If you buy cannabis online in Canada, will Uncle Sam find out?
When Canadians go to buy their first grams of legal cannabis next week, many of them will do so through the internet, creating huge quantities of data as a side effect of their purchases.
But with only one week until legalization, privacy advocates say they still have plenty of questions about how that data will be handled.
And the answers could have serious ramifications: The United States still considers cannabis to be an illegal substance and concerns have been raised that Canadians could be blocked from travelling to the U.S. if customs officials find out that they have purchased the drug, or been involved in legalized production.
âItâs going to be an issue, and itâs going to present problems and challenges in terms of how that data is used, how itâs protected,â said Matt Murphy, a former U.S. Drug Enforcement Administration agent who is now vice-president of compliance for Khiron Life Sciences, a Toronto-based cannabis company.
âIâm not aware of much guidance relative to how that data is protected, how itâs used, how itâs stored. These are all interesting questions that I think weâre going to have to deal with â" probably sooner rather than later.â
Murphy downplayed the concerns about the U.S. going to great lengths to figure out who bought a gram of cannabis â" he said theyâre more worried about terrorists and illegal migrants â" but he said that potential privacy breaches could affect peopleâs employment, or simply cause public embarrassment.
Some key players in the industry are clearly thinking about privacy issues, but with 10 provinces with different distribution systems, and the inherent complexity of e-commerce, itâs difficult to fully understand who all will have access to private cannabis-related data, and how it will be protected.
In a statement in late-September, the Ontario Can nabis Store said that it will take a âprivacy by designâ approach to online sales, which will be the only option available in the province until next year.
âOnly information required for completing the transaction will be collected: name, address, contact (phone/email) and payment information,â OCS spokesman Daffyd Roderick said in an email. âThis information is used to process transactions, to verify the identity of the purchaser, to deliver and return products, to issue refunds, and to protect against error or fraud.â
Roderick emphasized that data will be encrypted and stored in Canada. In a statement on the OCS website, the Crown corporation said that it will only retain data for the minimum amount of time required by law, and that the data will be held on servers in Canada.
The OCS is working with Shopify to provide e-commerce services for cannabis, and Loren Padelford, vice-president and GM for Shopify Plus, said the company has built special syste ms to store customer data exclusively in Canada.
âIf that data is stored in our Canadian infrastructure, it is not being shared,â Padelford said. âUnless we are provided a court order by an entity that has jurisdiction over Shopify as a Canadian company, we will not be sharing this information with anybody.â
But Padelford also gave an idea of the complexity of the situation. In addition to collecting enough identifiable information for verifying a customerâs age and delivering the drugs to them, thereâs a complicated financial system to consider.
Shopify routes payment information to âpayment gatewayâ companies such as Stripe.
âStripe has all the relationships with the banks, the credit card companies, thatâs what the payment processors do,â he said. âThey are the relationship with that side. So they take order information from us and process that with VISA and Mastercard.â
Both VISA and Mastercard issued statements to the Fina ncial Post downplaying the amount of customer data they have.
âWhen cardholders use their cards, we donât know who they are and do not have contact information â" because we only see an account number,â Mastercard said. âWe donât know what they purchased; we simply know the total amount spent at a merchant on a particular date.â
But anybody whoâs ever looked at a credit card statement knows it also identifies individual retailers, which could identify the nature of the purchase.
Neither VISA or Mastercard would say if Canadian customer data is stored on Canadian servers, or if it goes to data centres in the U.S.
VISA said that it would not provide any customer information to law enforcement without âwithout proper judicial authority.â
Brynne Moore, a spokesperson for Scotiabank, suggested that they wonât really be treating cannabis data any different from other financial information.
âThe safety and security of our customers and their accounts is a top priority for Scotiabank,â Moore said in an email. âWe have policies in place to protect our customersâ privacy for all of their transactions with our bank, regardless of their nature.âSource: Google News Canada | Netizen 24 Canada