The receipt and triage of cannabis complaints and questions pursuant to the Cannabis Act and the Cannabis Regulations

1. Description

The Cannabis Compliance and Enforcement Program oversees the activities of regulated parties under the Cannabis Act, including federal license holders, provincially and territorially authorized retailers (to which the Act's promotions prohibitions apply), parties who sell cannabis services and accessories, and registered persons authorized to grow cannabis for medical purposes.

The success of the Program depends partly on public participation in reporting potential violations of the Cannabis Act or its regulations (complaint process), such as unauthorized activities, improper advertising, or public health and safety risk.

Individuals or organizations may submit complaints or questions to the Program which may include personal information. The information provided, along with other relevant data, is utilized to respond to questions and to assess compliance and identify potential compliance and enforcement actions.

2. Why a privacy impact assessment was completed

In accordance with Appendix C.2.2.9 of the Treasury Board of Canada Secretariat Directive on Privacy Practices, a Privacy Impact Assessment (PIA) was conducted on the Program as this program involves the collection, use, disclosure, retention and disposal of personal information for an administrative purpose, including:

• the use of a new technology
• when an existing program that uses personal information for an administrative purpose does not already have a personal information bank (PIB)

The Program will use the Cannabis Tracking and Licensing System to retain personal information. A new PIB has been developed for this program.

3. Additional information

This PIA examines the collection, use, retention, disclosure, and disposal of personal information by Health Canada during the intake and triage of cannabis-related complaints and inquiries, in accordance with the Cannabis Act and Cannabis Regulations.

The assessment identified several areas where privacy practices can be strengthened. The Program is actively working to address these areas as part of its ongoing efforts to enhance privacy protections:

• Information sharing agreements and disclosure management: The Program is updating existing Memoranda of Understanding with key partners and establishing and enhancing new ones to help safeguard shared personal information while it is improving processes for documenting and monitoring disclosures.
• Data minimization, retention, disposal and communication: The Program is updating its records disposition authority to align with Library and Archives Canada's disposition standards to ensure that personal information is not retained longer than necessary. In parallel, a detailed review of data elements collected is underway to ensure only necessary information is collected, processed, retained and communicated through secure channels, including the use of encryption when interacting with individuals.
• Access controls and auditing: The Program will strengthen access control, including the implementation of centralized audit logs and standard operating procedures for routine system audits to address risk of unauthorized access to personal information.
• Transparency and individual awareness: To support greater transparency, the Program is introducing clear privacy notices and updating the PIB to ensure completeness and clarity.
• Program scope and privacy assessment: Recognizing that this PIA focuses on intake and triage, the Program is committed to conducting additional privacy assessments on other aspects of the cannabis activities to ensure comprehensive risk management.

4. Related personal information banks

Health Canada is developing a new PIB for this program.

5. For more information about this privacy impact assessment

For more information about this PIA please contact the Cannabis Compliance and Enforcement Program at compliance-cannabis-conformite@hc-sc.gc.ca.