Joint Efforts: Safeguarding Privacy in BC’s Cannabis Industry

Privacy in BC's cannabis industry is more important than ever as the sector expands and personal data collection in retail spaces increases. From customer purchase records to security footage, businesses are gathering more information than ever-raising critical questions about how this data is handled and protected. Beyond the standard privacy concerns faced by any retail industry, the cannabis sector grapples with the added challenge of stigma surrounding cannabis use. Unlike other products, the disclosure of private information related to cannabis consumption can carry a social stigma, making the information collected even more sensitive. As the industry grows, so do the risks, making privacy a key issue for businesses and consumers alike.

Here are some of the ways in which cannabis retailers may collect personal information:

• Identification: To purchase cannabis in BC, a retailer may collect a customer's identification to confirm they are of legal age to purchase cannabis.
  
• Marketing & Promotions: Cannabis retailers may collect personal information to send promotional materials, discounts, or special offers. This can include collecting email addresses, phone numbers, or even information on customer preferences to tailor marketing strategies.
  
• Sales & Privacy: Cannabis retailers collect personal information from customers when they shop with cannabis retailers. If a customer uses a credit card, a cannabis retailer is authorized to collect the credit card number and customer name to process the transaction. If a customer is ordering products for delivery, then the retailer must know the delivery address and the individual delivering the product will need to verify and document the purchaser's age.

• Online Profiles & Preferences: When customers shop online or use mobile apps to make purchases, cannabis retailers may collect information about their browsing habits, preferences, and past purchases to create a personalized shopping experience.
  
• Sales Tracking, Customer Feedback & Surveys: Cannabis retailers may track customers purchases in store to gain insight into consumer behavior. Retailers may also ask customers to provide personal information through surveys or feedback forms to improve services, products, or the overall shopping experience. These surveys often ask for demographic information or purchasing preferences.
  
• Surveillance: In accordance with the Cannabis Retail Store Terms & Conditions, B.C. requires cannabis retailers to maintain video surveillance in the interior and exterior of their store.
  
• Loyalty Programs: Some cannabis retailers offer loyalty programs or reward schemes where customers can earn points or benefits. To participate, customers may need to provide personal details such as their name, contact information, and purchasing history.

• Employee & Transaction Records: In addition to customer data, cannabis retailers may also collect employee information for operational purposes, including maintaining records of transactions and employee performance. This data is essential for regulatory compliance, financial audits, and internal analysis.

BC has legislation in place to safeguard customer information. The Personal Information Protection Act (PIPA) governs how businesses in the province, including cannabis retailers, can collect, use, and disclose personal information of its customers. Cannabis retailers must comply with PIPA, particularly around the collection of personal information. Under federal legislation, the Cannabis Act requires licensed producers and retailed to comply with provincial privacy legislation and other applicable privacy laws.

In response to growing privacy concerns, the Office of the Information and Privacy Commissioner for BC (OIPC) recommends that cannabis retailers only collect the infromation that is needed. If cannabis retailers do record personal information from customers, they are required to store it securely by making reasonable security arrangements to prevent unauthorized access, collection, use, copying, modification or disposal. Cannabis retailers must use physical, technological and administrative security measures to safeguard personal information. However, cannabis retailers are not immune to data breaches, and any breach could result in disclosure of personal infromation.

Compliance reviews in BC have been crucial in assessing whether cannabis retailers are meeting the mark when it comes to safeguarding customer data and privacy. In June 2021, the OIPC conducted a review of the province's 30 largest private sector liquor and cannabis retailers. The OIPC issued 18 key recommendations for improvement, including appointing a designated privacy officer, developing written policies, and conducting regular risk assessments to ensure security measures are up to par.

A follow-up review in June 2022 showed promising progress, with 70% of the recommendations fully implemented and 22% partially addressed. The OIPC emphasized that ongoing follow-up would continue to drive further compliance, which has a wide-reaching impact on BC's liquor and cannabis retail sector. For both current and future cannabis customers, this progress offers reassurance that the industry is making strides in protecting personal data in alignment with PIPA regulations.

As the cannabis landscape in BC continues to evolve, protecting customer privacy remains paramount. While improvements have been made, customers should remain vigilant in safeguarding their personal information and share only the necessary details when making purchases from cannabis retailers.

If you have questions about this or other topics discussed in our Privacy Blog posts, please get in touch with the authors or another member of our Privacy and Data Protection team.