When Canadians are able to buy legal recreational marijuana sometime this year, we are going to start generating a lot of consumer data.
Some of it will be clearly linked to individuals: credit card purchases at physical stores and online ordering to home addresses, for example.
If your Canadian marijuana-buying data ends up on a server in the United States, could it make its way to U.S. border officials? There’s little to stop it, privacy experts say.
And that could have lasting consequences. Canadians can be barred for life from the United States — even after legalization here — if a border officer decides that they are an “abuser” of marijuana.
“Under current technical instructions, use in the last year would qualify as a drug abuser,” says Scott Railton, an immigration lawyer in Bellingham, Wash.
“If they were able to access that data point for home delivery and everything, it would open the door for more questions.”
A U.S. border officer who knew of a Canadian’s marijuana buying history could quickly put the person in an impossible position — admit to marijuana use and be banned as a “drug abuser,” or deny it and be banned for lying. (Immigration lawyers advise refusing to answer the question, which will probably get you turned back on that one occasion, but doesn’t carry lasting consequences.)
“Any information that goes outside of Canada is up for grabs by local law enforcement,” says Heather Black, a former assistant federal privacy commissioner. “It’s part of the globalization of data. It goes all over the place.”
“American authorities are pretty greedy for scooping up information, and they clearly don’t confine themselves to the borders of the United States.”
And under U.S. law, Canadians don’t have the safeguards over their U.S.-held data that Americans would have, explains University of Toronto law Professor Lisa Austin.
“In Canada, we would be protected by the Charter. In the U.S. we’re not protected by the Fourth Amendment, as non-U.S. persons, so there’s no constitutional protection for our data.”
MasterCard, Visa and the CIBC didn’t respond to questions about where credit card data is stored. However, the privacy agreements of all five of the big banks warn that customers’ financial data can be stored outside Canada, and be subject to the laws of the country it’s stored in.
Some don’t specify the U.S. by name, but others do. BMO’s agreement, for example, says that companies holding data “may be located outside of Canada (such as in the United States) and may be required to disclose information to courts, government authorities, regulators or law enforcement in accordance with applicable law in that country.”
In a 2005 decision, the federal privacy commissioner noted that Canadians’ credit card data held in the U.S. could be obtained by American authorities under the PATRIOT Act, an anti-terrorism law passed in the aftermath of the September 11, 2001, attacks.
At issue was a CIBC Visa cardholder agreement in which cardholders were asked to acknowledge that ” … my information may be processed and stored in the United States and that United States governments, courts or law enforcement or regulatory agencies may be able to obtain disclosure of my information through the laws of the United States.”
Under the law” … certain U.S. intelligence and police surveillance and information collection tools have been expanded, and procedural hurdles for U.S. law enforcement agencies have been minimized. Under section 215 of the USA PATRIOT Act, the Federal Bureau of Investigation can access records held in the United States,” the decision said.
Canadians banned from the U.S. can apply for a waiver allowing them to cross the border, but the process is cumbersome and expensive, and the application has to be restarted from scratch every few years for the rest of the person’s life.
“It could be a public relations disaster if people realize they’re sending sensitive information across the border that could get them banned from crossing the border,” Austin says.
“Lots of people smoke pot, and we are all going to want to cross the border. It can screw up your whole work life if you can’t cross.”
Online ordering
Online marijuana shopping may be popular, especially since a network of marijuana retail stores will take years to develop. (Ontario, which has 660 liquor stores, 450 beer stores, 212 agency stores and 17,637 licensed establishments, will start with only 40 physical cannabis stores to serve an adult population of 11 million.)
Research by B.C.’s Liquor Distribution Branch found that 15 per cent of the province’s adult population, or about half a million people, were interested in buying pot online, spokesperson Viviana Zanocco wrote in an email.
Global News contacted every province to ask where data about online marijuana customers — name, delivery address and so forth — will be stored:
• Quebec, B.C., P.E.I. and Nova Scotia will operate their own online ordering systems directly, and plan to store the data only in Canada.
• Alberta and Ontario have contracted out online ordering, but require the contractor to store the data only in Canada. Ontario won’t collect date of birth information through the ordering process, verifying age through an ID check at delivery instead.
• Newfoundland and Labrador and New Brunswick haven’t chosen a contractor, but will impose a similar requirement.
• Manitoba and Saskatchewan will allow online cannabis sales by licensed private-sector companies, and won’t limit where they store their consumer data. (Federal privacy laws have no requirement to keep data in Canada.)
Neither Manitoba nor Saskatchewan prepared privacy impact assessments about their approach to marijuana legalization, spokespeople for those provinces said. (A privacy impact assessment is a tool to try to make sure that something government does doesn’t affect privacy, or affects it as minimally as possible.)
They didn’t have to because the data will be handled by private-sector companies, they said.
(Another thing to throw into the mix: the U.S. argues that privacy laws in B.C. and Nova Scotia that require keeping most personal data in Canada are a violation of NAFTA.)
Credit cards
Credit card data is a more challenging problem.
From the moment legal pot stores open, records of Canadians’ cannabis purchases are going to start to pile up in credit card data which the banks that issue the cards warn may end up south of the border.
So it’s an important question how credit card transactions will be recorded.
Nova Scotia cannabis purchases will be entered as NSLC (Nova Scotia Liquor Commission), which will make them effectively invisible in the data. Did the cardholder buy Bud or buds? It’s impossible to tell.
(“That’s smart,” Austin says. “It seems like the easiest way to solve the problem, to just not have the data available.”)
P.E.I., New Brunswick, Ontario, Quebec and B.C. haven’t yet decided how credit card transactions will appear on customers’ statements.
The credit card issue is “on our radar,” says New Brunswick Liquor Corporation spokesperson Mark Barbour. Nova Scotia’s cannabis sales will be run by a subsidiary of the NSLC, while New Brunswick’s will be run by a separate Crown corporation, Barbour points out. That makes it hard for New Brunswick to copy Nova Scotia’s solution.
In provinces with private-sector retailers, the details of credit card transactions are somewhat beyond government control. In Newfoundland and Labrador, for example, the name of the private-sector cannabis retailer will appear on the credit card statement, says liquor board spokesperson Greg Gill.
“The whole data piece, from domain name registration to credit card information, anything that might fall into federal U.S. hands, I can see how that would be a matter of concern, for sure,” he says.
(Interac debit card data is “processed, encrypted and stored in Canada,” Interac spokesperson Sandra DeCarvalho wrote in an email. Interac’s privacy policy makes no mention of data crossing borders. )
At the U.S. border, enforcement is getting more intense
As attitudes toward marijuana have softened on both sides of the border, attitudes at the border itself have hardened, warns Len Saunders, an immigration lawyer in Blaine, Wash. Saunders is now seeing a flood of Canadian clients who want help with waivers related to marijuana after being banned for life by U.S. border officials.
“I see one or two cases a week now,” he says. “I used to see one or two a year. I’m almost seeing one a day, and that’s just me. It’s like a tidal wave of cases. I’ve never been so busy in my life doing waiver applications.”
Saunders says he has three Canadian clients, senior executives in an agricultural equipment company, who were banned for life when they tried to cross the border to do a sales demonstration of a marijuana bud trimming machine.
“All three admitted that they were selling this legal product to the marijuana industry. All were banned from the U.S. on the basis of reason to believe that they are involved in the drug trade. That’s how low the threshold is. They weren’t even involved with the product (the marijuana itself).”
Saunders and Railton both say they have no idea how U.S. border officials will react to legal marijuana in Canada.
“We really need the United States, and particularly the Department of Homeland Security, to issue a policy statement about how they’ll handle the fact that Canada legalizes,” Railton says.
Saunders recently appeared as a witness at Canada’s Senate national security and defense committee, which was holding hearings about border-related marijuana issues.
“Within a few days, I got an email from the U.S. embassy in Ottawa wanting me to discuss these issues with the embassy, because now the embassy is concerned about the thickening of the U.S. border,” he says.
“I’m sitting there thinking: ‘You guys are just discussing this now, when it’s almost legalized? It should have been discussed two or three years ago.’”
“I haven’t got a straight answer, or anything in writing, to give guidance when it does become legal in Canada, whether Americans are going to look at that favorably or not. You’d think that if it is legal in Canada it’s not going to create border crossing issues, but I’ve yet to have someone say ‘There’s no issue here.’ That’s the big question mark.”
