oregon cannabis license marijuanaRunning a cannabis business is difficult and many people fail. There are a myriad of reasons why these ventures bottom out, although owners tend to blame federal law issues first of all. It’s true that federal law creates a tough environment for cannabis businesses (banking issues, tax issues, branding issues, etc.), but federal prohibition also kept big money sidelined at first, giving small business a real head start. My personal view, after seeing many spectacular business failures and slow motion crashes over the past several years, is that most are some combination of the following: 1) a challenging legal and regulatory environment, 2) saturated markets, and 3) operator error.

A start-up cannabis business cannot control the first two items listed above, but should be able to navigate them. The third item is a different animal. Margin of error tends to be slim for most new ventures, and self-inflicted wounds are difficult to overcome. This blog post covers the five biggest mistakes we continue to see in early stage Oregon cannabis business, and gives suggestions to avoid them.

  1. Failure to properly estimate license transition timelines

Because the Oregon Liquor Control Commission (OLCC) “paused” review of applications submitted after June 15, 2018, most new market entrants are buying their way in through asset or stock sales from existing licensees. The OLCC has a small and overtasked team of change-in-ownership investigators who work with both buyers and sellers on these transactions. Recently, agency higher-ups have advised us that these changes can still happen in as quickly as four to six weeks. However, that almost never occurs. Four to six months seems more common.

Even a non-cannabis business sale can be delayed by many things, from diligence issues to lease negotiations to ironing out terms in final agreements. In the Oregon cannabis industry, administrative vetting and disclosure requirements must be added to that list. Delays are almost always on the buyer side, stemming from initial business structuring, filling out OLCC business structure and individual history forms, submitting fingerprints, etc. Buyers should create realistic timelines to avoid hemorrhaging cash during this phase, and should strongly consider working with someone who has navigated the change-in-ownership process before. It’s a singular process and there is definitely some art to it.

  1. Paying lawyers to expedite your OLCC application

This is a bad idea, but many people do it. Whether for new applications (pretty straightforward) or change-in-ownership (harder) many new businesses spend significant money on lawyers to guide them through the application process. Our Portland office philosophy has always been not to blow through client retainers on ministerial work: We want people to succeed so we can work with them for years. For that reason, we have trained licensing paralegals who push these applications through efficiently and expertly. Attorneys only come in for unusual situations. The bottom line here is that new businesses should save their legal budgets for work that cannot be done by non-lawyers.

  1. Starry-eyed forecasting

You are not going to sell your marijuana for $2,000 a pound in Oregon. Forget it. You also do not have a strain of marijuana that you will patent and license one day to big pharma. You are not the only person trying to run down hemp for distillate, and, closer to home, you should not budget a six-figure salary for yourself or anyone else in the early stage. Although the market challenges have been well publicized, too many people believe that an OLCC marijuana license is tantamount to a license to print money. It’s not. All of this means that it is crucial to dial in your research and expectations before starting out – especially if you are taking on investment and the legal risk attached to that.

  1. Employment issues

For whatever reason, employment practices are often subpar with cannabis businesses. There are a couple of important things to note here. The first is that employee actions, even if unauthorized, can lead to license revocation in Oregon. This means you must ensure your employees are well versed in compliance, and you have to watch them. The second thing to note is employment law is complex and seems to change as often as cannabis licensing rules. We have a host of new employer requirements coming online January 1, 2019 in Oregon, for example. Whenever there is a dispute, courts and administrative bodies tend to favor employees, so it’s important to keep your team in order.

  1. Bad (or no) business agreements

You do not need a tall stack of complex documents to start a cannabis business. You do need the basics, though, and those agreements should be solid. If you are renting property, get a tailored industry lease. If you are organizing an LLC, get an operating agreement that covers matters important to your business, such as management, distributions, protocol for when someone jeopardizes the OLCC license, etc. Or, if you have a white label agreement, ensure that all processes and intellectual property ownership are delineated. The list goes on.

Starting a business can be expensive, and people tend to skim on legal. But nearly all of the cannabis litigation matters my firm is currently handling stem from defective contracts, and from people operating informally in that sense. Reasonably tailored contracts should be a part of any new business plan, and they should not break the bank. These contracts will set both guidelines and expectations for the business, and they operate like insurance when things go wrong.

cannabis business contractsYou can spend a lot of money on lawyers, accountants and consultants when starting a cannabis business. There is so much ground to cover from concept to execution– especially in a complex and highly regulated industry. Related to this issue, we have written on this blog about finding a team, and we have talked about the importance of things like operating formally, staying away from generic agreements and avoiding the seemingly bottomless pit of industry scams and schemes.

Today’s blog post will cover which documents are really necessary when structuring a cannabis business, and what you may be able to do without— at least in the beginning. Note that these are general guidelines. They are not intended to serve as legal advice and every business should use its best judgment and consult with counsel on these items.

  1. Stuff you cannot do without

Articles of Incorporation or Organization

This is very basic, but you cannot have a company unless the entity has been duly registered with the relevant Secretary of State. These days, most filings in most states can be done online, although there are situations where online filings are a bad idea, like when you want to do anything nonstandard with your Articles of Incorporation (for a corporation) or Articles of Organization (for an LLC). Those situations arise somewhat frequently. For example, you may want specific indemnity provisions for your board of directors beyond what the statutes contemplate. Or you may need to outline the attributes of preferred stock your corporation plans to issue. Many state registration portals do not allow “check the box” options for this type of tailored structuring. Get a solid cannabis business lawyer to help.

Internal Governance Agreements

If you have registered a multi-member LLC, it is a bad idea to proceed without an operating agreement and without an initial set of consent resolutions. The operating agreement in particular is going to define the spectrum of voting and economic rights each member has in the company, as well as crucial operational concepts. These concepts include non-industry specific matters (what happens when the company requires more capital?) to cannabis-specific matters (what happens when a member endangers the company’s state-issued license?).

In a corporation, you are going to have a few more agreements to start. Of these, bylaws and initial consent resolutions cannot be skipped. You will also need a shareholder agreement in most instances, and you will need to issue shares to owners (certificated or uncertificated). Other items, like a voting agreement, proxy agreements, etc., may be less important for some companies and you can often skip these to start.

Lease Agreement

Even if one of the cannabis business owners also owns the real estate at issue, you are going to need an industry-specific lease. A well drafted lease will insulate the property and its owners from liability if the cannabis business fails, or finds itself in litigation. When your business is leasing from a perfect stranger, the lease becomes even more important to outline the basic terms of the landlord-tenant relationship, on everything from your rights to occupy the property, to your rights to make modifications required to obtain a license.

Employee Handbook

If you have even one employee in your new business, get a handbook together. These internal business documents serve as a key communication tool between a business and its employees. A good handbook will set forth guidelines and expectations for workers, and perhaps most importantly, it can give a broad array of legal protections to business owners, as we previously explained here.

Third-Party Agreements

If your brand new cannabis business is doing a business transaction with a third party (some frequent, early examples include loans and services agreements) make sure you have adequately papered those items. Not memorializing a business or financial relationship in writing is asking for trouble.

  1. Stuff you can probably skip (for now)

Employment Agreements

Today, all states recognize at-will employment, with various limitations. This means that a written employment agreement is not needed (or even desirable) for many types of employees. An exception may be where the employee is occupying a highly specialized or highly compensated position, or has rights to vest in ownership. But if all you are worried about is an employee having access to proprietary information, you can generally cover this in an employee handbook, or through a simple non-disclosure agreement.

Stock Purchase Agreement

Lots of cannabis businesses try to raise capital shortly after formation, or as they approach licensure. They do this by selling stock or another form of ownership in the company. In our experience, though, it’s often best to wait until the business understands exactly how much money it needs to raise, and from whom, before drafting a stock purchase agreement. In many cases funds are raised from just one or two targets, and it does not make sense to draft purchase agreements until terms have been negotiated, or even memorialized in a letter of intent or other term sheet with prospective purchasers.

Business Plan

It’s a great idea to have a business plan, but not to pay a lawyer or consultant thousands of dollars to draft this for you. There is enough publicly available information out there for anyone to put together his or her own marijuana business plan these days; and you will know more than anyone you could hire about your goals. Even if you are unsure about some of the concepts at first, doing the research needed to put this document together will go a long way in educating and setting yourself up for success.


It’s easy to get lost when starting a business, and to rack up costs on unnecessary items, or items that are less important in the near term. Focus on the basics to start, and enlist a knowledgeable cannabis business attorney to get you off the ground. The lawyer should be able to provide you estimates for basic services, and allow you to focus mostly on what matters most– running a successful cannabis industry business.

cannabis marijuana scams
DON’T BE THE MOOCH.

This morning when I went to the gym before work, I put on an NPR podcast that delved into the story of the FTC’s bust of David Diamond. Diamond is an infamous Angeleno who defrauded hundreds of people via telemarketing scams. In the podcast, the interviewee does a great job of explaining the common scammer term, “mooch.” A mooch is, according to the podcast, “… someone who will essentially buy anything from anybody who calls [them] on the telephone.”

This got me thinking about the ideal marijuana mooch since so much fraud and bad behavior is rampant in the national marijuana marketplace. We’ve covered multiple marijuana scams here, here, and here (and have written about fraud and important red flags (and red herrings) in the industry multiple times in this past).

This time however, I want to dedicate this post to the top 5 red flags of which a marijuana mooch should be aware:

1.  Anyone who tells you to invest in cannabis at all costs because you might “miss the boat.”

News flash–big alcohol, big tobacco, and big pharma are not active in the U.S. cannabis space. Even though they may be thinking about it and may have future plans for it (and even if states may already creating “Big Marijuana” interests), there’s not one single U.S. cannabis company (that actually traffics in cannabis under state licensing laws) that’s tied officially or legitimately back to these big business interests. Normally, the mooch hustle is “You’re going to miss this once in a lifetime opportunity with cannabis since the bigger companies are flooding the space already, so you better invest all you have now, now, now.” Utilize your judgment to understand that this statement is not only overblown, but it’s untrue, and the source of the information is seriously suspect, even today. In any event, before you invest cannabis, which is an extremely volatile prospect, do your homework and determine whether there’s real value at the end of the elevator pitch.

2.  Marijuana penny stocks. 

Stay away from most marijuana penny stocks. As both we and the SEC keep pointing out, many (but not all) publicly traded cannabis companies are vehicles for investor fraud. As we have written before:

It almost seems that publicly traded stock companies are more focused on selling their stocks than on competing in the market. The herd mentality of investors seems to encourage this. Here’s how that basic logic works: Marijuana is booming. Therefore, marijuana businesses must be booming. In turn, all marijuana businesses must be booming. Therefore, I need to invest in a marijuana business. The only way I can easily invest in a marijuana business is to buy the stock in a publicly traded marijuana business. And so the stocks just keep booming.

All of which leads to pump and dump scams where “the group behind the scam increases the demand and trading volume in the stock and this new inflow of investors leads to a sharp rise in its price. Once the price rise has formulated, the group will sell its position to make a large short-term gain.” Pump and dump scams with publicly traded marijuana companies are still quite popular, especially as more and more states have legalized and “medicalized.”

3.  Marijuana franchises. 

Most marijuana franchise “offers” are just plain garbage because they fail to account for all of the reporting, registration, and disclosure requirements required by federal and state franchise laws and regulations. Franchising is governed by FTC and various state agency rules. Because of the state and federal law conflict with cannabis, franchising a cannabis business is a very risky proposition, and we are finding that most cannabis “franchisors” are not providing their potential “franchisees” with nearly enough risk disclosures to really inform franchisees and their investors what they’re getting themselves into at the end of the day.

4.  Marijuana reverse mergers (ESPECIALLY CANADIAN ONES).

Seems like everyone and their mother is trying to accomplish a Canadian reverse merger in the U.S. cannabis industry. Reverse mergers are a relatively fast, cheap and easy way for a private company to “go public” without having to go through all of the SEC reporting, disclosure, and registration requirements required by a standard initial public offering. Just like penny stock fraud though, reverse merger stock fraud is nothing new. In the typical reverse merger transaction, a privately operating company seeks to acquire controlling shares in an already publicly traded company with the goal of acquiring the public company’s listing. In the reverse merger scam, the underlying publicly traded company is usually just a shell company with little or no assets or positive business history. Because the underlying publicly traded shell has no assets, no real management base, and oftentimes no business at all, the whole point of these scams is to acquire investors and raise capital based on pumped-up stock statistics, prices, and claims before everything eventually goes bust. These scams tend to involve the same subset of marginal accounting and law firms that assist by securing IRS and SEC reporting delays. Like anything else, if you’re looking at acquiring stock in a reverse merger company, do your due diligence and know the red flags.

5.  Marijuana crowdfunding.

Back in May of 2015, the SEC released new crowdfunding rules designed to let the small fry swim with the sharks. As of May 16, 2016, companies were able to solicit $2,000 from anyone (and more in many cases) in exchange for an equity stake in their business. Companies can now raise up to $1 million annually through these offerings, which fall under Title III of the 2012 JOBS Act. As we have written before, the SEC does not care whether your business is a pot business, so long as you follow its offerings rules. Though the SEC’s rules for crowdfunding advertising are incredibly strict, we know there are a wind of crowdfunding cannabis companies seeking to skirt these new rules to the detriment of investors and mooches.

Don’t be the marijuana mooch! For more on cannabis scams, check out the following:

california cannabis indemnity
Don’t skim over that indemnification clause!

Coming from Seattle to Los Angeles, I’ve already seen one state flip from being a “gray medical cannabis state” to a fully regulated licensing system and I understand how painful a process this can be. So much of what I saw in Washington State is now happening in California.

In California today, folks are jockeying for operational licenses on the state and local levels under MAUCRSA and “the cream” is rising to the top, just as it did in Washington. One-to-two-person shops and mom and pop operators are feeling the financial pinch of licensing costs and compliance woes. The secondary market for buying cannabis businesses is also beginning to open up as cities and counties solidify and stick with their local cannabis entitlement programs. Transactions between cannabis licensees are becoming increasingly sophisticated, from IP licensing agreements, to distribution agreements, to white labeling agreements, to purchase and sale agreements for inventory.

And just as happened in Washington State at the onset of legalization there, we are seeing many cultivators and manufacturers overpromising on what they can deliver, more often due to overconfidence as to dishonesty. In legal terms, this means we are also seeing cultivation and manufacturing licensees, and distributors agreeing to indemnify retailers and other licensees for everything under the sun, quite often to their own detriment. Even though the cannabis industry is maturing rapidly in California, many are still using boilerplate or Google-discovered or Legal Zoom and Rocket Lawyer contracts for these very serious transactions. This use of bad template documents (most of which are modified little if at all for the realities of the cannabis industry) has got to stop, or cannabis licensees will soon find themselves embroiled in costly and counter-productive disputes/litigation.

And that brings me to the crux of this post, which is one of the most important “boilerplate” contract provisions that absolutely must be tailored for a California cannabis contract: indemnification. What, exactly, is indemnification? It’s when one party (the “indemnitor”) agrees to hold harmless and compensate the other party (the “indemnitee”) for losses suffered by the indemnitee.

Many cannabis sellers in California are far too willing to indemnify third parties for things completely out of their control, like lab results, changes in regulations that may affect the other party’s operations, and unforeseen conduct by users of the cannabis product. These blanket indemnification provisions are creating liability and exposure.

In the past month or so, many cannabis companies have come to us (both in Los Angeles and in San Francisco) with poorly drafted, irrelevant or nonsensical indemnification provisions and agreements from cannabis sellers. So, what makes for a good indemnification provision in a cannabis contract?

A preliminary question should be the breadth of the indemnification. If you are the seller and you want to protect yourself, you should tailor your indemnification to what makes sense and to what you can afford. You do not want something like the following (which is being used fairly often in California these days by inexperienced lawyers and lawyerless companies):

“The Indemnitor agrees to indemnify, defend, and hold harmless the Indemnitee, its officers, directors, employees, owners, agents, assigns, and affiliates (collectively, the “Indemnified Parties”) from and against any and all claims, liability, loss, expenses, suits, damages, judgments, demands, and costs(including reasonable attorneys’ fees and expenses) (each a “Claim”) arising out of any accident, injury, or death to persons, or loss of or damage to property, or fines and penalties which may result, in whole or in part, by reason of the use or sale of any Product, or its packaging, except to the extent that such damage is due solely and directly to the gross negligence or willful misconduct of the Indemnified Parties and that the Indemnified Parties, or any of them, were acting in bad faith.”

This sort of provision is a bad idea for any cannabis seller. It means that seller will be liable to the buyer for just about anything that could go wrong–anywhere, for anyone–from the product. No one wants to be on the hook for things they cannot control.

Here are a few important things to consider when crafting a cannabis indemnification term:

  • Both the cannabis seller and buyer need to focus on what kinds of losses will or will not be covered by indemnification. If I’m the seller, I’m going to want to exclude incidental, punitive, and indirect damages even if foreseeable. If I’m the cannabis buyer, I’m going to want to include at least incidental damages and foreseeable indirect damages.
  • It is both unusual and risky for a seller to agree to indemnify a party indefinitely, and yet this too has become common in California. If you are the seller, make sure your indemnity agreement or provision has an end date.
  • Your indemnification agreement or provision should include a protocol for making indemnification claims to the indemnifying party. The boilerplate indemnification provisions and agreements we are seeing typically never even mention any claim deadline or claim notice requirements. As the cannabis seller you should, at minimum, address these two issues in your indemnification provision or agreement.
  • If the indemnification is mutual, and captures reciprocal indemnification obligations in the same paragraph or contract section, ask yourself “why?” Putting the same parameters around indemnification for both parties often makes no sense, because each party has a different role in the business relationship. Consider separating the indemnity obligations and applying tailored language for each party, as appropriate for that party’s role in the transaction.
  • Finally, can you just cross it out? If you have deal leverage, and someone presents you with an indemnification provision (particularly an onerous one), you may be able to get rid of it altogether. Sometimes, you can convince the other party to give you everything they need to feel comfortable through appropriate representations and warranties.

There are certainly very good and reliable stock indemnification provisions in most contracts, and there’s a reason for that boilerplate in that it’s time-tested and mostly appropriate for more standard business agreements. However, be sure that whatever you’re putting into your cannabis contracts on indemnification is tailored to your specific situation. If not, you could find yourself holding the bag on way more than what is fair — let alone what you expected or can afford.

california cannabis marijuana privacy policy
No longer optional for your canna business website.

Unless you’ve been living under a rock for the past few months, you’ve probably read about the host of sweeping new laws in California, like its new Internet of Things law, cannabis privacy law, or net neutrality law, to name just a few. California has long been regarded a trailblazer when it comes to making people who are outside of California do things to comply with California law. So it probably comes as no surprise that website operators outside of California may need to comply with a privacy policy law in California: the California Online Privacy Protection Act.

Pursuant to this law, any business that owns or operates a website that advertises to, services, or in many cases is simply accessible by California residents will almost certainly need to conspicuously post (and—importantly—actually follow) a privacy policy containing statutorily defined disclosures. This requirement applies when a website collects “personally identifiable information” about California consumers, including first and last name, home or other address, email address, telephone number, Social Security number, or any other information that would permit a person to contact a website user (either physically or online). Moreover, a policy may be required even for businesses located in distant areas of the United States just by virtue of the fact that its website can collect this information.

If a company fails to create or adhere to a privacy policy and does so either intentionally or in a material and negligent way, that company may be in violation of the law. The law does state that website operators will not be in violation until 30 days after being notified that their website does not contain a privacy policy, but it does not specify where notification can come from (i.e., the state or any source), which means that reliance on this window may be risky. The law is enforced by the California Attorney General, with penalties of up $2,500 per violation. These penalties could be a severe for businesses that offer mobile apps, as the California Attorney General has taken the position that a new (potentially $2,500) violation occurs each time a non-compliant app is downloaded.

You may be wondering how this applies to your cannabis business. The fact is that there are numerous ways in which even seemingly passive websites collect protected information from and about users. Even if your website does not sell any products, it may include “Contact Us” or mailing list subscription portals which collect protected information. If your website sells or ships any sort of product, it may collect at least some protected information. Even if your business has not collected information about any California residents in the past but simply could do so, the mere possibility may mean it needs to comply.

Furthermore, there are other good business and legal reasons to post and adhere to a privacy policy. Customers appreciate when businesses are transparent about their privacy practices. For obvious reasons, ensuring that cannabis customers’ privacy is maintained is important. Additionally, in the event of a data breach which requires notification to state or federal authorities, the fact that a company took steps to maintain customer privacy may be important considerations in determining if any enforcement actions should be taken.

The good news is that, unlike some laws or regulations that cannabis companies face, California’s privacy policy law is relatively straightforward in that it specifies what a company needs to disclose in a privacy policy and how that policy needs to be displayed on a website. That said, ensuring that a privacy policy accurately describes a company’s current and future privacy practices can be a challenge, and inaccurate or gratuitous statements in a privacy policy could expose a company to additional liability. In other words, a policy needs to be tailored to a company’s specific practices, and so copying language from other privacy policies could cause even more trouble for a company.

Cannabis companies have enough to worry about. They shouldn’t add to the problem by failing to address privacy or data security laws. A good place to start is engaging counsel to draft a comprehensive privacy policy. After all, at least according to California, one is required.

oregon marijuana cannabis data securityLast week we discussed the data breach notification laws with which cannabis companies doing business in Oregon must comply following a cyber intrusion. Today, we discuss the safeguards these companies must adopt to protect the security, confidentiality and integrity of customers and employee (collectively, “Consumer”)’s personal information, who reside in Oregon.

Pursuant to Oregon Revised Statutes (“ORS”) § 646A.622 any business that “owns, maintains or otherwise possesses, and has control over or access to,” written and electronic data that includes personal information used for business purposes, must develop, implement, and maintain reasonable safeguards to protect the personal information.

Generally, “personal information” means a Consumer’s first name or first initial and last name in combination with, for example, a Consumer’s social security number, driver license number or financial account information, if (1) encryption, redaction or other methods have not rendered the data element or combination of data elements unusable; and (2) the data element or combination of data elements would enable a person to commit identity theft against a consumer.

The company must act in accordance with this law by:

(1) Complying with:

  • State or federal laws with greater protections for personal information than ORS § 646A.622;
  • Gramm-Leach-Billey Act as of January 1, 2016 as of June 2018, if the company is subject to this act; or
  • Requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as of June 2018, if HIPAA applies to the company;

and

(2) Implementing a security program that includes:

Administrative Safeguards, such as:

  • Frequently identifying reasonably foreseeable internal and external risks;
  • Frequently training and managing employees in security program practices and procedures; and
  • Selecting service providers that are capable of maintaining appropriate safeguards and adhering to procedures and protocols to which you and the service provider agree, but also requiring the service providers by contract to maintain the safeguards, procedures and protocols.

 Technical Safeguards, like:

  • Assessing risks and vulnerabilities in network and software design;
  • Taking reasonably timely action to address the risks and vulnerabilities; and
  • Applying security updates and a reasonable security patch management program to software that might reasonably be at risk of or vulnerable to a breach of security;

and

 Physical Safeguards, including but not limited to:

  • Monitoring, detecting, preventing, isolation and responding to intrusions timely and frequently; and
  • Disposing of personal information after you no longer use it for business purposes, pursuant to local, state and federal law.

So what does all of this mean? Simply put, business owners with 100 or fewer employees (which includes almost all Oregon cannabis businesses), will comply with these statutory requirements if their information security and disposal program contains administrative, technical and physical safeguards and disposal measures that are appropriate to: (1) the size and complexity of their business; (2) the nature and scope of their activities; and (3) the sensitivity of the personal information collected from or about a Consumer.

Cannabis business should take these safeguard standards seriously. Each violation if subject to a penalty of up to $1,000. Note that each day of a continuing violation is a separate violation, but the maximum penalty for any occurrence is $500,000. Civil penalties under ORS § 183.745 may also apply.

Complying with ORS § 646A.222 is not only required by law, it is also a very good idea for all cannabis business. Indeed, developing a vetted, comprehensive plan of action is the best way to effectively respond to an attack and to reduce the amount of damage to your company. Be safe out there!

noncompete marijuana cannabis
Noncompetes aren’t always enforceable.

Marijuana has been legal in Oregon for about three years now. Employees with specialized skills are starting to jump ship and head to competitors. What do you do, as an employer, if a candidate for employment shows you a non-competition agreement they signed with their former employer? Typically, the former employer will go after the employee to enforce the non-competition agreement, but the former employer may seek an injunction against your business to prohibit you from hiring the candidate.  Is there a way around this? Perhaps.

First, you should consider whether the non-competition agreement is enforceable. As we’ve previously discussed, non-competition agreements in Oregon are highly disfavored. Non-competition agreements in Oregon are only enforceable if the employee was making at least the median income of a family of four at the time of termination and the employee was given the non-competition agreement at least two weeks prior to the commencement of employment, or if the non-competition agreement was entered into as a part of a bona-fide advancement with the employer. If these factors are not met, the agreements are not enforceable.

However, this does not automatically invalidate the agreement. The Oregon Court of Appeals ruled in Bernard v. S.B., Inc. that the employee must take affirmative steps to invalidate or void the obligation of the non-competition agreement. Meaning, they need to send a written notice to the former employer that they intend to void the agreement. Have an attorney review the agreement to determine if its enforceable in the first place, if it’s not, it may be easy for the potential employee to void the agreement and make it safe for you to hire the individual.

Second, some employees may have entered into non-competition agreements in other states. Those agreements may be entirely enforceable under choice of law provisions in the agreements. What then? It’s time for negotiation skills. Some companies may not want to deal with the hassle of attempting to enforce a non-competition agreement and may agree to sign a waiver releasing the former employee from their obligations under the agreement. Others may truly want to enforce the non-competition agreement and refuse to release the employee from the agreement. At that point, you may want an attorney on your side to review the non-competition agreement and see if there is a way to avoid violating it. Perhaps the agreement only prohibits the employee from working with edibles, but you plan on utilizing the employee’s skills to clone plants, for example. Further, an attorney may be able to work with the former employer to convince them to waive the non-competition agreement.

Non-competition agreements can be a good tool to protect your investment in your employees and to protect trade secrets. Alternatively, they can be a pain when you are attempting to hire. Whatever side you’re on, it’s always best to have an attorney on your side to review the agreement and ensure your company is protected to the fullest extent.

california cannabis data privacy
California is taking steps to safeguard canna consumers.

Yesterday, California Governor Jerry Brown signed a new piece of privacy legislation—AB-2402—which places restrictions on how licensed cannabis companies in California share information about their customers.

AB-2402 is significant in that it prevents licensed cannabis businesses from sharing expansive categories of customers’ personal information with third parties—except in limited circumstances in connection with payments, or where a customer has consented to sharing his or her data with a third party. Notably, AB-2402 prohibits licensed cannabis businesses from discriminating against or refusing service to consumers who do not consent to disclosure of their personal information to third parties.

So what kinds of personal information is AB-2402 designed to protect? The bill incorporates the definition of “personal information” from existing California law, which definition includes a person’s first name or initial and last name in combination with a (1) Social Security number, (2) driver’s license number, (3) financial account number in combination with a security or access code, (4) medical information, or (5) health information. “Personal information” can also include a username or email address in combination with a password, or with a security question and answer that would permit access to an online account.

AB-2402 is also significant in that it expands the legal definition of “medical information” in the cannabis context to include medical marijuana identification cards, which also cannot be disclosed except as noted above (and also to certain government officials if necessary to perform certain official duties). In fact, AB-2402 goes so far as to deem licensed cannabis businesses that receive medical marijuana identification cards to be providers of health care—but only for purposes of the Confidentiality of Medical Information Act—which could subject businesses to penalties for improper use or disclosure of information.

The law is welcomed by many privacy advocates, including the Electronic Frontier Foundation, which cited surveys by Politifact which had found that a number of cannabis dispensaries kept broad categories of customer information. It is understandable why privacy advocates support stronger consumer rights in the cannabis industry. Cannabis is, after all, still illegal at the federal level, and so it is not difficult to imagine why customers would want their information to be kept under lock and key.

At the same time, compliance with this new privacy law may appear difficult to cannabis companies. That said, the law is not a totally new concept—California already requires companies (and not just cannabis companies) to provide notification to affected individuals in the event that similar information is acquired by a third party without authorization. AB-2404 simply modifies and expands existing obligations to encompass almost any kind of third-party information sharing.

Complying with AB-2402 will likely require companies to take stock of and retool their data security and sharing practices, and to retrain employees. This is not an impossible task, but it’s one that companies should place at the top of their agenda. After all, California is the state with (arguably) the most intense focus on protecting citizens’ personal information.

AB-2402 was only just signed, and its text does not identify when it takes effect.  We’ll keep you posted on any updates.

marijuana california cannabis L.A.
Be careful! It’s easy to slip up under Proposition M.

I’ve written in the past about the precarious business of buying and selling existing dispensaries in Los Angeles, but that was under the now repealed Proposition D. In March of 2017, Angelenos voted in favor of Proposition M, which is a licensing and regulatory piece of legislation implemented and overseen by the City’s Department of Cannabis Regulation (“DCR”) and the Cannabis Regulation Commission. Under Prop. M, the City is licensing cannabis businesses in three phases, the first of which was exclusively for “Existing Medical Marijuana Dispensaries” (EMMDs). EMMDs are basically grandfathered Prop. D/Pre-ICO operators that met certain compliance criteria set forth by the City under Prop. M. As of the writing of this post, there are only 163 EMMDs in the entire City. This low number of dispensaries in potentially the largest cannabis market in the world makes the secondary market for these storefronts incredibly hot. So much so that our Los Angeles cannabis lawyers are receiving term sheets for the purchase of EMMDs on an almost bi-weekly basis. And based on that experience, it’s time to update readers on what to look for when contemplating the purchase of an EMMD, which is no small task under the City’s new laws.

Running due diligence on dispensaries in Los Angeles is massively important. The reason being (in addition to normal M & A due diligence) is that the City still has many, many illegal operators (though the City Attorney is doing his best to shut down those operations as fast as possible). Therefore, it’s not a stretch that an “LA dispensary” would try to take a buyer for a ride on a sale when, in reality, that dispensary is 100% illegal, making the purchaser a sitting duck.

In turn, here are the major bases to cover when buying an EMMD in the City of LA under Prop. M:

  1. Is the dispensary even on the City’s EMMD list? The DCR has done a fantastic job of continually updating its EMMD list on its website. Checking that list is the very first step for any reliable due diligence. If the dispensary is not listed, ask the sellers why that’s the case. At this point, with the window for EMMD licensing closed, failure to appear is going to be a huge and fatal red flag that’s fatal unless the selling dispensary can provide viable proof that they are in valid pursuit of EMMD status from the DCR or appealing a DCR denial of EMMD status,
  1. Licenses are not transferable. Many people don’t realize that commercial cannabis licenses are not transferable under California State law. The same goes for commercial cannabis licenses in the City of L.A.—they cannot be bought and sold as individual assets; only the entity that holds them can change owners (meaning, you’re looking at purchasing the company that holds the license). Therefore, any EMMD that’s trying to sell you one of its licenses (or one of its future licenses) is not recognizing that it can only sell its membership interests or stock, and not the licenses themselves, under state and L.A. laws and regulations.
  1. What entity type is the EMMD? Assuming your target EMMD is on the City’s EMMD list and the EMMD understands that it can only engage in an entity purchase and sale, the next question is whether the EMMD is organized as a non-profit or a for profit company. If the EMMD was in compliance with Prop. D, it’s most likely some form of a non-profit corporation (most often a non-profit mutual benefit corporation (“NPMBC”), stemming from 2008 State Attorney General guidelines regarding compliance with the Compassionate Use Act of 1996 under which the sale of medical cannabis for profit is not permitted). This obviously creates an issue where a non-profit has no equity that can be legally bought and sold, and individual NPMBC directors taking buyer purchase money undoubtedly violates the California corporations code in a multitude of ways. In turn, part of the EMMD purchase will entail some form of “conversion” to a for profit entity to ensure that future membership interests or stock can be sold off. Luckily, NPMBCs and non-profits in general in California can “convert” to for profit corporations and, from there, into whatever other for profit entity the controlling interests so decide. To “convert” though, unless the NPMBC’s bylaws specify otherwise, a vote of the entire “membership” (i.e., potentially all of the medical cannabis patient members) of the non-profit may be required in order to convert. And do not forget that a lot of dispensaries in L.A. may have made significant mistakes when putting together their bylaws so that a “conversion” vote may not even be possible without exposing the purchaser to significant successor liability from the NPMBC’s “members”. Also, don’t forget that the old corporate and tax sins of the NPMBC may haunt the new entity, so secure the appropriate representations, warranties, and indemnities accordingly.
  2. EMMD conversion is permitted outright in LA with a catch. Once you have the general conversion plan sorted in your term sheet, you have to deal with conversion under local law. In L.A., “. . . a change from non-profit status to for-profit status by an EMMD is exempt from [having to seek DCR approval] if no other ownership change is made in accordance with Proposition D’s ownership rulesand notice is provided to DCR within five business days. This exemption is not available after a License is issued.” This means that while EMMDs maintain a temporary license from the DCR to operate, EMMDs can convert from non-profits to for-profits without having to secure DCR approval so long as: 1) The original directors remain the “owners” and 2) The DCR gets 5 business days’ notice of the corporate change over. In turn, even if the entity can be converted, purchasers cannot immediately take over the EMMD unless the EMMD and the new owners are ready to complete all of the steps at point 6 below.
  1. EMMD status stopped in Phase 1. A lot of our clients have been pitched by several EMMDs on the alleged fact that EMMDs will get special treatment for the receipt of additional retail licenses in L.A.. This is not correct. All retailers in L.A. can receive and run up to three retail licenses total (including Type 9 delivery only retail). In phase 1 licensing, which was for EMMDs only and which has come and gone forever, if an EMMD only applied for a single retail license in that “Priority Processing” phase, they must wait until phase 3 for additional retail license application (which is the general public licensing phase). Regarding phase 3, the City has never said when it will open and it’s anyone’s guess as to when that window will commence, but it’s unlikely to happen in 2018 given the slower pace of licensing in LA. In any event, if EMMDs want more retail licenses (for which they did not apply when phase 1 was open), they’ll have to get in line like everyone else in phase 3.
  2. Phase 3 may be a dead end. Per point 5 above, if part of your purchase agreement is that the EMMD status will help you secure additional retail licenses in phase 3, you really need to be careful with that performance obligation. In phase 3, the City is already obligated under Prop. M to issue retail licenses to social equity applicants on a 2-to-1 basis relative to other general public (non-social equity) applicants. Since over 160 EMMDs already exist in L.A., this means that before even a single retail license issues to a general public (non-social equity) applicant, the City must first issue over 300 retail licenses to social equity applicants. Couple that with the fact that Los Angeles has undue concentration caps for retail licenses and the writing is on the wall that retail licensure may not be possible for non-social equity general public applicants in phase 3, and that includes for non-social equity EMMDs seeking additional retail licenses.
  1. This ain’t your daddy’s M & A. Mergers and acquisitions in regulated industries are a different animal because the transaction has to fit with regulatory vetting and approval before anything really becomes effective between the parties. Cannabis M & A is no different and, in fact, is probably worse since it’s an emerging industry and because commercial cannabis activity remains federally illegal. Once a California cannabis business has its annual license, if it wants to sell its membership interests or stock to bring in a disclosable “owner” (i.e., among other things, anyone or any entity that owns 20% or more in equity), it will first need to seek approval from the state agency that issued it its licenses. That’s not uncommon in states with robust cannabis regulations. What people may not know, though, is that the DCR also wants to know about changes in ownership and has full authority to reject the change request based on its scrutiny of the incoming owners. Specifically, in LA:

“A License is not transferable unless the change to the Licensee’s organizational structure or ownership is submitted to and approved by DCR. The Licensee shall complete a change of ownership application, pay all applicable fees and obtain the written approval of the change of ownership by DCR, pursuant to the Rules and Regulations . . .”

There are also specific increased requirements for changes of ownership for a social equity business set forth in the City’s Cannabis Procedures at section 104.20.

In any M & A term sheet and/or definitive purchase agreement for an EMMD in L.A., the parties have to take into account the requirement of first going through the DCR to have the transaction approved and they also need to address what happens in the event the new owners are, or the change of ownership request is, rejected by the DCR. The timeline for state and local government approval on these things is also both important and unpredictable, but should nonetheless be agreed to by the parties at the outset of the transaction to ensure success.

  1. Relocation is no picnic. In addition to their grandfathering, the EMMDs are not subject to undue concentration limits, and so long as they meet certain requirements they don’t have to comply with the Prop. M zoning and buffer requirements until 2022. However, if the EMMD relocates (which the DCR currently allows) or if it moves any of its other licenses from its original premises, it will lose the zoning and buffer exemptions. A good amount of the M & A we’re seeing includes a component that an EMMD with other licenses will either re-locate itself or some or all of its other licenses as part of the transaction. And a lot of that M & A completely fails to address the fact that upon such relocation the zoning and buffer grandfathering is lost. Be sure to address this grandfathering and/or the loss thereof if it’s part of your dispensary M & A goals in LA.

It’s not a stretch to say that selling and buying EMMDs in LA is not for the faint of heart. There are many important details that must be considered in any due diligence period and that must also be reflected in any viable purchase and sale agreement. So, do your homework and proceed with extreme caution.

california cannabis labeling prop 65
Don’t sleep on Prop 65!

Almost on a weekly basis, clients ask our California cannabis attorneys to review and provide advice and guidance on their packaging and labeling for their cannabis and cannabis products pursuant to California’s Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA). This means that our California cannabis attorneys have committed to memory the applicable packaging and labeling rules set forth under MAUCRSA and by the California Department of Food and Agriculture (CDFA) and the California Department of Public Health (CDPH). Between the two, CDFA deferred to CDPH on packaging and labeling for flower, and CDPH really only regulated packaging and labeling for cannabis infused products under the emergency rules. The packaging and labeling rules are not rocket science, but they’re immensely important for MAUCRSA compliance and consumer safety. However, none of the CDPH regulations or even MAUCRSA mention the applicability of Proposition 65 to California cannabis and cannabis products.

In addition to reviewing countless packaging and labeling content under MAUCRSA, our California marijuana business lawyers have also done a good amount of clean up of non-compliant packaging and labeling related to poor or uninformed legal advice regarding how Prop. 65 applies in the context of California cannabis. Failure to comply with Prop. 65 usually means disaster for the unwary business owner, ranging from costly and aggressive lawsuits to being shut down by the state.

The Safe Drinking Water and Toxic Enforcement Act of 1986 (a/k/a Prop. 65), requires the Office of Environmental Health Hazard Assessment (OEHHA) to publish a list of chemicals known to cause cancer, birth defects or other types of reproductive harm. The list now includes more than 1,000 chemicals. Effective June 19, 2009, marijuana smoke was added to the Prop. 65 list of chemicals known to cause cancer. OEHHA’s Carcinogen Identification Committee “determined that marijuana smoke was clearly shown, through scientifically valid testing according to generally accepted principles, to cause cancer.” Technically then, all cannabis flower is subject to Prop. 65 warnings since all flower contains/produces “marijuana smoke.” In addition, oils, wax, vapes, etc. usually contain at least one chemical on OEHHA’s list. Given this fact, there is hardly a cannabis business in California that won’t find itself subject to Prop. 65 warning requirements at some point. And none of the state agencies in charge of MAUCRSA are going to assist licensees in figuring out what they need to do to protect themselves under Prop. 65.

The first question cannabis businesses need to ask themselves in a Prop. 65 analysis is whether they’re subject to Prop. 65 at all. Who’s exempt? It’s a short list:

  1. Businesses with fewer than 10 employees and government agencies.
  2. Businesses are also exempt from the warning requirement “if the exposures they cause are so low as to create no significant risk of cancer or are significantly below levels observed to cause birth defects or other reproductive harm.” How low you ask? The exposure levels are different for each chemical type–for cancer causing chemicals, for example, no warning is required if the chemical exposure is calculated to result in “not more than one excess case of cancer in 100,000 individuals exposed over a 70-year lifetime.” You can find the Prop. 65 allowable exposure levels here.

Availing yourself of this second exemption is going to be very difficult, complex, and expensive to prove. It likely isn’t worth it if you even think you’re close to exceeding the allowable exposure levels.

Once you determine that Prop. 65 applies to you, you then need to identify the type of warning you need based on your product(s) and the relevant chemicals. And to really throw in a twist, you should know that new Prop. 65 regulations take effect on August 30, 2018. In turn, only the new safe harbor warnings should be used for products manufactured on and after August 30, 2018 (though you can still use the old September 2008 safe harbor warnings for product made before that date).

One of the most important changes with the new regulations is that you now need to actually identify at least one triggering chemical depending on the type of harm caused by that chemical. Specifically, OEHHA mandates that:

If, for example, there are five possible chemical exposures from a given product, and all five chemicals are listed only as carcinogens, then the business would only be required to name one of those five chemicals in the warning. . . If there are exposures to both carcinogens and reproductive toxicants, a business would be required to name one of the chemicals that is a carcinogen and one of the chemicals that is a reproductive toxicant, but the business could choose to identify more chemicals in the warning.

In turn, your new Prop. 65 warning will look like one of the following (plus the required symbol at the beginning and to the left of the warning):

  • For carcinogens: “WARNING: This product can expose you to chemicals including [name of one or more chemicals], which is [are] known to the State of California to cause cancer. For more information go to www.P65Warnings.ca.gov.”
  • For  reproductive toxicants: “WARNING; This product can expose you to chemicals including [name of one or more chemicals], which is [are] known to the State of California to cause birth defects or other reproductive harm. For more information go to www.P65Warnings.ca.gov.”
  • For exposures to both listed carcinogens and reproductive toxicants: “WARNING; This product can expose you to chemicals including [name of one or more chemicals], which is [are] known to the State of California to cause cancer, and [name of one or more chemicals], which is [are] known to the State of California to cause birth defects or other reproductive harm. For more information go to www.P65Warnings.ca.gov.”
  • For exposures to a chemical that is listed as both a carcinogen and a reproductive toxicant: “WARNING: This product can expose you to chemicals including [name of one or more chemicals], which is [are] known to the State of California to cause cancer and birth defects or other reproductive harm. For more information go to www.P65Warnings.ca.gov.”

In certain circumstances, short-form warnings for consumer products are allowed so long as minimum font requirements are met. Specifically, in addition to other content requirements, the short-form warning must be “in a type size no smaller than the largest type size used for other consumer information on the product and in no case in a type size smaller than 6-point type.”

Unfortunately, I still see cannabis products floating around that completely ignore or bungle Prop. 65 requirements, making these businesses sitting ducks for bounty-hunter plaintiffs and their attorneys. You’ve really only gone halfway in your MAUCRSA packaging and labeling analysis if you haven’t considered whether Prop. 65 applies to your business and what you need to do to duck in under the safe harbors. So, double check whether Prop. 65 applies to you and what you need to do to protect your business to ensure that you’re not on the wrong end of any Prop. 65 litigation.