If you buy cannabis, will Uncle Sam find out?
TORONTO When Canadians buy their first grams of legal cannabis next week, many will do so through the internet, creating huge quantities of data as a side effect.
Privacy advocates say they still have plenty of questions about how that data will be handled.
And the answers could have serious ramifications: The U.S. still considers weed to be an illegal substance and concerns have been raised that Canadians could be blocked from travelling there if customs officials find out that they have purchased the drug, or been involved in legalized production.
“It’s going to be an issue, and it’s going to present problems and challenges in terms of how that data is used, how it’s protected,” said Matt Murphy, a former U.S. Drug Enforcement Administration agent who is now vice-president of compliance for Khiron Life Sciences, a Toronto-based pot firm. “I’m not aware of much guidance relative to how that data is protected, how it’s used, how it’s protected ... stored.”
He said U.S. officials are more worried about terrorists and illegal migrants.
Some key players in the industry are clearly thinking about privacy issues, but with 10 provinces with different distribution systems, and the inherent complexity of e-commerce, it’s difficult to fully understand who will have access to private cannabis-related data, and how it will be protected.
In a statement in late-September, the Ontario Cannabis Store said it will take a “privacy by design” approach to online sales, which will be the only option available in the province until next year.
“Only information required for completing the transaction will be collected: name, address, contact (phone/email) and payment information,” OCS spokesman Daffyd Roderick said in an email. “This information is used to process transactions, to verify the identity of the purchaser, to deliver and return products, to issue refunds, and to protect against error or fraud.”
Roderick said that data will be encrypted and stored in Canada.
The OCS is working with Shopify to provide e-commerce services for cannabis, and Loren Padelford, vice-president and GM for Shopify Plus, said the company has built special systems to store customer data exclusively in Canada.
“If that data is stored in our Canadian infrastructure, it is not being shared ... unless we are provided a court order ...,” Padelford said. Both Visa and Mastercard issued statements to the Financial Post downplaying the amount of customer data they have.
“When cardholders use their cards, we don’t know who they are and do not have contact information — because we only see an account number,” Mastercard said.
“We don’t know what they purchased; we simply know the total amount spent at a merchant on a particular date.”