Up in Smoke: Data Privacy in a Digital World

Legislation and technology have made it impossible to keep information in one place. Like a toppled glass of fine whiskey, it flows smoothly, and is impossible to catch or put back in the bottle.

In 1920, the temperance movement that had been brewing for a century was finally rewarded as the 18th Amendment to the U.S. Constitution was ratified, banning the production, importation, transportation, and sale of intoxicating liquors. Similar longstanding efforts in Canada, directed by influential groups such as the Woman's Christian Temperance Union, also enjoyed the success of seeing their views gain popularity among lawmakers and the social elite.

Three decades before prohibition was declared in the United States, in 1878, the Canada Temperance Act was passed, allowing any county or municipality in the Dominion of Canada to prohibit the retail sale of liquor by majority vote.

Vocal opponents of The Demon Rum had waged a tireless campaign to persuade the population that the same substance that had been used for medicinal purposes, or enjoyed with family or friends, was actually a nation-wide problem.

The public relations campaign was effective, to a degree, as lawmakers were goaded into criminalizing production and consumption of intoxicating spirits.

But as with so many things, laws are often ineffective at regulating behavior; so many people adjusted their routines but not their choices.

With a wink and a nudge, consuming alcohol was not illegal when prescribed by a doctor, and an entire lexicon of euphemisms grew to describe the activity that was suddenly illegal.

People who took on a rosy glow or made a night of it, and those who occasionally endured brown bottle flu or suffered from barley fever, wondered if they would be arrested for enjoying a tipple. And enjoy they did.

In Canada, a short-lived prohibition ended while the U.S. was still under the influence of the 18^th Amendment — creating tremendous economic opportunity for a bootlegging industry that enjoyed great success.

US gangster Al Capone built an empire bootlegging alcohol. Canadian entrepreneurs Sam and Harry Bronfman, whose family had built a distillery in Montreal in 1924, made their fortune selling liquor to American gangsters and bootleggers, often negotiating deals in Moose Jaw, Saskatchewan—a hub for rumrunners and a safe haven for American gangsters, where some local authorities provided tacit endorsement of the trade.

The competition for such a lucrative market led to increased gang activity, shootings, and murders—not unlike what Toronto, Chicago, and other major cities have experienced in recent decades as marijuana remained a prohibited substance.

The increased alcohol-related violence during prohibition caused support to wane and, in 1933, the 21st Amendment to the American Constitution was ratified. The failed social experiment that was U.S. Prohibition was finally ended.

The more modern social experiment—prohibition of marijuana—has followed a similar path, with longstanding support waning in recent years.

Gang violence and turf wars to cash in on the lucrative street drug market have contributed to the unpopularity of modern prohibition, and to the legalization of cannabis in Canada and a growing number of American states.

As their predecessors had with alcohol, physicians have been prescribing marijuana for medicinal purposes for several years—a program that, in Canada, has been carefully cultivated and closely regulated. The program provided tremendous relief to many sufferers, and was a way to test the program’s computer-based information management systems.

In 2013, Health Canada notified 41,514 people across the country about changes to the medical marijuana program. Unlike previous correspondence sent in plain brown wrappers, though, the words “Medical Marijuana Access Program” were printed on the envelope or adjacent to each addressee’s name. That breach of information resulted in a class action lawsuit, and more than 300 complaints to the Office of the Privacy Commissioner of Canada, which determined the complaints were well founded.

More recently, in preparation for the legalization of the lucrative recreational cannabis market across Canada, provinces and territories established local regimes and procedures to allow online sales of recreational marijuana.

The Prince Edward Island Cannabis Management Corporation oversees the operation of four cannabis retail locations. The Corporation also owns and operates PEI’s e-commerce platform that accepts payment by VISA, MasterCard, American Express, AMEX, and Diners Club. PEI Cannabis uses Moneris as its payment processor but does not store any credit card information on its systems.

In early 2018, the Liquor Control Board of Ontario (parent company of the Ontario Cannabis Retail Corporation) announced that it had chosen a Canadian company, Shopify Inc. (NYSE: SHOP; TSX: SHOP) to provide a cloud-based retail solution for its online and offline sales.

Alberta, on the other hand, chose OnX Enterprise Solutions, an Ohio-based company owned by Cincinnati Bell Technology Solutions, to handle all aspects of online cannabis sales on behalf of the province—that included providing personal information or copies of government-issued photo ID to facilitate age verification.

Alberta Gaming, Liquor & Cannabis (AGLC)—which is responsible for regulating private retail cannabis, the distribution of cannabis, and the operation of Alberta's only legal online cannabis store—received more than 10,000 orders on the first day of legal recreational cannabis sales.

Albertans were assured that records relating to their marijuana purchases would remain within Canada. On the other hand, the AGLC privacy policy is clear that “We will only share your information with another department if they need it to provide you a service or if it is required by law”—but offers no clarification whether that law must be an Albertan or Canadian law, or if it can be from any jurisdiction.

Adding to the quandary is the reality that most credit card purchases are processed in the United states, well beyond any protections of other nations’ privacy laws, which generally allow the disclosure of personal information without consent when it is “required by law.”

Similarly, VISA (which is accepted in more than 200 countries and territories) will “disclose Personal Information when required to do so by law... including to law enforcement agencies, regulators and courts in the United States and other countries where we operate.” As well, MasterCard (which can be used in 210 countries and territories) also shares personal information for "purposes required by law” and with "[o]ther entities as required under applicable law.”

Unfortunately for consumers, such vague descriptions make it difficult, if not impossible, to know what personal information is shared, under what circumstances,  and in which of the 195 countries in the world today.

Consumers who would rather their purchasing patterns be protected from authorities’ prying eyes might feel powerless, with good reason. Purchasers could pay in cash or use anonymous prepaid credit cards or gift cards, and retailers could create pseudonyms for customers. But tactics to remain anonymous are trumped by laws and regulations requiring that purchasers provide a plethora of personal information and, in some jurisdictions, copies of government-issued photo ID, for vendors to be able to verify a purchaser’s age.

Although the trend to legalizing marijuana in the United States is growing, there is no way to know for sure whether or which government or agency will want information about cannabis purchases—and purchasers—or what assumptions they will use that information to justify.

Thanks to the cross-border free trade of personal information by technology companies and governments alike, cannabis buyers might never know that their purchasing records have been shared with US authorities—and might be left to assume that that is the root cause if (or when) they are barred from entering the US, and see their family vacation and career prospects go up in smoke.