Ontario Cannabis Store Reported to Sell Postal Code-Based Customer Information to Licensed Producers

On August 30, 2019, Global News reported that the Ontario Cannabis Store (OCS) sells postal code-based data relating to online customer purchases through its Sale of Data program.  OCS’s privacy policy explicitly states that the company will not share or sell customer information to third parties.

According to the OCS, their Sale of Data program is limited "to the forward sortation area (FSA), or first three characters of the postal code”. Despite admitting to the sale of postal code-based data, OCS claims that “[n]o personal information is shared or sold, and OCS is operating in accordance with its privacy policy”. The OCS Sale of Data program is described on OCS’s Official Procurement and Information website but the website does not mention the sale of customer postal code-based data. 

Information that is not personally identifiable information is generally considered to fall outside of the scope of privacy legislation and may be shared without consent. In most cases, postal code information at the FSA level is unlikely to lead to the identification of a buyer. However, for certain low-population FSAs, there is a serious possibility that a buyer may be identified.  For these FSAs, FSA information should be considered as personally identifiable information and companies should obtain consent to share this information.  According to Ann Cavoukian, Ontario’s former privacy commissioner,

There are several [FSAs in Ontario] under 500 [people]. The potential to identify someone exists — and you don’t want to take that risk, because it’s not your information — the data subjects, the individual, in this case, haven’t been informed of this practice. There’s no notice, there’s certainly no consent[.]”

For more information, please see Global News’ website here.

Summary By: Jae Morris