california marijuana cannabis licensingIn California, under the Medicinal and Adult-Use Cannabis and Regulation Safety Act (MAUCRSA), temporary licenses began issuing to cannabis businesses on January 1, 2018. Since then, the state agencies in charge of MAUCRSA’s implementation (the Bureau of Cannabis Control (BCC), the California Department of Public Health (CDPH), and the California Department of Food and Agriculture (CDFA)) have worked pretty much round the clock on adopting permanent regulations. In case you forgot, the agencies dropped their initial proposed permanent rules this past summer, tweaked those, and then released another round of revised proposed permanent regulations last month (which are now in the hands of the Office of Administrative Law (OAL) for an overall review). That last round of proposed permanent rules (see herehere, and here) is very likely to become effective (pending OAL’s review) in early January. Right now, all licensees are still operating under the emergency rules that came out in fall of 2017. And pretty much everyone is racing to get their temporary licenses, which will NOT be available after December 31.

Despite the fact that the state has made great progress towards permanent rules, many questions and ambiguities around licensing and operational conduct remain. In fact, some of the grayer areas of the emergency regulations have been expanded by the proposed permanent rules for better or worse. In turn, with 2019 just around the corner, here’s my list of the top 10 unknowns that still remain for California cannabis:

    1.    IP licensing and white labeling restrictions.

In case you’ve been living under a rock, one of the most shocking proposed permanent rules to come from the BCC is section 5032(b) (which, yes, affects all licensees). Essentially, section 5032 (b), as originally written, basically prohibited all IP licensing and white labeling agreements between cannabis licensees and non-licensees. That rule stated that:

(a) Licensees shall not conduct commercial cannabis activities on behalf of, at the request of, or pursuant to a contract with any person that is not licensed under the Act. Such prohibited commercial cannabis activities include, but are not limited to, the following: (1) Procuring or purchasing cannabis goods from a licensed cultivator or licensed manufacturer; (2) Manufacturing cannabis goods according to the specifications of a non-licensee; (3) Packaging and labeling cannabis goods under a non-licensee’s brand or according to the specifications of a non-licensee; (4) Distributing cannabis goods for a non-licensee.

For more detail on that original rule, see our write-up here. During public comment on 5032, there was a good amount of dissent (including our own) in that it’s pretty obvious if such a rule went through a lot of branded product currently on the shelves would have to be tossed. In addition, California would be the only state in the cannabis union to adopt such a strict rule. When the BCC then released the revised proposed rules, 5032(b) was pared down to read as follows:

(b) Licensees shall not conduct commercial cannabis activities on behalf of, at the request of, or pursuant to a contract with any person that is not licensed under the Act.

As you can see, the IP licensing and white labeling examples were deleted, but the rule still makes clear that licensees can’t undertake commercial cannabis activity (i.e., manufacturing, labeling, processing, etc.) “on behalf of, at the request of, or pursuant to a contract” with a non-licensee. Just removing former examples (1)-(4) may have no impact whatsoever here, and it’s certainly confused the situation as a result. And while the BCC’s own comments to 5032 (in its Final Statement of Reasons) indicate that it takes no issue with non-licensee to licensee IP licensing and white labeling relationships, a plain reading of the rule indicates otherwise.

    2.    Ownership issues. 

The BCC struck again in the proposed rules revising “owner” disclosure standards to be much stricter at section 5003. Now, in addition to anyone with 20% or more in equity, the board of directors, the CEO, and anyone or any entity that exercises any direction, control, or management over the licensee, is also an owner. Any individual or entity merely entitled to profit share at or more than 20% is also an owner. This calls into question though how the BCC plans to treat things like cashless options and warrants that have no immediate entitlement to ownership in or profit sharing with the licensee. And what about husbands and wives (which are in community property marriages in California) since there’s no spousal disclosure requirement and they’re technically one person under existing law? The BCC has been silent on all of the foregoing and I have no doubt that these new revised rules may actually incentive people to be even more “creative” in order to avoid owner (and financial interest holder) status.

    3.   Financial Interest Holder woes.

Identifying financial interest holders (FIHs) is more complicated than owners because the FIH definition now encompasses a variety of folks and entities. I recently spoke to the OC Register about how now even lawyers who take a share of the profits of a cannabis business (in exchange for legal services) will now have to be disclosed as FIHs under the new rules. The BCC also made clear that it’s going to sort through more convoluted corporate structures around FIHs to get to the humans providing the capital to or profit sharing with cannabis businesses. At section 5004 of the proposed rules, the BCC now mandates that:

“When an entity has a financial interest in a commercial cannabis business, then all individuals who are owners of that entity shall be considered financial interest holders of the commercial cannabis business. For example, this includes all entities in a multi-layer business structure, as well as the chief executive officer, members of the board of directors, partners, trustees and all persons that have control of a trust, and managing members or non-member managers of the entity. Each entity disclosed as having a financial interest must disclose the identities of persons holding financial interests until only individuals remain.”

Of course, we have no way of really knowing how far the BCC will go here in vetting the individuals behind these structures, though I’m sure more than a few publicly traded companies are suffering severe heartburn at reading this new rule.

    4.    Packaging and labeling compliance in 2019. 

Under CDPH proposed permanent regulations, manufacturers will not have to implement child resistant packaging (CRP) for their cannabis products until 2020. In the interim, retailers will fill the gap by using CRP exit bags. And while CRP is going away for manufacturers, there are a slew of revised and new packaging and labeling standards being implemented upon the rules becoming effective in the new year. The outstanding issue then is that CDPH created no affirmative grace period for manufactured product that’s out there right now and compliant with the emergency regulations, but that doesn’t meet the new packaging and labeling regulations. (A great example is that manufacturers of certain products now have to put the universal symbol not only on outer packaging but also on the product container itself if that outer packaging is “separable” from the product container.) What’s for sure is that retailers cannot possess or sell finished product that doesn’t adhere to the new packaging and labeling rules. So, what exactly will happen to existing, non-compliant product in 2019? That remains a mystery.

    5.    Provisional licensing. 

Provisional licensing is the new temp licensing. (See here for more on the temp license race to secure provisionals for 2019.) Even though a provisional license is the new hot ticket in town, the BCC and CDPH have given no insight into how a licensee actually secures this license. I surmise that the issuance of provisionals will be automatic (similar to how the state was just renewing temp licenses automatically if a temporary licensee was in clear and earnest pursuit of its annual license). CDFA is the only agency that’s produced a fact sheet on the topic, but no agency has publicly announced the exact logistics around provisional licensing yet.

    6.    Social equity programs. 

For every city that’s done a social equity program, it’s been a challenge out of the gate to do it correctly and sustainably. Los Angeles is just getting started with its program while certain other California cities are trying but are producing meager results at best. While the state finally decided to financially back local social equity programs, it’s clear that the state and the cities need to study this particular social experiment for some time before a gold standard will actually emerge. In turn, the success of these programs is definitely a large unknown.

    7.    Banking.

Banking in California is the number question I get on a weekly basis at this point: namely, when the hell is it going to commence? I’m a firm believer that unless and until our permanent regulations are finalized and are proven to work relative to barriers to entry and vetting owners and FIHs, we will not see private sector banking in California. Our licensing and enforcement systems are still too loose/inchoate to satisfy the 2014 FinCEN guidelines, and no public bank is going to materialize here either for various complicated and practical legal reasons (be sure to watch out for banking fraudsters, too). And while California cannabis companies will likely continue to use management companies to help them alleviate some of the inability to access banking, it’s certainly not a long-term solution and it’s downright illegal when that relationship isn’t legitimate or at an arm’s length anyway.

    8.    Fee slotting agreements and anti-competitive tactics. 

On a regular basis now, I’m seeing retailers introduce to my cultivation and manufacturing clients a variety of fee slotting agreements so that my clients can secure known shelf-space in order to remain competitive. This month, I questioned whether such contracts were valid under MAUCRSA where anti-competitive behavior is strictly barred. Only time will tell whether regulators will address these agreements and their impact on the marketplace.

    9.    Tech platforms and delivery. 

The BCC seems to have developed an appetite for wading into increased regulation regarding retailers and delivery tech platforms. Pursuant to section 5415.1 of the proposed permanent BCC regulations, we now have a more robust code of conduct between retailers and tech platforms when it comes to delivery. Now that the BCC has finally opened the door to invading this relationship regarding contractual limitations and restrictions on advertising and marketing for licensees via tech platforms, it begs the question as to whether California is going to go further down the road of trying to essentially regulate tech platforms or not. Given the fact that California is one of the few states that’s embraced delivery, it’s a very important area for development, both legally and for public policy.

    10.    Corporate versus cottage debate rages on. 

Every single state that’s undertaken recreational cannabis has to battle between corporate and cottage interests. And every single state is different in how it’s handled the issue. In the proposed permanent regulations, it’s hard to tell which way California is leaning since those rules still contain some fairly big business friendly propositions (such as still being able to secure countless small cultivation license types, local law permitting, in order to aggregate big acreage) as well as some rules that cut against “Big Marijuana,” like having to disclose shareholders in a publicly traded company as FIHs unless they hold 5% or less of the equity. In 2019, I think we can fully expect the debate between small and large business interests to carry on, but where California lands remains unknown. That’s going to probably continue for quite some time as it works out the kinks spurred by the proposed regulations.

fourth circuit marijuana illegal search
Nice work by the court!

The Fourth Circuit Court of Appeals ruled last week that finding marijuana stems in a trash bag does not permit the police to search the house for evidence of a crime. From a legal standpoint this case has interesting implications on when, where, and what police can search. From a more practical perspective, it shows the courts, along with the majority of America, are accepting that marijuana is not a dangerous substance.

The case, United State v. Tyrone Lyles, saw Mr. Lyles accused of possessing firearms as a convicted felon. The police of Prince George County (in Maryland, right outside of Washington, D.C.) were investigating Mr. Lyles in an unrelated case. They searched four trash bags on a curb near his house and found three marijuana stems. Based on the marijuana stems, the police obtained a search warrant for Mr. Lyle’s house. In the application for the search warrant the police stated they had found the marijuana stems, rolling papers and based on this believed that there were “controlled dangerous substances, Marijuana, and handguns being stored, used and/or sold” at Mr. Lyles home.

Based on this information, the police were granted a broad warrant and allowed to search Mr. Lyles home in total. The police, during the search, found four handguns, ammunition, marijuana, and drug paraphernalia, in Mr. Lyle’s house. Mr. Lyle asked that the evidence found in his home be suppressed because there was not sufficient evidence to search his home based on the discovery of three marijuana stems in his trash.

The Fourth Circuit agreed. The court, in its decision, first reiterated the fact that police have the right to search trash that that has been left at the curb and that evidence found in trash can be used to support a warrant to search other premises. The Fourth Circuit recognized, that while the police can search trash, that there is limitations to what can be presumed from the discovery of the evidence in the trash. Focusing on the facts from Mr. Lyles’s case, the Fourth Circuit determined there was simply too little marijuana found in the trash to presume that Mr. Lyle had more marijuana in his home. The Fourth Circuit agreed with Mr. Lyles that the tiny quantity of discarded residue gave no indication of how long ago marijuana may have been consumed in Mr. Lyle’s home.

So what does this mean? The police used marijuana as an excuse to search Mr. Lyle’s house for evidence of crimes related to marijuana, money laundering, and hand guns. The Fourth Circuit essentially said the police cannot presume that someone has committed crimes related to controlled substances or to other crimes when a small amount of the substance has been found in the trash. This is important because in other cases, the Fourth Circuit has determined that evidence of a controlled substance in someone’s trash is sufficient for a warrant to search that person’s house. Perhaps the distinction here is that such a small amount was found, or perhaps it is evidence that the federal courts are no longer considering marijuana a dangerous drug that is evidence of other crimes (what if they had found a small amount of heroin?).

It will be interesting to see if any of the other federal circuits follow the Fourth Circuit’s helpful precedent, or if prosecutors decide to appeal this decision to the Supreme Court.

CBD product recall litigationWe counsel our cannabis (and non-cannabis) clients extensively on product liability issues, and have warned them that the federal illegality of their products will not shield them from the same products liability risks faced by companies in other industries. We extend the same warnings to our cannabidiol (CBD) clients, who, if they are operating outside of a state-run cannabis licensing regime, are actually in a position of even greater risk. Lack of regulation in the CBD space is to the detriment of consumers, who often cannot be certain what ingredients the products they purchase actually contain, or whether those products are safe and free of contaminants.

It’s only a matter of time before harmed consumers start suing CBD companies alleging defective, dangerous, or mislabeled products (and Proposition 65 violations). Here are some posts we’ve written about product liability in the cannabis industry, which are highly relevant to CBD companies as well:

Recently, Vice published an alarming article about a new study that detected synthetic marijuana and a compound in cough syrup in one CBD company’s vape products. The article summarizes the findings of Michelle Peace, a toxicologist and vaping expert at Virginia Commonwealth University who evaluates how electronic cigarettes are being used for substances other than nicotine. Peace received a tip that a product supposedly containing only CBD had psychedelic effects for a consumer. Upon further testing, she discovered that out of nine products tested, four contained synthetic marijuana (5-fluoro MDMB-PINACA (5F-ADB)) and one contained dextromethorphan, an ingredient in cough syrup.

Unfortunately, these findings do not surprise us. We’ve long been wary of the proliferation of CBD products with very little regulation from federal or state governments. Some states have taken steps to combat these unregulated products. In July of this year, the California Department of Public Health’s Food and Drug Branch (CDPH) issued an FAQ on CBD in food products stating:

“[A]lthough California currently allows the manufacturing and sales of cannabis products (including edibles), the use of industrial hemp as the source of CBD to be added to food products is prohibited. Until the FDA rules that industrial hemp-derived CBD oil and CBD products can be used as a food or California makes a determination that they are safe to use for human and animal consumption, CBD products are not an approved food, food ingredient, food additive, or dietary supplement.”

In California, CBD products derived from marijuana and produced by licensed cannabis manufacturers may be sold, but unregulated, industrial-hemp-derived products intended for consumption may not.

So, what should CBD companies be doing to protect themselves from consumer product liability claims? Of course, we recommend implementing robust testing protocols that are in line with those required by state agencies of cannabis manufacturers. The first step in protecting your company is ensuring that your products are safe. In the same vein, be sure that everything you state about your product is accurate.

And oftentimes, one of the best ways to mitigate against product liability claims is to institute a product recall, and having a product recall plan in place will facilitate this. In crafting that plan, below are some recommendations we’ve made before, which bear repeating:

  1. Create an overall recall strategy.
  2. As part of your recall plan, create definitions and standards for classes of recall and the depth and scope of any given recall. If your state or local laws do not provide basic recall standards for cannabis businesses, check out the FDA’s website under Guidance for Industry: Product Recalls, Including Removals and Corrections.
  3. Appoint a recall committee within your company, to be led by experienced personnel capable of evaluating and investigating product complaints to determine if a recall is warranted. This also entails your developing a product complaint form that will be utilized by customers. It is important to learn about product problems as early as possible.
  4. Develop a complaint receipt and evaluation method to ensure your product complaint processing and investigations are logical, efficient, and comprehensive. There are few things worse than receiving product safety complaints and then ignoring them until the situation is out of control.
  5. Truly ponder what your product complaint investigation will entail. What facts should your recall committee be gathering when seeking to determine if a product complaint is valid or if a recall is warranted? What should your recall look like, as based on the facts and circumstances and the threat your product may pose to consumers and vendors?
  6. Create a distribution list so your product recall committee can quickly and easily identify all affected products and product lots for disposition and potential destruction. The distribution list should — at minimum — include the names of all affected consumers and vendors, their contact information, and the dates on which the products were sold to them or consumed by them, and it should also include any side effects, injuries, or illnesses resulting from product use. Time is of the essence here. Our firm had a regional food client that inadvertently failed to issue a recall notice to one of many supermarket chains to which it sold its food. This supermarket chain was so angry about having been kept out of the loop that it refused ever to purchase our client’s product again. Then other supermarket chains learned of our client’s failure to notify this one supermarket company and they too ceased all of their purchasing. Needless to say, our client company no longer exists. Don’t let this sort of thing happen to you.
  7. Institute a method of stock recovery so all tainted product in inventory is effectively quarantined from sale and distribution.
  8. Generate your recall notice and be very careful with your wording in how you alert vendors and consumers to the recall. You want to effectively communicate that a product has been affected and how to deal with that, but you also want to minimize whatever liability your product problems may create for the company. On a case by case basis, consideration should also be given to drafting a press release to help the company’s PR. For this you absolutely need attorney help.
  9. Make sure to as quickly as possible (preferably in advance) alert your outside advisors (your lawyers, your insurance broker, etc.) regarding your recall.
  10. Set out in your recall plan your options for product disposition. Will you destroy a product? Cleanse and then repurpose it? Lay out your options in your plan now so you are not scrambling to try to figure out your possible options later, when you have no time to do so.
  11. Record everything you do. Document every effort you make and record all your communications with consumers and vendors. If there is a legal action later, you will want to be able to show the court that you took all reasonable steps to ensure consumer safety.

In addition to the foregoing, we also recommend regular compliance audits to ensure that your procedures are safe, legal and effective. It is only a matter of time before CBD product liability claims start to proliferate, and CBD companies should prepare for that reality now.

california cannabis litigation
We see litigation in the California industry’s future.

Because California’s cannabis regulatory scheme is still in relative infancy, 2018 has looked the same for most operators: applying for annual licenses and waiting (and then continuing to wait) for them to issue or fighting to get temporary license applications submitted before they can no longer be issued. But what happens in two or three years after hundreds or thousands of commercial cannabis licenses have been issued? A host of administrative and civil litigation, probably.

California’s cannabis regulators have immense power that’s not just going to disappear after they issue licenses. The Bureau of Cannabis Control, which regulates a number of different license types, arguably has more police power than the actual police. Section 5800 of the BCC’s readopted emergency regulations, for example, gives the BCC “full and immediate access”, without prior notice, to enter premises, inspect cannabis or vehicles, and copy books and records, and failure of a party to comply with a BCC investigation can be subject to discipline.

Not only do the agencies have broad investigative power, but the subject matter of what they can investigate—all the various regulations that companies have to comply with—is immense. The regulators are not going to sit around and assume that licensees are following the law, the regulations, or even their own operational plans submitted with their applications—they are almost certainly going to use their investigative power to root out non-compliant operators. This should come as no surprise as the BCC, for example, has already taken some action against allegedly unlicensed cannabis operators. Our cannabis lawyers in other states with older licensing schemes have already seen targeted agency investigations and enforcement actions.

There are really endless ways that the agencies may choose to investigate or enforce their regulations, but it’s safe to say that they will prioritize enforcement against unlicensed operators. They may also go after some other easy targets—selling to underage persons, violations of advertising or delivery regulations, track-and-trace non-compliance, and so on. Rest assured, too, that administrative rules will continue to evolve, and licensed businesses that do not keep up on compliance will also be vulnerable.

Not only are the next few years likely to see an increase in administrative actions, but they are also likely to see a swath of civil litigation between licensees and internally. With the development of so much new technology and other intellectual property, we expect to see a good deal of trade secret and other IP litigation. Prop 65 and other forms of false advertising litigation are likely to continue as well. And internally, members of cannabis companies may start to bring lawsuits against each other or their companies for a number of reasons—from simple things like alleged mismanagement of company assets to fraud in soliciting investors.

The future of the California cannabis industry isn’t entirely certain, but it’s likely going to involve a lot of time before arbitrators, judges and other dispute resolution officiants.

asset forfeiture fine cannabis marijuana

We have handled a number of excessive fines cases on behalf of clients who’ve had their property seized, or threatened to be seized by the government. For some background on this, see our blog posts here and here.

The United States Constitution provides that excessive bail shall not be required, nor excessive fines imposed, nor cruel and unusual punishments inflicted. U.S. Const., Amdt. 8. The Excessive Fines Clause “limits the government’s power to extract payments, whether in cash or in kind, ‘as punishment for some offense.’” Austin v. United States, 509 U.S. 602, 609-10 (1993). That constitutional protection applies in cannabis cases, just like everywhere else.

On Wednesday, the United States Supreme Court heard oral arguments in the case of Timbs v. Indiana regarding whether the Eighth Amendment’s Excessive Fines Clause is incorporated against the States under the Fourteenth Amendment. The case involves the forfeiture of petitioner’s land rover as punishment for selling heroin. The Indiana Court of Appeal held that the forfeiture of the land rover was grossly disproportionate to the gravity of the offense. The Indiana Supreme Court reversed and concluded that because states are not subject to the Excessive Fines Clause, the forfeiture was not unconstitutional.

The predicted outcome is that the United States Supreme Court will apply the Excessive Fines Clause against the states. The Timbs decision will have nationwide impacts for those accused of drug crimes and other offenses, and will be an important check on the government’s power to interfere with private property. That would be great news for the cannabis industry.

As stated in the petitioner’s opening brief:

“The right to be free from excessive fines is fundamental and applies to the States. The power to fine is—and has always been—a formidable one. And unlike every other form of punishment, fines and forfeitures are a source of revenue for the government, making them uniquely prone to abuse. The accompanying risk to life, liberty, and property is very real. “[I]n a free government,” after all, “almost all other rights would become utterly worthless, if the government possessed an uncontrollable power over the private fortune of every citizen.” 3 Joseph Story, Commentaries on the Constitution of the United States § 1784, 661 (1833).”

It’s a compelling argument, and you can read the full brief here.

We will be monitoring this case and will provide an update once the decision is published.

cannabis data breach
Cannabis businesses may be especially vulnerable.

Virtually everyone knows about breaches of companies like Equifax. Massive breaches have happened to established, mega-companies who still took major reputational and monetary hits after they were breached. What many people don’t realize is that it doesn’t take a major breach to devastate a business. We don’t want to be dramatic, but we also don’t want to downplay the significance of breaches—they are coming, and cannabis companies that are not prepared may be left in the dust.

Data breaches can range from anything from malicious hacking to the simple loss of a laptop containing unencrypted “personal information”. In either case, if statutorily defined classes of personal information were accessed or acquired without authorization, the party who held the personal information must provide written notification to the affected individuals within a relatively short period of time, and in many cases to other services like credit monitoring. This may seem like a straightforward process. It is not. Just figuring out what kinds of information may have been accessed and whose information may have been accessed could take tens of thousands—if not hundreds of thousands—of dollars in forensic review.

Take the following example: A human resources manager is the victim of a phishing attack. Typically, forensic review of the affected account may need to be undertaken to determine what part of the manager’s email accounts were accessed—did the attacker review one email, or access the entire mailbox? If the forensic vendor determines that the entire account was or could have been accessed, the entire account may need to be “data mined” at a high per-gigabyte cost to see whether emails contain personal information that could require reporting. This could potentially involve tens of thousands of dollars in expenses for one account. Now imagine this happens to five employees.

Not only is this piecing together of events time consuming and expensive, but it only gets half the job done. Once a list is made of the affected individuals and reportable information, notification (often drafted by lawyers) needs to be provided to individuals. This requires engaging companies to ensure that the individuals live where they are thought to live, and to physically mail notification letters out. Then, usually at a certain price per enrollee, credit or identity theft monitoring is provided.

It’s not difficult to see why this process is expensive, and the fact that it needs to occur in such a short period of time can cause intense pressure on an enterprise. To boot, in many states, attorneys general need to be given notification if a certain threshold of citizens of those states were notified of a breach. These attorney generals can (and sometimes do) request detailed summaries of how the breach happened and can even bring administrative actions against the companies who were the victims of the data breach.

Breaches are not unique to the cannabis industry —the Breach Level Index (“BLI”) estimates that more than 14 billion data records have been lost or stolen since 2013, with an average frequency of an astounding 6.9 million records per day. However, this industry is particularly susceptible to data breaches and their damaging effects for many reasons. Here are a few examples:

  • Companies may not be willing to report breaches to federal authorities like the FBI or IRS, who otherwise would likely be notified, in light of the federal illegality of cannabis. Malicious actors may believe that this gives them some sort of advantage—and to some extent it does if law enforcement is not given notice.
  • Given the state of banking in the cannabis industry, cannabis businesses may use cryptocurrency, which could have keys that are stored on electronic devices that are capable of breach. This could expose a cannabis business to financial losses unlike in virtually any other industry.
  • The reputational harms to an up-and-coming licensee could destroy a cannabis business. Even though many of the stigmas around cannabis have gone away, many people wouldn’t want their employer or the general public to know that they bought cannabis. Imagine what a government employee would think if a cannabis business was the victim of a breach and his or her employer suddenly could find out about the employee’s purchase history. That business probably would not last.
  • The industry is forced to interact with technology in a way that many others are not. In California, as well as most other states with licensing regimes, cannabis companies must implement track-and-trace systems to monitor all commercial cannabis activity. Licensees of the California Bureau of Cannabis Control (“BCC”) are legally prohibited from transporting, transferring, or delivering goods during outages of track-and-track systems—i.e., doing most kinds of business. What happens when they are the victim of a ransomware attack (a situation in which a hacker encrypts all computer systems and demands compensation in cryptocurrency or something similar in exchange for the decryption key, which may take days or weeks to fully restore)? Businesses could literally bleed out while trying to negotiate with–or pay a ransom to–someone across the globe.
  • State attorneys general may need to be notified of certain data breaches. If an attorney general in a state in which cannabis was not legal receives notice that a number of the attorney general’s home state citizens were the victims of a data breach, that attorney general may want to target that cannabis business with an enforcement action.

These are just a few of the unique pressures the cannabis industry faces.

Breaches are in many senses inevitable. There is still a lot that companies can do to reduce the impact of them or to attempt to prevent them. Below are a few:

  • Having a privacy policy and sticking to it. We’ve written about the need for policies before, and the potential penalties for not complying. We get the sense that a lot of cannabis businesses think of this as unnecessary or just a rote copy-and-paste job. This is not accurate. These policies are detailed, and are designed to identify the information gathering and usage policies of an organization. If an organization follows a policy, then it should in theory know what information it has, and where. This could be the difference in whether significant time and resources are spent tracking down potentially accessed information.
  • Complying with relevant information security standards. Many states actually require businesses to adopt certain standards when it comes to information storage. Technical measures can be adopted to reduce the likelihood or impact of breaches.
  • Planning for breaches. Training employees, and having plans for what to happen in the event of a breach, could also avoid or lessen the impact of a breach.
  • Considering insurance. Insurance companies are starting to provide cyber liability insurance, which could cover the costs of some breaches. This won’t actually prevent a breach, but may stop a company from spending significant amounts of money in response to a covered breach.

The point of this post is to highlight just how significant breaches can be for cannabis businesses. Preparing now, rather than after they occur, could avoid a great deal of issues later.

industrial hemp cannabis farm bill

Just two weeks after Speaker of the House Paul Ryan expressed public support for the legalization of industrial hemp, Senate Majority Leader Mitch McConnell is now guaranteeing that the 2018 Farm Bill will include the industrial hemp legalization provision once the House and the Senate solve their difference regarding this issue.

If there’s a Farm Bill, it’ll be in there, I guarantee that,” McConnell told reporters last Friday.

(To watch McConnell’s hemp legalization guarantee, go to 13:15 into this video clip).

As we have discussed at length, the House and the Senate versions of the bill differ in that the House version is silent on the legalization of industrial hemp whereas the Senate version, which was introduced by the Senate Majority Leader himself, would remove the crop from the definition of “marijuana” under the Controlled Substance Act, and instead treat hemp like a standard agricultural crop. Indeed, although industrial hemp and marijuana are the same species, hemp contains a negligible amount of tetrahydrocannabinol (“THC”), the psychoactive compound that gives its users a high.

In justifying his support of the legalization of the crop, McConnell stressed the immense value and versatility of industrial hemp. In addition, McConnell declared that he became aware of the international implications of hemp legalization during his visits of hemp processors this past year and explained that major foreign investors have expressed interest in the hemp business, signaling the crop’s tremendous potential.

I don’t want to overstate this—I don’t know if it’s going to be the next tobacco or not—but I do think it has a lot of potential. And as all of you already know, in terms of food and medicine but also car parts…it’s an extraordinary plant.”

According to the Senate Majority Leader, once legalized, industrial hemp will be “lightly regulated” by the U.S. Department of Agriculture. In addition, there will be no more federal involvement except for the issuance of crop insurances to hemp farmers—which is one of the most significant provisions included in the Senate version of the bill. Instead, industrial hemp would be regulated by local law enforcement, pursuant to the state program under which hemp farmers would be registered.

Although McConnell acknowledged that a provision pertaining to work requirements for food stamp recipients had caused delays in the enactment of the 2018 Farm Bill, he declared that the enactment of the bill will be one of his top priorities when Congress reconvenes for a lame-duck session.

The continuing public support for the legalization of industrial hemp by conservative Congressional leaders strongly suggests that the enactment of the 2018 Farm Bill is imminent, which is fantastic news!

OLCC oregon violation license
Recommended compliance level for Oregon licensees.

A couple of months ago, the Oregon Liquor Control Commission (OLCC), for the first time, rejected a settlement offer from a licensee who had violated OLCC rules. At the time, we speculated the OLCC was done with settling and moving towards stricter compliance requirements. It seems, along with more stringent review of applications, the OLCC is doing exactly what we predicted and either rejecting settlement agreements or negotiating tougher settlements that result in licensees voluntarily giving up their licenses.

On September 21, the OLCC approved an administrative law judge’s (ALJ) order to temporarily suspend the marijuana license of the Corvallis Cannabis Club. Typically, a licensee is allowed to continue to operate as normal after receiving a charging document from the OLCC pending the outcome of a settlement or hearing. However, the Corvallis Cannabis Club was under investigation from the federal DEA and the OLCC agreed with the ALJ that a temporary suspension was necessary.

That same day, the OLCC also cancelled High Cascade Farms license after determining the licensee had violated 13 OLCC rules including transporting marijuana to an off-site location and intentionally misrepresenting to the OLCC what happened to the plants.

On October 26, 2018, the Oregon Bud Works agreed to surrender its license to the OLCC after committing 10 OLCC rule violations including changing the licensed premises without approval from the OLCC, failing to keep required surveillance video, and misrepresenting data in METRC.

I have spoken with several people at the OLCC recently about these developments. They all have the same message: now more than ever, it’s time to ensure compliance with the rules. The OLCC believes there has been sufficient time since legalization and the rules have rolled out for licensees to understand and abide by the rules. They are no longer willing to consider settlements that allow licensees to keep their licenses when there are multiple rule violations or especially egregious rule violations.

It unlikely that the OLCC will ever go back to reduced penalties for egregious violations or multiple violations. The agency seems less interested in teaching compliance at this point, than culling the herd. So what can you, an OLCC licensee do?

First and foremost, get familiar with the rules. Undoubtedly, the rules are expansive and overwhelming. They also change frequently. However, if you want to preserve your license, one of the most important assets you can have is a compliance person whose job it is to know the rules and ensure that your company complies at all times. On this point, make sure all of your employees are familiar with the rules, as well. The fact that an employee has a marijuana worker permit is not enough– your business is on the hook for any violation they may commit.

Second, when you have questions about whether a step or process is correct, specialized cannabis business attorneys are a great resource to assist. If you can have person dedicated to ensuring compliance and an attorney to help with interpretation when necessary, hopefully your licensed business will avoid a charging document from the OLCC. Those documents are looking more and more dangerous, and contesting them can be quite a process.

california cannabis temporary license
Hopefully, more cities are creative with this hard stop.

We recently wrote about an announcement by the California Department of Food and Agriculture (“CDFA”) that temporary license applications need to be submitted by December 1, 2018 in order to be reviewed on time for approval and issuance before December 31, 2018. To date, California Department of Public Health (“CDPH”) followed suit, but the California Bureau of Cannabis Control (“BCC”) has not. It’s safe to say that BCC applications submitted after December 1, 2018 have a low chance of being issued this year.

This is significant because after January 1, 2019, these agencies will have no legal authority to issue temporary licenses, and will not do so. After January 1, 2019, only provisional licenses will be issued, and only then to parties who hold or held temporary licenses. Parties that don’t have temporary licenses and thus cannot get provisional licenses will be stuck in the annual license logjam, which everyone knows moves at a snails’ pace. These deadlines cannot be solved with more regulations. They are from MAUCRSA and only the legislature can modify them. We wouldn’t count on that happening.

This time crunch places would-be licensees whose local applications are under review from California cities in a tough spot. As part of the state-level application process, the above-linked MAUCRSA section requires applicants to fork over “[a] copy of a valid license, permit, or other authorization, issued by a local jurisdiction”, and cities are not going to state that an applicant is approved while an application is under review.

Some cities have come up with creative solutions to this problem. The Los Angeles Department of Cannabis Regulation (“DCR”), for example, issued a release stating that it would issue to applicants from the second phase of applications (which closed a few months ago) who have paid their application fees a local letter of authorization that could be taken to the target state agency. The letter would not authorize commercial cannabis activity in Los Angeles. It would authorize an applicant to simply move into the temporary license phase, in order to eventually secure the provisional license that would eventually get them operational faster. At least one state agency, in turn, has expressed that letters from localities may be sufficient. Earlier this year, the CDPH wrote that local authorization may take the form of a “letter of acknowledgement”.

L.A. is a big city, and is swamped in applications. Our L.A. cannabis business and real estate lawyers have seen some other cities issue letters of authorization, but others that have refused. It’s not clear whether many other cities would write a letter of authorization, or what they would be willing to say. But it’s certainly worth reaching out to a city to see if they will.

california real estate development agreement
You get what you negotiate in development agreements.

This is the third post in our three-part series on development agreements in California. In our first post we provide an overview of the use (and misuse) of development agreements in the cannabis industry. The second post breaks down the basics of development agreement laws. Here, we will discuss the key terms to include and what to watch out for when negotiating a development agreement with a public agency.

Term

As we’ve explained, California’s development agreement laws were enacted to provide assurances to developers faced with uncertainty in government approval processes for complex and long-term development projects. A development agreement should provide developers with assurances that the developer will see a return on investment by providing vested rights to engage in a particular use on a property. The rights are locked in so that if local laws change in the future (e.g., the voters or legislative body prohibit a particular use), the uses permitted in the agreement can continue for the remaining term of the agreement.

Accordingly, one of the fundamental terms of a development agreement is its duration. Commonly, development agreements in the non-cannabis context provide vested rights for a period of ten to twenty years. Properly building out a facility tailored for commercial cannabis uses may cost millions to tens of millions of dollars. If the term of a development agreement is only one to five years (as many California public agencies are proposing), a developer will not likely recoup the value of his or her investment. Imagine investing $15 million into a state-of-the-art cultivation and manufacturing facility, only to be prohibited from engaging in commercial cannabis activity one year down the road. Don’t go in for a short-term agreement!

Permitted Uses

Another key term of a development agreement is the description of permitted uses at the property. This clause should be given careful attention, and must be drafted to ensure that all of the contemplated uses of the property are explicitly spelled out. Stating “commercial cannabis activity” without referring to specific categories or license types will lead to confusion and potential problems. If the developer wants to engage in manufacturing, cultivation, and distribution, for example, then all of those uses should be described with as much specificity as possible to ensure that there is no question as to what the public agency authorized.

Many developers want to include uses that the local jurisdiction has not yet authorized. For example, a local jurisdiction may currently allow cultivation and manufacturing, but no retail use. A developer might want to engage in retail use at some point down the road, and therefore want to include retail in the permitted use clause. However, while a developer can commit to uses more restrictive than those set forth in the zoning ordinance, a development agreement may not allow uses or create exceptions to use restrictions beyond those allowed in the zoning code; to do so requires a rezoning or amendment to the zoning ordinance. Neighbors in Support of Appropriate Land Use v County of Tuolumne (2007) 157 Cal. App. 4th 997, 1015. Once the zoning code is amended, the developer can apply to amend the development agreement accordingly.

Vested Rights

Another fundamental aspect of a development agreement is the provision of vested rights to the developer. A “vested right” is a right to proceed with construction or other land use activity despite an intervening change in the law. See Avco Community Developers, Inc. v South Coast Reg’l Comm’n (1976) 17 C3d 785. Obtaining vested rights is essentially the entire point of a development agreement. However, we have seen some cities attempt to expressly prohibit developers from obtaining a vested right to engage in commercial cannabis activity. A development agreement should explicitly grant vested rights to the developer, and the vesting should not be conditioned on unreasonable or unattainable benchmarks.

Notice and Cure Period

Development agreements should provide developers with an adequate notice and cure period to enable the developer to remedy any problems and maintain its rights under the agreement before the public agency has the right to terminate. Vested rights under a development agreement are a valuable asset to the property, and developers (and their lenders, if applicable) need to have an opportunity to cure any potential defect and remain in good standing with the public agency to protect the value of the property.

Non-Mandatory

A development agreement should provide developers with the right, but not the obligation, to develop and use a property. Similarly, a development agreement should not require the developer to pay fees for a use it does not pursue. Many development agreements we have seen purport to require developers to pay fees to the public agency even when the cannabis uses are not actually pursued by the developer.

Construction Schedule

Some public agencies require developers to include a construction schedule in the development agreement. If the public agency insists on such a provision, make sure that the proposed schedule provides maximum discretion and control to the developer, is realistic and attainable, and does not penalize developer for failing to reach certain construction milestones. Construction is riddled with unforeseeable delays, which means there is a strong chance of running afoul of the development agreement terms or having to amend the development agreement if a strict construction schedule is spelled out in the agreement.


This post is not exhaustive, and you should consult with an experienced cannabis real estate attorney before negotiating a development agreement related to this highly dynamic industry in California.