The Privacy Commissioner of Canada released a "guidance document" today explaining why he feels it best that Canadians use cash when purchasing marijuana, even at legal and licensed dispensaries. The guideline also advises Canadians to provide as little personal information as possible when making purchases of marijuana.

Marijuana became legal in Canada this past October, and while most Canadians were more than pleased with the choice by the federal government, there have been a handful of hiccups.

Because cannabis is an illegal substance in most other countries, the personal information of Canadians who are making legal purchases within Canada is very "sensitive," according to the guide.

This sensitivity is, of course, due to the fact that countries can deny entry to Canadian citizens if they know they have purchased cannabis, even if it was purchased within the limits of the Canadian law.

This of course is most pertinent to Canadians travelling to the United States. Because marijuana has not been legalized by the federal American government, Canadians who have purchased marijuana can still be under scrutiny at the border, and can certainly be turned away.

Ambiguity about the spread of personal data through legal marijuana purchases is exactly why the Privacy Commissioner has released this document — while any personal information collected should be kept private at all times, it can be difficult to ensure.

Under the Personal Information Protection and Electronic Documents Act, retailers are required to inform individuals about "what personal information is being collected, to which parties it will be disclosed, the purposes for its collection, and any residual risks of harm" to the customer.

The guide is clear that while marijuana dispensaries are required to confirm the age of customers before purchase, there is no reason to record this information. Moreover, because marijuana has been legalized recreationally, customers should not feel the need to provide medicinal information upon purchase.

With that said, a retailer cannot avoid collecting personal infromation when completing a transaction with a credit card. As we all know, "a purchase made using a credit card would involve the collection of the credit card number and cardholder’s name."

This is also the case with a mailing list or a membership club, where a retailer might choose to collect an e-mail address associated with the customer. The privacy guideline suggests that retailers "consider only collecting the minimum amount of personal information required for mailing lists or memberships."

The guideline also makes reference to the safety of online information, going so far as to advise consumers to "ask retailers whether they store [...] personal information on servers outside of Canada," inevitably implying that the safety of information stored on international servers may run the risk of being compromised.