While existing laws can protect consumers who provide personal information to purchase cannabis online, experts have warned that authorities need to keep a close eye on the matter to ensure the rules are properly enforced.
Experts have drawn attention to the matter as cannabis use continues to be stigmatized in many countries. With consumer personal information at risk at online marijuana stores, some Canadian buyers could potentially be barred from entering the US, for example, if word of their cannabis use is leaked.
“We need to keep eyes on it, meaning we have to make sure this information is not abused or used for secondary purposes that were never intended,” former privacy commissioner for Ontario and Ryerson University expert-in-residence Ann Cavoukian told The Canadian Press. “Theoretically, it should not be used for any other purpose.”
Tobi Cohen, senior communications advisor with the Office of the Privacy Commissioner of Canada, has confirmed that the office has not yet considered online marijuana sales, but said it has recognized privacy concerns around buying or using cannabis due to its long-established status as a controlled substance in Canada.
“The legal sale and use of both medicinal and recreational marijuana raises privacy issues, particularly since laws and regulations differ from country to country and even within countries,” Cohen remarked. “We have repeatedly raised concerns about the effectiveness of [Canada’s two privacy laws] in the digital age and have called for both laws to be strengthened.”
At a minimum, online buyers generally have to provide a name, their email address, delivery address, and payment information. But, in some places, like Ontario, buyers will be able to purchase cannabis as a “guest” without the need to register or open an account.
The office of Ontario privacy commissioner Brian Beamish said in a statement that public institutions are accountable for the information they collect.
“All public institutions are responsible for having strong privacy protections in place to ensure personal information remains secure and protected at all times,” the office explained. “Personal information provided to a public institution for the purposes of buying cannabis is no exception.”
The office added that a federally-contracted private company collecting personal information for the government must spell out the terms, use and security of their customers’ information.
“These legal requirements must be met by the institution regardless of where the data resides or who is accessing it,” the office’s statement read.
