Federal legislation makes it legal for Canadians to enjoy cannabis in the privacy of their homes. That legislation, however, does not necessarily offer privacy protection for cannabis purchasers. Legal experts have raised concerns that credit card data may not be stored in this country and may be accessible to prying eyes in other countries.
Federal legislation makes it legal for Canadians to enjoy cannabis in the privacy of their homes. That legislation, however, does not necessarily offer privacy protection for cannabis purchasers. Legal experts have raised concerns that credit card data may not be stored in this country and may be accessible to prying eyes in other countries.
“While we would like to think that our personal information will be properly shielded from the prying eyes of American law enforcement, there have been cases in the past where it wasn’t. So, in the end, despite some legal protection in Canada . . . there remains a risk,” says Kris Klein, a partner with nNovation LLP in Ottawa.
Mark Hayes, founder of Hayes eLaw LLP, an IP and technology firm in Toronto, agrees.
“There is definitely concern regarding privacy in respect of cannabis purchases by Canadians,” he says. “Outside of public sector privacy legislation in British Columbia and Nova Scotia, there is no express requirement that the personal information of Canadians must remain in Canada.”
Credit card and other purchasing information stored outside of Canada, particularly in the United States, may be accessible by law enforcement there. This issue was recently raised in a new guidance document released by the Office of the Information and Privacy Commissioner for British Columbia.
“This document notes that personal information of cannabis users will in most cases be considered ‘sensitive,’ given that cannabis is illegal in most jurisdictions outside of Canada and that some countries may deny entry to individuals if they know they have purchased cannabis,” says Hayes.
According to the guidance document — "Protecting Personal Information: Cannabis Transactions" — access to the personal information of cannabis users may be used by some countries to deny entry. The four-page overview also points out that, in a digital age, the privacy issue is not moot. “Keep in mind,” it notes, “that storing data in the Cloud or in proprietary software means there is likely disclosure of that personal information outside of Canada. It is much more privacy protective to store personal information on a server located in Canada to prevent access by unauthorized third parties.”
Bernice Karn, a partner with Cassels Brock & Blackwell LLP in Toronto, says that any organization that collects, uses or discloses personal information in the course of commercial activities has privacy obligations under the federal Personal Information Protection and Electronic Documents Act. “That includes Canadian retailers, banks and credit card companies in respect of any type of business that they are transacting in Canada.”
PIPEDA does contain an exemption that permits disclosure of personal information without consent where “required by law,” she says, but “the scope of this exemption is unclear. On its face, and given the language of the other exemptions, it seems to be very broad and could conceivably be referring to foreign law. So, we’ll have to see whether anyone challenges whether any lawful U.S. access to this information falls under that exemption.”
Two other factors may help to reduce the likelihood that purchasing information will be accessed by law enforcement or other agencies outside Canada. First, notes Klein, “It is difficult to predict whether American authorities will really want this data.”
Ease of access may also play a role in deterring access, he adds. “Canadian privacy laws do make it difficult for private sector entities such as banks and credit card companies to simply hand over data. It must be in response to a lawful subpoena and must be more than a mere request.”
There are steps both retailers and purchasers of cannabis products can take to reduce the risks involved in using credit cards for cannabis transactions. “Retailers who want to distinguish themselves on the basis of protecting individuals’ privacy could ensure that they do not store any personal information outside of Canada and that they do not engage any third-party service providers who do so,” says Hayes.
In addition, he says, retailers may want to use generic names and product descriptions when processing credit card purchases.
Purchasers can also make their concerns known. This can start by asking retailers whether they store personal information outside of Canada. If possible, says Hayes, purchasers may choose to buy cannabis only from those retailers who store personal information in Canada.
Finally, he notes, “Until questions about the potential risks of using credit cards for cannabis purchases are resolved, purchasers may want to pay cash for cannabis purchases in provinces which allow in-person shopping and consider using only anonymous prepaid credit cards or gift certificates for online purchases.”
