Across Canada, cannabis consumers are growing increasingly concerned about the privacy risks that come with buying legal weed. Retail is now a licensed and regulated operation. And that means that retail dispensaries have a legal obligation to record transaction data, including personal and financial information. But what happens if—or when—that data falls into the hands of a third-party? Already, Canadian citizens have been barred from entering the United States due to their involvement in Canada’s legal industry. Foreign consulates have issued warnings to nationals in Canada about the legal consequences of consuming cannabis. In other words, problems can arise when a person’s weed purchases become part of the public record.
Buying Legal Weed in Canada Could Get You In Trouble Other Places
Prior to legalization, unlicensed dispensaries across Canada were able to take their customers’ privacy seriously. Customers could pay anonymously, with cash. And receipts, if there were any, would invoice “organics” or “botanicals” or other innocuous terminology. In the first place, the reason for the discretion is simple: purchasing and selling from unlicensed dispensaries is illegal. But the concern over privacy also protected consumer’s cannabis habits from getting out.
Now that dispensaries are regulated operations, however, data collection is in full force. Dispensary receipts, in most cases, make it clear where and what a consumer purchased. And the ability to use credit cards creates a transaction history complete with name, address, account number, date of birth and email. Furthermore, part of Canada’s Cannabis Act mandates that Statistics Canada, a government organization collecting data on the country’s economy, track cannabis sales as part of the total economic picture.
Legal cannabis purchases show up on bank and credit card statements. Receipts often identify the specific cannabis product and the quantity purchased. And while there is as yet no instance of the data’s malicious use, the possibility is hard to rule out. Data about cannabis purchase could end up in the hands of an employer, costing someone their job. It could end up in the hands of an insurance company, raising premiums. Another jurisdiction could process someone’s information and press charges, bar entry or issue other sanctions.
Canada’s Privacy Commissioner Focusing on Cannabis Transactions
As a result of the potentially huge consequences, privacy commissioners across Canada are working on solutions. But most are piecemeal. The problem is that companies have legal requirements to report their sales. In some provinces, retailers are using a coding system to make cannabis purchases less obvious on bank statements. Manitoba, for example, indicates a Delta 9 dispensary purchase as D9-2-90210145 Winnipeg MB. In Ontario, by contrast, the info is very clear: OCS/SOC, or Ontario Cannabis Store, Sale of Cannabis.
Concerns over cannabis consumers’ privacy are particular pitched at the moment, too. Just last week, a massive privacy breach involving the Canada Post and the Ontario Cannabis Store exposed the private purchase data of 4,500 cannabis customers. The data breach, along with government tracking and recording purchases, is a major concern. And in response, the Ontario Cannabis Store pulled all order tracking numbers from the database it shares with Canada Post.