a case-specific determination. I have determined that the issue was relevant in this case, and that the Proposed UPR here is disproportional.

[273] In the end, nothing precludes the Minister from proceeding in steps. After obtaining the information sought in an authorized UPR, the Minister may seek another authorization from the Court, on additional information, if the disclosure originally obtained does not allow the CRA to conduct the compliance review it intended to undertake. Proceeding in stages allows the CRA to obtain the basic information it needs, while preserving the resources of the third party responding to the UPR. If additional information is necessary, it will then perhaps be justifiable for the Court to impose on the third party to undertake an additional search of their records.

c) Unavailable Information

[274] The evidence demonstrates that Shopify does not have some of the information sought by the Minister. Given potential contempt proceedings under subsection 231.7(4) of the ITA, the Court should not authorize UPR requests on items where the evidence demonstrates that no information exists.

[275] As conceded by the Minister, Shopify is not expected to give what it does not have. For instance, because the evidence demonstrates that Shopify purges information two years after an account has become inactive, Shopify would not be obliged to provide that purged information. Shopify also adduced evidence that, for example, it does not collect some other information sought in that File, such as “store type” and the SINs (subject to potential contradicting evidence). As such, the Court may in its discretion strike items for which the evidence demonstrates that the third party cannot respond, in order to satisfy the third party that no contempt proceedings may be brought against them on these items.

[276] In the Proposed UPR, I would have been inclined to strike items A.4) (SIN) and A.11) (Store type) for a lack of evidence that Shopify actually possesses them.

D. The Privacy Commissioner Special Report

[277] Shopify seeks the Court’s approval to file the Privacy Commissioner Special Report in evidence, arguing that it should be considered by the Court due to the heightened risk to the public interest that arises from disclosure of sensitive information, because the CRA is an attractive target for cyber-attacks.

[278] Shopify attempted to introduce the Privacy Commissioner Special Report through the cross-examination of the Minister’s affiants, instead of using one of its own affiants, or introducing it in any other valid way. The Minister objected to questions made to its affiants relating to the Privacy Commissioner Special Report on the basis of relevance. However, answers were permitted under Rule 95(2) of the Rules, where the affiants responded that they had not seen the Privacy Commissioner Special Report and had only passing awareness of prior CRA hacking. The Minister therefore argues that since the affiants were not aware of the Privacy Commissioner Special Report, it cannot be introduced into evidence through their cross-examination. Nevertheless, the Minister is of the view that the Privacy Commissioner Special Report is not relevant in this case.

[279] In the circumstances, I do not need to rule on this motion.

[280] Indeed, the Privacy Commissioner Special Report cannot support Shopify’s argument that a specific data-breach in 2020 jeopardizes the relevant privacy interests here. The Privacy Commissioner Special Report is not conclusive evidence that the CRA’s system is compromised at this time and may affect the data obtained in this case. Moreover, there is no evidence that the CRA system is susceptible to systemic hacking, so as to affect any information obtained by the CRA.

[281] While the Privacy Commissioner Special Report could have been relevant if it had been properly introduced into evidence, I agree with the Minister that it would not affect the validity of the Proposed UPR as it does not demonstrate any specific privacy issues related to hacking at this time.

VI. Costs

[282] Shopify is presumptively entitled to costs because it was successful in this Application (Allergan Inc v Sandoz Canada Inc, 2021 FC 186 at para 30 [Allergan]; Crocs Canada, Inc v Double Diamond Distribution Ltd, 2023 FC 184 at para 1 [Crocs Canada]).

[283] However, I have also found that Shopify possesses some information that could be responsive to the Minister’s UPR request, as conceded by Mr. Fazeli in his affidavit and cross-examination, and contrary to the arguments made by Shopify in these proceedings. Indeed, despite Shopify’s vehement arguments to the contrary, I have found that it does have some information for “Merchants” that have a Canadian address and that have activated a financial service such as “Shopify Checkout” and “Shopify Payments.” Had Shopify responded to the Minister’s letter of January 12, 2023, and notified the Minister that the only information Shopify could provide was limited by these factors, perhaps the Minister would have amended its Proposed UPR, as was done in Rona FC.

[284] Shopify seeks an order for a lump sum cost award equal to 30% of the solicitor-client costs plus 100% of disbursements. Shopify alleges that the costs incurred exceed $1,000,000 inclusive of both File Nos. T-777-23 and T-778-23, with 58% of the costs allocated to the former and 36% to the latter, the remaining 6% being for the refusals motion on the issue of the Privacy Commissioner Special Report. Shopify cannot obtain costs for the refusals motion for the reasons described above.

[285] Rule 400(1) of the Rules provides that the application judge has full discretion when awarding costs, including the decision to award solicitor-client costs or a lump sum amount. As stated by Justice Favel in McCarthy v Whitefish Lake First Nation #128, 2023 FC 1492 at paragraph 23 [McCarthy]: “[this] discretion must be exercised judicially. The exercise of awarding costs involves an inescapable risk of arbitrariness and roughness on the part of the Court (Eurocopter v Bell Helicopter Textron Canada Limitée, 2012 FC 842, aff’d 2013 FCA 220 at para 9). This risk is tempered by the applicable legal principles.”

[286] Shopify relies on Rule 400(3), which provides:

(3) In exercising its discretion under subsection (1), the Court may consider

(a) the result of the proceeding; […]

(c) the importance and complexity of the issues; […]

(g) the amount of work;

(h) whether the public interest in having the proceeding litigated justifies a particular award of costs; […]

(o) any other matter that it considers relevant.

(3) Dans l’exercice de son pouvoir discrétionnaire en application du paragraphe (1), la Cour peut tenir compte de l’un ou l’autre des facteurs suivants :

a) le résultat de l’instance;

c) l’importance et la complexité des questions en litige;

g) la charge de travail;

h) le fait que l’intérêt public dans la résolution judiciaire de l’instance justifie une adjudication particulière des dépens;

o) toute autre question qu’elle juge pertinente.

[287] The guiding principles for costs orders were summarized by the Court in Canadian Pacific Railway Company v R, 2022 FC 392 at paragraphs 23–26 [Canadian Pacific] (see also Nova Chemicals Corporation v Dow Chemical Company, 2017 FCA 25 at para 10 [Nova]). Those principles are rooted in “[the Court’s] full discretionary power over the amount and allocation of costs,” and the notion that “[costs] customarily provide partial compensation […] representing a compromise between compensating the successful party and burdening the unsuccessful party” (Canadian Pacific at para 23).

[288] As noted by Chief Justice Crampton in Allergan (at para 19), the Court must also be mindful of the three principal objectives underlying a costs award, namely to (i) provide indemnification for costs associated with successfully pursuing a valid legal right or defending an unfounded claim, (ii) penalize a party who has refused a reasonable settlement offer, and (iii) sanction behaviour that increases the duration and expense of litigation, or is otherwise unreasonable or vexatious (see Canadian Pacific at para 34).

[289] Broadly speaking, a cost award should “further the objective of securing the ‘just, most expeditious and least expensive determination’ of proceedings” (see Nova at para 11 and Allergan at paras 22–23, both citing Rule 3 of the Rules; see also Canadian Pacific at para 25), and a lump sum should be considered when the Tariff rate “bears little relationship to the objective of making a reasonable contribution to the costs of litigation” (Canadian Pacific at para 26, citing Consorzio del Prosciutto di Parma v Maple Leaf Meats Inc (CA), 2002 FCA 417 at paras 9–10).

[290] As explained in Crocs Canada at paragraph 10 (citing Loblaws Inc v Columbia Insurance Company, 2019 FC 1434 at para 15), lump sum cost awards usually fall within a range of 25% to 50% of the actual legal costs of the successful party (see also Nova at para 17).

[291] In terms of evidence required to award a lump sum in costs, Justice Favel held in McCarthy (at para 32) that evidence of the actual legal costs is not necessary. However, to avoid “[plucking costs] from thin air” (Shirt v Saddle Lake Cree Nation, 2022 FC 321 at para 107, citing Whalen v Fort McMurray No 468 First Nation, 2019 FC 1119 at para 33 and Nova at para 15), the Court may rely on Bill of Costs calculations provided by the parties based on elevated costs of Column III and Column V of Tariff B, or similar evidence of fees and expenses provided by the parties.

[292] The Minister provided the Court with its Tariff B cost outline to support its costs submissions. Shopify did not provide a Bill of Costs outline, nor any other evidence justifying its alleged $1,000,000 amount in legal costs.

[293] Shopify relies mainly on Rules 400(3)(c), 400(3)(g), 400(3)(h), and 400(3)(o) and argues that the lump sum it seeks is justified because the Application was important and complex for the parties. This case involved a considerable amount of work from sophisticated litigants, and by the Minister’s own admission, was “important” because it would serve as a test case for further applications under subsection 231.2(3). Further, Shopify argues that it identified the deficiencies in the Minister’s Application to them, but that the Minister decided to proceed instead of withdrawing and amending the Proposed UPR, and seeking the authorization of the Court on a new application as was done following Hydro-Québec #2.

[294] The Minister responds that Shopify’s cost submissions are unreasonable and lack consistency with the Court’s prior UPR cost awards, where either no costs or Tariff B costs were awarded. The highest amount ever awarded in a UPR is $30,000. The Minister further argues that the Court should avoid the arbitrariness resulting from Shopify’s proposed award, which lacks consistency overall (see Canada v Bowker, 2023 FCA 133 at paras 26–32).

[295] Taking into account the legal principles set out above, the submissions of the parties, and the discretion afforded to me under Rule 400, I order that the Minister pay lump sum costs to Shopify in the amount of $45,000, all inclusive. This is a reasonable amount, when considering all the circumstances of this matter as set out above.

[296] First, I agree with Shopify that a Tariff B award is insufficient. In this regard, the Minister has filed a draft Bill of Costs proposing a cost award of up to $15,000 for each Application, indicating that this amount would approximate a default Tariff B award. I accept the Minister’s amount as approximative for a Tariff B cost award.

[297 ] For this particular Application, Shopify indicates that its costs amount to about 36% of its total legal costs, evaluated at about $1,000,000. Its legal costs for this Application are therefore about $360,000. An award of 30% of that amount represents $108,000. Shopify has filed no draft Bill of Cost nor any other evidence to justify its request.

[298] I find Shopify’s request unreasonable. While Shopify is a sophisticated litigant, I agree with the Minister that in the normal course of events, UPR proceedings proceed forthwith and follow adequate communication between the parties. Moreover, I agree with the Minister that in other UPR cases, even those that were opposed, no costs or lower costs were awarded. Shopify is no doubt a sophisticated litigant, but the same can be said of eBay, PayPal, Hydro-Québec, RBC, and others. Most of these other cases proceeded unopposed or on consent (and some in a similar e-commerce context), following better collaboration between the parties, or costs awarded were much lower.

[299] In that sense, even if I noted above that the Minister ought to have collaborated more with Shopify, I also find, for the purposes of this costs award, that Shopify failed to approach the Minister with sufficient information, before or following reception of the Proposed UPR, to allow the Minister to amend and proceed with a narrower Proposed UPR.

[300] The conduct of the parties is a relevant principle in determining costs (Canadian Pacific at paragraphs 23–26). While Shopify noted in oral argument that it wished to collaborate, the evidence rather demonstrates that it did not respond to the January 12, 2023, letter in writing, and that the letter sought answers from a previous meeting held on December 16, 2022. Even if a meeting was held on February 14, 2023, to address the issues related to the Minister’s two distinct UPR requests, Ms. Lee states, on second-hand information, that Shopify explained in that meeting that its “core offering is not a marketplace and Shopify does not sell goods or services to its ‘Store Owner’s customers’” (Lee Affidavit at paras 68–72, RR at 82–83). However, there is no first-hand information, or minutes of the meeting, indicating that Shopify otherwise responded to the CRA’s questions posed in its letter dated January 12, 2023—including one that related specifically to “Shopify Payments.” While I recognize that the January 12, 2023, letter related mostly to the UPR request in File No. T-777-23, it is clear from the correspondence (including the leadup to the February 14, 2023, meeting) that some of the most important information requested also applied to the UPR request in this case and that this was known to Shopify.

[301] No criticism is advanced toward Shopify’s legal strategy; it was entitled to oppose the Minister’s UPR request as it did. However, Shopify made the choice of imposing a stringent defence and including a detailed evidentiary record on issues for which it was not successful, and this choice results in both parties having to bear their own costs, to some extent. As held in Gordon v Altus, 2015 ONSC 6642 at paras 12, 15, parties that “go to the wall” must expect to have to absorb much of their significant costs, which is the case for Shopify in this Application.

[302] For these reasons, I find that the lump sum requested by Shopify is unreasonable. The legal fees proposed by Shopify are too high in the circumstances and have not been substantiated. Moreover, Shopify’s conduct in the file, while not reproachable, was disproportionate. Nevertheless, I recognize that Tariff B costs of about $15,000 are also disproportional because of the complexity and importance of the legal issues, and sheer scope of the evidence. I therefore rule that a lump sum of an amount of $45,000 all inclusive (which is three times the amount that would have resulted out of a Tariff B cost award) is reasonable in the circumstances. An amount of $45,000 all inclusive better represents 30% of a cost award that ought to have been required to defend against the Application.

VII. Conclusion

[303] The evidence demonstrates that the target group in this case is not “ascertainable.” The Minister has accordingly failed to meet a mandatory precondition under subsection 231.2(3) of the ITA, and leaves this Court with no other choice than to dismiss their Application.

[304] The Application is dismissed with costs in an amount of $45,000, all inclusive.

ORDER in T-778-23

THIS COURT’S ORDER is that:

The Application is dismissed;
Costs in an amount of $45,000 are ordered in favour of Shopify.

“Guy Régimbald”

Judge

FEDERAL COURT

SOLICITORS OF RECORD

DOCKETS:	T-778-23
STYLE OF CAUSE:	MINISTER OF NATIONAL REVENUE v SHOPIFY INC.
PLACE OF HEARING:	OTTAWA (ONTARIO)
DATES OF HEARING:	SEPTEMBER 25–26, 2024
JUDGMENT AND REASONS:	RÉGIMBALD J.
DATED:	MAY 29, 2025

APPEARANCES:

Montano Cabezas

Martin Lamoureux

FOR THE APPLICANT

Brynne Harding

Jehad Haymour

Daphne Wang

Hannah Lecach

FOR THE RESPONDENT

SOLICITORS OF RECORD:

Attorney General of Canada

Ottawa (Ontario)

FOR THE APPLICANT

Bennett Jones LLP

Barristers & Solicitors

Calgary (Alberta)

FOR THE RESPONDENT

Summaries

Summary Under

Tax Topics - Income Tax Act - Section 231.2 - Subsection 231.2(3)

it would be appropriate to pare back a CRA unnamed-person requirement (if not already invalid for vagueness) because it would require 8 person-years to respond

Shopify was a Canadian corporation providing a software platform for online e-commerce transactions. The Minister issued a requirement to Shopify...

The text of this content is paywalled except for the first five days of each month. Subscribe or log in for unrestricted access.

You are here

Canada (National Revenue) v. Shopify Inc., 2025 FC 969

Citations2025 FC 969

Case tabs