Risks of Disclosing Personal Information to California Cannabis Licensing Authorities

When registering with California licensing authorities and applying for cannabis licenses, certain information must be disclosed.  Depending on the type of license applied for, some of that information, such as the cannabis license type, legal business name of the license holder, license holder contact information, premises location, and other information, may be obtained publically with a little searching.  But what about all of the sensitive or personal information disclosed? 

Responsibility to know how personal information will be used

Individuals considered “owners” or “financial interest holders” (as defined in California cannabis regulations) in California commercial cannabis businesses must disclose their social security numbers along with other personal information.  Although, most of the information disclosed is not generally available to the public, in certain circumstances the information can be obtained by the public or other governmental agencies.  Participants in cannabis businesses should have an idea of how their information can be used, especially when the participant has a responsibility to inform others in the venture of how the information can be used.  For example, a founder raising capital and collecting personal information should describe to the participants how the information could be used and request consent to disclose that information to certain governmental authorities.

How can your personal information be used? Are there use limitations?

California cannabis laws and regulations do not specifically state what that information can or cannot be used for.  However, some of the use limitations can be found in the terms that must be accepted by an applicant prior to registering electronically with the applicable California licensing agency.  For example, the terms of the Bureau of Cannabis Control (BCC) state in part that “[t]he [BCC] will not disclose, use for any purpose other than as specified at the time it was collected, or make available any personal information collected, except with the written consent of the subject of the information or as otherwise permitted by law or regulation.”  In other words, the information provided to the BCC can only be used for the BCC stated purpose unless a legal exception applies.

So what purpose does the BCC state the personal information will be used for?  It depends on the information provided, but here are a few examples: On the more confidential end of the spectrum, when registering with the BCC and a social security number is first provided, the BCC states that the information will be used exclusively for tax enforcement purposes and for purposes of compliance with child support obligations.  On the other end of the spectrum, when providing a mailing address, the BCC states that the mailing address is considered public information and disclosable pursuant to the California Public Records Act.

Public access to information

The BCC registration terms go on to state that “the public has a right to access appropriate records and information processed by State government. At the same time, there are exceptions to the public’s right to access public records. These exceptions serve various needs including maintaining privacy of individuals. Both State and federal laws provide exceptions. All information collected [by the BCC] becomes public record that may be subject to inspection and copying by the public, unless an exemption in law exists.”

In short, there are limited circumstances where sensitive information can be disclosed. Those limited circumstances must be specifically stated.  Other than those circumstances the information will be protected unless applicable law requires the material be disclosed.

Stay compliant with state and local laws to avoid disclosure of personal information

The worst-case-scenario for possible disclosure is if the cannabis business violates major state and federal laws (e.g. distribution across state lines, distributing to minors, working with the cartel, etc.).  In the foregoing scenario, all personal information disclosed under the business committing the violation may be subject to law enforcement action and could be released via subpoena, court order or by other enforcement process.

The above describes only a few disclosure risk examples. However, each person involved with a cannabis business should understand their company and their involvement to the degree necessary to have a basic understanding of the risk of personal information disclosure.