Privacy Issues for B.C.’s Cannabis Consumers


B.C.’s office of the information and privacy commissioner (OIPC) has released a guidance document for protecting personal information in cannabis transactions. The commissioner’s office advises that the Personal Information Protection Act (PIPA) applies to all organizations that collects peoples’ personal information in British Columbia. PIPA’s broad definition of ‘personal information’ as “information about an identifiable individual” can be taken to include someone’s name, birthday, contact information, driver’s license number, medical or financial information, or social insurance number.

The Office also points to the Ten Principles of Privacy, or the “Fair Information Practices” which inform B.C.’s privacy legislation for all private companies collection, use and disclosure of individual’s private information.

The ten principles of privacy protection are:

  1. Be accountable
  2. Identify the purpose
  3. Obtain consent
  4. Limit collection
  5. Limit use, disclosure and retention
  6. Be accurate
  7. Use appropriate safeguards
  8. Be open
  9. Give individuals access
  10. Provide recourse

The Commissioner’s advice for consumers includes using cash to purchase cannabis, and inquiring into how your personal information will stored if you’re signing up for membership lists or promotions. For retailers, the Commissioner warns that if data is stored in the Cloud or other proprietary software “there is likely disclosure of that Personal information outside of Canada.”

While dispensaries do obtain membership information like names and addresses, the pressing issues seem to be surrounding the B.C. government’s online stores and its practices of storing costumer data. The data is stored in Canada with Shopify. The company meet the requisite privacy and security requirements under B.C.’s Freedom of Information and Protection of Privacy Act. B.C.’s Privacy Commissioner has insisted that “Cyber security is a priority with online sales of any kind and we will work closely with Shopify to ensure that our customers’ data is secure.”

Considering the risks associated with cannabis consumption and border crossing, warrants, and extra-territorial jurisdiction of countries like Japan and South Korea who have issued strong warnings to their citizens in Canada to steer clear of cannabis, there’s a lot riding on the security capabilities of Shopify and the storage of B.C.’s costumer data in Canada.