175
Private organizations, including Ontario’s lucky lottery-winning private retailers, are required to abide by the Canadian federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (“PIPEDA”).
The Office of the Privacy Commissioner of Canada (the “OPC”) is responsible for overseeing the legislation and ensuring compliance. In December 2018, prior to Ontario private retailers opening their doors, the OPC released a guide to assist private retailers in planning for cannabis transactions and how to best protect the personal information of customers.
PIPEDA requires that the collection of personal information by private cannabis retailers be limited to that which is necessary for the purpose identified by the organization. Retailers are not entitled to manufacture purposes that best suit them or stretch their abilities under the legislation, because “purposes” must be in line with what a reasonable person would consider to be appropriate in the circumstances.