Massive CRA fishing expedition against PayPal customers

From phishing (as in my last post) to fishing as last night, PayPal informed Business account customers in Canada that CRA is to receive a treasure trove of fine-grained customer and transaction data directly from PayPal. This is pursuant to an order of the Federal Court of Canada.

I don’t have a copy of the order yet as it isn’t yet posted, so this first post discusses only what PayPal itself has related about the order. Their post about the information to be provided is below. It essentially represents a very large trove of customer data, some of which will enable CRA to link some recipients with some payors, but not generally including any transaction data except in aggregate. Any customer who had a PayPal Business account between 1/1/2014 and last Friday is included.

CRA is to have this information in their hands by December 25th. It includes those who have closed their accounts. They will know how much money you earned and how much money you sent, in each of 2014, 2015, 2016 and in 2017 up to November 10.

This type of sleuthing is a classic “fishing expedition” where CRA is not (because of the massive amount and breadth of customer data requested) trying to enforce the Act but rather is seeking targets to enforce against. More and more powers are being given over to CRA with only the Federal Court as a check, and previous rules that there had to be reasonable expectations that the fishing would prove fruitful were repealed a long time ago now.

Because this was a result of a Federal Court application, we can ascertain that it was made under subsection 231.2(3) of the Income Tax Act (and/or similar provisions of other taxing statutes). This allows the Federal Court to allow CRA to obtain information against unnamed persons. (Otherwise, CRA can’t require third-party information disclosure against unnamed persons.)

It has to be information regarding persons in an “ascertainable” group, and the information sought has to be “made to verify compliance” by the group with the act. Presumably (although we’ll see once I have the order) this means that the “ascertainable” group was all PayPal Business account owners.

Remember, this means that CRA will know how much you made on PayPal each year, possibly linked to your Social Insurance Number or Business Number. Certainly linked to your customer data. If this is a problem for you, remember that there are ways of managing disclosure to the CRA proactively, to reduce your cost, such as a Voluntary Disclosure. You certainly may wish to receive advice about doing so.

This also means, at first blush, that you are at greater risk of being investigated, questioned or contacted by CRA regarding your dealings with someone else, including by interview or by a written questionnaire where CRA requires you to inform them. Remember that in these instances you also can benefit from the advice of a lawyer, including or especially when your own behaviour is blameless or pristine.

All of this is part of CRA’s greater concentration on enforcement, backed up by large recent influxes of budget cash. Expect more of the same.

Written by Craig Burley