Licences and Registration of Controlled Substances and Precursor Chemicals under the Controlled Drugs and Substances Act

Description

In Canada, activities involving controlled substances and precursor chemicals require specific licences or registrations under the Controlled Drugs and Substances Act (CDSA). There are two broad streams:

1. Controlled Substances: Entities must obtain a Controlled Substances Dealer’s Licence to possess, package, produce, sell, import, export or distribute controlled substances. The requirements are the same for the following substance type:
   1. Narcotics and Controlled Drugs: Applicants must designate a Qualified Person in Charge (QPIC) and meet security, record-keeping, and personnel criteria.
   2. Restricted Drugs: Licences are issued only for research or clinical testing, with prior Health Canada approval.
   3. Targeted Substances (e.g., benzodiazepines): Similar licensing requirements apply, including QPIC designation and operational controls.
2. Precursor chemicals are regulated as Class A or Class B:
   1. Class A Precursor chemicals require a dealer’s licence. Applicants must designate a Senior Person in Charge (Senior PIC) and a Responsible Person in Charge (RPIC), and provide detailed site and security information.
   2. Class B Precursor chemicals require registration, not a licence. Applicants must designate a Senior PIC and a contact person. Registration covers all sites and is valid for a set term. Both processes are subject to Health Canada oversight, including inspections and compliance reviews.

Why a privacy impact assessment was completed

In accordance with Appendix C.2.2.9 of the Directive on Privacy Practices, a Privacy Impact Assessment (PIA) was conducted on the legacy programs within the Office of Controlled Substances, including the licensing and registration program as it involves the collection, use, disclosure, retention and disposal of personal information for an administrative purpose, including when an existing program that uses personal information for an administrative purpose does not already have a Personal Information Bank (PIB).

The PIA identifies and assesses privacy risks to personal information collected and used by the OCS as part of the intake, assessment, and decision-making process for licence and registration applications. 

Additional information

The assessment identified areas where privacy practices can be strengthened. The Program will take steps to address these areas as part of its ongoing efforts to enhance privacy protections:

• Transparency and individual awareness: The Program will update its privacy notices to meet Treasury Board Secretariat (TBS) requirements, ensuring individuals are clearly informed about how their personal information is handled and what their rights are. It will also work with internal partners to develop and publish a PIB to improve transparency about the types of personal information collected and how it is used.
• Access controls and auditing: The Program will establish standard procedures to regularly review access to personal information stored in shared inboxes, SharePoint sites, and Shared Drives. It will also implement an audit process to ensure that only authorized staff can access or modify sensitive information.
• Information sharing agreements and disclosure management: The Program will work with the Privacy Management Division to explore formal agreements with key partners to clarify how shared personal information should be used, retained, disclosed, and destroyed. It will also improve internal processes for documenting and monitoring disclosures of personal information.
• Data minimization, retention and disposal and communication: The Program is updating its records disposition authority to align with Library and Archives Canada's disposition standards to ensure that personal information is not retained longer than necessary. In parallel, a detailed review of data elements collected is underway to ensure only necessary information is collected, processed, retained and communicated through secure channels, including the use of encryption when interacting with individuals.
• Responding to informal access requests: The Program will direct all informal requests from individuals seeking access to their personal information to Health Canada’s Access to Information and Privacy (ATIP) Operations. While not a compliance requirement, this approach supports transparency and aligns with best practices encouraged by the TBS Directive on Personal Information Requests and Correction of Personal Information.

For more information about this privacy impact assessment

If you would like more information about this PIA, contact the Office of Controlled Substances at ocs-bsc@hc-sc.gc.ca