ID scanners in use at Toronto’s only legal cannabis store are set to forget the information they scan, but are also designed to be able to build a customer database, their U.S.-based supplier says.
The first day that legal bricks-and-mortar stores opened in Ontario, some customers at the Hunny Pot found that employees were scanning their driver’s licences with a device.
“I have had some people advise me that, without their consent, the ID was scanned, and that was before being asked about any membership participation, or tracking for internal purposes,” said cannabis lawyer Caryma Sa’d. “That has been troubling to some people.”
Kate Johnny, a spokesperson for the store, said that the scanning was optional. However, she did not answer a follow-up question about whether customers had any way of being aware of that.
The scanners are meant to flag fake IDs and verify unusual IDs, like out-of-province driver’s licences, explains the device’s supplier.
“We can basically take a picture of the back of the ID, suck in all that bar code information, validate whether it’s a valid ID, and whether the person is of age,” says Cova Software CEO Gary Cohen.
“The whole screen turns red if it’s not valid, or green if it’s good.”
Cova, a Denver-based company, supplies IT services to Canadian and U.S. cannabis stores.
The customers Sa’d talked to were using Ontario driver’s licences as ID, she says. She says the store scanned her ID, a Canadian passport.
The scanners were originally supplied to U.S. dispensaries that didn’t trust their employees to check birth dates properly, Cohen says.
“Our original thought was: You’re paying a guy at the door to check IDs – it seems like it’s pretty well handled. The feedback was, ‘We don’t trust our guys at the door. Unlike a bar or something else, our licence is on the line for this. It really rose to the level of ‘this is essential.’”
In the United States, medical dispensaries wanted to use the devices to call up a customer file as well, which is why they have that capability.
The scanners can verify all North American driver’s licences and non-driver IDs, but not health cards, Cohen says.
Johnny would not explain what data was collected by the Hunny Pot’s ID scanners, whether it is retained and how it is safeguarded, referring those questions to Cova.
“There are two paths the owners can go through,” Cohen says. “They can preserve that information, and build a database of customers. However, we pre-set it to just scan the ID and let it go. So it does the ID scan but doesn’t build a record.”
“Our default is that it doesn’t retain any information. But the owner has the capability to start building a customer database.”
The Hunny Pot only stores information if the customer wants to create a profile, Johnny wrote.
All Canadian customer-related data is stored on servers in Canada, Cohen said.
In the early days of legalization, PEI Cannabis used similar devices to check for fake IDs. They were quickly abandoned after they were found to be collecting and storing customer information, something the provincial retailer hadn’t been aware of when they started using them.
PEI Cannabis wasn’t using a scanner supplied by Cova, Cohen says.
In most provinces, buying cannabis in person is far more inconvenient than buying it online – customers face long lineups at often faraway stores.
Other than being able to see and smell the cannabis and get advice in person, one of the main reasons to accept the effort and hassle of buying it in person is privacy. Customers can show up anonymously and buy in cash. Their ID may be checked, but the details aren’t recorded.
In principle, a customer can always walk away. But with few stores and long lineups to get into the ones that do exist, there’s an incentive to not do that once you’ve finally made it to the front of the line.
“It’s sort of like the conundrum of arriving at the border and you’re asked an uncomfortable question about your cannabis consumption,” Sa’d says. “Do I turn around and lose my hotel bookings and whatever other plans I had in place and live to fight another day?”
In December, the federal privacy commissioner issued a strongly worded warning advising cannabis buyers to buy in person and use cash if at all possible.
“The personal information of cannabis users is … very sensitive,” the statement said. “For example, some countries may deny entry to individuals if they know they have purchased cannabis, even lawfully.”
However, ID scanning that’s perceived as compulsory defeats that approach.
“You could go in with cash, with the intent of ‘I’m going to make my legal purchase, and it’s nobody’s business, and I don’t need to be put on any sort of list,” Sa’d says. “If that’s happening against your will, there are reasons to be wary.”
“Legalization is still in its early stages, so there’s some stigma and concern about the use of cannabis, and wanting to protect one’s privacy around that. There are a whole bunch of areas where being outed as a cannabis user may have negative implications.”
Last Tuesday, Ontario Premier Doug Ford defended ID scanning at cannabis stores, saying that, “We do have to track who’s buying it right now.”
By Thursday, the government’s position had shifted.
“Any store collecting data isn’t doing so at our government’s insistence, and we expect them to comply with privacy laws with any information they handle,” wrote Ivana Yelich, Ford’s press secretary.
“Stores are required to have reasonable safeguards around data security and protection of data integrity and these stores must be compliant with federal privacy laws.”
What should you do if a cannabis store wants to scan your ID? Ask questions and be prepared to leave if you’re not satisfied with the answers, Sa’d says.
“The options are somewhat limited.”
“There’s perhaps a bit of room to push back and say, ‘Look, I’m not comfortable having my ID scanned, but you can see from the dates that I’m above age, and allowed to purchase.’ If that doesn’t get you very far with whoever is manning that entry point, the option may simply be to turn around and shop another day.”
A man who shopped at the Hunny Pot on Wednesday said he was asked to show ID to staff, but it wasn’t scanned.
At the Ganjika House in Brampton, the GTA’s only other cannabis store, there was no sign of an ID scanner being in use when a reporter visited last week.
In the meantime, the prospect of having their ID scanned could discourage cannabis buyers from using legal sources, Sa’d says.
“If the scanning policy in brick-and-mortar stores is not comforting to customers, and they don’t have faith that their information will either be deleted or kept safely, I do think that this could be yet another reason individuals could continue to purchase from the underground market.”
Comments