california cannabis temporary license
Hopefully, more cities are creative with this hard stop.

We recently wrote about an announcement by the California Department of Food and Agriculture (“CDFA”) that temporary license applications need to be submitted by December 1, 2018 in order to be reviewed on time for approval and issuance before December 31, 2018. To date, California Department of Public Health (“CDPH”) followed suit, but the California Bureau of Cannabis Control (“BCC”) has not. It’s safe to say that BCC applications submitted after December 1, 2018 have a low chance of being issued this year.

This is significant because after January 1, 2019, these agencies will have no legal authority to issue temporary licenses, and will not do so. After January 1, 2019, only provisional licenses will be issued, and only then to parties who hold or held temporary licenses. Parties that don’t have temporary licenses and thus cannot get provisional licenses will be stuck in the annual license logjam, which everyone knows moves at a snails’ pace. These deadlines cannot be solved with more regulations. They are from MAUCRSA and only the legislature can modify them. We wouldn’t count on that happening.

This time crunch places would-be licensees whose local applications are under review from California cities in a tough spot. As part of the state-level application process, the above-linked MAUCRSA section requires applicants to fork over “[a] copy of a valid license, permit, or other authorization, issued by a local jurisdiction”, and cities are not going to state that an applicant is approved while an application is under review.

Some cities have come up with creative solutions to this problem. The Los Angeles Department of Cannabis Regulation (“DCR”), for example, issued a release stating that it would issue to applicants from the second phase of applications (which closed a few months ago) who have paid their application fees a local letter of authorization that could be taken to the target state agency. The letter would not authorize commercial cannabis activity in Los Angeles. It would authorize an applicant to simply move into the temporary license phase, in order to eventually secure the provisional license that would eventually get them operational faster. At least one state agency, in turn, has expressed that letters from localities may be sufficient. Earlier this year, the CDPH wrote that local authorization may take the form of a “letter of acknowledgement”.

L.A. is a big city, and is swamped in applications. Our L.A. cannabis business and real estate lawyers have seen some other cities issue letters of authorization, but others that have refused. It’s not clear whether many other cities would write a letter of authorization, or what they would be willing to say. But it’s certainly worth reaching out to a city to see if they will.

As we wrote on Tuesday, the midterm elections were monumental for cannabis: Michigan voters approved of a proposal legalizing recreational marijuana for adult use, Utah and Missouri will soon establish medical marijuana regimes, and Texas Representative and marijuana antagonist Pete Sessions lost to a Democrat.

All in all, Tuesday was a good day at the state and national level. But cannabis wasn’t just on the ballot at the state or national level—many cities had measures on that would regulate cannabis in one form or another. This post discusses some of the more impactful ballot measures that won and lost in California.

california elections cannabis marijuana

To start, dozens of cities and counties in California had cannabis taxation measures, which is a good sign for the expanding market. Oakland voters, for example, approved of Measure V, which amends the local code to allow cannabis manufacturers and cultivators to deduct the value of raw materials when calculating gross receipts for tax purposes. Fresno voters approved of Measure A, which adopts a cannabis business license tax. As noted above, numerous cities had tax measures on the ballot—and they are quite literally all over the map.

El Dorado County had a number of cannabis measures on its ballot. Measures P, Q, R, and S each passed, allowing the retail sale, delivery, distribution, and outdoor/indoor cultivation of commercial cannabis for recreational and medicinal purposes. Interestingly, El Dorado County’s Measure N (a tax measure), didn’t pass.

Los Angeles County’s well-publicized Measure B, which would have established a municipal bank, failed. This was a closely watched measure in the cannabis industry, as many had hoped for a local bank in which to bank their earnings. Because the California effort to charter a state bank has cooled, local businesses may have limited options until a federal fix occurs.

Elsewhere, the City of Malibu passed Measure G, which will now allow retail sales of commercial cannabis and deliveries. Before, Malibu only allowed medicinal sales. But wait before delivering into Malibu from other cities; you’ll need a regulatory permit from the City of Malibu to do so. No word yet on what that application process will look like.

As noted above, these are just a few of the measures that were adopted (or not) on Tuesday. California, like many other places nationally, is certainly moving toward a more open marijuana landscape.

los ángeles california medical dispensary licensing
Certain L.A. dispensaries may soon be stuck in place.

Los Angeles’s existing medical marijuana dispensaries (“EMMDs”) under Measure M will soon be precluded from relocating from their current operations unless and until they receive their local annual licenses from the City of Los Angeles. Movement post-initial application to L.A. has been a common practice for  EMMDs for some time, and has apparently caused a rift with other potential commercial cannabis licensees who were effectively “zoned out” based on buffer requirements when an EMMD moved into their planned licensed territory (non-EMMD storefronts have to be no less than 700 feet from each other). The new requirement goes into effect soon—but just how soon remains to be seen.

On October 19, 2018, the Los Angeles Rules, Elections, and Intergovernmental Relations Committee (the “Committee”) held a meeting which dealt with various cannabis-related matters. Shortly before the October 19 meeting, the Los Angeles Department of Cannabis Regulation (“DCR”) submitted a letter requesting amendments to the City’s cannabis procedures, which are codified in the Los Angeles Municipal Code (“LAMC”). The letter requested that the City Council instruct the DCR to stop processing EMMD relocation requests or amend the LAMC accordingly. The DCR is concerned with EMMD relocation requests because:

In certain instances, an EMMD has re-located to a business premises within 700 feet of a location a Phase 3 applicant has secured as a potential retail business premises. Because the City does not permit a Phase 3 retailer to be within 700 feet of another retailer, in those instances, the Phase 3 applicant must abandon the location it has secured and find an alternate location. As this re-location issue may impact the Tier 1 and Tier 2 Social Equity Applicants applying for retail licenses, DCR recommends that the City Council either instruct DCR to stop processing EMMD re-location requests or amend Sec. 45.19.7.2 of Article 5.1 of Chapter IV of the LAMC to prohibit EMMD re-locations as of January 1,2019.

In other words, EMMD relocations could create a block on real estate for potential other dispensary licensees, and based on the social equity program in the City (for more on social equity, see here), the City wants to make sure that phase 3 social equity retailers get a fair shot at a more static real estate situation.

Also on October 19, the Committee issued a report that requests that the City Attorney, working with the DCR, “prepare and present an Ordinance to amend [the LAMC] to prohibit future Existing Medical Marijuana Dispensaries re-locations prior to the issuance of an annual license, and instruct the DCR to cease accepting and approving new re-location requests while this ordinance is under consideration by the City Council.”

EMMDs whose local annual licenses are still under review will thus no longer be able to change locations (unless and until they get that annual local approval)—but the big question is when that will kick in. From the text of the report, the DCR will be instructed to cease accepting and approving new relocation requests while the to-be-drafted ordinance is under consideration. It does not look like the ordinance is yet under consideration, so relocation requests may still be processed by the DCR if you get in the queue now.

One other important issue is whether relocation requests submitted before the ordinance is passed can still be approved after the ordinance is implemented–meaning, is the ordinance going to be retroactive? The text of the report suggests that the DCR’s ban will be only for new relocation requests made after the ordinance is under consideration. That said though, it really depends on what the ordinance ultimately says in the end and whether the City Attorney and DCR decide to prohibit any already-pending relocation requests.

For now, stay tuned. We will be sure to provide updates on the EMMD relocation prohibition as it evolves.

This is the second post in a series on various aspects of cannabis litigation. The title is admittedly a bit misleading, as arbitration isn’t really the same thing as litigation. That said, the two can intersect, and so understanding what arbitration is and is not, is important for cannabis businesses. After all, many contracts in the cannabis industry can include arbitration clauses.

Arbitration is, essentially, a trial before a private entity (this post only describes private arbitration and not judicial arbitration, which is different). Typically, arbitration cannot occur unless the parties have agreed to it in a contract; for example, an LLC operating agreement, sales contract, distributor agreement, intellectual property license, or any other kind of contract. The parties can use this contract to dictate the terms of the arbitration and how it will proceed. That said, below are a few of the features that are common to almost any arbitration:

cannabis litigation arbitration marijuana

Who Presides: In private arbitration, there are no juries. Instead, the parties pay a private arbitrator or arbitration company. Arbitrations are presided over by at least one arbitrator, who is generally a former judge or attorney. In some cases, there can be a panel of arbitrators who decide a dispute. Arbitrators are almost always neutral, meaning that the parties cannot communicate with them outside the presence of the other parties (there are some cases in which some of the arbitrators can be “party” arbitrators).

Anyone who has spent significant time in a court room knows that judges have intense caseloads—sometimes hundreds of active cases at any given time. On the other hand, arbitrators typically have less-intensive caseloads. This means both that arbitration can proceed more quickly and that the arbitrator(s) can devote more time to and gain more understanding of each case.

Arbitration Setting: In private arbitration, there is no court room. Instead, arbitration hearings take place in private facilities provided by the arbitrator or arbitration company. It’s not uncommon for an arbitration to occur in something that looks more like a classroom or board room than a court room. While an arbitration can feel a bit less formal, it is key to remember that arbitration is still an adjudicative and adversarial proceeding.

Private Nature: Arbitration is, again, private. This is very different from litigation, where almost every facet of a case is published or can be made public unless there is an order of the court to “seal” certain records. Parties to arbitrations don’t necessarily need to keep things confidential—it’s just that way by design. That said, they certainly can agree to strict confidentiality provisions above and beyond the non-public nature of arbitration.

Procedural and Evidentiary Rules: In court litigation, there are rules of procedure and evidence set forth in a number of different places. For example, in federal litigation, the process is governed by the Federal Rules of Civil Procedure, a district court’s local rules, and rules set forth by the individual judge. Evidence is received according to the Federal Rules of Evidence. In state court, there are typically a number of different evidentiary and procedural rules that will govern any proceeding.

Unlike in court proceedings, the procedural rules and rules of evidence are slimmer. Arbitration forums often have their own rules, which will generally apply by default unless the parties elect to follow the federal or state rules in their arbitration contract. Arbitration rules are generally much more compact than federal or state rules, and based on the private nature of arbitration, there are usually no cases discussing how those rules are to be applied. The result of this process is that arbitration proceedings can seem less formal.

Arbitration is not Mediation: One common misconception is that arbitration is or is similar to mediation, when the two are in fact very different. Mediation is a typically non-binding process in which parties come together in front of a third-party neutral (the mediator) to discuss their case with the intention of settling it. Arbitration is similar to a trial, and if it proceeds to the end, will result in an award to one party (which can be filed in court), rather than a settlement. The only important similarities are the presence of a neutral, and the fact that many arbitration companies employ arbitrators and mediators (often, the same people do both kinds of work).

This all sounds great, right? You may be asking why would someone would ever want to litigate, when they could just arbitrate faster, with less-intense rules, in front of a focused neutral who could devote more time to the dispute? It may come as a surprise that parties in a dispute often seek to avoid arbitration. One of the chief concerns is cost—because arbitration is private, parties need to pay the arbitrators, on top of their attorneys. This additional cost can be overly burdensome for some private litigants and is likely a major concern for smaller businesses. Another concern may be the private nature of arbitration. There may be a host of reasons why one party to an arbitration wants the dispute to not be kept private. And finally, there are generally no options for appealing an unfavorable arbitration decision. These are just a few of the reasons that parties may want to avoid arbitration.

As mentioned in the beginning of this post, arbitration and litigation can overlap. Parties to disputes sometimes file cases in court in spite of arbitration provisions. In such circumstances, the other party may file what’s called a “motion to compel arbitration”, and the other party could resist arbitration by arguing that the arbitration agreement is void, or that the dispute at issue is outside the scope of the arbitration clause. In California, for example, we have an additional law that permits a court to delay or even avoid arbitration if there are parties to a court case and a separate arbitration, if there would be a risk of an inconsistent outcome or factual finding. This is a very powerful tool for a party who wants to resist arbitration in multi-party disputes and, in many cases, it is available unless disclaimed in the arbitration clause.

In sum, what an arbitration clause says is powerful and will dictate how any dispute is resolved. When negotiating any contract, the dispute resolution procedures may be an afterthought for some, which can end up costing the parties later down the road. That’s why its critical to put serious thought into arbitration clauses and engage counsel who is experienced in drafting and reviewing such clauses.

For more on cannabis litigation, see our series here.

Hemp and Hemp-CBD in California is wild right now.

As readers of this blog know, California is on its way to developing robust laws governing the sale (and all other aspects) of cannabis and cannabis products. So, it’s somewhat surprising that California’s laws concerning the sale of industrial hemp and hemp-derived cannabidiol (“hemp-CBD”), to the extent they even exist, are all over the map. And in some cases, selling industrial hemp or hemp-CBD is apparently unlawful, in spite of the fact that it may contain just trace amounts of THC found in California-legal cannabis products and despite the fact that that hemp-CBD is coming from Farm Bill-sanctioned sources.

Our California cannabis lawyers often get asked what the requirements are for selling industrial hemp or hemp-CBD in California. This post tries to explain California’s convoluted regulation of industrial hemp and hemp-CBD.

As a baseline, “Industrial Hemp” is legally defined as parts of the Cannabis sativa L. plant, or derivatives of that plant, containing less than .3% THC. The Medicinal and Adult-Use Cannabis Regulation and Safety Act (“MAUCRSA”) specifically defines “Cannabis” to exclude Industrial Hemp. The Health and Safety Code echoes this sentiment, and also states that the California Department of Food and Agriculture (“DFA”) exclusively regulates industrial hemp.

The Food and Agriculture Code, which the DFA enforces and interprets, includes some provisions regarding industrial hemp—but notably that Code contains nothing concerning its sale. We have been monitoring (here and here) California’s SB-1409, which modifies these parts of the Food and Agriculture Code, but again there are no requirements concerning actual sales (for what it’s worth, you can also read more about the expiration of the federal 2014 Farm Bill here). Even the DFA has recognized that “California law does not currently provide any requirements for the manufacturing, processing, or selling of non-food industrial hemp or hemp products.”

The message here then is that there are no regulations governing the sale of industrial hemp or hemp-derived CBD. There are, however, some other pretty important requirements at the legislative, policy, and even local levels that could affect hemp and hemp-CBD businesses across the state:

  • Legislation: California recently passed legislation banning licensed cannabis or alcoholic beverage companies from selling alcoholic beverages that contain cannabis, or cannabinoids derived from industrial hemp. Stay tuned for in-depth coverage of that in another post.
  • Policy: Over the summer, the California Department of Public Health’s Food and Drug Branch (“FDB”) drafted a FAQ taking the position that “the use of industrial hemp as the source of CBD to be added to food products is prohibited.” We don’t yet know what FDB’s enforcement measures will look like, if anything, but it’s pretty clear what its position is on hemp-CBD in food and drinks.
  • Local Level: This is where things get dicey. As anyone familiar with cannabis law knows, every one of the hundreds of cities and counties in California has different laws on cannabis licensing. One common requirement for any business in most municipalities is to have a form of business license—and this may be an area in which local jurisdictions create specific industrial hemp and hemp-CBD requirements. For example, the Department of Cannabis Regulation (“DCR”) within the City of Los Angeles recently published an “attestation” form that hemp business owners must sign under penalty of perjury, certifying that their hemp-CBD or industrial hemp products meet the definitions of the Health and Safety Code, and that those products are not “cannabis”. This is now apparently a requirement for Los Angeles hemp businesses that wish to obtain local business licenses, and it looks like that’s the only hemp/hemp-CBD “regulation” that the City of Los Angeles currently has on the books.

Overall, the bottom line is that we still lack the critical legal infrastructure for industrial hemp and hemp-CBD in California. We don’t know how the state or localities will enforce the FDB FAQ. We don’t know how the state will regulate hemp-CBD sales. We don’t know how the locals will regulate hemp-CBD businesses, if at all.

So, stay tuned, as we’ll be sure to write about new California hemp and hemp-CBD laws as they come.

california bcc cannabis rules
Huge changes ahead. Get your comments in by Nov. 5!

Last Friday, we wrote about the amended proposed permanent cannabis regulations that are now in a 15-day notice-and-comment period for each California agency—the Bureau of Cannabis Control (“BCC”), Department of Public Health (“DPH”), and Department of Food and Agriculture (“DFA”). Each of the proposed rules can be found here, here, and here. The next round of written public comments is due to each agency by November 5, 2018. It’s important then for California cannabis businesses to get a handle on the proposed regulations as quickly as possible to determine whether to provide written comments since some impactful changes are coming.

Here are the key proposed changes from the BCC regulations:

Intellectual Property Licenses: Yesterday, we explained the threat that the BCC’s regulations pose to cannabis intellectual property licensing in California. Our California cannabis lawyers are regularly involved in intellectual property licensing deals and we think it’s critical for cannabis businesses to speak up in opposition to this proposed rule. California would be the only state in the cannabis union to bar third-party IP-licensing deals for cannabis licensees, which will certainly undercut the business growth of a good amount of operators if this rule passes.

“Owners”: The BCC modified the definition of “owner” (as well as “financial interest holder”; see below), which now includes “[a]n individual entitled to a share of at least 20 percent of the profits of the commercial cannabis business.” This is much broader than the existing 20 percent aggregate ownership threshold (which also still stands). To illustrate, the current ownership threshold definition expressly states that it does not apply where that interest holder holds “solely a security, lien, or encumbrance.” This new addition to the rules seems to capture a mere security holder—so long as that security holder is entitled to 20 percent of the profits.

The BCC also expanded upon the form of “ownership” that requires disclosure based on assumption of responsibility for the license, by specifying certain kinds of persons or entities who qualify (note that this list is not exhaustive or complete, so it likely will be read even more broadly), as:

  • Persons who manage or direct the licensed business in exchange for a portion of the profits. Note, there is no minimum threshold for profit entitlements here, so this could include persons who expect less than 20 percent of the profits.
  • Persons who assume responsibility for the licensed business’ debts. Here too, there is no threshold for debt assumption.
  • Persons who determine how “a portion” of the licensed business is run. This includes things such as “non-plant-touching portions of the commercial cannabis business such as branding or marketing”, but it too could include much more broad categories of business operations.
  • Persons who determine what cannabis goods will be cultivated, manufactured, distributed, purchased, or sold.

Notably too, these modifications now take the position that if an “owner” is an entity, all entities and individuals with a financial interest in that entity must be disclosed to the BCC and may be considered owners of the commercial cannabis business. The BCC emphasized that each entity and person in the corporate chain must be disclosed until the applicant can identify actual persons.

The takeaway from these changes is that the BCC now wants full identification of any person who has anything to do with an applicant entity—even if that person simply owns a company multiple steps away in a corporate chain. That is not dissimilar to what our cannabis business lawyers have seen in Oregon and Washington.

“Financial Interest Holder”: Like before, the BCC considers a financial interest to include an agreement to receive a portion of the profits of a licensed entity. Now, however, the BCC gives a number of examples of what qualifies as such an agreement:

  • An employee who enters into a profit-share plan with a licensee.
  • A landlord who enters into a lease agreement with a licensee for a share of the profits.
  • A consultant who provides services to a licensee for a share of the profits.
  • A person who acts as an agent, such as an accountant or attorney, for the licensee for a share of the profits.
  • A broker who engages in activities for the licensee for a share of the profits.
  • A salesperson who earns a commission.

The BCC will now also require the identification of all persons in the corporate hierarchy for interest holders, similar to the rules regarding owners. Meaning, if a financial interest holder is an entity, everyone in that entity is getting disclosed .

Annual License Fees: The BCC scrapped its previous test for determining the amount of appropriate fees for the annual licenses—estimating the maximum dollar value of planned operations—and now has created a new formula: “To determine the appropriate license fee due, the applicant or licensee shall first estimate the gross revenue for the 12-month license period of the license.”

Changes in Ownership: The BCC is also expanding its prohibition on changes of ownership over a licensed entity. If any new person is added as an “owner” by virtue of a change in ownership of a licensed entity, that person will need to provide the vast categories of information required by section 5002(c)(20) within 14 calendar days of the transfer. This will obviously have an impact on California cannabis M&A. The business can still operate pending the change so long as one previous owner remains on; otherwise, operations will need to cease pending the BCC’s review of the new owner. The BCC is also now requiring 14 calendar days’ notification of changes in any of the following:

  • Any changes to the contact information that was provided to the BCC in the original application;
  • Any change in legal name, business name, trade name, or fictitious business name of the licensee;
  • Any change to financial information, including funds, loans, investments, and gifts required in the original application;
  • Any change in the required bond; or
  • Any change or lapse in a distributor’s insurance coverage.

Annual License Applications and Requirements: As to annual licenses, the BCC made tweaks to the information that it will require for submission, which signals its desire to place more scrutiny on applicants and ensure compliance with California law. We won’t explain every change here, but here are the essential ones:

  • First, the BCC changed the requirement to provide it with “The business-formation documents” for the licenses business to “All business-formation documents”.
  • Second, the BCC is requiring that applicants provide it with state employeridentification numbers (“SEIN”), which the BCC explains in its notice of modification as being “necessary to ensure that all applicants that are required to obtain such a number have obtained it and are thus, in compliance with California law.”
  • Finally, licensees with more than one employee must attest that within one year of receiving their license, the licensee will have employees who have undergone certain Cal-OSHA safety training.

The BCC is also beefing up its requirements for renewal of licenses to require documentation of any change to any item listed in the original application. So, chances are that if a cannabis business obtains an annual license before these proposed changes become effective (and assuming they do), that business will need to provide these additional disclosures later.

Premises: There are a number of modifications to the proposed rules concerning licensed premises, but here are the highlights:

  • While it’s been routine for multiple licensees to operate on the same premises, the proposed modifications now expressly state that they do not “prohibit two or more licensed premises from occupying separate portions of the same parcel of land or sharing common use areas, such as a bathroom, breakroom, hallway, or building entrance.”
  • The premises must consist of permanent structures—shipping containers, modular buildings, or anything on wheels are a no-go—that are affixed to the ground and not capable of movement.
  • There is now a form (BCC-LIC-027) to submit to the BCC to request to make a physical change or alteration to the premises.

Marketing and Promotions: Licensees will be prohibited from selling or transporting goods that are identified as any kind of alcoholic product (and they cannot refer to anything as containing or being an alcoholic product). There are also now definitions for promotional goods and branded goods. If licensees want to sell branded goods that are not listed in the definition, they will need to seek BCC approval first. The proposed modifications also clarify that licensees can provide customers with promotional non-cannabis goods—and it looks like these goods could be provided at the premises or via delivery, too.

Packaging: The proposed modifications set up a time tier for cannabis packaging, whereby until January 1, 2020, cannabis packaging needs to be tamper-evident, in some cases re-sealable, and must not look like packaging that is marketed to children. Until January 1, 2020, retailers and microbusinesses can satisfy this rule by providing opaque exit packaging that meets the foregoing standards.

Testing and Quality Assurance: The proposed regulations include prohibitions on re-sampling previously tested batches, new requirements for remediation plans for failed batches, and new requirements for quality assurance testing for the level of THC, CBD, and terpenoids, among other things. If goods have undergone testing and haven’t been sold in 12 months, they now  have to be destroyed.

Retailer Packaging: Similar to the revised distribution rules, the proposed modifications set up a time table that require tamper-evident packaging until January 1, 2020, and re-sealable, tamper evident, and child-resistant packaging thereafter. There are opposite requirements for retailer exit packaging—it must be child-resistant, re-sealable and opaque until 2020, and then just opaque thereafter.

Deliveries: The rules now more heavily regulate a retailer’s use of tech platforms for delivery (i.e., the platform can’t share profits and can’t be the one doing the delivery, presumably unless it too is licensed). Delivery vehicles cannot contain any exterior markings that indicate that they are delivering cannabis goods. Delivery vehicles may now carry only $5,000 in cannabis goods at once. And the biggest change of all, per the modified section 5416(d), deliveries can be made into any jurisdiction in the state, so long as they comply with the BCC’s delivery rules. Currently, localities can and do prohibit deliveries from other jurisdictions. The BCC’s proposed regulations, however, now open the floodgates to previously “dark” delivery jurisdictions.

For the next few days, we’ll be writing on the proposed rules issued by DPH and DFA. We cannot emphasize enough how licensee stakeholders need to speak up and provide public comment for the rules they like and don’t like so that industry can better shape the regulatory playing field. So, get those comments in by November 5!

california cannabis regulations
Here we go again!

This morning, the California Bureau of Cannabis Control, California Department of Public Health, and California Department of Food and Agriculture issued 15-day notices of modification to the texts of their respective proposed regulations. The California Cannabis Portal has published links to each notice and the modified texts of the proposed regulations. For each set, the respective Department will accept written comments by November 5, 2018.

Stay tuned to the Canna Law Blog for future posts analyzing modified proposed regulations, which are extensive.

california cannabis marijuana privacy policy
No longer optional for your canna business website.

Unless you’ve been living under a rock for the past few months, you’ve probably read about the host of sweeping new laws in California, like its new Internet of Things law, cannabis privacy law, or net neutrality law, to name just a few. California has long been regarded a trailblazer when it comes to making people who are outside of California do things to comply with California law. So it probably comes as no surprise that website operators outside of California may need to comply with a privacy policy law in California: the California Online Privacy Protection Act.

Pursuant to this law, any business that owns or operates a website that advertises to, services, or in many cases is simply accessible by California residents will almost certainly need to conspicuously post (and—importantly—actually follow) a privacy policy containing statutorily defined disclosures. This requirement applies when a website collects “personally identifiable information” about California consumers, including first and last name, home or other address, email address, telephone number, Social Security number, or any other information that would permit a person to contact a website user (either physically or online). Moreover, a policy may be required even for businesses located in distant areas of the United States just by virtue of the fact that its website can collect this information.

If a company fails to create or adhere to a privacy policy and does so either intentionally or in a material and negligent way, that company may be in violation of the law. The law does state that website operators will not be in violation until 30 days after being notified that their website does not contain a privacy policy, but it does not specify where notification can come from (i.e., the state or any source), which means that reliance on this window may be risky. The law is enforced by the California Attorney General, with penalties of up $2,500 per violation. These penalties could be a severe for businesses that offer mobile apps, as the California Attorney General has taken the position that a new (potentially $2,500) violation occurs each time a non-compliant app is downloaded.

You may be wondering how this applies to your cannabis business. The fact is that there are numerous ways in which even seemingly passive websites collect protected information from and about users. Even if your website does not sell any products, it may include “Contact Us” or mailing list subscription portals which collect protected information. If your website sells or ships any sort of product, it may collect at least some protected information. Even if your business has not collected information about any California residents in the past but simply could do so, the mere possibility may mean it needs to comply.

Furthermore, there are other good business and legal reasons to post and adhere to a privacy policy. Customers appreciate when businesses are transparent about their privacy practices. For obvious reasons, ensuring that cannabis customers’ privacy is maintained is important. Additionally, in the event of a data breach which requires notification to state or federal authorities, the fact that a company took steps to maintain customer privacy may be important considerations in determining if any enforcement actions should be taken.

The good news is that, unlike some laws or regulations that cannabis companies face, California’s privacy policy law is relatively straightforward in that it specifies what a company needs to disclose in a privacy policy and how that policy needs to be displayed on a website. That said, ensuring that a privacy policy accurately describes a company’s current and future privacy practices can be a challenge, and inaccurate or gratuitous statements in a privacy policy could expose a company to additional liability. In other words, a policy needs to be tailored to a company’s specific practices, and so copying language from other privacy policies could cause even more trouble for a company.

Cannabis companies have enough to worry about. They shouldn’t add to the problem by failing to address privacy or data security laws. A good place to start is engaging counsel to draft a comprehensive privacy policy. After all, at least according to California, one is required.

cannabis marijuana IOT
Cannabis things included.

Two years ago, we published a series of posts about the cannabis industry’s embrace of the Internet of Things (“IoT”)—the network of physical objects connected through the Internet—for use in everything from garden sensors to dispensers. In that same series, we also discussed some of the potential legal risks and ramifications of using the IoT in the cannabis business—particularly some of the privacy and security risks inherent in the IoT.

Just last week, California Governor Jerry Brown approved of SB-327, the first information security law in the U.S. specifically targeting the IoT. SB-327 takes effect on January 1, 2020, and will require manufacturers of connected devices—essentially, devices in the IoT—to equip them with “reasonable” security measures. These security measures must be appropriate to the nature of the devices and information they collect and contain, and must be designed to protect the devices from unauthorized access, destruction, use, modification, or disclosure. SB-327 also requires devices that can be accessed outside of a local area network either to be equipped with a unique password or to allow a user to generate its own password.

It’s important to emphasize that SB-327 does not impose any requirements on users of IoT devices, but rather to manufacturers. So, for many businesses in the cannabis space that rely on the IoT, no real changes in operations may be necessary. Both plant-touching and ancillary marijuana companies that manufacture qualifying devices, on the other hand, may need to re-do or even re-invent their products.

It’s also important to note that the law applies to more than just California manufacturers. It applies so long as a business manufactures—either itself or through a contracting third party—qualifying devices that will be sold or offered for sale in California. Crucially, there is no threshold for product sales in California. Consequently, any manufacturer, anywhere, could be subject to SB-327.

Complying with SB-327 may be as simple as assigning randomly generated passwords to each device or re-tooling software or firmware to provide more robust security protection. But for some manufacturers—especially of devices that gather or contain sensitive information—compliance may be more involved and may require a ground-up reinvention. Consultation with counsel is always the best step towards compliance.

cannabis litigation trade secrets
Protect them at all costs!

Over the course of the next few weeks and months, we intend to write a number of blog posts about various forms of civil litigation that could arise in future in the cannabis industry. This is the first, and is focused on trade secret litigation.

For those of you who haven’t read some of our earlier posts on trade secret law, here’s a short recap of what trade secrets even are. A trade secret is virtually any form of information, formula, device, method, etc. that is kept secret, and that derives an independent economic value from being kept secret. For example, a cannabis cultivator invents a new process to cultivate cannabis more quickly. That process is valuable not only intrinsically (i.e., because the cultivator can now work faster), but also because it’s secret (because competitors will still be producing cannabis more slowly without the new process). Trade secrets are not limited to technical inventions—they can also include run-of-the-mill confidential information such as customer lists, preferred vendor pricing lists, and so on. The key is secrecy.

Trade secret protection can often be more valuable than patent protection, as trade secrets are kept secret for so long as their owners choose to keep them secret (or until they get released to the public through other means). Patented inventions, on the other hand, are immediately disclosed to the government and anyone with a computer. To boot, a patent owner loses protections after a fixed period of time.

In short, trade secret protection is a great system—if you can keep your secrets secret. But as you can imagine, that can be difficult and expensive to do—and in some cases third parties take your secrets. Thus, litigation is sometimes necessary.

There are a number of ways in which trade secret cases play out, but there are essentially two common fact patterns in the cannabis industry and elsewhere. First, an employee or group of employees leave one company for a competitor and are alleged to take its trade secrets.  Second, a company who comes out with a similar product/device/set of information, and is alleged to have stolen the idea from its competitor.

In the legal world, the theft of a trade secret by any source is referred to as “misappropriation”, and the party from whom the secret was taken can assert civil claims for misappropriation (we won’t address any criminal issues in this post). Until relatively recently, parties were forced to litigate disputes pursuant to various state laws, which are mostly relatively similar. In 2016, the federal Defend Trade Secrets Act (“DTSA”) was passed, which opened up the doors to the federal court system for many plaintiffs who otherwise would have been stuck in state court.

The remedies available under the various trade secret laws vary, but generally include, among other things, damages, injunctions (orders by a court to do or stop doing something), and in some cases, a requirement that the losing party pay the attorneys’ fees of the winning party. The DTSA also allows, in certain circumstances, a plaintiff to obtain an order to seize property that would assist with continued misappropriation of trade secrets.

Why is trade secret law important or applicable to the state-legal cannabis industry? The answer is that the industry is in its infancy, which necessarily means that it will experience great innovation and invention in the coming years—anyone with experience in the industry can attest to that. Unfortunately, and like in any other growth-phase industry, this also means that there may be an abundance of misconduct and theft. Even companies that take steps to prevent misappropriation could be the victims of it in the near future.

Navigating the trade secret landscape may be tough—especially for new cannabis businesses. Spending time and resources up-front to develop safeguards to protect from misappropriation and train employees is critical, even though it may be costly. But by that same token, litigating trade secret disputes can be even more difficult and costly. Consulting with trade secret counsel, both during the normal course of business and after any potential dispute arises, is always a good approach.