Photo of Griffen Thorne

Griffen is based in the Los Angeles office of Harris Bricken and focuses his practice on corporate and transactional law as well as on data privacy and California cannabis law compliance.

HR 420 marijuana blumenauer

On Wednesday, January 9, 2018, Representative Earl Blumenauer (D-Or) introduced the aptly designated H.R. 420, or the Regulate Marijuana like Alcohol Act. The bill is still so new that it’s not yet up on Congress’ site, but the apparent text for the bill can be found online.

H.R. 420, if passed in its current form, would remove marijuana from the Controlled Substances Act’s scheduling. The law wouldn’t allow complete legalization without regulation. It still makes clear that bringing cannabis into a jurisdiction would be unlawful where it would violate the laws of that jurisdiction. Instead of full-scale legalization, the bill would require the Secretary of the Treasury to establish a permitting scheme which could, like state law, involve different permits for each different kind of cannabis activity. It’s not yet totally clear how this would play out for permit holders in states with current regimes, i.e., whether they would have to get federal permits and/or what criteria they’d be held to.

Interestingly, these federal permits appear to last indefinitely until suspended and can be transferred if the transferee makes a timely request. There are of course disqualifying convictions, but those appear to be relatively narrow and exclude federal or state offenses if the underlying conduct was lawful in the state where the conviction was rendered. The bill also makes clear that applicants couldn’t get permits that would violate state law (this is an interesting flip where federal law bows to state law) or if an applicant wasn’t likely to commence operations within a reasonable period or maintain them in accordance with federal law.

One other interesting component of the bill is that it would transfer jurisdiction from the Attorney General over marijuana to the re-named Bureau of Alcohol, Tobacco, Marijuana, Firearms, and Explosives. The bill would also give the Food and Drug Administration the same authority over marijuana that it has over alcohol. The bill would also give the Treasury Secretary the authority to regulate certain elements of marijuana advertising to ensure that it was not false or misleading.

Ultimately, the bill leaves more unsaid than said, and if it is ever passes, it will be up to the regulators to figure out the mechanics. It’s not certain that this bill will go anywhere, especially in such a tumultuous and chaotic time. However, the approach of regulating marijuana more or less like alcohol, similar to what many states are already doing and with an element of federal oversight, is a compelling idea. Stay tuned to the Canna Law Blog for more details and updates.

california cannabis final regulations

Yesterday afternoon, on January 16, 2019, the California Office of Administrative Law (“OAL) finally approved the sets of final regulations under it had been reviewing after submissions from the California Department of Public Health (“CDPH”) which regulates cannabis manufacturers, the California Department of Food and Agriculture (“CDFA”) which regulates cultivators, and the Bureau of Cannabis Control (“BCC”) which regulates distributors, retailers, event organizers, and testing laboratories. You can find the final regulations here.

The three sets of regulations follow on the heels of final proposed regulations that the CDPH, CDFA, and BCC submitted to the OAL for its review in December. We will be providing some overview of the key components of the final regulations shortly, but it looks upon initial review like these regulations adopted most or all of what was submitted for review in December.

These regulations are “final”, meaning cannabis operators and applicants no longer need to worry about discrepancies between emergency regulations (which as of now are no longer effective per the OAL’s statement) and whatever version of proposed regulations were then out in the ether. But though these regulations are “final”, we’re pretty positive that there will be changes and modifications—probably on a more incremental level—in the future.

Stay tuned to the Canna Law Blog for further insight and analysis into these final regulations and any final regulations that will come.

california hemp CBD
We’ve got you covered on California, hemp, FDA and CBD.

A few months ago, I wrote a blog post about the precarious state of industrial-hemp derived CBD in California. Since then, as everyone knows, President Trump signed the Agricultural Improvement Act of 2018 (or “Farm Bill”). A lot of people think that in the wake of the Farm Bill, hemp-derived CBD (“Hemp CBD”) is now completely legal. This is in many cases a wildly inaccurate misconception—especially in California. Now, the legal status of Hemp CBD is arguably even more confounding than it was then. And it was pretty bad.

What did the 2018 Farm Bill Actually Do?

Before getting into California Hemp CBD laws, it’s important to discuss what the new Farm Bill even changes. If you follow us here at the Canna Law Blog, you know we’ve written pretty comprehensively on this topic. For a brief overview, the 2018 Farm Bill modified the Controlled Substances Act (the “CSA”) to exempt hemp from the definition of marijuana. Not only is hemp now clearly excluded from this definition and thus not a scheduled drug, but states and tribes also cannot prohibit the distribution of hemp. However, as I explain below, that doesn’t necessarily mean hemp or Hemp CBD can be sold without state restrictions.

The current Farm Bill also gives the U.S. Department of Food and Agriculture (the “USDA”) authority to oversee state hemp regulatory programs. For example, states and tribes must submit plans to the USDA for implementing regulatory schemes, and these plans must be approved by the USDA. In the event that they aren’t, the USDA can implement its own plan.

One other interesting component of the Farm Bill is that crop insurance coverage could be extended to hemp, meaning hemp crops could actually gain federal insurance. In a state like California that is prone to natural disasters, this is critical.

These aren’t all the changes that the new Farm Bill brought along, but they are some of the key ones. Now, on to California.

Hemp CBD in Food/Beverages in California

Over the summer, the California Department of Public Health (“CDPH”) issued its now infamous FAQs (the text is here), which took the position that:

[A]lthough California currently allows the manufacturing and sales of cannabis products (including edibles), the use of industrial hemp as the source of CBD to be added to food products is prohibited. Until the FDA rules that industrial hemp-derived CBD oil and CBD products can be used as a food or California makes a determination that they are safe to use for human and animal consumption, CBD products are not an approved food, food ingredient, food additive, or dietary supplement.”

Under California law, “food” is defined as “[a]ny article used or intended for use for food, drink, confection, condiment, or chewing gum by man or other animal” and “[a]ny article used or intended for use as a component of any article designated” in the foregoing definition. What this means is that the CDPH views anything that counts as food or drink that’s intended for human or animal consumption as unlawful.

On an important side note, the Medicinal and Adult-Use Cannabis Regulation and Safety Act (or “MAUCRSA”) defines “cannabis” to exclude industrial hemp (and therefore doesn’t regulate industrial hemp), and instead incorporates provisions of the California Health and Safety Code which leave the regulation of hemp cultivation to the California Department of Food and Agriculture (“CDFA”). The CDPH expressly cited this issue in MAUCRSA back in response to the 45-day comment period for its proposed regulations to note that the CDPH doesn’t have jurisdiction over regulating industrial hemp. This doesn’t mean that the CDPH can ban hemp in other things (like manufactured cannabis, see below), but it just means that under MAUCRSA, the CDPH can’t start issuing hemp regulations.

Back to the main story, it was pretty clear after the FAQs were issued that the CDPH wouldn’t continue to tolerate sales of foods or beverages with Hemp CBD for long. But we weren’t aware of any sort of enforcement efforts or actual regulations by the CDPH regarding Hemp CBD in foods or beverages. However, after the Farm Bill wound its way through Congress but before Trump signed it, there was some question on whether the Farm Bill would negate the CDPH FAQs.

A few days before the Farm Bill was signed, I wrote a post predicting that the 2018 Farm Bill would not do away with the FAQs. This was because the FAQs are based on the CSA’s prohibitions on hemp as well as the federal Food and Drug Administration’s (“FDA”) stance that Hemp CBD foods are not permissible. The Farm Bill changed the CSA, but not the position of the FDA.

In fact, while the ink from Trump’s signature on the Farm Bill was still drying, the FDA issued a statement (see here) telling companies to pump the brakes and that it still regulates hemp and CBD in at least medicines and foods. In an accompanying Q&A document, the FDA takes the fairly unequivocal position (see response to Q.13) that it is illegal to introduce into interstate commerce food that has CBD in it.

So what is going to happen now? As noted above, we aren’t yet aware of any enforcement actions in California. We’re also unlikely to see any sort of new guidance from the feds during the shutdown or in the immediate future thereafter. But localities may be taking a very different approach.

For example, the L.A. County Department of Public Health’s Environmental Health Division (“LADPH”) published an undated PDF concerning industrial hemp in food and saying that the LADPH will begin actually enforcing them: “Effective July 1, 2019, prohibited use of industrial hemp derived products in food will be considered adulterated and cited by [LADPH] as a violation resulting in a deduction of two (2) points on the official inspection report.”

This is one of the first instances we’ve seen of a county taking an official enforcement position on CBD food products, and interestingly comes on the heels of the L.A. Department of Cannabis Regulation (“DCR”) creating an attestation (which I wrote about here) for businesses who sell hemp products to advise that those products don’t fit within the legal definition of cannabis.

Now it seems like we have our first glimpse of what is going to happen when companies sell CBD foods or beverages. While this is only in L.A., we can assume that other counties will follow suit and may be even more aggressive in their pursuit of these hemp CBD food companies.

What is much less clear though is what this means for simply manufacturing or distributing food products that contain hemp CBD. The CDFA’s website Q&As still say that “California law does not currently provide any requirements for the manufacturing, processing, or selling of non-food industrial hemp or hemp products.” It seems like we will need to wait and see what the final answer is.

Licensed Cannabis Products

Cannabis products will generally contain at least some level of CBD naturally. But what about adding CBD from an industrial hemp source to a manufactured product under the Medicinal and Adult-Use Cannabis Regulation and Safety Act? Well, the CDPH (which governs the manufacture of all cannabis products in California) says no.  In the proposed final regulations (no. 40175(c)), the CDPH states pretty clearly that, “A manufacturer licensee shall only use cannabinoid concentrates and extracts that are manufactured or processed from cannabis obtained from a licensed cannabis cultivator.” With this regulation, the CDPH has effectively cut Hemp CBD out of the manufacturing process altogether.

Alcohol Products

In 2018, the California legislature passed a piece of legislation that prohibits cannabis or alcohol licensees from introducing Hemp CBD (or THC) to alcoholic beverages. You can read more about that here.

Dietary Supplements and Medicinal Products

The FDA’s statement makes clear that it will retain jurisdiction over CBD products making medicinal claims, and the accompanying Q&A (see response to Q.12) says that the FDA views dietary supplements containing CBD as unlawful. That said, the FDA notes that there is at least a path towards FDA approval. For what it’s worth, the FDA’s not all talk—see the case of Epidiolex (and see subsequent statement by California’s Attorney General, Xavier Becerra, on Epidiolex). Also, the same day that it issued the statement discussed above, the FDA issued a companion statement listing as generally recognized as safe (“GRAS”) hulled hemp seed, hemp seed protein powder, and hemp seed oil. The FDA is making clear that it’s willing to work with the CBD industry, but it will probably not be cheap.

Vaporizers and Other Products

We recently wrote a comprehensive post about Hemp CBD in vape cartridges. What we said then still holds—it’s a grey and undefined area. This is probably another area that the FDA may eventually regulate given its similar work with nicotine-based vape products. But given the shutdown and just the general speed of regulators, we’re unlikely to know anytime soon.

For what it’s worth, the FAQs are only tailored to food, but it’s possible that regulators could view all products containing Hemp CBD intended for human consumption as unlawful. This seems a bit less likely to happen right away because the CDPH and other agencies have had ample chance to do this but haven’t. But it’s certainly possible, and we’ll make sure to keep you informed of any developments.

Cultivation

We know that at least for cultivation, California’s recent bill SB-1409 (which we’ve written about here and here) was intended to create an application and registration scheme for cultivators. Now that the Farm Bill will require states to submit plans to the USDA for hemp production, it’ll be interesting to see what happens with SB-1409.

Packaging and Labeling

Anyone in the California cannabis game knows that the packaging and labeling regulations are tough, ever-changing, and hard to comply with. The point of these laws seems straightforward—regulators want people to know what they are consuming, and to ensure that cannabis products are properly labeled so that people don’t unwittingly ingest cannabis. They also want to avoid false and misleading claims in labeling.

Because CBD products in California are either in grey or quasi-illegal areas, things aren’t so clear. There aren’t specific packaging and labeling laws for it here, so people who still are selling these products are operating in a labeling wild west. This is different from states like Oregon or Indiana, which have actually begun to figure out how some CBD products should be labeled. We published a post recently on the complexities of and in many cases lack of instruction for hemp labeling laws at the FDA level—and the fact that there may not be guidance for another year or two.

The FDA’s Q&As (see response to Q.15) note that in deciding whether to institute enforcement actions, the FDA will now consider factors, such as “agency resources and the threat to public health.” This may be the FDA’s way of saying that in light of its limited resources, it’s going to spend its enforcement power on those companies selling dangerous products or making false or misleading health claims. One thing we do already know is that the FDA has already sent warning letters to companies that have marketed CBD as new drugs, in the FDA’s view. So in post-shutdown mode, we may see the FDA step in more aggressively on enforcement, especially for products and claims that it views as unlawful.

With the passage of the Farm Bill comes the possibility of a completely new playing field for industrial hemp producers. It appears that the question of whether IRS Code 280E (which prohibits deductions for any amount paid or incurred in carrying on any trade or business that consists of trafficking in a Schedule I or II controlled substance under the CSA) will apply to hemp producers is now settled.

But what about issues like banking or federal intellectual property protections? While it seems like these may be a reality soon, the answer is not as clear cut. If the FDA starts using its enforcement powers against companies that make Hemp CBD foods, for example, it’s certainly possible that banks will still stay away from those companies or that the USPTO won’t register their trademarks. It’s all too soon to say how this will play out, so stay tuned to the Canna Law Blog.

It may seem difficult to understand why cannabis, which is still prohibited federally, is at the state level treated more liberally than Hemp CBD. But the reason is clear—there are strict regulatory testing and quality assurance requirements for cannabis, there will be a track-and-trace system in place to ensure that only white market sources are used, and there are tight packaging and labeling rules that create uniformity in how cannabis products are identified to consumers.

That level of regulatory security doesn’t really exist yet for Hemp CBD and so regulators and lawmakers are naturally more concerned about products that they cannot trace, that may not be labeled at all, and that have undergone zero testing. When Hemp CBD is regulated more like cannabis, regulators may very well relax some of their positions.

Stay tuned to the Canna Law Blog as we will be sure to follow and interpret each and every development in this complex and fast moving space.

california cannabis packaging labeling
You simply must reconsider your packaging and labeling.

In early December, California’s cannabis regulators released their proposed final regulations. If the regulations aren’t changed, it’s expected that they will take effect at some point this month, or shortly after. These regulations have some pretty important changes from the current readopted emergency regulations. One of the notable areas of change is the packaging and labeling requirements. In spite of some of the changes, there is almost no grace period for compliance. If the regulations go into effect as is, requirements could change overnight.

For some background, the regulations between the agencies permit manufacturers to package and label manufactured cannabis products such as vape cartridges or edibles, and distributors to package and label cannabis flower. Retailers are not permitted to do any labeling. In large part, this will remain unchanged. But the requirements for different license types will change significantly.

First is child-resistant packaging, which is the only major packaging change that has any kind of transitional period. The proposed final regulations of the California Department of Public Health (“CDPH”), which regulates manufacturers, postpone the child-resistant packaging requirements until January 1, 2020. The Bureau of Cannabis Control (“BCC”), which regulates a number of license types including distributors and retailers, likewise will not require distributors to package cannabis goods in child-resistant packages. However, retailers are forced to ensure that any products sold on their premises are in child-resistant exit packaging until 2020, at which point the manufacturers will need to start providing child-resistant packaging.

Second, the specific labeling requirements will change, and most dramatically for manufacturers. There will be a number of specific changes, including:

  • For manufacturers, if product containers are separable from the outermost packaging (i.e., a product container is inside of a box), then the product container must also contain certain information that would be required on the outermost layer. For edibles, topicals, suppositories, and orally consumed concentrates, all primary panel information—with the exception of the cannabinoid content—must be on the product package. For inhaled products (i.e., dab, shatter, or wax), the Universal Symbol must be stamped on the product package.
  • The manufacture regulations include specific primary and informational panel label requirements for pre-rolls and packaged cannabis flower that are similar to the requirements for manufactured cannabis goods, which must provide certain information, have the universal symbol and government warnings, and identify the cultivator of the flower.
  • For packaged manufactured goods, the DPH will no longer require primary paneling to include THC and CBD content. Instead, the proposed rules state that cannabinoid content “may” be placed on the primary panel packaging. The DPH will allow distributors to label packaging with the correct cannabinoid content after required laboratory testing. Cannabinoid content labeling will include very specific requirements that will vary from product to product.
  • The DPH is prohibiting labels for edibles to contain pictures of the food product inside the packaging, and from making false or misleading claims that products are organic.

Crucially, other than the child-resistant packaging requirements, there will be no transition period in these proposed final regulations. The packaging and labeling rules in earlier emergency regulations included explicit transitional periods for prior modifications, but the proposed final regulations of both the CDPH and BCC specifically delete these transitional period requirements.

What the lack of transitional periods means is that these proposed regulations will change labeling requirements overnight if they are implemented. This will create major issues for distributors and retailers who have products in their possession that suddenly don’t conform to the new final regulations.

For example, retailers cannot accept or sell products except as they will appear in their final form and cannot do any packaging or labeling themselves. This means that products must be labeled in accordance with BCC and CDPH standards. If a package or label is suddenly insufficient, then retailers may be prohibited from selling those products.

Distributors may be in a similar bind. While distributors can package and label cannabis flower, their ability under these proposed final regulations to package or label manufactured cannabis products is very limited: They essentially can only correct labels’ THC content if testing confirms it was inaccurate. The regulations don’t seem to allow distributors, for example, to add required warnings that are not present on packaging.

In sum, if these regulations become final, there may suddenly be a host of products that overnight are not compatible with the regulations. And because these regulations may become final very soon, getting products into compliance now is critical.

On January 1, 2019, the City of Pasadena in Northeastern Los Angeles County will open up its 30-day window to apply for one of six retail, four cultivation, or four testing facility permits. These 14 licenses will be highly coveted and sought after, and the winners will not be derived from a lottery system, but selected instead on scored applications. For anyone looking to get licensed in Pasadena, it’s going to be a busy month and an uphill battle.

Licensing in Pasadena is based on the June 2018 approval of local ballot measures CC and DD, which allow these limited permits and establish local taxing regimes. These ballot measures set hard caps on the license types as noted above. Unless Pasadena elects to allow more license types or licenses at later dates, this one-month window will be the only time to apply for commercial cannabis licenses in this city. And where the majority of California cities and counties still ban commercial cannabis activity, having Pasadena come online is a big win for overall legalization.

Notably, section 17.50.66 of the Pasadena Municipal Code precludes businesses from being licensed within the same building or even within 500–1,000 feet of one another, depending on the license type. In other words, Pasadena won’t be allowing combined license types in the same building or even anywhere near one another (which is much stricter than applicable state laws). Nor will it allow manufacturing or distribution, so there won’t be complete vertical integration for businesses in the near future in Pasadena.

Pasadena’s official screening information can be found here. To summarize, Pasadena will require information about owners of the business and about the proposed business generally. This includes detailed operations and security plans, statements of the owners’ previous experience, and statements of how the proposed business would be compatible with the surrounding community. The paper applications will have a hard cap of 100 pages. If you tried for a license in West Hollywood earlier this year, this should all sound very familiar.

Every aspect of these written plans will be reviewed based on scored criteria (found here). This scoring, in combination with the detailed plan requirements and page limitations mean that applications will need to be both comprehensive and polished. Pasadena will be evaluating these applications for owner experience, and if the applications are not well done or formatted properly, they may be dead on arrival.

Applicants may be tempted to approach this like a lottery as there are relatively few spots open. But this process will be very different from a lottery, where putting together a quick application or using a lot of the same boilerplate materials from other applications may be in the applicant’s best interest. Here, Pasadena has made pretty clear that it wants to see top-shape applications from folks with business acumen and industry experience. It’s even more important to ensure that applications are as perfectly formatted and complete as they can be, as the fee is a whopping $13,654 per permit.

Our L.A. cannabis business attorneys expect many Pasadena applicants, as there were with other popular L.A. cities with very limited license openings, and which awarded on a merit basis. For anyone who is applying in Pasadena, sharpen your pencils. January’s going to be a busy month.

FDA CBD Industrial HempYesterday, President Trump signed the 2018 Farm Bill, paving the way for industrial hemp legalization. Within hours, the U.S. Food and Drug Administration (“FDA”) Commissioner, Scott Gottlieb, issued a statement clarifying the FDA’s position on industrial hemp.

The FDA’s position: Just because industrial hemp is legal doesn’t mean that you can put it in food or call it medicine.

Gottlieb was quick to point out that even though the Farm Bill modified the Controlled Substances Act, the FDA still retains the authority to “regulate products containing cannabis or cannabis-derived compounds under the Federal Food, Drug, and Cosmetic Act” (or “FDCA”). Gottlieb went on to state that the FDA fully intends to exercise that authority:

[I]t’s unlawful under the FD&C Act to introduce food containing added CBD or THC into interstate commerce, or to market CBD or THC products as, or in, dietary supplements, regardless of whether the substances are hemp-derived. This is because both CBD and THC are active ingredients in FDA-approved drugs and were the subject of substantial clinical investigations before they were marketed as foods or dietary supplements. Under the FD&C Act, it’s illegal to introduce drug ingredients like these into the food supply, or to market them as dietary supplements. This is a requirement that we apply across the board to food products that contain substances that are active ingredients in any drug.”

Moving on, Gottlieb was careful to point out that the FDA is open to taking steps to clearing pathways for those who wish to seek FDA approval—as it did for Epidiolex. And in fact, the statement incorporates yet another statement by the FDA issued yesterday which concluded that the FDA “has no questions about Fresh Hemp Food’s conclusion that the following ingredients are GRAS under their intended conditions of use: hulled hemp seed (GRN765), hemp seed protein powder (GRN771), and hemp seed oil (GRN778).”

But Gottlieb was careful to cite, in general terms, a number of different kinds of conduct by companies selling products containing CBD that, according to the statement, are unlawful. These include things like claiming CBD or cannabis products cure diseases prior to undergoing FDA approval. And Gottlieb noted that the FDA will not hesitate to warn consumers and even initiate enforcement actions. In that sense, status quo prevails.

What does this mean for California? We’ve written pretty extensively on the California Department of Public Health’s FAQs which take the position that industrial hemp derived food products are unlawful. In fact, we wrote just days ago that the Farm Bill was unlikely to change the core of the FAQs.  The FDA’s statement from yesterday in combination with the FAQs seem to hammer home that in California, CBD in food products will not be considered lawful unless the FDA and CDPH say otherwise.

2018 has been a roller coaster for California cannabis businesses. The cannabis laws and regulations in California have made life difficult, to say the least, for anyone wishing to obtain licensure. This isn’t necessarily the fault of any single legislature, municipality, or agency, but instead was the result of a perfect storm of legal and non-legal issues.

The beginning of the year saw the opening of adult use licensing under the Medicinal and Adult Use Cannabis Regulatory and Safety Act (or “MAUCRSA”). Businesses that sought licensure could apply as of January 1, 2018 for an annual application. In theory, this could have been simple, but it turned out to be far more complex than anyone probably intended.

One provision in MAUCRSA that has been the bane of any applicant’s existence is the requirement to have local approval when applying for an annual (or temporary) license. What this means is that applicants couldn’t apply for state and local licenses concurrently; instead, they had to apply for and obtain full local approval first, and then move onto the statewide licensing. Localities have been all over the map in terms of how they process applications, which means that it could take months between finding an eligible parcel of land and even starting the process of applying for state licensing.

Many cities (for example, Los Angeles) have created complex, phased licensing schemes that meant that certain applicants couldn’t even apply until late in the year. (For Los Angeles, the final, third phase won’t even open until some undisclosed time in 2019.) It’s understandable why larger cities would want to phase their application processes—but for operators, this posed a pretty big problem in terms of delays to apply for annuals and the temporary license deadline.

And regarding temporary licenses, MAUCRSA set up a scheme to allow for temporary licenses that last for 120 days and could be renewed for 90 days. The intent appears to have been to allow operators with local approval to start engaging in business while applying for annual licenses. For reasons that in hindsight appear to not make too much sense, these temporary licenses could only be issued during 2018.

This end-of-2018 cutoff meant that applicants needed local approval prior to the cutoff date so that they could obtain temporary licenses while awaiting the very, very slow annual license application process. But the problem was that cities were so backlogged—or in some cases hadn’t opened all phases until too late in 2018. To solve this issue, many localities started providing applicants with local approval letters late in 2018, and there was a bottleneck in applications in November and December.

Additionally, over the summer, the California legislature, recognizing the delay in processing local approvals (some of which was caused by environmental disasters and other forces that nobody drafting MAUCRSA probably anticipated), created a new kind of “provisional license” to be issued through 2020, which is similar to the temporary license but will last longer. This could have been a saving grace for applicants who were delayed by phasing or other local issues into late 2018. However, the legislature expressly required that an applicant for a provisional license had to have obtained a temporary license at some point in 2018. In other words, the provisional license scheme really only benefits those who were already first in line in 2018.

Separate from these licensing issues, the regulations have undergone numerous and drastic changes many times in 2018. For example, in October 2018, the Bureau of Cannabis Control (“BCC”)—which regulates distributors and retailers, among other things—issued modified proposed regulations that seemed to ban many IP licensing agreements and vastly broaden the ownership definitions in requirements in a manner unlike the other California cannabis regulators. It appears that some of these expansions may have been drawn back in subsequent proposed final regulations. But these many rounds of proposed or emergency regulations have imposed a lot of stress on applicants already under the stress of the foregoing application process.

This is only a short post and we can certainly point out many more areas in which the cannabis industry in California undergone growing pains this year.  We intend to write soon about what 2019 will look like for applicants, but suffice it to say, for those who don’t have temporary licenses, there will be more delay.

farm bill hemp california cbdThe federal 2018 Farm Bill is likely to become law in the very near future. If it does, it will redefine the hemp industry nationwide. We intend on writing more in the near future as to the specifics of the 2018 Farm Bill, but one interesting question is what effect it will have on California’s industrial hemp and CBD policies.

As anyone in the California hemp business knows, the Department of Public Health (“CDPH”) issued a FAQ policy guideline over the summer which took the position that industrial-hemp derived CBD in food products is unlawful. The FAQ justified this position in part because the federal Controlled Substances Act included industrial hemp as a Schedule I drug, and in part because the federal Food and Drug Administration (“FDA”) had concluded that it was unlawful to place THC or CBD into food products.

The 2018 Farm Bill, if it passes, will essentially amend the Controlled Substances Act to take industrial hemp out of the definition of marijuana. In essence, this would make industrial hemp derived products lawful products. The question then is: Will the 2018 Farm Bill negate the FAQ?

The answer is probably not. Even though the Controlled Substances Act may be amended and some of the underlying support for the FAQ may be undermined, that won’t change the fact that the FDA has not concluded that CBD in food products is lawful. While the CDPH certainly could change its position, the de-scheduling of industrial hemp won’t necessarily change the FDA’s positions right away. In the meantime, it’s safe to conclude that the FAQ still stands.

Ultimately, the 2018 Farm Bill is likely to have far-reaching impacts throughout the industrial hemp industry. We’ll make sure to keep you updated along the way.

california cannabis litigation
We see litigation in the California industry’s future.

Because California’s cannabis regulatory scheme is still in relative infancy, 2018 has looked the same for most operators: applying for annual licenses and waiting (and then continuing to wait) for them to issue or fighting to get temporary license applications submitted before they can no longer be issued. But what happens in two or three years after hundreds or thousands of commercial cannabis licenses have been issued? A host of administrative and civil litigation, probably.

California’s cannabis regulators have immense power that’s not just going to disappear after they issue licenses. The Bureau of Cannabis Control, which regulates a number of different license types, arguably has more police power than the actual police. Section 5800 of the BCC’s readopted emergency regulations, for example, gives the BCC “full and immediate access”, without prior notice, to enter premises, inspect cannabis or vehicles, and copy books and records, and failure of a party to comply with a BCC investigation can be subject to discipline.

Not only do the agencies have broad investigative power, but the subject matter of what they can investigate—all the various regulations that companies have to comply with—is immense. The regulators are not going to sit around and assume that licensees are following the law, the regulations, or even their own operational plans submitted with their applications—they are almost certainly going to use their investigative power to root out non-compliant operators. This should come as no surprise as the BCC, for example, has already taken some action against allegedly unlicensed cannabis operators. Our cannabis lawyers in other states with older licensing schemes have already seen targeted agency investigations and enforcement actions.

There are really endless ways that the agencies may choose to investigate or enforce their regulations, but it’s safe to say that they will prioritize enforcement against unlicensed operators. They may also go after some other easy targets—selling to underage persons, violations of advertising or delivery regulations, track-and-trace non-compliance, and so on. Rest assured, too, that administrative rules will continue to evolve, and licensed businesses that do not keep up on compliance will also be vulnerable.

Not only are the next few years likely to see an increase in administrative actions, but they are also likely to see a swath of civil litigation between licensees and internally. With the development of so much new technology and other intellectual property, we expect to see a good deal of trade secret and other IP litigation. Prop 65 and other forms of false advertising litigation are likely to continue as well. And internally, members of cannabis companies may start to bring lawsuits against each other or their companies for a number of reasons—from simple things like alleged mismanagement of company assets to fraud in soliciting investors.

The future of the California cannabis industry isn’t entirely certain, but it’s likely going to involve a lot of time before arbitrators, judges and other dispute resolution officiants.

cannabis data breach
Cannabis businesses may be especially vulnerable.

Virtually everyone knows about breaches of companies like Equifax. Massive breaches have happened to established, mega-companies who still took major reputational and monetary hits after they were breached. What many people don’t realize is that it doesn’t take a major breach to devastate a business. We don’t want to be dramatic, but we also don’t want to downplay the significance of breaches—they are coming, and cannabis companies that are not prepared may be left in the dust.

Data breaches can range from anything from malicious hacking to the simple loss of a laptop containing unencrypted “personal information”. In either case, if statutorily defined classes of personal information were accessed or acquired without authorization, the party who held the personal information must provide written notification to the affected individuals within a relatively short period of time, and in many cases to other services like credit monitoring. This may seem like a straightforward process. It is not. Just figuring out what kinds of information may have been accessed and whose information may have been accessed could take tens of thousands—if not hundreds of thousands—of dollars in forensic review.

Take the following example: A human resources manager is the victim of a phishing attack. Typically, forensic review of the affected account may need to be undertaken to determine what part of the manager’s email accounts were accessed—did the attacker review one email, or access the entire mailbox? If the forensic vendor determines that the entire account was or could have been accessed, the entire account may need to be “data mined” at a high per-gigabyte cost to see whether emails contain personal information that could require reporting. This could potentially involve tens of thousands of dollars in expenses for one account. Now imagine this happens to five employees.

Not only is this piecing together of events time consuming and expensive, but it only gets half the job done. Once a list is made of the affected individuals and reportable information, notification (often drafted by lawyers) needs to be provided to individuals. This requires engaging companies to ensure that the individuals live where they are thought to live, and to physically mail notification letters out. Then, usually at a certain price per enrollee, credit or identity theft monitoring is provided.

It’s not difficult to see why this process is expensive, and the fact that it needs to occur in such a short period of time can cause intense pressure on an enterprise. To boot, in many states, attorneys general need to be given notification if a certain threshold of citizens of those states were notified of a breach. These attorney generals can (and sometimes do) request detailed summaries of how the breach happened and can even bring administrative actions against the companies who were the victims of the data breach.

Breaches are not unique to the cannabis industry —the Breach Level Index (“BLI”) estimates that more than 14 billion data records have been lost or stolen since 2013, with an average frequency of an astounding 6.9 million records per day. However, this industry is particularly susceptible to data breaches and their damaging effects for many reasons. Here are a few examples:

  • Companies may not be willing to report breaches to federal authorities like the FBI or IRS, who otherwise would likely be notified, in light of the federal illegality of cannabis. Malicious actors may believe that this gives them some sort of advantage—and to some extent it does if law enforcement is not given notice.
  • Given the state of banking in the cannabis industry, cannabis businesses may use cryptocurrency, which could have keys that are stored on electronic devices that are capable of breach. This could expose a cannabis business to financial losses unlike in virtually any other industry.
  • The reputational harms to an up-and-coming licensee could destroy a cannabis business. Even though many of the stigmas around cannabis have gone away, many people wouldn’t want their employer or the general public to know that they bought cannabis. Imagine what a government employee would think if a cannabis business was the victim of a breach and his or her employer suddenly could find out about the employee’s purchase history. That business probably would not last.
  • The industry is forced to interact with technology in a way that many others are not. In California, as well as most other states with licensing regimes, cannabis companies must implement track-and-trace systems to monitor all commercial cannabis activity. Licensees of the California Bureau of Cannabis Control (“BCC”) are legally prohibited from transporting, transferring, or delivering goods during outages of track-and-track systems—i.e., doing most kinds of business. What happens when they are the victim of a ransomware attack (a situation in which a hacker encrypts all computer systems and demands compensation in cryptocurrency or something similar in exchange for the decryption key, which may take days or weeks to fully restore)? Businesses could literally bleed out while trying to negotiate with–or pay a ransom to–someone across the globe.
  • State attorneys general may need to be notified of certain data breaches. If an attorney general in a state in which cannabis was not legal receives notice that a number of the attorney general’s home state citizens were the victims of a data breach, that attorney general may want to target that cannabis business with an enforcement action.

These are just a few of the unique pressures the cannabis industry faces.

Breaches are in many senses inevitable. There is still a lot that companies can do to reduce the impact of them or to attempt to prevent them. Below are a few:

  • Having a privacy policy and sticking to it. We’ve written about the need for policies before, and the potential penalties for not complying. We get the sense that a lot of cannabis businesses think of this as unnecessary or just a rote copy-and-paste job. This is not accurate. These policies are detailed, and are designed to identify the information gathering and usage policies of an organization. If an organization follows a policy, then it should in theory know what information it has, and where. This could be the difference in whether significant time and resources are spent tracking down potentially accessed information.
  • Complying with relevant information security standards. Many states actually require businesses to adopt certain standards when it comes to information storage. Technical measures can be adopted to reduce the likelihood or impact of breaches.
  • Planning for breaches. Training employees, and having plans for what to happen in the event of a breach, could also avoid or lessen the impact of a breach.
  • Considering insurance. Insurance companies are starting to provide cyber liability insurance, which could cover the costs of some breaches. This won’t actually prevent a breach, but may stop a company from spending significant amounts of money in response to a covered breach.

The point of this post is to highlight just how significant breaches can be for cannabis businesses. Preparing now, rather than after they occur, could avoid a great deal of issues later.