The Cannabis Act1 came into force on 17 October 2018. A number of newspaper articles appearing before and after cannabis was legalized in Canada raised concerns about online cannabis purchases and privacy. One concern is that the credit card statements of Canadian citizens might be accessed by United States (U.S.) authorities in order to deny them entry into the U.S.2 This concern stems from the possibility that data from online credit card purchases, including information about cannabis purchases, could end up on servers based in the U.S.3
U.S. authorities have broad data collection powers, particularly under the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 20014 (Patriot Act). As explained by the Office of the Privacy Commissioner of Canada (OPC) in an investigation case summary published in 2005:
What has changed with the passage of USA PATRIOT Act is that certain U.S. intelligence and police surveillance and information collection tools have been expanded, and procedural hurdles for U.S. law enforcement agencies have been minimized.5
Section 215 of the Patriot Act amended sections 501 to 503 of the Foreign Intelligence Surveillance Act of 19786 (FISA) to allow U.S. authorities, in certain circumstances, to collect data without the knowledge of the persons concerned. According to the wording of section 501 of FISA, as amended by section 215 of the Patriot Act, U.S. authorities can only collect data if they relate to an investigation to protect the U.S. from international terrorism and clandestine intelligence activities.7
However, the Patriot Act has been criticized on a number of fronts, including the fact that it appears to lead to a broad collection of data. It has also been criticized for being widely used by U.S. authorities for purposes completely unrelated to the fight against terrorism.8 For example, the authorities used this legislation to justify the mass interception of millions of telephone records of U.S. citizens by the National Security Agency (NSA). The telephone surveillance program, carried out without the subjects’ knowledge, was exposed by Edward Snowden and ruled illegal by the U.S. Court of Appeals in 2015.9
Since 2015, the U.S. authorities’ data collection powers under the Patriot Act have been more limited with the passage of the USA FREEDOM Act of 2015 (Freedom Act).10 One of the purposes of the legislation was to end the above‑mentioned mass interception of telephone records and make it more difficult for U.S. authorities to obtain the necessary approval to collect data under section 215 of the Patriot Act. The Freedom Act ensures greater oversight of data collection and imposes new procedural constraints.11
Angelina Mason, Chief Counsel and Vice‑President of the Canadian Bankers Association, said the following with respect to the risk that information related to the purchase of cannabis online using a credit card could be obtained by U.S. authorities:
On that point, if you’re talking about where that transactional data information is housed–let’s say for example it is housed in the U.S.–the only way that data could be accessed for the purpose of seeing whether or not you are meeting this question would be through a formalized warrant process under the Patriot Act.
I don’t anticipate that as being something that would be a real problem. I don’t think it would be applied that way. That legislation’s really intended to address cases of national importance, not an individual’s particular use of a substance.12
Indeed, there is no evidence to suggest that U.S. authorities, following the legalization of cannabis in Canada, have implemented special measures to track, by way of electronic surveillance, the online cannabis purchases of Canadian citizens. There is also no evidence that American authorities will conduct routine checks of online cannabis purchases made by Canadian citizens using a credit card with a view to preventing them from travelling to the U.S.
However, privacy risks relating to cannabis consumption and purchase may still arise when individuals cross the Canada–U.S. border.
The Government of Canada has published information to help travellers understand border rules regarding cannabis and the consequences for international travel. On its website, it informs Canadians that cannabis is illegal in most countries, meaning that “[p]revious use of cannabis, or any other substance prohibited by local law, could result in a traveller being denied entry to his or her destination country.”13
As for crossing the Canada–U.S. border, the Government of Canada states the following:
Although the possession of cannabis is legal in some U.S. states, it remains illegal under U.S. federal laws in any form and quantity, making it illegal to bring across the Canada‑U.S. border.
Previous use of cannabis, or any substance prohibited by U.S. federal laws, could mean that you are denied entry to the U.S. Canadians travelling for reasons related to the cannabis industry may be deemed inadmissible.
Do not attempt to cross the Canada‑U.S. border with any amount of cannabis in any form, even if you are travelling to a U.S. state that has legalized possession of cannabis. If you do so you can expect legal prosecution and fines, and possibly jail time.14
The Canada Border Services Agency (CBSA) also issued a brochure for travellers about crossing the border with cannabis. The brochure advises that it is illegal to take cannabis across the border even if it was obtained legally and even if the final destination is in a country or state that has legalized or decriminalized cannabis.15
The U.S. Customs and Border Protection (CBP) issued a statement regarding the legalization of cannabis in Canada. In it, CBP affirms that U.S. federal law prohibiting the use or production of cannabis continues to apply to individuals entering the U.S. despite its legalization in Canada. The agency also affirms that an arriving alien who has been determined to be a drug abuser or addict or who was convicted of an act that violates any law or regulation of a state, the United States or a foreign country relating to a controlled substance (cannabis being one) is inadmissible to the country.16
However, the statement notes that workers in Canada’s cannabis industry coming to the U.S. for reasons unrelated to the industry (e.g., a family vacation) will generally be admissible to the U.S.17
In September 2018, a few weeks before the Cannabis Act came into force, a senior CBP official, Todd Owen, said in an interview that Canadians should not expect cannabis‑related questions as a matter of routine and that border officers are not going to be asking all travellers if they have used marijuana. He nevertheless added that if answers to certain questions asked by border officers lead to inquiries about cannabis, or for instance if the vehicle smells of marijuana, officers may ask questions about cannabis use and could conduct further checks.18
Consequently, there are still some risks associated with cannabis when crossing the Canada–U.S. border, despite the fact that the purchase of such a substance is legal in Canada.
In October 2018, the Office of the Information and Privacy Commissioner for British Columbia (OIPC) released a guidance document, entitled Protecting Personal Information: Cannabis Transactions,19 which offers advice on protecting personal information during cannabis transactions.
In this guidance document, the OIPC notes that cannabis is illegal in most jurisdictions outside Canada and that the personal information of cannabis buyers and users is therefore very sensitive. It also notes that some countries may deny entry to individuals if they know they have purchased cannabis.20
The OIPC also states that providing information online, such as a credit card number, for the purpose of buying cannabis, may create additional privacy risks to the purchasers of this product, which they should consider before making such a purchase. It advises consumers concerned about using their credit card to purchase cannabis to consider using cash when the option is available.21
Finally, it recommends consumers purchase only from retailers who keep personal information related to cannabis purchases within Canada, in order to ensure greater protection of this information.22
In December 2018, the Office of the Privacy Commissioner of Canada (OPC) also released a guidance document entitled Protecting personal information: Cannabis transactions. The guidance document was adapted from the OIPC document discussed above.23
Like the OIPC’s document, the OPC’s guidance document states that since cannabis remains illegal in most countries, the personal information of cannabis users is very sensitive. It also states that in some cases, a country may deny entry to a Canadian who has previously purchased cannabis, even if the purchase was made legally in Canada.24
The OPC reminds cannabis retailers of the importance of collecting only the information necessary to complete a transaction and stresses that personal information collected should be stored securely by retailers. It provides some examples of physical, technological or organizational security measures, including locking or restricting access to locations with records containing personal information, using strong passwords and providing mandatory staff training.25
The OPC also offers some advice for cannabis purchasers:
When purchasing cannabis, do not provide the retailer with more personal information than necessary. You may need to show your identification to verify age.
If you are concerned about using your credit card, and the option is available, consider using cash to purchase cannabis.
If you are providing personal information to join a membership club or mailing list, consider the risks involved, and ask how your personal information will be stored.26
Prior to the release of its guidance document, the OPC had identified cannabis‑related risks that Canadian travellers should be aware of on its web page entitled Your privacy at airports and borders, which includes the following information:
Canadian citizens should be aware that, even after legalization of cannabis, a U.S. border agent could deem them inadmissible to the United States if the agent determines they have used cannabis, even legally.
With that in mind, you may wish to consider removing from your electronic devices any information related to the lawful use of cannabis (e.g. photos) or lawful purchases of cannabis (e.g. receipts).
You should also be aware that if U.S. officers determine you have provided false or deceptive information at the border, you could be deemed inadmissible to the United States.27
The OPC therefore seems to acknowledge the possibility that U.S. border services officers may, in certain circumstances, be able to access information related to cannabis purchases on an electronic device.
In its guidance document, the OPC highlights the risks associated with storing data outside Canada. It states the following:
Keep in mind that storing data in the Cloud or in proprietary software means there is likely transfer or storage of that personal information outside of Canada, which could then potentially be accessed by foreign law enforcement. Again, given the fact that cannabis use is not legal in most other jurisdictions, potential access to this data by foreign governments is of particular concern, which means it will generally be more privacy protective to store personal information on a server located in Canada.28
The OPC points out that if cannabis purchasers have concerns about a retailer’s collection, use, storage, disclosure or disposal of personal information, they can speak with the retailer’s privacy officer. It further suggests that purchasers ask retailers whether they store the personal information they collect on servers outside Canada and advises them to only purchase cannabis from retailers who keep customers’ personal information in Canada.29
However, concerns have been raised about the impact that the Canada–United States–Mexico Agreement (CUSMA)30 may have in Canada with respect to data storage. The proposed free trade agreement seems to prohibit rules requiring that data be stored within a member country.31
The CUSMA is not yet in force in Canada. As a result, the North American Free Trade Agreement (NAFTA) remains in effect until the CUSMA is ratified, which means until legislation is passed to implement the agreement domestically or until Canada withdraws from NAFTA.
As well, although Article 19.2 of the CUSMA, which deals with digital trade, likely prevents a member country from requiring data processing centres to be located within its borders as a condition for another member country to do business there, Article 32.1 provides an exception.
Under Article 32.1 of the CUSMA, subparagraphs (a), (b) and (c) of Article XIV of the General Agreement on Trade in Services (GATS),32 a World Trade Organization agreement, are incorporated into and made part of the CUSMA. These subparagraphs provide that, notwithstanding the requirements of the GATS, a member country may adopt and enforce legislation concerning the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts.
Therefore, a law requiring certain personal information to be stored in Canada should remain in force even if the CUSMA is ratified in Canada.
For example, section 30.1 of British Columbia’s Freedom of Information and Protection of Privacy Act and section 5 of Nova Scotia’s Personal Information International Disclosure Protection Act provide that personal information held by the public sector (e.g., medical records) must be stored and processed within Canada.33 These two laws should survive the CUSMA’s potential ratification.
As noted above, both the OIPC and the OPC advise individuals concerned about using a credit card to purchase cannabis to opt for cash payment when that option is available.
Whether the purchase is made online or in person, the way a cannabis purchase transaction appears on a credit card or bank statement may vary from province to province.
For example, unlike in other provinces, purchases in Quebec and Ontario clearly appear on bank or credit card statements as “SQDC” or “OCS/SOC,” identifying the Société québécoise du cannabis or the Ontario Cannabis Store.
In contrast, in Nova Scotia and Newfoundland and Labrador, only the acronym NSLC (Nova Scotia Liquor Corporation) or NLC (Newfoundland and Labrador Liquor Corporation) appears on bank or credit card statements, which do not specify what type of purchase (alcohol or cannabis) was made.34
Therefore, the nature and extent of the potential risk that a purchase of cannabis could create with respect to privacy may depend on the jurisdiction in which the purchaser is located.
For example, the Ontario Cannabis Store (OCS) operates an online store for the purchase of recreational cannabis. However, in November 2018, the Ontario government adopted a legislative framework to allow certain privately owned outlets to sell cannabis.35 The first points of sale began operating on 1 April 2019. Before that date, the only way to obtain “legal” cannabis in Ontario was online.36 In cities where there is a privately owned store, cannabis purchases can now be made in person rather than on the OCS website.
Since 17 October 2018, when the legalization of cannabis came into effect in Canada, there do not appear to have been any reported cases of Canadian citizens being denied entry into the U.S. specifically because of the detection by U.S. authorities of a cannabis purchase made online using a credit card.
Thus, there is nothing to suggest that as soon as Canadian citizens purchase cannabis online, they will be immediately and automatically registered or targeted by U.S. authorities and denied entry when they decide to travel to the U.S.
However, as the federal government, one of its agencies (the CBSA) and the OPC have pointed out, current or past cannabis use or purchase could effectively prevent entry into some countries where it is still illegal to use or purchase the substance, such as the U.S.
The advice provided by the OPC and its British Columbia counterpart to mitigate the privacy risks that may arise from cannabis purchases is therefore likely to be useful to Canadian citizens who purchase that product and wish to cross the Canada–U.S. border.
† Library of Parliament Background Papers provide in-depth studies of policy issues. They feature historical background, current information and references, and many anticipate the emergence of the issues they examine. They are prepared by the Parliamentary Information and Research Service, which carries out research for and provides information and analysis to parliamentarians and Senate and House of Commons committees and parliamentary associations in an objective, impartial manner. [ Return to text ]
(404 KB, 132 pages) [Patriot Act], Public Law 107–56, 115 Stat. 272, 26 October 2001. [ Return to text ] (2.5 MB, 16 pages) [FISA], Public Law 95–511, 92 Stat. 1783, 25 October 1978. [ Return to text ] (439 KB, 110 pages), Docket No. 14‑42‑cv, (2d Cir. 7 May 2015). [ Return to text ] (379 KB, 47 pages), Public Law 114–23, 129 Stat. 268, 2 June 2015. [ Return to text ] (259 KB, 5 pages), October 2018. [ Return to text ]© Library of Parliament