An overlooked aspect of the legalization of recreational cannabis in Canada concerns the privacy implications of the distribution system, especially in the online environment.

Privacy and security risks are critical and protecting consumers’ online rights requires more attention. Sensitive personal information will be at risk of redistribution and data breach, and these risks are increased if the data is stored or processed in the United States.

In Ontario, the new government of Doug Ford has reversed the policies put in place by the first Liberal government. Although the liberal agenda has its faults, those problems will be exacerbated by the president’s decision to make it unmarketable.

The previous plan was to regulate sales through the Ontario Cannabis Store (OCS), a subsidiary of the Liquor Control Board of Ontario (LCBO). By canceling the plan, the government is handing over a lucrative new market to private sector workers.

A 2018 Deloitte report estimates that Canadians will spend up to $7.17 billion on cannabis products in 2019, about 35% of which will be spent online. Under Ford’s plan, OCS will handle only online sales and physical placements under a private model, which is scheduled to take place in April 2019.

With this change in the law, the law will change quickly and, unsurprisingly, this change is controversial. Although it was praised by corporate interests, it was criticized by other groups. Their concerns should not be ignored in the rush to meet their own deadlines for online and in-store sales.

Will customer data be transferred to the United States?

OCS is a public company, but Shopify will handle the actual online business, Canada’s e-commerce platform. When the use of recreational marijuana becomes legal in October, consumers will have no choice but to use this online system until retail stores open in 2019. It is in This space where serious privacy issues come into play. Canadian privacy laws require organizations to hold personal information in order to comply with the Personal and Electronic Information Protection Act (PIPEDA). The purpose of the Act is to protect Canadians regarding the collection, use, storage and distribution of their personal information. But data breaches are a growing concern and different laws apply when data goes beyond limits.

In the case of the cannabis business, a security breach or even a regular transfer of data to US aid can have a significant negative impact on consumers. Insurance companies, employers and local police may be interested in accessing this data.

Privacy is a big problem, but perhaps the biggest problem affects data transfers in the United States. Once across the border, US security agencies can access information about the cannabis consumption habits of Canadians who participate in online systems. This can lead to delays in crossing the border, confusing questions and inspections, and can lead to laws banning Canadians from entering the United States because of their use of cannabis.

Other distributions include Google, PayPal Express and Apple Pay accounts. When a Shopify account is opened, affiliate accounts are created, each with its own terms and privacy policies. This method is not suitable for the sale of cannabis online because sharing too much data with third parties increases the risk of damage and the possibility of data transfer to the United States. 

What about data breaches?

Security of personal information online is a growing problem. Data is increasingly vulnerable to damage, loss, damage or loss. Breaches like those at Ashley Madison, Equifax, Hudson’s Bay, Yahoo and eBay get a lot of attention, but they have become so ubiquitous that a 2015 Ernst and Young report states that “…cyberattacks are no longer a question of “but it if ” and”when “. 

PIPEDA requires safeguards, but its language is unclear. A 2017 report on the Internet of Things concluded that the current security language should be strengthened to reflect technological developments. These features are related to online platforms like Shopify. Although Shopify claims to protect its customers’ data, details about how they do so have been divulged and many questions remain unanswered. How will Shopify ensure this high engagement from other US based partners with whom they share information? 

With online delivery starting in October, many important service details still need to be determined and demonstrated. Since Ontario does not meet the same data processing requirements as British Columbia, these details are even more urgent. For consumers to make the right choice about whether they want to take risks in online business or not, more understanding.

Privacy should not be an afterthought 

Online security issues beyond the cannabis market won’t be solved overnight. The same challenge faces other online retailers. But the online cannabis data is very sensitive and its scope is much higher. While Ontario’s old plan did not adequately address privacy concerns, this new change will add complexity and make the situation worse. If consumers are not sure that their sensitive information will be properly protected, or if they are concerned that it might end up in the United States, the system will fail.

Without such trust, cannabis consumers will continue their current buying behavior and the implementation of legal sales will be ineffective. In Ontario, Ontario Cannabis Stores/LCBOs are well positioned to implement sales in a safe and secure manner, but their online practices also need to be scrutinized. Adding many new independent dealers to the mix, as Ford is currently doing with its strategic plan, will heighten the problem. Confidentiality cannot be an afterthought; they have to be built into the system from the beginning, and that doesn’t make them confident.