Landmark Canadian tax law decision that limits CRA's authority under section 231.2 of Income Tax Act

Introduction: Section 231.2 of the Income Tax Act

David J Rotfleisch, CPA, JD is the founding tax lawyer of Taxpage.com and Rotfleisch & Samulovitch P.C., a Toronto-based boutique tax law corporate law firm.

The Canada Revenue Agency (CRA) has expansive powers to enforce compliance with the Income Tax Act, notably through Section 231.2, which allows the agency to demand documents or information from individuals or entities during a tax audit. Section 231.2(1) of the Income Tax Act, after its most recent update on December 15, 2022, specifically grants the CRA the authority to require any person to provide information or documents for the purposes of the Income Tax Act.

This power is broad and has been interpreted by courts to include compelling third parties, such as banks, employers, or digital platforms, to provide data about taxpayers. If you are interested in learning more about section 231.2, you can refer to our previous article on this topic: Tax Lawyer Analysis: CRA's Broad Powers to Compel Third Party Information Under Section 231.2 Is Not Without Limits.

However, section 231.2(2) imposes an important limitation: if the request targets information about unnamed persons (i.e., not individually identified in the request), the CRA must first seek judicial authorization under Section 231.2(3). The purpose of this provision is to protect individuals from the CRA's "fishing expeditions" and ensure that CRA requests have a clearly defined scope and justification.

In other words, the purpose of this provision is to restrict the CRA's power to demand documents and information related to parties that the CRA cannot yet identify during a request. To obtain judicial authorization under 231.2(3), the CRA must satisfy the court that:

1. The unnamed persons are ascertainable.
2. The information is sought for the purpose of verifying compliance with the Income Tax Act.
3. The request is not overly broad or speculative.

A 2025 Federal Court case, Canada (National Revenue) v. Shopify Inc., sheds critical light on the boundaries of these powers, particularly regarding unnamed third parties. This decision is emblematic of the ongoing tension between government authority and individual privacy, and it underscores the judiciary's role in ensuring the CRA's enforcement tools are applied fairly and lawfully.

Canada (National Revenue) v Shopify Inc., 2025 FC 968: A Landmark Decision that Affirms the Importance of Checks and Balances in Canadian Tax Law

Shopify Inc. is a leading e-commerce platform that allows merchants to facilitate sales of products using the Shopify platform. In April 2023, the Canada Revenue Agency sought a court order compelling Shopify Inc. to provide information about merchants using its platform. The CRA's request was unusually broad, asking Shopify Inc. to provide information covering all Canadian-resident merchants over a specific period of time, including names, addresses, sales figures, and banking details.

The CRA's goal was allegedly to identify businesses that may not have properly reported their income earned via the Shopify platform, and the CRA argued that this request was necessary to assess compliance with tax obligations among Shopify merchants.

Shopify Inc. opposed the CRA's request, arguing that the request was overly broad, lacked specificity, and did not satisfy the requirements under Section 231.2(3). Specifically, Shopify Inc. contended that the group of unnamed persons was not "ascertainable" as required and that the CRA failed to justify the scope of its demand. Shopify Inc. called the CRA's request a "fishing expedition," defining it as a general survey seeking to determine whether individuals are complying with unspecified laws.

The Federal Court sided with Shopify Inc., concluding that the CRA's request and judicial authorization application failed to meet the statutory requirements under the Income Tax Act. The Court found that even if the CRA satisfies the legal criteria for issuing an Unnamed Persons Requirement (UPR) request, which is to request documents and information related to unnamed parties, it still retains the discretion to deny or limit the request to prevent abuse. Shopify's argument that the Minister failed to consider less invasive means was rejected, as such a requirement no longer exists in law.

The court, turning to the feasibility and proportionality of the proposed UPR, noted that Shopify Inc. provided unchallenged evidence that compliance would require an extreme amount of labour — eight full-time working years for one employee. The Federal Court then concluded the proposed UPR request was disproportional and would have supported a more limited scope, in line with other similar UPR requests that have been previously approved by the court.

For example, a UPR request asking a business to provide any merchants' names, business or operating names and numbers, contact information, banking information, and monthly transaction amounts has received judicial authorization in the past. In addition, the CRA cannot request a business to provide information that the business does not collect or possess. Furthermore, some requested data also wasn't even available to Shopify based on the evidence submitted during the proceeding.

In light of the above-noted issues, the court indicated that narrowing the scope of the request would have been appropriate and consistent with precedent, without undermining legislative intent. The court thereby had no choice but to deny the CRA's judicial authorization application for the UPR request in this case.

In addition, the Federal Court awarded Shopify Inc. $45,000 in costs even though the court acknowledged that it is Shopify Inc.'s decision to take the legal strategy of imposing a "stringent defence" to include a detailed evidentiary record on all issues.

Impact of the Shopify Inc. Case on Digital Platforms and Broader Privacy Debate

The Shopify case has significant implications for Canadian digital platforms or any businesses that serve as custodians of user data. E-commerce platforms, financial institutions, and tech companies can expect to be popular targets of CRA information requests for documents and information related to their user.

In light of the Shopify decision, businesses must be aware that they are not merely passive conduits for user data and have standing to challenge CRA overreach and breach of users' privacy. If the CRA request is unjustified, the court has the power to review, to approve, or to deny such a request.

Moreover, at the heart of the Shopify Inc. case is a broader tension in Canadian tax and privacy law. On one hand, the CRA finds it necessary to be equipped to detect tax avoidance and evasion in an increasingly digital, mobile, and international economy. On the other, Canadian taxpayers have a right to expect that their personal and financial data will not be accessed indiscriminately by the government.

The Federal Court's approach reflects a growing recognition that privacy must be safeguarded, even in the context of tax compliance. This aligns with the Supreme Court of Canada's evolving jurisprudence on informational privacy, which acknowledges that modern data collection presents novel risks to personal autonomy.

However, importantly, the court did not foreclose the CRA's ability to investigate merchants using the Shopify platform; rather, it emphasized that such investigations must be conducted within the legal boundaries set by the Income Tax Act.

David J Rotfleisch, CPA, JD is the founding tax lawyer of Taxpage.com and Rotfleisch & Samulovitch P.C., a Toronto-based boutique tax law corporate law firm and is a Certified Specialist in Taxation Law who has completed the CICA in-depth tax planning course. He appears regularly in print, radio and TV and blogs extensively.  

With over 30 years of experience as both a lawyer and chartered professional accountant, he has helped start-up businesses, cryptocurrency traders, resident and non-resident business owners and corporations with their tax planning, with will and estate planning, voluntary disclosures and tax dispute resolution including tax audit representation and tax litigation. Visit www.Taxpage.com and email David at david@taxpage.com.

Read the original article in full on Goods Services Tax. Author photo courtesy Rotfleisch & Samulovitch P.C. Title image by hookle.app on Unsplash.