The decriminalization of marijuana use in Canada is certainly not news anymore. I’m going to give you the straight dope and admit I’m a bit of a nerd when it comes to this stuff, but I know people have been doing it since the stone age. Many say legalization in Canada was much ado about nothing.
I’m personally curious as to how lucrative an industry it is. All I know is that in my neighborhood, so many of the great little boutiques, cafés and food shops are being replaced with cannabis shops. One short block has three. A little variety, please, urban planners.
Anyway, as more of these businesses emerge, so too are privacy issues.
Privacy commissioners in Canada had the foresight a few years ago to produce guidance on this issue — first, the Information and Privacy Commissioner for B.C. and then the federal OPC.
I haven’t seen regulatory action at the federal level under PIPEDA since it became legal in 2018, which surprises me a touch given the growing prevalence of this industry.
There’s been at least a little bit of activity in the breach space. For example, the Information and Privacy Commissioner of Alberta has a couple of breach notification decisions about cannabis retailers — one involving misdirected emails and another involving a hacked company database. Commissioner Jill Clayton determined there was a real risk of significant harm related to the access and disclosure of individuals’ contact information. Good to know!
More significant movement on this issue came just a few short weeks ago when B.C. Commissioner Michael McEvoy once again blazed a trail by publishing his office’s compliance review of 30 private sector licensed liquor and cannabis retailers. The OIPC B.C. found these businesses weren’t up to snuff and made 18 recommendations to improve their privacy practices.
The report is worth checking out. If you’re a privacy pro who has cannabis clients — whether they’re in B.C. or other parts of Canada — you need to pipe up and weed out any privacy problems they might have. It’s time to work with them to make sure they have a solid privacy management program. You don’t want all this great entrepreneurial spirit going to pot.
It’s clearly a budding industry with, I’m sure, much regulation to deal with on a regular basis, and it’s going to take a joint effort with privacy professionals to make sure privacy gets the attention it deserves.
On that note, have a relaxing and safe weekend!