176
because “purposes” must be in line with what a reasonable person would consider to be appropriate in the circumstances.
Retailers must be clear on what information they are required to collect, and the purpose they are using it for. It seems reasonable in these circumstances to ask a customer to view their ID to verify their age and determine if they are legally entitled to enter the store or not, given the legal requirement that no one enter the store if they are under 19 years old. In fact, the legislation requires that any individual who appears to be under 25 years old provide a form of identification prescribed for the purposes of subsection 7 (2) of the Ontario Cannabis Control Act, 2017. However, what if retailers go one step further and try to record or retain that information?
In order to collect any personal information, individuals must be made aware of what information is being collected, to what parties it will be disclosed, the purposes for its collection, and any residual risks of harm. Retailers ought to be aware of their obligations under PIPEDA and how to balance those with their own goals in terms of building a customer list or database.
Many customers waited until purchasing in person (and in cash) was available, before making their first legal cannabis purchase in Canada. These customers may have taken the OPC’s “warning”, which advised cannabis buyers to purchase in
It seems reasonable in these circumstances to ask a customer to view their ID to verify their age and determine if they are legally entitled to enter the store or not, given the legal requirement that no one enter the store if they are under 19 years old.