.jpg)
The Office of the Information and Privacy Commissioner for British Columbia has released guidance to help cannabis retailers and purchasers understand their rights and obligations under the Personal Information Protection Act (British Columbia) ("PIPA").
All private sector organizations in British Columbia including corporations, partnerships, legal representatives, unincorporated associations, trade unions, trusts and not-for-profit organizations must follow the personal information and privacy rules set out in PIPA and are legally obligated to protect any information about an identifiable individual or "personal information" (which can include, but is not limited to name, sex, age, weight, height, home address and phone number, medical information, purchases and spending habits) that they collect, use or disclose, whether the information is about the organizations customers, employees or others.
In late 2018 the Office of the Information and Privacy Commissioner for British Columbia (the "BC Privacy Commissioner") released a guidance document entitled "Protecting Personal Information: Cannabis Transactions" (the "Guidance Document") to help cannabis retailers and purchasers understand their rights and obligations under PIPA. The Guidance Document highlights the fact that although cannabis is now legal in Canada, it remains illegal in many jurisdictions outside of Canada, making personal information concerning cannabis users particularly sensitive.
The Guidance Document emphasizes that PIPA limits the collection of personal information by organizations, including private sector cannabis retailers, to purposes that a reasonable person would consider “appropriate in the circumstances” and that retailers are required to obtain informed consent before collecting any personal information. This means retailers need to inform individuals about what personal information is being collected and the purposes for its collection. The Guidance Document provides specific comments on issues like confirming age and identify of customers, credit card transactions, club membership issues, online retailing and video surveillance.
The Guidance Document further emphasizes the need for the safekeeping of any personal information collected from purchasers and staff. Cannabis retailers must protect the personal information in their custody or under their control by making reasonable security arrangements to prevent unauthorized access, collection, use, copying, modification, or disposal. This means ensuring physical, technological, and administrative security measures are in place to store personal information. Cannabis retailers, like all private organizations in BC, are required by law to develop policies and practices to meet their responsibilities under PIPA, including developing a process to respond to complaints about management of personal information. Retailers who have websites, and especially those with a membership login, should have a separate privacy policy posted online that informs visitors to the webpage about the personal information collected (such as tracking cookies and website analytics) and the reasons for collection. Retailers must also designate someone to be responsible for ensuring compliance with PIPA and must provide that person’s position name or title and contact information when requested.
In addition to providing advice to cannabis retailers, the Guidance Document offers advice to purchasers regarding the protection of their own personal information including providing cannabis retailers with only the information they need, ensuring that such information be stored only within Canada, understanding associated risks if providing personal information to join a membership club or mailing list and raising concerns regarding a cannabis retailer's personal information practices with the retailer's privacy officer.
The Guidance Document provides a useful overview of the policies and practices with respect to collection, storage, usage, and disposal of personal information that comply with PIPA to help cannabis retailers and purchasers consider the relevant requirements and issues. As cannabis retailers obtain licences and establish retail operations in British Columbia they must appreciate the particular sensitivity of personal information of cannabis purchasers and employees involved in the cannabis industry and implement privacy policies and practices to address the requirements of PIPA and the particular concerns raised by participating in this developing and unique industry.
Endeavor Law can assist new cannabis entrepreneurs develop policies and practices to meet their responsibilities under PIPA, including developing a process to respond to complaints about management of personal information.. Endeavor Law will always seek to provide competitive pricing for any legal services requested and is pleased to discuss fee arrangements that suit any potential client.
Does not constitute legal or other advice and must not be used as a substitute for legal advice from a qualified legal professional in your jurisdiction who has been fully informed of your specific circumstances. Information may not be up-dated subsequent to its initial publication and may therefore be out of date at the time it is read or viewed. Always consult a qualified legal professional in your jurisdiction.