Privacy impact assessment: Cannabis and hemp licensing application process
Description of program
Health Canada assesses applications for licences under the Cannabis Act, including:
- Licence for standard cultivation
- Licence for micro-cultivation
- Licence for a nursery
- Licences for standard processing
- Licence for micro-processing
- Licence for sale for medical purposes
- Licence to cultivate industrial hemp
- Licence for analytical testing
- Licence for research
- Cannabis drug licence
This program is delivered by Health Canada's Controlled Substances and Cannabis Branch. The program requires the collection of personal information about licence applicants, as well as specific staff/management for the licence holder.
Why was a PIA completed?
This PIA was completed as personal information is used to make administrative decisions about individuals who are involved in the cannabis or hemp licensing process. While the majority of applicants for licences and permits are companies, some are individuals. The PIA examines the privacy-related risks of the Controlled Substances and Cannabis Branch's licence application process related to the collection of personal information for licensing, credential validation or security clearance and proposes methods to lower these risks.
More information
This PIA focused on Health Canada's collection, use, disclosure, retention, and disposition of personal information involved in the licensing process under the Cannabis Act.
The PIA recommended the following risk are as: develop Personal Information Banks, amend the online privacy notice statements, document regular disclosures in an Information Sharing Agreement or Standard Operating Procedure and limiting the collection of personal information.