National Post (National Edition)
If you buy cannabis, will Uncle Sam find out?
TORONTO • When Canadians go to buy their first grams of legal cannabis next week, many of them will do so through the internet, creating huge quantities of data as a side effect of their purchases.
But with only one week until legalization, privacy advocates say they still have plenty of questions about how that data will be handled.
And the answers could have serious ramifications: The United States still considers cannabis to be an illegal substance and concerns have been raised that Canadians could be blocked from travelling to the U.S. if customs officials find out that they have purchased the drug, or been involved in legalized production.
“It’s going to be an issue, and it’s going to present problems and challenges in terms of how that data is used, how it’s protected,” said Matt Murphy, a former U.S. Drug Enforcement Administration agent who is now vice-president of compliance for Khiron Life Sciences, a Torontobased cannabis company.
“I’m not aware of much guidance relative to how that data is protected, how it’s used, how it’s protected, how it’s stored. These are all interesting questions that I think we’re going to have to deal with — probably sooner rather than later.”
Murphy played down the concerns about the United States going to great lengths to figure out who bought a gram of cannabis — he said they’re more worried about terrorists and illegal migrants — but he said that potential privacy breaches could affect people’s employment, or simply cause public embarrassment.
Some key players in the industry are clearly thinking about privacy issues, but with 10 provinces with different distribution systems, and the inherent complexity of e-commerce, it’s difficult to fully understand who will have access to private cannabis-related data, and how it will be protected.
In a statement in late September, the Ontario Cannabis Store said that it will take a “privacy by design” approach to online sales, which will be the only option available in the province until next year.
“Only information required for completing the transaction will be collected: name, address, contact (phone/email) and payment information,” OCS spokesman Daffyd Roderick said in an email.
“This information is used to process transactions, to verify the identity of the purchaser, to deliver and return products, to issue refunds, and to protect against error or fraud.”
Roderick emphasized that data will be encrypted and stored in Canada.
In a statement on the OCS website, the Crown corporation said that it will only retain data for the minimum amount of time required by law, and that the data will be held on servers in Canada.
The OCS is working with Shopify to provide e-commerce services for cannabis, and Loren Padelford, vicepresident and GM for Shopify Plus, said the company has built special systems to store customer data exclusively in Canada.
“If that data is stored in our Canadian infrastructure, it is not being shared,” Padelford said. “Unless we are provided a court order by an entity that has jurisdiction over Shopify as a Canadian company, we will not be sharing this information with anybody.”
But Padelford also gave an idea of the complexity of the situation. In addition to collecting enough identifiable information for verifying a customer’s age and delivering the drugs to them, there’s a complicated financial system to consider.
Shopify routes payment information to “payment gateway” companies such as Stripe.“stripe has all the relationships with the banks, the credit card companies, that’s what the payment processors do,” he said. ”They are the relationship with that side. So they take order information from us and process that with Visa and Mastercard.” Both Visa and Mastercard issued statements to Financial Post downplaying the amount of customer data they have.
“When cardholders use their cards, we don’t know who they are and do not have contact information — because we only see an account number,” Mastercard said. “We don’t know what they purchased; we simply know the total amount spent at a merchant on a particular date.”
But anybody who’s ever looked at a credit card statement knows it also identifies individual retailers, which could identify the nature of the purchase.
Neither Visa or MasterCard would say if Canadian customer data is stored on Canadian servers, or if it goes to data centres in the United States.
Visa said that it would not provide any customer information to law enforcement without “without proper judicial authority.”
Brynne Moore, a spokesperson for Scotiabank, suggested that they won’t really be treating cannabis data any different from other financial information.
“The safety and security of our customers and their accounts is a top priority for Scotiabank,” Moore said in an email. “We have policies in place to protect our customers’ privacy for all of their transactions with our bank, regardless of their nature.”
WE WILL NOT BE SHARING THIS INFORMATION WITH ANYBODY.