Personal data will remain in Canada and not be shared with third parties

Buyers who have to provide personal information to purchase recreational pot online after legalization this fall should be able to rely on existing laws to protect their privacy. But the issue needs to be watched closely to ensure regulations are obeyed and mistakes are avoided, experts say.

The matter is important given the stigma many people still attach to marijuana use, and the potential for Canadians to be barred from the United States if American border agents come to know of their otherwise legal indulgence.

Ann Cavoukian, Ontario’s former privacy commissioner and an expert at Ryerson University said in an interview, “We need to keep eyes on it, meaning we have to make sure this information is not abused or used for secondary purposes that were never intended. Theoretically, it should not be used for any other purpose.”

A spokeswoman for federal Privacy Commissioner Daniel Therrien said the office had not looked specifically at online marijuana sales. At the same time, the commission said it recognized privacy concerns around buying or using marijuana given its long time status as a controlled substance.

“The legal sale and use of both medicinal and recreational marijuana raises privacy issues, particularly since laws and regulations differ from country to country and even within countries,” Tobi Cohen said. “We have repeatedly raised concerns about the effectiveness of (Canada’s two privacy laws) in the digital age and have called for both laws to be strengthened.”

Last week, Ontario’s new Progressive Conservative government announced that consumers who are 19 years or older will have to go online to buy weed after legalization on Oct. 17 because private retail stores won’t be up and running until April. A government agency called the Ontario Cannabis Store will run the online sales, although private e-commerce provider Shopify will be involved.

Online buyers will have to provide a name along with email, delivery address, and payment information. In Ontario, as is currently the case with online alcohol sales, buyers will be able to order as a “guest” without creating an online account.

However, Scott Blodgett, a spokesman for the Ministry of Finance said buyers would have to provide proof of age via government-issued ID, which a delivery person will verify but not copy. The cannabis store website will have data security and privacy controls “aligned with global e-commerce best practice,” he said.

Personal data will remain in Canada and not be shared with third parties, Blodgett added.

Ontario’s Privacy Commissioner Brian Beamish was unavailable to discuss the issue but his office said in a statement that public institutions are accountable for the information they collect.

“All public institutions are responsible for having strong privacy protections in place to ensure personal information remains secure and protected at all times,” the office said. “Personal information provided to a public institution for the purposes of buying cannabis is no exception.”

In addition, the office said, contracts by which a private company collects personal information for the government must spell out the terms, use and security of the data. “These legal requirements must be met by the institution regardless of where the data resides or who is accessing it,” the office added.

In general, privacy laws mandate that personal information can only be collected with informed consent. Among other things, that means spelling out why the information is needed, how it will be used, whom it might be shared with and how long it will be stored.

Key among the various rules is that personal information should be securely stored and only used for the stated purpose.

Cavoukian said, “Government is not supposed to use the information for any other purpose. Theoretically, the laws are in place. We just have to make sure they are enforced and the data is properly used.”

One obvious exception is where a person is suspected of a crime. In that case, police can force a government agency or private company to release otherwise private information — after obtaining a search warrant.

“But without a warrant, no, they’re not supposed to make (private information) available to the police or law enforcement or border crossing. It’s supposed to be used only for a very limited primary purpose.” Cavoukian added.

Mistakes can also happen. In 2013, for example, Health Canada inadvertently breached the rules when it sent about 40,000 letters to individuals about the medical marijuana program with envelopes labelled to indicate the program sent them.