Law Times

LAW TIMES 8 COVERING ONTARIO'S LEGAL SCENE | MARCH 11, 2019 www.lawtimesnews.com BY MARG. BRUINEMAN For Law Times P rotecting the identity and financial informa- tion of those who pur- chase marijuana is one of the primary con- cerns of the nascent retail market for recently legal marijuana, say lawyers. Privacy protection is of par- ticular interest this spring as private-sector shops start pop- ping up across Ontario. Since the federal government legalized the recreational use of marijua- na in October, legal marijuana has only been accessible up un- til this point online through the Ontario Cannabis Store. "If [retailers] do not protect that sensitive personal informa- tion, they will not get customer trust. If you don't get customer trust, you don't get customers," says privacy lawyer Chantal Ber- nier, a partner with Dentons Can- ada LLP, who previously worked with the office of the federal pri- vacy commissioner and served as acting privacy commissioner. She points out that private- sector businesses are required under the Personal Informa- tion Protection and Electronic Documents Act to ensure there are safeguards in place to protect any information. The commercial reality, says Bernier, is that if the privacy protections are not in place, pur- chasers will simply turn to the black market and buy untested product that could pose health risks, contrary to one of the mo- tivations behind legalization. "We all know that the use of cannabis is sensitive personal information. Why? If that infor- mation is disclosed without au- thorization, it can be impactful," she says. "So, all of the retailers and the producers are truly gear- ing up for the most secure sys- tem to protect that information." Bernier points to guidance from the federal privacy com- missioner suggesting that cus- tomers can also take steps to protect their own personal and financial information by mak- ing purchases with cash and staying off mailing lists. Those who want to make the purchase in the privacy of their own home by buying marijuana online will leave a digital trail, adds Bernier. In its December 2018 state- ment on the collection of per- sonal information in cannabis transactions, the Office of the Privacy Commissioner of Can- ada advises that cash transac- tions can help to minimize risks for consumers, who should also make a point of knowing what kind of information the retailer is collecting. It highlights widespread con- cern by Canadians and potential problems at the border as they cross into the United States. "Cannabis is illegal in most jurisdictions outside of Canada. The personal information of cannabis users is therefore very sensitive. For example, some countries may deny entry to in- dividuals if they know they have purchased cannabis, even law- fully," reads the statement. It further suggests retailers make "appropriate security ar- rangements to prevent unauthor- ized access, disclosure, use, copy- ing, or modification. This means ensuring physical, technological, and organizational security mea- sures are in place to store person- al information." But paying cash for marijuana transactions isn't yet possible in Ontario given that cannabis has only been available through the Ontario Cannabis Store online so far, says Lisa Lif- shitz, a privacy partner at Torkin Manes LLP in Toronto. As legal private-sector pot shops start doing business in Ontario, Lifshitz says, there are other potential privacy risks for purchasers, even for consumers who pay in cash. Retailers often collect infor- mation about their clients and some may copy proof of age identification. Any of that infor- mation inputted into the store's system then becomes vulnerable to the controls of a third-party processor that hosts data, she explains. Any servers used to store that information that don't reside in Canada can be subject to the laws of that other jurisdiction, such as the United States' anti- terrorism Patriot Act or its Clar- ifying Lawful Overseas Use of Data Act, which allows U.S. of- ficials and foreign governments more access to personal data stored in the cloud. "There's a good chance that that processor is actually an af- filiate or foreign processor that may actually have other obliga- tions under other laws to dis- close that data," she says. "Then they would have to disclose it, subject to due process, obvious- ly. That's why the commissioner is advising that individuals may want to purchase cannabis from retailers who keep the personal information in Canada. "Again, you have to dig a little deeper than that. It's not just about keeping it in Canada; it's who is the entity that is actually hosting it and where are they geo- graphically located and where are their servers located." LT Secure systems needed Privacy protection at issue in pot purchases Facial recognition technology raises concerns P. 10 Open banking explored in Canada P. 11 Privacy Law FOCUS We all know that the use of cannabis is sensitive personal information. Chantal Bernier Chantal Bernier says those who want to purchase cannabis within the privacy of their own home by buying marijuana online will leave a digital trail, but there are privacy protections in place. Focus on TOP 25 MOST INFLUENTIAL LAWYERS IN CANADA Nominate your choices between February 25 and April 2 VISIT WWW.CANADIANLAWYERMAG.COM/SURVEYS Untitled-8 1 2019-02-20 3:54 PM

• Cover