OTTAWA -- Canada's privacy watchdog is warning marijuana users to pay with cash rather than plastic if they're worried about the collection of their personal information.
In a statement posted on his website, Privacy Commissioner Daniel Therrien says pot sellers and buyers need to better understand their privacy rights and obligations and has suggested a number of guidelines.
"Cannabis is illegal in most jurisdictions outside of Canada. The personal information of cannabis users is therefore very sensitive," Therrien said.
"Some countries may deny entry to individuals if they know they have purchased cannabis, even lawfully."
Some Canadians have been barred for life from entering the United States after admitting to using cannabis or being involved in the legal industry.
Therrien suggests buyers can avoid the collection of their personal information by using cash instead of credit cards when buying pot from legal retail outlets.
However this option is currently not available to Canadians who have little choice but to buy online because some provinces have only a limited number of retail stores or, in the case of Ontario, no retail outlets at all for several more months.
The Ontario Cannabis Store has already reported a privacy breach through Canada Post that affected approximately 4,500 individuals last month. Information from about two per cent of customer orders was accessed by a person using a Canada Post delivery tracking tool. The incident was reported to Ontario's privacy commissioner.
Therrien says cannabis purchasers should further guard their privacy by not providing retailers with more personal information than necessary, other than what is legally required to verify their age.
Video surveillance in pot shops should only be used if less privacy intrusive measures cannot be met, Therrien says. If retailers do use video surveillance, they must notify individuals with signage clearly visible to anyone before entering the store.
Cannabis stores should also only collect email addresses, and not customer names, for mailing lists or memberships, he added.
"Private organizations are required by law to develop policies and practices to meet their responsibilities under the (law)," Therrien says in the statement.
"The best way of ensuring (compliance) is for management to emphasize that protection of personal information is a company priority and to ensure that all staff are trained in, understand, and follow the privacy policy in everyday transactions."
