Instead, Shopify is legally considered to be the owner of the user data As I see it, Shopify's role in this situation is more likely to be considered a data fe

Instead, Shopify is legally considered to be the owner of the user data As I see it, Shopify's role in this situation is more likely to be considered a data fence: because of the lack of processing agreement, they're not allowed to process any data (more accurately, the shop owner is not allowed to give them access to any data). The data that they do have through services they provide is illegally obtained; that doesn't mean they suddenly own that data.