Buying weed online in N.L.? Your data's moving to the 'Wild West' of privacy protection, experts say

Cannabis N.L. online customers have been asked to consent to having their data transferred from servers in Canada to servers in the United States — and data and privacy experts say they should think twice before saying yes.

The email from Cannabis N.L., the online marijuana retailer owned and operated by the Newfoundland and Labrador's Crown liquor corporation, says Shopify, the ecommerce platform which hosts the website, will transfer the data on July 31. 

David Murakami Wood, director of surveillance studies at Queens University, told CBC News with that transfer will likely come a loss of control.

"We're taking out a lot of personal data from one jurisdiction, where it's relatively controlled and relatively transparent and relatively private," he said.

"We're moving it to … a jurisdiction where this is the Wild West of privacy and data protection."

Shopify did not respond to requests for comment.

Newfoundland and Labrador Liquor Corporation chief marketing officer Peter Murphy said the company was notified of the transfer in 2021. He said any personal information the customer enters into the website — including names, addresses and more — will be moved to the U.S. servers.

"We're confident, given that with the move, we're still going to have that very safe environment for our customers," he said. 

According to Murphy, the data transfer will also impact customers of online cannabis retailers based in other jurisdictions, including Ontario and British Columbia.

However, in an email, a spokesperson for B.C. Cannabis said while Shopify hosts the online platform, all information is currently hosted in Canada and there are no plans to change the location of customer data. 

A spokesperson for the Ontario Cannabis Store said customer data is still currently hosted in Canada. 

The Ontario Cannabis Store was subject to a data breach earlier this year.

Potential consequences

While cannabis has been legalized or decriminalized in some states, it remains illegal in the United States under federal law. The Canadian federal government warns travelers they may be denied entry into the United States for cannabis use, or if they work in the cannabis industry.

Yuan Stevens, policy lead on technology, cybersecurity and democracy at the Leadership Lab at Toronto Metropolitan University, said customers should take United States privacy and data laws into consideration.

"Potentially highly sensitive information, like who buys cannabis in Newfoundland and Labrador, how much they buy, when they buy it and people's home addresses could be more easily accessed by U.S. government agencies," she said.

Murphy said the NLC looked for a new platform to host its online cannabis store when it learned Shopify would be transferring data, but didn't find any suitable options. He said Cannabis N.L. is asking customers for consent before transferring the data because of different laws regarding cannabis and data in the United States.

"I can't say there's no risk there because I can't speak to the legal system in the U.S.," he said.

However, Murphy said it's unlikely Canadian cannabis customers will be penalized by U.S. law enforcement.

Murakami Wood said the possible consequences for Canadian cannabis users aren't clear — but they could be serious, especially if U.S. laws get more restrictive.

"It's not just about now, it's about what could happen … when it comes to people's safety and people's welfare in the future," he said. 

Being data-conscious

Vass Bednar, the executive director of McMaster University's master of public policy and digital society program, said customers should think carefully about the information they provide ecommerce platforms in general.

"People expect smooth, seamless virtual shopping experiences, but those shopping experiences come with a particular cost," she said.

She said those costs range from security, to the way the information is used — and potentially bought or sold.

"Just because you purchased in the past, does that really need to be on record? What's the utility of that? Does people's payment information need to be stored?"

Cannabis N.L. is giving customers the option to delete their information before it gets transferred.

"I think deleting your information is a great option," Bednar said.

Read more from CBC Newfoundland and Labrador