22
purchased online exclusively from the Ontario Cannabis Store, rather than at physical stores.
Accordingly, the OCS’s privacy policy notes that customer information is subject to Ontario’s Freedom of Information and Protection of Privacy Act rather the PIPEDA. However, the Guidance will eventually become more pertinent when the Government of Ontario authorizes private retail cannabis outlets, which is expected to occur on April 1, 2019 with the OCS acting as the wholesaler to such establishments.
The guidance stressed a number of critical themes under PIPEDA, as follows.
Only collect what
is needed
In some respects, it’s business as usual for private sector cannabis retailers, who are cautioned that they should only be collecting personal information for the purposes identified by the organization and that any such purpose has to be in line with what a “reasonable person” would consider to be appropriate in the circumstances. Moreover, cannabis retailers will also have to obtain “meaningful consent” from individuals before collecting their personal information, which includes telling customers what personal information is being collected, to which parties it will be disclosed, the purposes for its collection, and risks of harm. For example, if a retailer plans to use video surveillance to protect its store (although the OPC considers the use of video surveillance as a last resort) it must warn individuals of such activity using visible signage before the customer enters the store and is recorded.