Originally published by High Times
By Adam Drury
Canadians aren’t so into paying for cannabis on credit. And Canada’s federal privacy commissioner says you probably shouldn’t anyway. Instead, Commissioner Daniel Therrien is recommending extreme caution when it comes to putting pot purchases on plastic, telling consumers that it’s probably better to just pay with cash. Because while cannabis is legal across Canada, consumer credit card data is almost always housed across the border. And that means records of an activity that’s lawful in Canada end up on servers in countries, like the United States, where it isn’t.
Canadian cannabis consumers prefer cash, debit over credit
The cultural transformation that’s taking place because of marijuana legalization is raising privacy concerns in unexpected places. And Canadian cannabis consumers may have a sense of the way their purchasing habits put them at risk.
According to cannabis sales data, Canadian buyers vastly favor paying for weed with cash or debit card over paying with credit. In New Brunswick, for example, just 16 percent of all in-store cannabis purchases were made with a credit card. Instead, consumers made half of their purchases with a debit card, and 34 percent paid with cold, hard cash.
It’s a phenomenon that’s specific to cannabis, market analysis say. Indeed, there were more than twice as many (34 percent) credit card alcohol purchases in New Brunswick, with just 26 percent of consumers using cash.
So why aren’t Canadians buying cannabis with credit cards? Privacy.
Canada’s privacy commissioner warns buying pot with a credit card could have consequences
Canada’s medical and retail cannabis industries has had some high-profile privacy problems recently. In November 2018, a major privacy breach impacting thousands of consumers hit the Ontario Cannabis Store. The breach exposed the names, shipping addresses and order dates of more than 4,5000 Ontario Cannabis Store customers who ordered weed online—which requires a credit card.
Then, in March of this year, another massive data breach exposed the private information of roughly 34,000 medical cannabis patients. The breach allowed unauthorized access to an electronic medical record system, not dissimilar to the transaction record systems credit card companies use.
Canada’s medical cannabis laws include broad protections for patients to shield them from discrimination and ensure access to their medicine. Still, workers have faced sanction, discrimination and other consequences despite those protections. In some jobs, no-tolerance drug policies override Canadian’s legal right to buy, possess, and consume cannabis.
These data and privacy breaches have understandably raised concerns among cannabis consumers. And privacy officials have acknowledged that those concerns are not misplaced. They’re reminding customers that cannabis is illegal in most jurisdictions outside of Canada, making cannabis consumers’ personal data and sales records extremely sensitive information.
Legal cannabis purchases show up on bank and credit card statements. Receipts often identify the specific cannabis product and the quantity purchased. And while there haven’t been any instances of malicious data use, the possibility is tough to rule out.
Most major credit cards house data on U.S. servers
When credit card data is stored on U.S. servers, it’s possible for U.S. officials to access it without a warrant. And U.S. law bars anyone who “abuses” cannabis—which in this context, means buying even a single joint—from entering the country.
To avoid that risk, consumers are using debit cards, since bank information stays in Canada, or simply resorting to cash. In fact, concerns over privacy are so high that in places like Ontario where recreational sales have for the most part been online, per capita sales are lower than in provinces with more brick-and-mortar shops.
