The Privacy Commissioner of British Columbia wants the province’s cannabis and liquor retailers to better protect their customers’ information. This news comes off the back of two reports, one in 2021 and another in 2022, that examine the collection of customers’ private information by retailers in BC.
The results of the 2021 report prompted calls from the Office of Information and Privacy Commissioner for BC (OPIC) to cannabis and liquor stores in BC asking them to improve their oversight of private information collected from customers and employees. It also included 18 recommendations on how these retailers could achieve this.
While the OPIC says they are pleased with the subsequent efforts by cannabis and liquor retailers in the province to ensure the privacy and security for their customers, they also stated that there is much room for improvement.
The 2022 Follow-up Report
The newest report—published on June 7, 2022—is a follow-up to the 2021 report and reveals that several retailers have “considerable work to do in order to ensure the privacy and security of the personal information they collect” and that this information “is kept in accordance with the law.”
The original 2021 report analyzes 15 cannabis stores and 15 liquor stores across BC and contains 18 recommendations for retailers to follow in order to properly fill the gaps identified by OPIC. According to the 2022 report, some retailers do have processes in place to protect the personal information of their customers and staff. However, many were completely unaware that they were collecting people’s personal information in the first place.
Additionally, the 2021 report reveals that a small number of the surveyed retailers collect biometric information from staff, customers, or both. In one case, a retailer even informed inspectors that they use facial recognition as part of their surveillance system, something that OPIC says is prohibited.
Other types of data collection mentioned in the reports includes asking for customer ID and personal details gathered by online sales which may include a person’s IP or home address as well as credit card numbers. Many of the retailers also lacked a privacy officer or privacy policies for the information they possess, or staff training to help manage the information.
Welcome Improvements
Covering 29 of the 30 stores from the original report, the 2022 follow-up thankfully notes significant improvements and efforts to address these and other concerns.
OPIC’s report notes that 70% of the recommendations from the 2021 report have been fully implemented while 22% have been partially implemented, meaning retailers had made some progress to incorporate the recommendations into their own privacy management program. The Information and Privacy Commissioner for BC will continue to follow up with retailers in the future to ensure compliance moving forward.