Oregon lawmakers are considering legislation to protect Oregon cannabis consumers and patients against potential federal government enforcement actions. Proposed legislation, Senate Bill 863, would require marijuana retailers to purge patients’ personally identifiable information and would prohibit dispensaries from “record[ing] and retain[ing]” such information. This bill seeks to shield individual cannabis patients and consumers from federal authorities by eliminating a potentially damning piece of evidence. Oregon dispensaries currently keep much of this information, in contrast to other states where purges are commonplace by law or custom.
SB 863 defines “information that may be used to identify a consumer” to include information found on a consumer’s passport, driver’s license, or other identification document.” The information is protected whether it is on a physical copy of the identifying document or stored otherwise, such as in a customer database. Though dispensaries may collect aggregate non-identifying information, the bill would make it unlawful for dispensaries to “record or “retain” individual customer data. The legislation would further limit the spread of personally identifiable information by prohibiting dispensaries from requiring customers to produce any other form of identification.
In addition to preventing the recording of personally identifying information, the bill would also prohibit transferring any personally identifying information in the dispensary’s possession. On its face, this would appear to prevent dispensaries from cooperating with federal enforcement against customers, though it remains to be seen whether a state law requiring something like this would hold up in a federal court.
What personally identifying information does the bill not cover? The bill does not cover other forms of record-keeping that could contain personally identifying information. For instance, the bill would not prevent dispensaries from retaining recorded security footage that could include recognizable images of its customers or from capturing license plate numbers of cars coming and going from the parking lot. The bill also would not cover information received incident to credit and debit card-based transactions.
What about data retained for marketing purposes? A dispensary may record and retain the name and contact information of a consumer for the purpose of notifying them of products, services, discounts, etc. if the consumers gives informed consent. Even then, however, the dispensary may not transfer the information to another person — good news for those wary of their personal data being sold to third party marketers.
Will the bill pass? It seems likely some form of the bill will succeed and our Oregon cannabis lawyers are predicting passage. SB 863 enjoys bipartisan support and lawmakers are moving quickly to consider the proposal. Of course, the bill may change significantly as it gets through committee.
The next action on the bill should come this week of March 20, so keep an eye on this fast-moving issue.