Cannabis NL online customers have been asked to consent to the transfer of their data from servers in Canada to servers in the United States – and data and privacy experts say they should think twice before saying yes. The email from Cannabis NL, the online marijuana retailer owned and operated by Newfoundland and Labrador’s Crown liquor corporation, says Shopify, the e-commerce platform that hosts the site, will transfer the data on July 31, 2022. David Murakami Wood, director of surveillance studies at the University of Queens, told CBC News that the shipment was likely to lose control. “We extract a lot of personal data from a jurisdiction, where it is relatively controlled and relatively transparent and relatively private,” he said. “We are taking it to… a jurisdiction where this is the Wild West of privacy and data protection.” Shopify did not respond to requests for comment. Newfoundland and Labrador Liquor Corporation chief marketing officer Peter Murphy said the company was notified of the transfer in 2021. He said any personal information the customer enters into the site – including names, addresses and more – will be moved to US servers. “We are confident that with the move, we will continue to have this very safe environment for our customers,” he said. According to Murphy, data transfer will also affect customers of online cannabis retailers based in other jurisdictions, such as Ontario and British Columbia. In an email, a spokesman for the Ontario Cannabis Store said customer data is still hosted in Canada. CBC News asked BC Cannabis Stores for comments. The Ontario Cannabis Store was breached earlier this year.
Possible consequences
While cannabis has been legalized or decriminalized in some states, it remains illegal in the United States under federal law. The Canadian federal government warns travelers that they may be barred from entering the United States for cannabis use or working in the cannabis industry. Yuan Stevens, chief policy officer for technology, cybersecurity and democracy at the Leadership Lab at Toronto Metropolitan University, said customers should consider U.S. privacy and data laws. “Potentially highly sensitive information, such as who buys cannabis in Newfoundland and Labrador, how much it buys, when it buys it, and people’s home addresses could be more easily accessible by U.S. government agencies,” he said. Peter Murphy is the NLC Chief Merchandising Officer and head of the cannabis project team. (Katie Breen / CBC) Murphy said NLC was looking for a new platform to host its online cannabis store when it learned that Shopify would transfer data, but found no suitable option. He said NL Cannabis seeks the consent of customers before transferring data due to different cannabis and data laws in the United States. “I can not say that there is no danger because I can not speak to the US legal system,” he said. However, Murphy said it was unlikely that Canadian cannabis users would be punished by US law enforcement. Murakami Wood said the potential consequences for Canadian cannabis users are unclear – but could be serious, especially if U.S. laws become more restrictive. “It’s not just about now, it’s about what can happen … when it comes to people’s safety and well-being in the future,” he said.
Being aware of data
Vass Bednar, executive director of McMaster University’s Graduate Program in Public Policy and Digital Society, said customers should think carefully about the information they provide on e-commerce platforms in general. “People expect smooth, seamless virtual shopping experiences, but these shopping experiences come at a special cost,” he said. Vass Bednar is the Executive Director of the Master of Public Policy in Digital Society program at McMaster University. (Submitted by Vass Bednar) He said these costs range from security to the way information is used – and possibly bought or sold. “Just because you bought it in the past, does it really need to be recorded? What’s the use of it? Do users’ payment information need to be saved?” NL Cannabis allows customers to delete their information before it is transferred. “I think deleting your information is a great option,” Bednar said. Read more from CBC Newfoundland and Labrador
