In a report issued earlier this month, the Office of the Information and Privacy Commissioner warned retailers to be careful how they collect and store buyers’ personal information.
Cannabis, the report notes, remains illegal in most countries across the world, some of which have threatened to bar entrants if they admit to pot use.
In a tweet, the South Korean embassy in Ottawa urged its citizens to not consume cannabis even outside the country.
“Even in the legalized area of cannabis, please note that if the citizens of Korea [caught] smoking (including purchase, possession and transportation), they will be penalized for the offence,” the embassy tweeted.
[대마초 합법화에 따른 주의사항 안내] 내일부터 캐나다 전역에서 여가용 대마초 합법화 법안이 발효됩니다. 대마초 합법화 지역이라 할지라도, 우리 국민이 대마초 흡연(구매, 소지, 운반 포함)을 할 경우 범법행위에 해당하여 처벌받게 되니 불이익을 받는 일이 없도록 주의하시기 바랍니다.
— 주캐나다대한민국대사관 (@koremb_canada) October 16, 2018
In a statement posted by the Consulate-General of Japan in Vancouver, Japanese citizens, and those wishing to go to Japan, were told to stay away from marijuana.
The consulate warned that in Japan, the “possession and transfer of cannabis is illegal and subject to punishment.”
But the rules apply even to those outside the country.
“Japanese nationals residing in Japan and Japanese tourists should observe these Japanese laws and take sufficient precautions not to hand over cannabis (as well as foods and drinks containing cannabis), even outside of Japan,” the statement reads.
Only collect necessary information
B.C.’s privacy watchdog notes that retailers should only gather needed information, and not store it unless they have to.
For in-person pot sales, the privacy commissioner said that only payment information and age-verification should be collected, but that neither should be stored.
Although security cameras are popular in most stores with expensive, and small, merchandise, the watchdog said that pot shops should use video surveillance only as a last resort and that not warning shoppers that they’re on camera violates the province’s Personal Information Protection Act.
For mailing lists, even if members consent to having their information collected, the watchdog urged retailers to collect only the “minimum amount of personal information” needed.
The privacy commissioner urged online shoppers to be extra-careful where they purchase cannabis from, warning that data leaks can, and do, happen.
Back in 2013, Health Canada breached privacy laws by mailing letters to more than 40,000 clients of the Marihuana Medical Access Program, with the topic of the letter, as well as the clients’ names and addressed clearly displayed on the envelope.
Buying pot online
In B.C., legal pot can only be bought online through the government store.
The website requires customers to declare their birthday before accessing the site.
The province accepts payments by credit card or debit VISA or Mastercard, and uses Shopify for online sales.
“Government chose to use Shopify’s platform for online cannabis sales because it met the privacy and security requirements under the B.C. Freedom of Information and Protection of Privacy Act,” the Ministry of the Attorney General said in a statement.
“Cyber security is a priority with online sales of any kind and we will work closely with Shopify to ensure that our customers’ data is secure.”
The ministry noted that all customer data is stored in Canada.
|A privacy statement seen at checkout from the BC Cannabis Store website. (BC Cannabis Store)|
The watchdog noted that physical records should be stored safely if needed, or preferably destroyed. Online information, it noted, should only be collected to the minimum level needed and deleted as soon as possible.
Shopify noted that how long this information was stored for is up to the merchant, in this case B.C. liquor distribution branch. The province did not provide details on how long they plan to store customers’ information.
However, in a statement on the BC Cannabis Store website, the province noted that “collected personal information will only be used by those authorized to fulfill the purpose for which it was originally collected or for a use consistent with that purpose…. We keep the information only for the length of time necessary to fulfill the purpose(s) for which it was collected.”