Are Cannabis Users Protected? A Look at California's Revised Consumer Privacy Act
Posted on Apr 19, 2020On January 1, 2020 the California Consumer Privacy Act (“CCPA”) took effect. The CCPA promises, among many things, strengthened protection of consumer data for California residents, specifically in the use and sale of their data to third parties, and the right to know what that data is.[1] The CCPA was enacted in 2018, the same year California allowed recreational sale of marijuana.[2] Legalized recreational sale promised economic prosperity by expanding the cannabis industry beyond medicinal use, but with this expansion came several regulatory questions and novel issues specific to the cannabis industry—one of which is consumer data privacy. Medicinal use of marijuana has been legal in California since 1996,[3] and is protected by acts such as the Medical Information Act which requires confidentiality of a patient’s medical information.[4] But for companies engaged in the sale of both recreational and medically prescribed marijuana, additional measures to protect consumer data for recreational sales are required. At the federal level, marijuana is classified as a schedule one controlled substance making its use illegal under federal law.[5] The tension between state and federal marijuana laws make consumer privacy protections all the more significant for consumers.[6]
Under California Business Code § 26161.5, licensed cannabis companies are prohibited from disclosing “personal information” to third parties except for reasons that are needed to make the transaction (such as payment information).[7] Section 26161.5 limits personal information to the civil code’s definition of information such as name, address, and social security number.[8] However, this definition of personal information is much narrower than the CCPA.[9] The CCPA’s broader reading of the term personal information includes any “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”[10]
The CCPA has three key data requirements for businesses. The first is the disclosure of the company’s data collection and sharing practices to the consumer.[11] This means that the consumer has the right to inquire and learn about personal data the company collects. Second, the CCPA provides consumers the right to request the deletion of their data.[12] And third, it provides the consumer’s right to option out of having their data sold and/or shared.[13] This means that if the consumer does not ask for their data to be deleted, they can request for their information to remain between them and the company. In summary, these definitions and requirements create a mandate for companies who fall under the CCPA to fulfill consumer information requests about data collection—in any of these categories—and to delete or option out of having it shared with others.[14]
Additionally—and particularly of interest for the protection of cannabis users’ data—the CCPA applies only to companies that generate annual revenues of more than 25 million dollars, interact with data of 50,000 or more consumers, or derive half or more of their annual revenues from the collection and selling of consumer information.[15] Currently, most California cannabis companies fall short of the revenue figure that would require compliance with the CCPA.[16] However, despite not falling under the CCPA’s mandate, many cannabis companies are, nonetheless, taking measures to comply with the act.[17] Company executives and boards forecast that cannabis industry developments such as consolidations and mergers will lead to significant revenue increases, therefore subjecting them to the CCPA requirements. With this in mind, executives are beginning to take proactive measures by putting privacy protections in place.
The increase in demand for privacy protections will likely come from cannabis consumers. Concerns over the social stigma marijuana has historically carried may worry users when it comes to jobs and health benefits because despite its legality, some employers and agencies continue to test and screen for its use.[18] Cannabis companies will likely respond to these pressures by taking actions that closely align with the requirements of the CCPA in order to keep consumers satisfied even if they do not fall under its jurisdiction. Going forward, cannabis companies will need to carefully inspect the data they collect to understand the CCPA’s current and future applicability. For California cannabis consumers, the CCPA provides an extra safety measure needed in an industry that evolves and grows day by day.
-------------------------------------------------------------------------------------------
[1] S.B. 1121, 2017–2018 Reg. Sess. (Cal. 2018); A.B. 375, 2017–2018 Reg. Sess. (Cal. 2018).
[2] Thomas Fuller, Recreational Pot Is Officially Legal in California, N.Y. Times (Jan. 1, 2018), https://www.nytimes.com/2018/01/01/us/legal-pot-california.html.
[3] Medicinal Marijuana Laws, Sacramento County Pub. L. Libr. (last updated May 2019), https://saclaw.org/articles/marijuana-laws-in-california-edl/.
[4] Cal. Civ. Code § 56 (West, Westlaw through Ch. 1 of 2020 Reg. Sess.).
[5] 21 U.S.C. § 812. Classification of a schedule I drug under the Controlled Substance Act labels a drug as having the potential for high abuse, and does not give exceptions for medical usage.
[6] David Stauss, Analyzing the California Consumer Privacy Act's Impact on the Cannabis Industry, Husch Blackwell: Cannabis Law Now (Mar. 7, 2019), https://www.cannabislawnow.com/2019/03/analyzing-the-california-consumer-privacy-acts-impact-on-the-cannabis-industry/.
[7] Cal. Bus. & Prof. Code § 26161.5 (West, Westlaw through Ch. 1 of 2020 Reg. Sess.).
[8] Cal. Civ. Code § 1798.81.5(d)(1)(A).
[9] Id.
[10] S.B. 1121, 2017-2018 Reg. Sess. (Cal. 2018); A.B. 375, 2017-2018 Reg. Sess. (Cal. 2018).
[11] S.B. 1121.
[12] Id.
[13] Id.
[14] Id.; 21 U.S.C. § 812.
[15] S.B. 1121.
[16] Daniel Stoller, California Pot Firms Aim to Deliver Privacy Weed Users Want, Bloomberg L. (Feb. 28, 2020), https://news.bloomberglaw.com/privacy-and-data-security/california-pot-firms-aim-to-deliver-privacy-weed-users-want.
[17] Id.
[18] Cheryl Sarfaty, California Employers Wrestle with Drug Testing After Cannabis Legalization, North Bay Bus. J. (Aug. 14, 2019), https://www.northbaybusinessjournal.com/northbay/sonomacounty/9882718-181/cannabis-employment-law-drug-testing. See Will Medical Marijuana Affect My Social Security Disability Case?, Disability Guide, https://disabilityguide.com/will-medical-marijuana-affect-my-social-security-disability-case.html.