Client Alert: New California Privacy Law, AB-2402, Specifically Targets Cannabis Licensees

A new California privacy law aims to protect cannabis customers by restricting the information to be shared by cannabis companies licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA).

Signed into law on September 20, 2018, AB-2402 prohibits California cannabis licensees from sharing their customers’ personal information, with a few exceptions.

Notably:

• Under this new law, a cannabis licensee may not disclose a consumer’s “personal information” to a third party, except under certain circumstances relating to payment, to facilitate the official duties of the state/county/city, or where the consumer has consented to the disclosure.
• Importantly, the law prohibits cannabis licensees from refusing service to (or otherwise discriminating against) consumers who do not consent to disclosing their personal information.
• “Personal information” under this law means an individual’s first name (or first initial) and last name in combination with one or more of the following: (i) Social security number; (ii) Driver’s license number or California identification card number; (iii) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; (iv) Medical information; (v) Health insurance information.
• A “third party” under this law does not include a contractor providing software services to conduct a transaction or verify eligibility (so long as the contractor does not share the consumers’ information).
• The law now categorizes marijuana identification cards (issued under the Medical Marijuana Program) as “medical information” for purposes of complying with California’s Confidentiality of Medical Information Act (or “CMIA”).
• Further, a MAUCRSA licensee authorized to receive or receiving marijuana identification cards is considered a “provider of health care” (again, for purposes of complying with the CMIA only), meaning that cannabis companies could face penalties for improper use and disclosure of medical information.
• In sum, the law clarifies cannabis licensees’ duties with respect to their customers’ personal information and affords greater protection to such information than the California Civil Code

For questions regarding this update, please contact:

Kristina Sherry
310.203.2800
[email protected]