- der current law, each cannabis operator can work with a bank and submit limited information to protect consumers and patients’ privacy.
- AB 1525 would encourage financial institutions to require cannabis operators to choose between safe access to banking and sharing confidential information without limits, to “entities” not required to maintain confidentiality.
- AB 1525 allows any Joint Powers Authority (JPA) such as the California Cannabis Authority to obtain track and trace data at time when this entity is understaffed and underfunded.
- AB 1525 encourages the creation of entities that want to create duplicative regulatory oversight for profit purposes that will create additional costs to cannabis operators.
Currently, there is only one joint powers authority in California in the businesses of collecting cannabis licensee’s data, the California Cannabis Authority (CCA). AB 1525 permits cannabis businesses to:
“request in writing that a state or local licensing authority, state or local agency, or joint powers authority share the person’s application, license, and other regulatory and financial information with a financial institution of the person’s designation. The person shall include in the written request a waiver authorizing the transfer of that information and waiving any confidentiality or privilege that applies to that information.”
While AB 1525 was amended to not name the CCA specifically, the bill continues to only apply to this entity as no local government is collecting track and trace data to provide financial services. The CCA mandates cannabis operators at the local level to provide data which has caused cannabis operators to raise concerns and refusal to provide such data.
AB 1525 Allows Disclosure of Cannabis Operators’ Confidential Information
AB 1525 requires a blanket waiver of confidentiality and privilege. There is no need for a blanket waiver of all confidentiality and privilege with such language which will have unintended effects on other laws and regulations, including but not limited to the California Consumer Privacy Act, the Gramm- Leach-Bliley Act of 1999, The Fair Credit Reporting Act, Right to Financial Privacy Act, and those upon which the Bureau of Cannabis Control currently rests in opposing Federal Drug Enforcement Administration licensee information subpoenas in United States v Bureau of Cannabis Control, et al, Case No. 3:20-cv-01375-BEN-LL (2020). The data-sharing provisions in 1525 would simply hinder our collective efforts to protect sensitive consumer and licensee data from fishing expeditions.
While access to specified, financial information is necessary to maintain compliance with FinCEN guidelines, broad, unrestricted access to an operator’s track and trace data is unnecessary and unwarranted.
Requirements For Joining the CCA Creates a Burden on Cannabis Operators
Cities and Counties that are members of the CCA must require cannabis licensees in their jurisdiction’s to provide the CCA with point-of-sale information; the information is collected directly by the CCA.
Point of sale data contains proprietary business information that is similar to track and trace data. The information is confidential as it contains consumers and patients’ names, number of sales, and type of products sold. The information discloses cannabis businesses operations. The CCA has stated in public documents that the more data they have, the higher profits they would make.
CCA Funding Method Increases Costs for Cannabis Operators
The CCA adopted a financing structure that includes a fee to be paid by each member county and participating entity that is based upon total sales within the jurisdiction. The use fee originally set was 0.35%, or 35 basis points of total sales within the jurisdiction. In addition, the use fee of 35 basis points was lowered to 15 (.0015) through 2019, and to 25 (.0025) beginning January 1, 2020. The 25 basis points are charged on all analyzed cannabis transactions to occur in each jurisdiction that is part of the CCA. The following use fees can apply:
- First Fee: Cultivator sale to distributor transaction.
- Second Fee: Distributor sale to manufacturer transaction.
- Third Fee: Manufacturer sale to retailer transaction.
- Fourth Fee: Retailer sale to consumer transaction.
When $500 million of cannabis transactions occur within a jurisdiction, the local jurisdiction will have to pay one million two hundred and fifty thousand dollars ($1,250,000) to the CCA. These costs would be passed onto the licensees and consumers in order for the local jurisdiction to observe the costs. AB 1525 encourages the activities by the CCA to charge per data collected..
The cannabis industry is overtaxed, over regulated and substantial fees are paid for licensing. In addition, the cannabis industry is undermined by the illicit market. Cannabis operators should not be paying fees for data to be processed specially when the local governments’ and JPA’s data programs are duplicative.
CCA Is Understaffed and Underfunded, Will Not Stand Federal Scrutiny and Place Cannabis Operators at Risk
The CCA is understaffed and underfunded. Cannabis operators are required to disclose point of sale data at the local level. The CCA is not ready to obtain data from thousands of operators. One big concern is that the Federal law enforcement can subpoena the CCA to turn over track and trace data and point of sale data. We recently have witnessed the Bureau of Cannabis Control not comply with federal subpoenas because of the agency’s substantial legal resources. However, an entity as the CCA would not be able to protect this information. The CCA has very limited staff to address legal challenges that can arise because of the data that would be acquired. The track and trade data would be turned over to the federal government that would be used against cannabis operators.
The CCA is Creating a Duplicated Reporting Method for Cannabis Operators
The purpose of the CCA is to create a duplicative enforcement structure for the cannabis industry. The CCA intends to use water usage data, energy usage data, sales data, cultivation data and any other data available to monitor cannabis operators.
According to the CCA:
“The data platform will be designed to start where the state’s Track and Trace (TaT) systems stop. TaT systems are built to track anything entered by an end user. TaT methodology requires user input and relies on the end user’s ability to enter, or scan data correctly into the TaT system. This is where the CCA platform adds significant value. The CCA platform isn’t constrained to just data from one source, and it isn’t built to “track”, but is built to analyze and evaluate. The platform looks for anomalies with individual data sources and also looks at how those sources interact with one another, giving a more complete picture and a higher degree of confidence that what is being reported and what is occurring are truly one in the same. When they are not the same, the platform creates an alert. The speed at which the alert is delivered is key for investigation and enforcement actions to correct bad behaviors and catch bad actors quickly and more efficiently.”