Privacy expert calls Ontario Cannabis Store’s sale of postal code data ‘appalling’

Click to play video: 'Ontario Cannabis Store sells data about consumer purchases'
Ontario Cannabis Store sells data about consumer purchases
WATCH ABOVE: Global News has discovered that the government-run Ontario Cannabis Store sells selected data relating to customer purchases online. But in its privacy policy, the OCS says it never sells customer information. Sean O’Shea has more – Aug 30, 2019

The Ontario Cannabis Store sells licensed producers data based on customers’ addresses, Global News has learned.

That’s contrary to its own privacy policy, a leading privacy expert says.

The address data is broken down by the first three characters of customers’ postal codes.

The postal areas vary in population. The average one in Ontario has about 25,000 residents, though 19 have fewer than 1,000. One in Cambridge has only 279 residents.

“We only collect information that is necessary for each transaction,” the government-owned cannabis online retailer says in its privacy policy. “We won’t use or share it for any other purposes, and it will never be sold to third parties.

Story continues below advertisement

“All information will be kept for only the minimum length of time required by law and then deleted as soon as possible.”

Ann Cavoukian, Ontario’s former privacy commissioner, calls the practice “appalling.”

“You can have a privacy policy but you have to ensure that it’s followed,” she said.

“You’ve got to walk the talk. That’s the talk, and clearly, they’re not walking it if they’re selling information to third parties.”

The OCS’s Sale of Data program isn’t referred to on its customer-facing website. It’s described on a separate site for businesses but with no mention of customer geographic data.

WATCH: Pot stores scanning ID raises privacy concerns
Click to play video: 'Pot stores scanning ID raises privacy concerns'
Pot stores scanning ID raises privacy concerns

Global News found out about the sale of postal code-based data when it was cited as a reason to deny an access-to-information request.

Story continues below advertisement

The OCS says its program is based on an equivalent one at the LCBO. That program, which is mostly focused on inventory levels of different kinds of alcohol, doesn’t offer customer information, though very little is collected by the liquor retailer in the first place.

Until early April, the online OCS site was Ontario’s only legal source of recreational cannabis. Because of Ontario’s limited rollout of cannabis stores, it still is in large parts of the province.

“This program provides licensed producers with access to sales information that can be used to evolve and improve their product offerings in response to actual consumer demand,” OCS spokesperson Daffyd Roderick wrote in an email.

“The sales data referred to in the Sale of Data program is focused on products and sales volumes, with geographic information limited to the forward sortation area [FSA], or first three characters of the postal code. No personal information is shared or sold, and OCS is operating in accordance with its privacy policy, which has not been altered.”

Roderick did not respond to a question about the apparent contradiction between the privacy policy and the sale of postal code data.

“In this case, the privacy policy specifically says: ‘We will not share or sell your information to third parties,’” Cavoukian says. “Clearly, the practice they’re engaged in is a violation of their privacy policy. And that has to be considered unacceptable.”

Story continues below advertisement
WATCH: Mississauga condo asks pot smoking residents to register with board
Click to play video: 'Mississauga condo asks pot smoking residents to register with board'
Mississauga condo asks pot smoking residents to register with board

A longer version of the OCS privacy policy says that “… we collect and use personal information …  to create aggregated information that does not allow you to be personally identified or contacted” but doesn’t refer to this information being sold.

If the OCS wants to sell any customer information to third parties, it should explain what it wants to do and get explicit consent first, Cavoukian says.

“It would simply be when you make your purchase of cannabis, at that time, whoever you’re buying it from could say: ‘Would you be OK with us sharing this information with x number of third parties? We’ll make every effort to make sure that you’re not identified.’ If I had to bet on it, I’d bet that everyone would say: ‘No, I don’t want you to share my information. Why would I want you to share my information?’”

Story continues below advertisement

Privacy experts debate the situations in which “reidentification,” or the identification of people who are otherwise anonymous in data, can happen. Address data at the FSA level is unlikely to lead to an individual being identified in most cases, though data from low-population FSAs is sometimes treated differently from high-population data for privacy reasons.

In most postal areas, Cavoukian says: “I’m guessing the risk is minimal.”

But low-population areas are a different case.

“There are several under 500 [people]. The potential to identify someone exists — and you don’t want to take that risk, because it’s not your information — the data subjects, the individual, in this case, haven’t been informed of this practice. There’s no notice, there’s certainly no consent,” she says.
WATCH: Winners of Ontario cannabis lottery await vetting
Click to play video: 'Winners of Ontario cannabis lottery await vetting'
Winners of Ontario cannabis lottery await vetting

Canadian cannabis buyers touchy about privacy

Since legalization, there has been a high level of sensitivity about cannabis buyers’ information. Last December, the federal privacy commissioner said cannabis buyers who are concerned about using credit cards should use cash if possible.

Story continues below advertisement

Canadians show a strong preference for buying cannabis in person, even when it’s much more inconvenient than buying it online. A major reason cited is privacy.

Legal cannabis sales more than doubled in Ontario in April after a handful of stores started to open. That strongly implies that many potential cannabis buyers would rather not buy it at all or not buy from legal sources than buy online.

In provinces like Nova Scotia and New Brunswick, which started legalization with a network of stores, almost all cannabis sales are in person, although both provinces have well-stocked online cannabis retail sites.

Other provinces don’t sell data

No other province contacted by Global News sold cannabis customer data.

“We don’t sell sales data, period, not by region, community or product,” B.C. Cannabis Stores spokesperson Viviana Zanocco wrote in an email. Publicly owned cannabis retailers in Nova Scotia, New Brunswick and Alberta also said they didn’t sell data.

“We do not sell any of our customer data,” wrote Cannabis NB spokesperson Marie-Andrée Bolduc. “For anyone who signs up for an account and gives us that information, none of that is sold or shared externally.”

Story continues below advertisement
WATCH: 3 cannabis store licences awarded to Innisfil in government selection
Click to play video: '3 cannabis store licences awarded to Innisfil in government selection'
3 cannabis store licences awarded to Innisfil in government selection

The OCS would not answer questions about the business side of the program, such as how much clients are charged for what kind of information and what revenues and expenditures have been.

“Like many things in the cannabis sector, this program is in its early days,” OCS spokesperson Amanda Winton wrote in an email. “We do not discuss the details of our commercial relationships or transactions.”

The OCS did not respond to a request for a copy of the agreement that Sale of Data clients must sign or say whether there was any stipulation that the data had to be stored in Canada. The cannabis retailer also declined an interview request.

“If you ask the majority of the people, I’m guessing they’re going to say: ‘No, I don’t want my information shared. I don’t want any risk associated with that,’” Cavoukian says. “So why wouldn’t this be made public? Because they don’t want to make it public. They want it to be concealed. It’s a practice that they are benefitting from commercially.”


Sponsored content