Dispensaries in California Can Sell Your Personal Information

A bill awaiting a vote in the California Senate aims to close a loophole in consumer privacy for people buying cannabis in the state’s dispensaries that few are aware of. Assemblymember Evan Low introduced AB-2402 to the California Assembly in February and it will soon be voted on by the Senate, reports Motherboard. California, unlike some other states with recreational or medical cannabis, has no law preventing the collection or sale of consumer information by cannabis businesses.

The bill aims to fix that before the nation’s largest cannabis economy comes fully online. It would prevent dispensaries from selling customer information to data brokers without consent, and would prohibit them from refusing service to customers who decline to give their info. It would also upgrade the status of medical cannabis patients’ authorization cards to “medical information,” giving them protection under HIPAA (the Health Insurance Portability and Accountability Act).

“At best, this information can be used to target consumers with unwanted marketing materials,” wrote the Electronic Frontier Foundation (EFF), a major backer of the bill, in a letter of support. “At worst this information could be used to discriminate against lawful cannabis consumers in housing, hiring, credit, and benefits. This information would also more easily make its way into the hands of federal drug enforcement investigators.”

Indeed, medical cannabis patients have already run into issues around gun ownership, and many are afraid to join state registries because of it. Employer anti-cannabis policies are easing a bit in legal states, but there are still plenty of professions in which cannabis can earn someone a pink slip. People can also be evicted from Section 8 housing for using medical marijuana, even in legal states.

California’s medical cannabis registry is off-limits to employers and law enforcement, but the EFF warns that the amount of data being collected on patients still presents a significant risk. As evidence of this risk, they point to surveys conducted by Politifact and the Sacramento Bee, which found that almost all responding dispensaries collected detailed info on their customers, and many said that they’d refuse service to a patient who didn’t provide that information. Another concern is that cannabis sales could ultimately move online, which could be even more invasive.

Other legal states have taken steps to protect consumer privacy. Oregon recently joined Alaska and Colorado in preventing dispensaries from collecting consumer information. However, California is far and away the nation’s largest weed economy.

“California voters passed Proposition 64 because they wanted to legalize recreational marijuana, not because they wanted their consumer data exposed to their employers, family members, or others,” Assemblymember Low told Motherboard. “Good actors should be happy to comply with this bill, but as this new industry grows, more nefarious businesses will enter the market with no hesitation about profiting off the exploitation of consumer privacy.”

The bill passed the Assembly 61-5.