B.C. cannabis buyers needn’t worry pot is making them paranoid if they see surveillance cameras at their retailer.
There are cameras.
But, not to worry.
B.C.’s privacy watchdog says the province’s liquor and cannabis stores have improved protection of customers’ personal information, a year after media stories indicated problems.
“I am encouraged to see that retailers have, by and large, taken action following the report to ensure compliance with B.C.’s privacy laws,” information and privacy commissioner Michael McEvoy said. “We know that liquor and cannabis retailers collect sensitive personal information that, if compromised, can result in real harms to individuals.”
In a report released June 7, the Office of the Information and Privacy Commissioner's findings came after an initial review that many retailers failed to maintain adequate privacy management programs or document privacy policies. That’s something they are obligated to do under B.C.’s Personal Information Protection Act (PIPA).
McEvoy said use of adequate privacy protections helps organizations build and maintain trust with their customers.
But, it wasn’t that way to start with when the review began in June 2021.
“We found that many had a lot of work to do on this important front,” the report said. “We learned that many retailers didn’t have the appropriate policies and safeguards in place, while others didn’t even realize they collected personal information.”
Among information collected were images of individuals via video surveillance; customer dates of birth from ID cards during age verification; customer contact information, credit card information and purchase history; customer computer information through online orders; and employee personal contact information, work history, security clearance, payroll and tax information, and health information.
The report noted cannabis retailers in particular must use security cameras to monitor retail and product storage areas, entrances, and exits, adding an additional collection of sensitive personal information.
What the follow-up report found is that retailers have fully implemented 70% of the recommendations, and partially implemented a further 22%.
What McEvoy hopes retailers will take from the new report is that customers’ and employees’ trust should not be taken for granted.
“Instead, they should continuously monitor, evaluate and improve their privacy management programs with the same vigour and urgency towards protecting personal information as they would give to protecting their valuable financial and physical assets,” he said.
The original report contained 18 recommendations for liquor and cannabis retailers to establish and maintain privacy management programs, including:
- designating someone to be responsible for ensuring the organization complies with PIPA;
- developing written policies; and
- monitoring compliance and conducting risk assessments to know that security safeguards are effective.
“A breach for a cannabis retail organization can have more negative implications for individuals compared to other types of organizations,” the report said.
