How Concerned Should Canadian Cannabis Customers be About Privacy?

Recreational cannabis has been legalized in Canada for a few months now, but the next time you slide through a recreational cannabis shop in the Six, you’d best come equipped with loonies and toonies instead of a credit card.

In a recent statement issued by Daniel Therrien, Canada’s privacy commissioner, he urged cannabis sellers and buyers across the country to obtain a better understanding of their privacy rights. To keep the personal information of consumers safe, Therrien suggested that only cash should be used for pot-related transactions.

Although recreational cannabis was officially legalized in Canada back in October 2018, the privacy watchdog warned that even lawful marijuana users can be banned from entering countries where cannabis remains illegal.

“The OPC [Office of the Privacy Commissioner of Canada] recognizes the sensitive nature of cannabis-related transactions,” the statement reads. “Although cannabis is legal in Canada, it remains illegal in most jurisdictions outside of Canada. Some countries may, for example, deny entry to individuals if they know they have purchased cannabis, even lawfully.

In the past, there have been several reports of Canadians getting barred from entering the United States for admitting to cannabis use, even when attempting to cross into a state where adult-use legalization is already in effect, such as Washington state.

Conversely, a few foreign countries have asked their own citizens not to smoke legal buds while vacationing in the Great White North.

Privacy Watchdog Issues Guidelines for Cannabis Sellers and Buyers

The Office of the Privacy Commissioner of Canada (OPC) released a handful of guidelines for both cannabis sellers and buyers to follow. This document was created to help these parties understand the right to privacy and obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA).

This Canadian law effectively defines personal information as “information about an identifiable individual,” which can include potentially sensitive data like your name, date of birth, driver’s license number, social insurance number, financial information, and so on.

To help protect legal cannabis consumers from having their personal information used against them, the privacy watchdog offered a number of recommendations to retailers and buyers.

For instance, the OPC’s guidance states that cannabis shops should “obtain meaningful consent before collecting any personal information” and that they “should be clear on what information they are required to collect during in-person transactions.”

However, there is little that cannabis retailers can do when a customer decides to use a credit card, as the seller could be required by law to collect the credit card number and cardholder’s name. Similarly, most online cannabis retailers will also have to gather their customers’ data, including information related to identification, payment, and shipping.  

Cash Transactions Are Not an Option for All Canadians

Unfortunately, not every Canadian citizen has the luxury of living close to a recreational shop, meaning that cash isn’t always an option. In Ontario, recreational cannabis stores aren’t scheduled to open until at least April 1, 2019, which leaves customers turning to online retailers or the black market.  

There have also been some alarming data breaches that have put the personal information of Canadian cannabis users in jeopardy. Back in November 2018, CBC reported that a breach into the Ontario Cannabis Store’s database affected the information of around 4,500 customers.

Ultimately, one of the few surefire solutions that the OPC came up with for retailers is that they only request necessary information to confirm that the customer is of legal age.

“One way to minimize the possibility of disclosure to foreign governments (given that cannabis use is not legal in most other jurisdictions), and reduce the impacts of a data breach, or other incidents that reveal purchasers’ names or other personal information, is to refrain from recording customers’ personal information,” the guidance document states.

Another suggestion mentioned in the guidance is that cannabis stores collect email addresses for mailing lists, but not the customer’s actual name.

Of course, at the end of the day, the protection of personal information is also in the hands of the consumer. As long as cannabis users in Canada use their credit card or willingly share personal information with retailers, they run the risk of being prevented from entering countries that have yet to give legal pot the green light.