The office of Canada’s Privacy Commissioner Daniel Therrien published guidelines on Monday meant to help cannabis retailers and purchasers understand their rights and obligations under Canada’s federal private sector privacy law.
Therrien says Canadians need to know their rights and obligations when it comes to the use of personal data in this digital age. He points out that, “Cannabis is illegal in most jurisdictions outside of Canada. The personal information of cannabis users is therefore very sensitive.”
According to CBC Canada, Therrien notes that marijuana is still illegal in many countries around the world, and in the United States, many Canadians have been barred from entering the country if they admitted to using cannabis or being involved in the legal industry.
This leads to the option of paying cash for cannabis when buying the product at legal retail outlets. But, herein lies the problem: this option is not currently available to all Canadians because there are only a limited number of retail stores across the provinces. And in Ontario, there are currently no retail stores. That will change in 2019, but will take several more months.
Privacy breaches already detected
In a letter to Innovation Minister Navdeep Bains earlier this month, Therrien wrote, “We have reached a critical tipping point upon which privacy rights and democratic values are at stake.” And they are indeed at risk.
“Recent events have shed light on how personal information can be manipulated and used in unintended, even nefarious ways,” the letter says, according to the National Post.
In this analysis, Therrien’s office used the document from the Office of the Information and Privacy Commissioner for British Columbia’s “Protecting personal information: Cannabis transactions.” Personal information is the biggest issue with any transaction. And this information can be extensive: from a name, birth date, medical information, physical description, social insurance number, financial information and more.
Under the British Columbia privacy act, only a driver’s license or B.C. ID card is needed to purchase marijuana, and even that information doesn’t need to be written down. Medical information or other personal information is not required to purchase cannabis or cannabis products in person.
Basically, it is up to an individual to limit how much personal information about themselves is being broadcast on the Internet. As we become more intertwined in digital technology, it is important that we keep in mind that “new and intrusive targeting techniques are already influencing democratic processes and data analytics, automated decision-making technologies, and artificial intelligence are raising important ethical questions that have yet to be answered,” according to Therrien.
