Pubdate: Wed, 12 Oct 2016
Source: Vancouver Sun (CN BC)
Copyright: 2016 Postmedia Network Inc.
Author: Dan Fumano
Page: A9


Leaders in B.C.'s retail marijuana industry responded with concerns
Tuesday to news of a privacy breach involving the website of a
Vancouver pot dispensary.

After news broke Tuesday that patients' personal and medical records
had been publicly accessible through the website of an East Vancouver
pot shop, the head of Canada's dispensary industry association said
such privacy breaches are serious concerns, but are not limited or
exclusive to pot dispensaries.

Jeremy Jacob, president of the Canadian Association of Medical
Cannabis Dispensaries (CAMCD) said patient privacy breaches have
occurred elsewhere, including a 2013 incident when Health Canada
mistakenly mailed out 40,000 letters identifying recipients as medical
marijuana users.

Jacob said: "The privacy of patients is very important, especially
when a medicine is stigmatized the way cannabis is, and CAMCD
dispensaries have a set of standards on patient privacy that we adhere

The dispensary involved with the recent breach, the Vancouver Pain
Management Society, is not a member of CAMCD, said Jacob.

Vancouver Pain Management delivered a statement Tuesday through lawyer
Robert W.E. Laurie, which also cited the 2013 Health Canada privacy
gaffe and the ensuing class-action suit for violation of privacy. The
statement said: "Hospitals and even local health authorities have
experienced the breach of private patient records recently."

Private organizations in B.C. that collect personal information are
subject to the Personal Information Protection Act (PIPA), said Erin
Beattie, spokeswoman for the Office of the Information and Privacy
Commissioner for B.C. The act, she said, explains that "when an
organization collects personal information it must take reasonable
security measures to protect it."

Beattie confirmed her office had been notified of the breach involving
the dispensary last week, and said she could not provide further
information about the active investigation.

Organizations are subject to PIPA even if they are not regulated by
government, like marijuana dispensaries. Canada' s federal government
is expected to introduce legislation next year to legalize pot, but in
the meantime, dispensaries are illegal under federal law.

Regarding the question of why a pot shop would store patients'
potentially sensitive medical records, cannabis advocate and
dispensary owner Jodie Emery said many dispensaries have traditionally
collected patient data because the government and society viewed the
use and sale of cannabis more favourably if it has a medicinal purpose.

"Collecting patient data was to demonstrate that (dispensaries) are
offering a medical service to patients, that was part of their
defence, really, that they aren't just over-the-counter (sales)," said
Emery, who said she had no specific knowledge about the recent breach.

In a public post on Twitter on Tuesday morning, Emery wrote that her
business, Cannabis Culture, which operates dispensaries in Vancouver
and other Canadian cities, is different from most dispensaries because
they don't require customers to register and do not keep customers'
personal information.

In an interview, Emery said: "We don't feel like it's right for us to
collect people's personal information, especially given that it's
still illegal and you're basically compiling a list of people who are
breaking the law."
- ---
MAP posted-by: Matt