Michael Geist: Canada Revenue Agency Obtains Broad Court Order for Years of PayPal Data

The Canada Revenue Agency has obtained a federal court order requiring PayPal to hand over years of transactional information from all business accounts in Canada. The scope of the order is incredibly broad, covering any business account holder who sent or received a payment over a nearly four year period from January 1, 2014 to November 10, 2017. The information to be disclosed includes:

• The full name of every individual or corporation holding a business account that has a Canadian address;
• The date of birth of each individual holding a business account;
• The business name, if applicable;
• The telephone number(s) of the corporation or individual holding the business account, if available;
• The full address(es) of the corporation or individual holding the business account;
• The email address of the corporation or individual holding the business account;
• The Social Insurance Number and/or Business Number of the corporation or individual holding the Business Account, if available.
• The total number and value of received transactions for each calendar year between January 1, 2014 and November 10, 2017.
• The total number and value of sent transactions for each calendar year between January 1, 2014 and November 10, 2017.

PayPal has indicated that it must comply with the order within 45 days from November 10th (the date the order was issued). The order will presumably allow CRA to conduct audits of thousands of small businesses that use PayPal for transactions. The issue has arisen in other jurisdictions. For example, the UK has been working on legislation that would allow for the collection of “bulk” information from Internet companies.

The Canadian order indicates that CRA intends to use the information to “combat the underground economy” and that there is no obligation to demonstrate that there is an existing investigation or audit. In fact, there is not even the need to demonstrate that “a genuine and serious inquiry” exists.  The order also reveals that PayPal objected to the breadth of the order.  It states that the court:

“considered the concerns expressed by PayPal with respect to the proposed Unnamed Persons Requirement, namely that the authorization sought by the Minister would interfere with the privacy of PayPal’s clients and that the Unnamed Persons Requirement is overly broad and unreasonable given the absence of any threshold amount for each transaction targeted by the requirement;”

It rejected those arguments, observing that the expectation of privacy with respect to business records is very low.  It also concluded that PayPal had the relevant information and that it did not file evidence that the order was overbroad or reached a disproportionate number of persons.

Ensuring that tax laws are respected is obviously important, yet many of PayPal’s business account records are presumably not similar to those typically found in larger businesses. Indeed, the business account may be often be closer to individual, identifiable records that might carry a higher level of expectation of privacy. PayPal apparently fought against the order, but having lost, will now be required to hand over a massive trove of financial data dating back years to Canada’s tax authorities without a threshold or other limitations.