Legislation and technology have made it impossible to keep information in one place. Like a toppled glass of fine whiskey, our information flows smoothly and is impossible to catch or put back in the bottle.
A hundred years ago, after a decades-long public relations campaign, lawmakers put a cork in the production and consumption of intoxicating spirits. But as with so many things, laws are often ineffective at regulating behavior — so many people adjusted their routines but not their choices. With a wink and a nudge, the consumption of now-illegal alcohol was possible when prescribed by a doctor.
In Canada, a short-lived liquor prohibition ended while the U.S. was still under the influence of the 18th Amendment that had criminalized intoxicating spirits — creating tremendous economic opportunity for a bootlegging industry that enjoyed great success.
U.S. gangster Al Capone built an empire bootlegging alcohol. Canadian entrepreneurs Sam and Harry Bronfman, whose family had built a distillery in Montreal in 1924, made their fortune selling liquor to American gangsters and bootleggers, often negotiating deals in Moose Jaw, Saskatchewan — where some local authorities provided tacit endorsement of the illicit liquor trade.
The competition for such the lucrative liquor market led to increased gang activity, shootings, and murders. The increased alcohol-related violence during Prohibition caused support to wane and, in 1933, the failed social experiment that was U.S. Prohibition was finally ended.
The more modern social experiment — prohibition of marijuana — has followed a similar path. Gang violence and turf wars for supremacy in the lucrative illicit drug market contributed to fading popularity for modern prohibition, and to the legalization of cannabis in Canada.
As their predecessors had with alcohol, Canadian have been prescribing marijuana for medicinal purposes for several years. In Canada, that program has been closely regulated by the Government of Canada and provided tremendous relief to many sufferers. It also caused consternation (and at least one class action lawsuit and more than 300 well-founded complaints to the Office of the Privacy Commissioner of Canada) after Health Canada breached the privacy of 40,000 people enrolled in the medical marijuana program
More recently, in preparation for the legalization of recreational cannabis, Canadian provinces and territories established local regimes and procedures to allow online sales of recreational marijuana.
The Prince Edward Island Cannabis Management Corporation oversees the operation of four cannabis retail locations. The Corporation also owns and operates PEI’s e-commerce platform that accepts payment by VISA, MasterCard,American Express, AMEX, and Diners Club.
In early 2018, the Liquor Control Board of Ontario (parent company of the Ontario Cannabis Retail Corporation) announced that it had chosen a Canadian company, Shopify, to provide a cloud-based retail solution for its online and offline sales.
Alberta, on the other hand, chose OnXEnterprise Solutions, an Ohio-based company owned by Cincinnati Bell, to handle all aspects of online cannabis sales on behalf of the province. Under the Alberta regime, customers will have to provide personal information or copies of government-issued photo ID to facilitate age verification.
Albertans — including more than 10,000 who placed orders on the first day of legal recreational cannabis sales — have been assured that records relating to their marijuana purchases will remain within Canada.
But they might wonder if someone’s blowing smoke.
The AGLC privacy policy is clear that “We will only share your information with another department if they need it to provide you a service or if it is required by law.” The AGLC privacy policy is not clear whether that law must be an Albertan or Canadian law, or one from any jurisdiction.
Adding to the quandary is the conflicting privacy statements of OnX and those of its parent company. OnX’s privacy policy indicates that complaints may be referred to the Ontario Information and Privacy Commissioner, yet the privacy policy of its parent company, Cincinnati Bell — which is subject to the USA PATRIOT Act — is clear that it applies to OnX:
“As part of our commitment to our customers, this comprehensive Privacy Policy(“Policy”) has been adopted by Cincinnati Bell, Inc. and its (and their) subsidiaries, including but not limited to: Cincinnati Bell Telephone Co. LLC (and Cincinnati Bell Extended Territories LLC), and CBTS LLC (and CBTS Technology Solutions LLC and OnX Enterprise Solutions Ltd.).”
Bell also makes clear that it uses the personally identifiable information it collects “To respond to legal requests or as otherwise required by applicable law.”
The vast majority of credit card purchases are processed in the United states, well beyond any protections of Canada’s privacy and access laws. Even relying on those laws is debatable, since the disclosure of personal information without consent is permitted under PIPEDA and other Canadian privacy laws when it is “required by law.” As is the case with many laws, PIPEDA and other privacy laws are unclear whether that exemption relates only to Canadian law or laws of other countries as well.
Visa’s Global Privacy Notice makes clear that it is based in the United States, and that the company “will disclose Personal Information when required to do so by law… including to law enforcement agencies and courts in the United States and other countries where we operate. As a result, your Personal Information may be transferred to,stored at or processed in other countries, including the United States…”
MasterCard’s Global Privacy Notice indicates that the company is headquartered in the U.S. and that it shares personal information for “other purposes required by law” and with “Other entities as required under applicable law”.
Unfortunately for consumers, such vague descriptions mean that the companies are able to take great latitude in what personal information they share, with whom, and under what circumstances.
Like OnX, U.S.-based Visa and MasterCard are subject to the USA PATRIOT Act; therefore, Canadians’ purchasing information is ultimately available to American authorities (and, through the Five Eyes and numerous Canadian laws, to other nations and organizations as well).
Retailers could create pseudonyms for customers. Customers could use anonymous prepaid credit cards or gift cards. And customers could obtain some measure of anonymity by paying in cash when that option is available — but all of those tactics to remain anonymous are undermined by the need to provide detailed personal information and, in some jurisdictions, copies of government-issue photo ID, for vendors to be able to verify a purchaser’s age.
There is no way to know for sure whether or which agency or government will want Canadians’ cannabis purchasing information; but, given the masses of personal information flowing beyond Canadians’ control, it is not unlikely that the Department of Homeland Security or, more likely, the U.S. Customs and Border Protection agency, will be among the authorities requesting information about cannabis purchasers.
Thanks to the collection and free trade of personal information by global technology companies and governments alike, Canadians might never know that their cannabis purchasing records have been disclosed to the U.S.authorities. Tens of thousands of Canadians might only be able to assume that is the case if (or when) they are prevented from entering the United States and watch their family vacation and career prospects go up in smoke.
