A check of your ID to verify age, which might involve an ID scanner, and quick tap of a debit or credit card allows you to buy cannabis or liquor, but how safe is that electronic data from prying eyes or being stolen?
The Office of the Independent Privacy Commissioner of BC has found that some cannabis retailers and private liquor stores in the province need to do a better job of protecting the personal information they collect.
Privacy commissioner Michael McEvoy and his staff did a compliance check of 30 private sector licensed liquor and cannabis retailers and says few of them had proper systems to safely manage personal information.
The province requires store employees to verify customer identification and cannabis retailers must use an age-verification tool for their online sales.
He says a cannabis retailer or a liquor store can “get a whole bunch of information about an individual,” including credit card information.
When it comes to the purchase of cannabis, McEvoy says it “becomes a fact known about you, which can be significant.”
He says Canada has legalized the possession of cannabis, but notes there are some jurisdictions where it’s not legal.
People working in the industry, or those who use cannabis, might face being restricted from entering other countries if that information became public.
McEvoy says “many retailers didn’t understand that they collect personal information, despite the fact that all private licensed liquor and cannabis retailers collect some form of personal information from employees and customers who enter physical stores or make purchases online.”
Cannabis retailers must have security cameras to monitor all retail and product storage areas, entrances, and exits, which collect additional sensitive personal information.
McEvoy says they also found that a small number of retailers “collect biometric information from staff, customers, or both,” thumbprint scanners to document staff signing in and out, and even the use of facial recognition software as part of a surveillance system.
He says unless there are unusual circumstances, BC cannabis and liquor stores “are not authorized to use facial recognition technology,” and should not do so.
The report has 18 recommendations for liquor and cannabis retailers to establish and maintain privacy management programs.
They include designating someone to be responsible for ensuring the organization complies with PIPA (Personal Information Protection Act), developing written policies, and monitoring compliance and conducting risk assessments to know that security safeguards are effective.
Recently, the province announced that licensed cannabis retailers will be able to deliver non-medical cannabis products directly to consumers starting on July 15.
The addition of home delivery comes almost one year after BC allowed cannabis retail stores to sell their products online.
The province says consumers will gain a new way to purchase non-medical cannabis from a legal source in their community, helping to support BC’s legal cannabis industry and strengthen their local economy.
Only adults will be allowed to receive delivery orders, and anyone who appears to be under 19 will have to present two pieces of identification.
They will have to provide their name and signature at the time of delivery.
A guidance document from the Office of the Independent Privacy Commissioner says if cannabis retailers do record personal information from customers, they are required to store it securely by making reasonable security arrangements to prevent unauthorized access, collection, use, copying, modification or disposal.
