Privacy commissioner investigating personal data collection at cannabis stores

P.E.I.'s information and privacy commissioner has launched an investigation to see if the new government run cannabis stores are collecting personal data from customers — and how they're using any information collected.

Commissioner Karen Rose said she decided to investigate after being informed by a member of the public that the stores are using electronic ID scanners.

"Our investigation will include any and all personal information which is being collected by the cannabis outlets," Rose said in an email to CBC News Friday. "We are also investigating how that personal information, if any, will be used, and whether, and how, it will be disclosed."

Rose said she'll also look in the security measures that are in place to protect customers' personal information.

Data found stored in device

In an email to CBC Friday, Cannabis Management Corporation (CMC) said an IT specialist examined the scanner after concerns were raised and found some data was being kept for 24 hours inside the device.

"This data was immediately wiped and settings have been changed so nothing can be kept in the future," the email said.

"The privacy commissioner has been in contact with the Cannabis Management Corporation and CMC will be fully briefing her on this matter."

However, later on Friday CMC announced it would be pulling the scanners from the stores.

'Standalone device'

Zach Currie, the director of cannabis operations for CMC, said the scanners were merely a tool to flag fake IDs and not intended to collected personal information from customers.

"Our core pillar of our customer service piece is ensuring customer confidentiality, so we don't retain any data," said Currie.

"Those ID scanners are not connected to any sort of internet. They are not connected to our Wi-Fi. They are essentially a standalone device that our folks use."

Currie said the scanner is an industry standard used in other jurisdictions to validate a wide variety of national and international identification cards.

He says staff have been instructed to scan every person's ID entering the store, even people who appear to be much older than 19 — the legal age for purchasing cannabis.

Cannabis stores 'overdoing it'

Currie acknowledges the scanning practice has prompted several questions and concerns from Islanders, including Kara MacRae, who emailed P.E.I.'s finance minister.

"I question the scanning. What is being done with the information they're collecting off the ID? Where's it going? Who has access to it? Is it protected under privacy laws? And why is that practice not taking place at the liquor stores or with people purchasing tobacco?" MacRae said.

Currie said given how new the legal cannabis industry is, and the concerns around young people getting their hands on pot, the province may be "overdoing it in some circumstances to ensure we're thought of as a retailer very focused on social responsibility."

He said the practice of using scanners and IDing everyone will be reviewed, and may be changed "in the months ahead."

The privacy commissioner hasn't said how long her investigation will take.

More P.E.I. news

With files from Steve Bruce