Oregon Gov. Kate Brown recently signed into law Senate Bill 863. The bill attracted bi-partisan support as it moved through the legislature and is well intended. The bill protects consumer names, addresses and other personally identifiable information. Patrons of adult-use cannabis retailers in Oregon no longer have to worry about whether or not their information will be recorded or transmitted to a third party. The obvious benefit to consumers is that their personally identifiable information is not available to unscrupulous persons or government bodies. Maintaining privacy in the face of potential federal investigations sometime in the future is a welcome development.
However, the privacy protections granted in SB 863 are so broadly written that they potentially create a new hurdle for providing cannabis businesses with greater access to banking services. Oregon cannabis retailers are prohibited from recording, retaining or transmitting any information that may be used to identify a consumer to any other person. The bill defines “information that may be used to identify a consumer” as information that may be acquired through the production of a passport, state-issued driver’s license, state-issued ID card or U.S. military ID card, whether the information is contained in that document or in a different document or record.
Cannabis retailers operating on an all-cash basis generally have two reasons for obtaining identifying information from customers. First, adult-use cannabis cannot be sold by a licensed retailer to anyone under the age of 21. Identification is used by the retailer to verify the customer’s age. Second, the Oregon Administrative Rules prohibit a retailer from selling more than 1 ounce of flower, 16 ounces of a cannabinoid product in solid form, 72 ounces of a cannabinoid product in liquid form, 5 grams of cannabis extracts or concentrates, 4 immature cannabis plants and 10 cannabis seeds (in the aggregate) to one customer at any one time or within one day. Cannabis retailers that were concerned about overselling to a customer may have recorded personally identifiable customer information in order to avoid violating the stated limits.
A common merchant services debit or credit card transaction generally goes something like this — the retailer uses a point-of-sale terminal to scan your item or items and calculates the total amount due. The retailer then keys in the amount due to a credit and debit card payment terminal that is able to read the magnetic stripe or chip. The magnetic stripe generally contains the card number, the name of the cardholder and the expiration date. Newer chip-enabled cards generally have identical data encoded on the chip. The card payment is authorized and a receipt is printed for the customer to sign, which the merchant keeps. A duplicate copy may be printed for the customer. The plain language of SB 863 may prohibit recording, retaining or transmitting a debit or credit card holder’s name because that information identifies the consumer, and their name is probably contained on their ID.
The legislature’s efforts to protect consumer privacy are laudable, and is a logical outcome following the confirmation of Jeff Sessions as Attorney General and subsequent increased fears of federal enforcement. Cannabis consumers should be aware that any federal enforcement could have negative effects and should therefore demand state-level laws that protect their interests.
However, SB 863 does not appear be crafted in ways that anticipate the potential relaxing of federal laws. Instead, the bill was so broadly drafted that it may create an additional hurdle to banking services in the future. Banks and merchant service providers that offer debt and credit card services to retailers may continue to balk at providing such services to Oregon cannabis retailers if boilerplate merchant services agreements require cannabis retailers to retain personally identifiable information in violation of state law. We can only hope that Oregon law is not the final hurdle that prevents access to banking services.
Earlier this week, Congressman Earl Blumenauer was the keynote speaker at the Oregon Cannabis Association event, Toke Talk. Congressman Blumenauer emphasized his efforts to provide greater access to banking services and eliminating the impact of Internal Revenue Code section 280E on cannabis businesses that are compliant with state law. Toke Talk featured a number of speakers that offered industry insights and inspiration, while others expressed consternation over intrusions from big business and big pharma.