Customer privacy at cannabis shops was being compromised, but retailers have improved their protocols and policies to protect that information, according to a new report by British Columbia’s Information and Privacy Commissioner.
The recent follow-up report published this week by the Information and Privacy Commissioner for British Columbia says that security and safeguards in provincial liquor and cannabis stores have improved from last year when confidentiality issues were outlined.
According to the new report, the initial review in 2021 found some serious issues with 30 different retail locations. Those retailers were found to be lacking sufficient privacy management programs and many of them had no privacy officer, privacy policies of any kind or privacy management training for managers and employees. Several were also not keeping inventory of the confidential information they had collected from customers.
In the report, Privacy Commissioner Michael McEvoy said that the utmost care and due diligence are critical when it comes to personal information collected by cannabis and alcohol retailers.
“The potential harms resulting from a data breach in this sector are especially acute,” McEvoy said.
McEvoy added that when the previous report was made a year ago many retailers did not have adequate policies and safeguards in place, and many were just oblivious to the scale of confidential information they were collecting.
Read more: SQDC employees strike because of low wages, poor working conditions
Read more: VIVO Cannabis study finds medical cannabis effective in treating anxiety and depression
In response to this, last year the privacy commissioner sent recommendations to several retail outlets outlining the details of their surveillance and confidentiality policy shortcomings.
After a year passed, the Privacy Commissioner now says that the vast majority of liquor and cannabis stores are either completely in compliance with the recommended safeguards they had formerly failed to implement in their shops, or working toward meeting those standards.
According to the report, the exact numbers for 29 retailers consisted of a 70 per cent rate of full implementation for the recommendations, a 22 per cent rate of partial fulfillment and an 8 per cent rate of recommendations that had not yet been acted upon.
Retailers were required to submit detailed documentation of their updated policies and procedures to the Office of the Information & Privacy Commissioner for British Columbia (OIPC).
Some B.C. retailers like Evergreen Cannabis, the first retail shop in Vancouver, told Mugglehead via email that by the time the report was released they had already done more changes than were recommended.
“What all retailers can take from this report is that they should not take the trust that customers and employees give them, or their responsibility to appropriately manage personal information, lightly,” wrote McEvoy in the new report.
“Instead, they should continuously monitor, evaluate and improve their privacy management programs with the same vigour and urgency towards protecting personal information as they would give to protecting their valuable financial and physical assets,” he added.
Confidential information collected by liquor and cannabis stores can include age and date of birth, credit card information, video images of customers and employees, customer information acquired through online orders and staff info used for payroll and hiring purposes.
