Privacy and security stakes high in cannabis arena

By Staff

The clock is ticking for licensed producers of cannabis to get their privacy and security measures in order ahead of the drug’s legalization for recreational use, Toronto health lawyer Mary Jane Dykeman tells

The Toronto Star recently reported on a survey by a global audit firm that found cybersecurity and protection of sensitive consumer information was the primary concern of Canadian respondents around cannabis which is set for legalization next month.

The article also noted that many users have taken steps in the past to avoid creating paper trails that may connect them to the drug.

Dykeman, a partner with DDO Health Law, is working with a number of organizations that are actively examining and enhancing their privacy and security protections. She says it’s no surprise that consumers are concerned, given the illicit history of cannabis. And it’s not just licensed producers of cannabis who have cause to worry about the fast approaching legalization date, she adds.

"Long-term care homes and retirement homes, among others, should also be paying attention as the status of cannabis evolves, since new issues arise where someone lives in a setting that is home to many residents and is also a workplace. To that end, any recreational use by employees will also need to be addressed from a human resources point of view to the extent that cannabis use impacts an employee’s ability to perform their job duties," says Dykeman.

“People are still worried about the stigma and the potential damage they feel could be done if information leaks out,” she says. “The stakes are very high for licensed producers, who will want to make sure they are compliant with the legislation and reflecting best practices in these areas. On the flip side, both consumers and those running the homes where they live are mindful of the fact that cannabis can be legally obtained and consumed, subject to any rules that apply.

"An added wrinkle is in mail-order cannabis, and with it a new host of privacy issues, since age minimums must be verified even if it is possible to sign in online as a guest, as discussed in a recent CBC article," she notes.

“For all of these reasons, many are moving quickly to assess their readiness because they realize this is something they need to take seriously,” Dykeman adds.

She explains that some companies operating in the burgeoning industry are bound by the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which governs the collection, use and disclosure of personal information in the private sector for commercial purposes.

"By contrast, long-term care homes, retirement homes and some other residential settings are bound by the Personal Health Information Protection Act (PHIPA)," she says. "Even if a resident’s use is recreational and not medical, it is possible that this could be documented in their health record, for example, if there were an infraction of smoking by-laws or other incident in the home.

“Good practice is to safeguard information and be transparent about how it is stored and might be used,” Dykeman says.

However, she says that whether commercial or non-profit, organizations must take care in how they communicate their duties under applicable laws.

“Don’t make promises you can’t keep,” she warns, noting that some may be tempted to promise complete security or to guarantee personal information — or personal health information in the case of health care organizations — will never be disclosed without the person’s consent.

“There are certain circumstances when an organization may be permitted or required by law to share information with the authorities,” Dykeman says. “Be clear about the efforts you will make to safeguard information, recognizing that despite best efforts, a breach is always a possibility — whether it’s an inadvertent or malicious internal access or a cyber attack originating from the outside.

“Part of the challenge as this unfolds will be to make sure everyone is informed and on the same page. Anyone collecting information will have to be very careful and prepared from a privacy and security point of view,” she adds.

The concern for consumers is also heightened by uncertainty over the status of cannabis at the U.S. border, Dykeman says.

Another Toronto Star article on the subject suggests that people who admit their involvement in the industry or even to have used the drug in the past may find themselves turned back as inadmissible to the U.S.

“As a privacy lawyer and as a traveller, it gives you pause,” Dykeman says.

“People are starting to wonder about where the balance is between someone’s right to use versus its use in a communal setting – and the myriad of privacy implications.” Dykeman says. “There are lots of developments, which makes it a very exciting area to be involved in.”

To Read More Mary Jane Dykeman Posts Click Here