( Disponible en anglais seulement )
Cannabis was legalized in Canada on October 17, 2018. Since legalization, there have been a number of developments in the retail sector that will be of interest to insurers and insureds.
In particular, Ontario, Canada’s most populous province and an important Canadian retail market, has implemented legislation and regulations that govern the retail sale of cannabis. Under Canada’s federal legal structure, provinces like Ontario have independent jurisdiction to set their own rules regarding the distribution and sale of cannabis.
Ontario’s Cannabis Licence Act, 2018, S.O. 2018, c 12, Sched. 2 (the “Act”) was proclaimed into force on November 14, 2018, and O. Reg. 468/18 (the “Regulations”) was published on the same date. The Act and its Regulations set out a comprehensive licensing, sale and distribution scheme for recreational cannabis. The Province has already begun selling cannabis online, and private cannabis retail storefronts are expected to be operational by April 1, 2019.
Ontario Retail Cannabis Regulatory Framework
Overview – Ontario’s Retail and Distribution Model
The Province’s cannabis legislation has created a two-tiered system for the distribution and sale of cannabis. Online sales are the exclusive domain of the province, and are conducted by the Ontario Cannabis Retail Corporation (“OCRC”). The OCRC set up the Ontario Cannabis Store for this purpose, and remains the only legal retailer of recreational cannabis until private storefronts open under the Act.
Conversely, brick and mortar cannabis retail has been opened up to the private sector. The Act and its regulations set out a scheme that permits private retailers to run their own private cannabis retail stores.
The Province’s cannabis legislation also establishes the OCRC as the exclusive distributor of cannabis to retail entities and the Regulations prohibit private retailers from entering into cannabis distribution agreements with any other entity.
The Act also provides an out for individual municipalities if they do not want cannabis storefronts located within their boundaries. Prior to January 22, 2019, municipalities can pass a resolution prohibiting cannabis retail stores within their limits. Such resolutions can be lifted to permit cannabis retail stores at any point in the future.
Licensing Scheme
Private retailers wanting to operate a cannabis retail store are required to comply with the licensing scheme set out by the Act and its Regulations.
The licensing scheme is administered by the Alcohol and Gaming Commission of Ontario (“AGCO”), and requires private retailers to have the following licences in order to operate a storefront:
- Retail Operator Licence (“ROL”): This licence authorizes a given entity to sell cannabis at a specific location ($6,000 for an initial 2-year term);
- Retail Store Authorization (“RSA”): This licence authorizes an entity with ROL to operate a retail store (one per location) ($4,000 for an initial 2-year term); and
- Cannabis Retail Manager Licence: This licence authorizes a store manager to oversee the sale of cannabis in a private storefront (some exceptions apply for small businesses) ($750 for an initial 2-year term).
The Act limits who is eligible for these licences. Specifically, licences will not be issued to individuals who have an affiliation with organized crime, who have not complied with tax law, or who have been convicted of certain offences related to cannabis.
The Act also limits the extent to which cannabis producers can be involved in the sale of cannabis. Licensed cannabis producers and their affiliates can only be issued one RSA, and it must be for the site set out on their federal production licence. Further, corporations will not be issued ROLs if more than 9.9% of the corporation is owned or controlled by a licenced cannabis producer or one if its affiliates.
Finally, the Act and its Regulations put a 75-store cap on the number of retail stores that can be run by a single operator. This rule is part of an effort to prevent market saturation and encourage investment in the retail cannabis space.
Rules Around Storefronts
The Act and its regulations set out a number of rules for private retailers who want to operate a cannabis storefront. Additionally, the AGCO has published additional rules and requirements in its Cannabis Retail Regulation Guide.
First, cannabis can only be sold in standalone stores with their own entrances and storage. As a result, cannabis cannot be sold by multi-purpose entities like pharmacies or grocery stores.
Stores must also be 150 meters away from schools, and may only open between 9:00 a.m. and 11:00 p.m. Employees will be required to complete a governmental training program. No one under the age of 19 is to be permitted in the stores.
Private cannabis storefronts will only be permitted to sell cannabis, cannabis accessories and shopping bags. This means stores can stock products like rolling papers, pipes, bongs and vaporizers, but will not be able to sell other products, including other regulated substances like alcohol or cigarettes.
The Act also strictly prohibits private retailers from entering into exclusive promotional deals for certain brands of cannabis. Private retailers are forbidden from contracting with cannabis producers to promote their products within the store.
Liability for Breaching the Act
Failure to comply with these regulatory requirements carries liability risks for private retailers. The Act makes it an offence to sell cannabis without an appropriate license, or to enter into a promotional arrangement in contravention of the Act. Liability will also arise if private retailers attempt to sell cannabis in any setting other than a private storefront, or enter into distribution arrangements with anyone other than the OCRC. Directors and officers of corporations that commit offences will also be liable under the Act.
Conviction under the Act carries heavy penalties. Corporations are liable for fines of up to $250,000, and individuals can be subject to fines of $100,000 or imprisonment.
Privacy
The introduction of a cannabis retail scheme has privacy implications for consumers. These issues are of interest to insurers and insureds because of the significant liability that can arise for retailers in the event of a privacy breach.
Potential for Liability
Though legalized, cannabis consumption continues to be a polarizing social issue. Information about Canadians’ legal cannabis use is sensitive because cannabis is still illegal in other places. These countries could deny Canadians entry if border agents see they have purchased or consumed cannabis. This is a possibility even with close Canadian allies like the United States.
For this reason, there is likely to be particular sensitivity about any privacy breaches associated with cannabis retailers.
Litigation related to cannabis and privacy has already been filed. Health Canada is in ongoing litigation over a class action filed by participants of the Medical Marihuana Access Program. The lawsuit alleges that in 2013, Health Canada breached the privacy interests of 40,000 medical marihuana users when it sent them envelopes that listed the Marihuana Medical Access Program in the return address. The class action continues to make its way through the courts.
There has also already been a recreational cannabis-related privacy breach since legalization. In November 2018, the Ontario Cannabis Store admitted to experiencing a privacy breach when an unknown individual used the Canada Post online tracking tool to access the names and addresses of individuals who had purchased cannabis at the store online, as well as the names of the people who signed for the packages received. We are not aware of a legal action filed in connection with this breach, although one may be forthcoming.
Privacy Commissioner Advice
Given the sensitivity of the information at issue, Canadian privacy commissioners at both the federal and provincial levels have flagged a number of issues for cannabis retailers to keep in mind.
In particular, Canadian privacy commissioners have emphasized the potential risk for customers if information about their purchases becomes available in other jurisdictions. This can happen if cannabis retail transactions show up on credit card statements, or if customers receive digital communications from a cannabis retailer, like an emailed receipt or a newsletter.
As the Federal Office of the Privacy Commissioner of Canada noted, “organizations need to make it plain to individuals that their information may be processed in a foreign country, and that it may be accessible to law enforcement and national security authorities of that jurisdiction.”
In a similar vein, the Information and Privacy Commissioner of Ontario has recommended that Canadians remove information about the purchase or use of cannabis from their electronic devices when crossing the border.
With these concerns in mind, the Office of the Information and Privacy Commissioner for British Columbia (“BC Information and Privacy Commissioner”) issued a privacy guide for cannabis retailers. Many of the points in the guide will be useful for helping retailers avoid the potential liability that can arise if they fail to adequately protect their customers’ privacy.
As a general rule, the BC Information and Privacy Commissioner recommends that retailers be familiar with the privacy legislation applicable to them. As often required by such legislation, the Privacy Commissioner recommends that retailers get consent before collecting customers’ information, and that they only use it in a manner consistent with the purpose for which they collected it. Another recommendation is that cannabis retailers only record the minimum amount of personal information necessary. For example, the Privacy Commissioner notes that even if a retailer reviews an individual’s government ID as part of a purchase, there is no need to record and then store that information.
The BC Privacy Commissioner also recommends that retailers turn their mind to security, and consider the physical, technological and administrative security measures they can adopt to keep customer information secure. In particular, the privacy commissioner recommends storing any digital information on a server in Canada.
Insurance Risks
The cannabis retail sphere is a dynamic and fast-growing space. Though cannabis retail ventures can be great opportunities, they also carry a number of risks. Among other possibilities, liability can arise from failing to comply with the stringent regulatory requirements, or experiencing a privacy breach.
Insurers and insureds should be familiar with the risks associated with cannabis retail ventures, and make efforts to prevent potential liability. Miller Thomson LLP is happy to assist clients in understanding the risks present in the cannabis retail space, and to help them structure their affairs to avoid or minimize liability.
