Skip to main content

Canada Experts urge close monitoring of privacy issues when Ontario makes marijuana sales online-only this fall

Part of cannabis laws and regulations

Buyers who have to provide personal information to purchase recreational pot online after legalization this fall should be able to rely on existing laws to protect their privacy but the issue needs to be watched closely to ensure regulations are obeyed and mistakes are avoided, experts say.

The matter is important given the stigma many people still attach to marijuana use, and the potential for Canadians to be barred from the United States if their otherwise legal indulgence becomes known to American border agents.

“We need to keep eyes on it, meaning we have to make sure this information is not abused or used for secondary purposes that were never intended,” Ann Cavoukian, Ontario’s former privacy commissioner and now an expert at Ryerson University, said in an interview. “Theoretically, it should not be used for any other purpose.”

Story continues below advertisement

A spokeswoman for federal Privacy Commissioner Daniel Therrien said the office had not looked specifically at online marijuana sales. At the same time, the commission said it recognized privacy concerns around buying or using marijuana given its longtime status as a controlled substance.

“The legal sale and use of both medicinal and recreational marijuana raises privacy issues, particularly since laws and regulations differ from country to country and even within countries,” Tobi Cohen said. “We have repeatedly raised concerns about the effectiveness of (Canada’s two privacy laws) in the digital age and have called for both laws to be strengthened.”

Last week, Ontario’s new Progressive Conservative government announced that consumers 19 years or older will have to go online to buy weed after legalization federally on Oct. 17 because private retail stores won’t be up and running until April. A government agency called the Ontario Cannabis Store will run the online sales, although private e-commerce provider Shopify will be involved.

Online buyers will, at minimum, have to provide a name along with email and delivery address, and payment information. In Ontario, as is currently the case with online alcohol sales, buyers will be able to order as a “guest” without creating an online account.

However, Scott Blodgett, a spokesman for the Ministry of Finance, said buyers will have to provide proof of age via government-issued ID, which a delivery person will verify but not copy. The cannabis store website will have data security and privacy controls “aligned with global e-commerce best practice,” he said.

Personal data will remain in Canada and not be shared with third parties, Blodgett said.

Ontario’s Privacy Commissioner Brian Beamish was unavailable to discuss the issue but his office said in a statement that public institutions are accountable for the information they collect.

Story continues below advertisement

“All public institutions are responsible for having strong privacy protections in place to ensure personal information remains secure and protected at all times,” the office said. “Personal information provided to a public institution for the purposes of buying cannabis is no exception.”

In addition, the office said, contracts by which a private company collects personal information for the government must spell out the terms, use and security of the data.

“These legal requirements must be met by the institution regardless of where the data resides or who is accessing it,” the office said.

In general, privacy laws mandate that personal information can only be collected with informed consent. Among other things, that means spelling out why the information is needed, how it will be used, who it might be shared with, and how long it will be stored.

Key among the various rules is that personal information should be securely stored and only used for the stated purpose.

“Government is not supposed to use the information for any other purpose,” Cavoukian said. “Theoretically, the laws are in place. We just have to make sure they are enforced and the data is properly used.”

Story continues below advertisement

One obvious exception is where a person is suspected of a crime. In that case, police can force a government agency or private company to release otherwise private information — after obtaining a search warrant.

“But without a warrant, no, they’re not supposed to make (private information) available to the police or law enforcement or border crossing,” Cavoukian said. “It’s supposed to be used only for a very limited primary purpose.”

Mistakes can also happen. In 2013, for example, Health Canada inadvertently breached the rules when it sent about 40,000 letters to individuals about the medical marijuana program with envelopes labelled to indicate they were sent by the program.

Report an error
Comments

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • All comments will be reviewed by one or more moderators before being posted to the site. This should only take a few moments.
  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed. Commenters who repeatedly violate community guidelines may be suspended, causing them to temporarily lose their ability to engage with comments.

Read our community guidelines here

Discussion loading ...

Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.
Cannabis pro newsletter