Privacy expert calls Ontario Cannabis Store’s sale of postal code data ‘appalling’
https://globalnews.ca/video/rd/ee502da1-cb76-11e9-bd92-0242ac110004/?jwsource=cl
WATCH ABOVE: Global News has discovered that the government-run Ontario Cannabis Store sells selected data relating to customer purchases online. But in its privacy policy, the OCS says it never sells customer information. Sean O’Shea has more.
A A
The Ontario Cannabis Store sells licensed producers data based on customers’ addresses, Global News has learned.
That’s contrary to its own privacy policy, a leading privacy expert says.
The address data is broken down by the first three characters of customers’ postal codes.
Related
“All information will be kept for only the minimum length of time required by law and then deleted as soon as possible.”
Ann Cavoukian, Ontario’s former privacy commissioner, calls the practice “appalling.”
“You can have a privacy policy but you have to ensure that it’s followed,” she said.
“You’ve got to walk the talk. That’s the talk, and clearly, they’re not walking it if they’re selling information to third parties.”
The OCS’s Sale of Data program isn’t referred to on its customer-facing website. It’s described on a separate site for businesses but with no mention of customer geographic data.
WATCH: Pot stores scanning ID raises privacy concerns
Global News found out about the sale of postal code-based data when it was cited as a reason to deny an access-to-information request.
The OCS says its program is based on an equivalent one at the LCBO. That program, which is mostly focused on inventory levels of different kinds of alcohol, doesn’t offer customer information, though very little is collected by the liquor retailer in the first place.
Until early April, the online OCS site was Ontario’s only legal source of recreational cannabis. Because of Ontario’s limited rollout of cannabis stores, it still is in large parts of the province.
“This program provides licensed producers with access to sales information that can be used to evolve and improve their product offerings in response to actual consumer demand,” OCS spokesperson Daffyd Roderick wrote in an email.
“The sales data referred to in the Sale of Data program is focused on products and sales volumes, with geographic information limited to the forward sortation area [FSA], or first three characters of the postal code. No personal information is shared or sold, and OCS is operating in accordance with its privacy policy, which has not been altered.”
Roderick did not respond to a question about the apparent contradiction between the privacy policy and the sale of postal code data.
“In this case, the privacy policy specifically says: ‘We will not share or sell your information to third parties,’” Cavoukian says. “Clearly, the practice they’re engaged in is a violation of their privacy policy. And that has to be considered unacceptable.”
WATCH: Mississauga condo asks pot smoking residents to register with board
A longer version of the OCS privacy policy says that “… we collect and use personal information … to create aggregated information that does not allow you to be personally identified or contacted” but doesn’t refer to this information being sold.
If the OCS wants to sell any customer information to third parties, it should explain what it wants to do and get explicit consent first, Cavoukian says.
“It would simply be when you make your purchase of cannabis, at that time, whoever you’re buying it from could say: ‘Would you be OK with us sharing this information with x number of third parties? We’ll make every effort to make sure that you’re not identified.’ If I had to bet on it, I’d bet that everyone would say: ‘No, I don’t want you to share my information. Why would I want you to share my information?’”
READ MORE: Ontario cannabis sales more than doubled after stores started to open
Privacy experts debate the situations in which “reidentification,” or the identification of people who are otherwise anonymous in data, can happen. Address data at the FSA level is unlikely to lead to an individual being identified in most cases, though data from low-population FSAs is sometimes treated differently from high-population data for privacy reasons.
In most postal areas, Cavoukian says: “I’m guessing the risk is minimal.”
But low-population areas are a different case.
“There are several under 500 [people]. The potential to identify someone exists — and you don’t want to take that risk, because it’s not your information — the data subjects, the individual, in this case, haven’t been informed of this practice. There’s no notice, there’s certainly no consent,” she says.
WATCH: Winners of Ontario cannabis lottery await vetting
Canadian cannabis buyers touchy about privacy
Since legalization, there has been a high level of sensitivity about cannabis buyers’ information. Last December, the federal privacy commissioner said cannabis buyers who are concerned about using credit cards should use cash if possible.
Canadians show a strong preference for buying cannabis in person, even when it’s much more inconvenient than buying it online. A major reason cited is privacy.
READ MORE: Why do Canadians hate to buy marijuana online?
Legal cannabis sales more than doubled in Ontario in April after a handful of stores started to open. That strongly implies that many potential cannabis buyers would rather not buy it at all or not buy from legal sources than buy online.
In provinces like Nova Scotia and New Brunswick, which started legalization with a network of stores, almost all cannabis sales are in person, although both provinces have well-stocked online cannabis retail sites.
Other provinces don’t sell data
No other province contacted by Global News sold cannabis customer data.
“We don’t sell sales data, period, not by region, community or product,” B.C. Cannabis Stores spokesperson Viviana Zanocco wrote in an email. Publicly owned cannabis retailers in Nova Scotia, New Brunswick and Alberta also said they didn’t sell data.
“We do not sell any of our customer data,” wrote Cannabis NB spokesperson Marie-Andrée Bolduc. “For anyone who signs up for an account and gives us that information, none of that is sold or shared externally.”
WATCH: 3 cannabis store licences awarded to Innisfil in government selection
The OCS would not answer questions about the business side of the program, such as how much clients are charged for what kind of information and what revenues and expenditures have been.
“Like many things in the cannabis sector, this program is in its early days,” OCS spokesperson Amanda Winton wrote in an email. “We do not discuss the details of our commercial relationships or transactions.”
The OCS did not respond to a request for a copy of the agreement that Sale of Data clients must sign or say whether there was any stipulation that the data had to be stored in Canada. The cannabis retailer also declined an interview request.
“If you ask the majority of the people, I’m guessing they’re going to say: ‘No, I don’t want my information shared. I don’t want any risk associated with that,’” Cavoukian says. “So why wouldn’t this be made public? Because they don’t want to make it public. They want it to be concealed. It’s a practice that they are benefitting from commercially.”
https://globalnews.ca/video/rd/ee502da1-cb76-11e9-bd92-0242ac110004/?jwsource=cl
WATCH ABOVE: Global News has discovered that the government-run Ontario Cannabis Store sells selected data relating to customer purchases online. But in its privacy policy, the OCS says it never sells customer information. Sean O’Shea has more.
A A
The Ontario Cannabis Store sells licensed producers data based on customers’ addresses, Global News has learned.
That’s contrary to its own privacy policy, a leading privacy expert says.
The address data is broken down by the first three characters of customers’ postal codes.
Related
“All information will be kept for only the minimum length of time required by law and then deleted as soon as possible.”
Ann Cavoukian, Ontario’s former privacy commissioner, calls the practice “appalling.”
“You can have a privacy policy but you have to ensure that it’s followed,” she said.
“You’ve got to walk the talk. That’s the talk, and clearly, they’re not walking it if they’re selling information to third parties.”
The OCS’s Sale of Data program isn’t referred to on its customer-facing website. It’s described on a separate site for businesses but with no mention of customer geographic data.
WATCH: Pot stores scanning ID raises privacy concerns
Global News found out about the sale of postal code-based data when it was cited as a reason to deny an access-to-information request.
The OCS says its program is based on an equivalent one at the LCBO. That program, which is mostly focused on inventory levels of different kinds of alcohol, doesn’t offer customer information, though very little is collected by the liquor retailer in the first place.
Until early April, the online OCS site was Ontario’s only legal source of recreational cannabis. Because of Ontario’s limited rollout of cannabis stores, it still is in large parts of the province.
“This program provides licensed producers with access to sales information that can be used to evolve and improve their product offerings in response to actual consumer demand,” OCS spokesperson Daffyd Roderick wrote in an email.
“The sales data referred to in the Sale of Data program is focused on products and sales volumes, with geographic information limited to the forward sortation area [FSA], or first three characters of the postal code. No personal information is shared or sold, and OCS is operating in accordance with its privacy policy, which has not been altered.”
Roderick did not respond to a question about the apparent contradiction between the privacy policy and the sale of postal code data.
“In this case, the privacy policy specifically says: ‘We will not share or sell your information to third parties,’” Cavoukian says. “Clearly, the practice they’re engaged in is a violation of their privacy policy. And that has to be considered unacceptable.”
WATCH: Mississauga condo asks pot smoking residents to register with board
A longer version of the OCS privacy policy says that “… we collect and use personal information … to create aggregated information that does not allow you to be personally identified or contacted” but doesn’t refer to this information being sold.
If the OCS wants to sell any customer information to third parties, it should explain what it wants to do and get explicit consent first, Cavoukian says.
“It would simply be when you make your purchase of cannabis, at that time, whoever you’re buying it from could say: ‘Would you be OK with us sharing this information with x number of third parties? We’ll make every effort to make sure that you’re not identified.’ If I had to bet on it, I’d bet that everyone would say: ‘No, I don’t want you to share my information. Why would I want you to share my information?’”
READ MORE: Ontario cannabis sales more than doubled after stores started to open
Privacy experts debate the situations in which “reidentification,” or the identification of people who are otherwise anonymous in data, can happen. Address data at the FSA level is unlikely to lead to an individual being identified in most cases, though data from low-population FSAs is sometimes treated differently from high-population data for privacy reasons.
In most postal areas, Cavoukian says: “I’m guessing the risk is minimal.”
But low-population areas are a different case.
“There are several under 500 [people]. The potential to identify someone exists — and you don’t want to take that risk, because it’s not your information — the data subjects, the individual, in this case, haven’t been informed of this practice. There’s no notice, there’s certainly no consent,” she says.
WATCH: Winners of Ontario cannabis lottery await vetting
Canadian cannabis buyers touchy about privacy
Since legalization, there has been a high level of sensitivity about cannabis buyers’ information. Last December, the federal privacy commissioner said cannabis buyers who are concerned about using credit cards should use cash if possible.
Canadians show a strong preference for buying cannabis in person, even when it’s much more inconvenient than buying it online. A major reason cited is privacy.
READ MORE: Why do Canadians hate to buy marijuana online?
Legal cannabis sales more than doubled in Ontario in April after a handful of stores started to open. That strongly implies that many potential cannabis buyers would rather not buy it at all or not buy from legal sources than buy online.
In provinces like Nova Scotia and New Brunswick, which started legalization with a network of stores, almost all cannabis sales are in person, although both provinces have well-stocked online cannabis retail sites.
Other provinces don’t sell data
No other province contacted by Global News sold cannabis customer data.
“We don’t sell sales data, period, not by region, community or product,” B.C. Cannabis Stores spokesperson Viviana Zanocco wrote in an email. Publicly owned cannabis retailers in Nova Scotia, New Brunswick and Alberta also said they didn’t sell data.
“We do not sell any of our customer data,” wrote Cannabis NB spokesperson Marie-Andrée Bolduc. “For anyone who signs up for an account and gives us that information, none of that is sold or shared externally.”
WATCH: 3 cannabis store licences awarded to Innisfil in government selection
The OCS would not answer questions about the business side of the program, such as how much clients are charged for what kind of information and what revenues and expenditures have been.
“Like many things in the cannabis sector, this program is in its early days,” OCS spokesperson Amanda Winton wrote in an email. “We do not discuss the details of our commercial relationships or transactions.”
The OCS did not respond to a request for a copy of the agreement that Sale of Data clients must sign or say whether there was any stipulation that the data had to be stored in Canada. The cannabis retailer also declined an interview request.
“If you ask the majority of the people, I’m guessing they’re going to say: ‘No, I don’t want my information shared. I don’t want any risk associated with that,’” Cavoukian says. “So why wouldn’t this be made public? Because they don’t want to make it public. They want it to be concealed. It’s a practice that they are benefitting from commercially.”
