The Ontario Cannabis Store sells licensed producers data based on customers’ addresses, Global News has learned.
That’s contrary to its own privacy policy, a leading privacy expert says.
The address data is broken down by the first three characters of customers’ postal codes.
The postal areas vary in population. The average one in Ontario has about 25,000 residents, though 19 have fewer than 1,000. One in Cambridge has only 279 residents.
“We only collect information that is necessary for each transaction,” the government-owned cannabis online retailer says in its privacy policy. “We won’t use or share it for any other purposes, and it will never be sold to third parties.
“All information will be kept for only the minimum length of time required by law and then deleted as soon as possible.”
Ann Cavoukian, Ontario’s former privacy commissioner, calls the practice “appalling.”
“You can have a privacy policy but you have to ensure that it’s followed,” she said.
“You’ve got to walk the talk. That’s the talk, and clearly, they’re not walking it if they’re selling information to third parties.”
The OCS’s Sale of Data program isn’t referred to on its customer-facing website. It’s described on a separate site for businesses but with no mention of customer geographic data.
Global News found out about the sale of postal code-based data when it was cited as a reason to deny an access-to-information request.
The OCS says its program is based on an equivalent one at the LCBO. That program, which is mostly focused on inventory levels of different kinds of alcohol, doesn’t offer customer information, though very little is collected by the liquor retailer in the first place.
Until early April, the online OCS site was Ontario’s only legal source of recreational cannabis. Because of Ontario’s limited rollout of cannabis stores, it still is in large parts of the province.
“This program provides licensed producers with access to sales information that can be used to evolve and improve their product offerings in response to actual consumer demand,” OCS spokesperson Daffyd Roderick wrote in an email.
Roderick did not respond to a question about the apparent contradiction between the privacy policy and the sale of postal code data.
“In this case, the privacy policy specifically says: ‘We will not share or sell your information to third parties,’” Cavoukian says. “Clearly, the practice they’re engaged in is a violation of their privacy policy. And that has to be considered unacceptable.”
A longer version of the OCS privacy policy says that “… we collect and use personal information … to create aggregated information that does not allow you to be personally identified or contacted” but doesn’t refer to this information being sold.
If the OCS wants to sell any customer information to third parties, it should explain what it wants to do and get explicit consent first, Cavoukian says.
“It would simply be when you make your purchase of cannabis, at that time, whoever you’re buying it from could say: ‘Would you be OK with us sharing this information with x number of third parties? We’ll make every effort to make sure that you’re not identified.’ If I had to bet on it, I’d bet that everyone would say: ‘No, I don’t want you to share my information. Why would I want you to share my information?’”
Privacy experts debate the situations in which “reidentification,” or the identification of people who are otherwise anonymous in data, can happen. Address data at the FSA level is unlikely to lead to an individual being identified in most cases, though data from low-population FSAs is sometimes treated differently from high-population data for privacy reasons.
In most postal areas, Cavoukian says: “I’m guessing the risk is minimal.”
But low-population areas are a different case.
Canadian cannabis buyers touchy about privacy
Since legalization, there has been a high level of sensitivity about cannabis buyers’ information. Last December, the federal privacy commissioner said cannabis buyers who are concerned about using credit cards should use cash if possible.
Canadians show a strong preference for buying cannabis in person, even when it’s much more inconvenient than buying it online. A major reason cited is privacy.
Legal cannabis sales more than doubled in Ontario in April after a handful of stores started to open. That strongly implies that many potential cannabis buyers would rather not buy it at all or not buy from legal sources than buy online.
In provinces like Nova Scotia and New Brunswick, which started legalization with a network of stores, almost all cannabis sales are in person, although both provinces have well-stocked online cannabis retail sites.
Other provinces don’t sell data
No other province contacted by Global News sold cannabis customer data.
“We don’t sell sales data, period, not by region, community or product,” B.C. Cannabis Stores spokesperson Viviana Zanocco wrote in an email. Publicly owned cannabis retailers in Nova Scotia, New Brunswick and Alberta also said they didn’t sell data.
“We do not sell any of our customer data,” wrote Cannabis NB spokesperson Marie-Andrée Bolduc. “For anyone who signs up for an account and gives us that information, none of that is sold or shared externally.”
The OCS would not answer questions about the business side of the program, such as how much clients are charged for what kind of information and what revenues and expenditures have been.
“Like many things in the cannabis sector, this program is in its early days,” OCS spokesperson Amanda Winton wrote in an email. “We do not discuss the details of our commercial relationships or transactions.”
The OCS did not respond to a request for a copy of the agreement that Sale of Data clients must sign or say whether there was any stipulation that the data had to be stored in Canada. The cannabis retailer also declined an interview request.
“If you ask the majority of the people, I’m guessing they’re going to say: ‘No, I don’t want my information shared. I don’t want any risk associated with that,’” Cavoukian says. “So why wouldn’t this be made public? Because they don’t want to make it public. They want it to be concealed. It’s a practice that they are benefitting from commercially.”
Comments