Cannabis companies: You should care where your data lives

Cannabis companies: You should care where your data lives

Table full of Cannabis Products

Are you in the business of cannabis? You need to listen. In Canada, cannabis is a drug that's been legalized nationwide for recreational and medicinal use. Cannabis consumption is now legal across all of Canada.

But if you’re in the business of growing, manufacturing or selling cannabis products, and especially if your business takes you south of the border, you're probably already aware that cannabis has been outlawed for over 8 decades in the United States. It’s still a federally-controlled substance that can lead to jail time if you’re caught with it. This is why many cannabis companies do not use the word "cannabis" or derivatives in their companies name.

Marijuana can’t be transported over state lines, and while there are some states that have legalized recreational and medicinal use of cannabis there are still many states that have not. Unlike Canada, where you can now fly with cannabis in your carry no luggage flying between provinces, you are not able to travel from Canada to the U.S. with cannabis. This is true even if you are flying into a state that has legalized the use and consumption of cannabis as the TSA is a federally regulated agency. Each individual state has different rules on what is and isn’t acceptable regarding production and sales of the drug.

If you're dealing with any U.S.-based hosting company, you should reconsider. Seriously. If for any reason the U.S. changes gears or the next elected government that comes into power has more stringent views on the consumption of cannabis, your email and data could be at risk. It's probably at risk right now if you're hosting your data with a U.S. based company.

This means that if your email is stored with companies such as Google, Office 365, GoDaddy and more, they have no choice but to hand over your information to the government if requested. Even if you’re storing it in a U.S. data centre in a state where it’s legal to use cannabis recreationally.

The same is true if you have your data stored in a Canadian data centre, but the ownership of the company is U.S. based. Amazon Web Services, Azure, Google Cloud Platform, and so on. The U.S. CLOUD Act gives the U.S. government carte blanche access to your emails, most likely without you knowing about it and without any protest from the company that hosts your email. Below is a quick overview of the CLOUD act and how it could negatively impact your cannabis production, even as a Sovereign Canadian business.

U.S. Access to Foreign Stored Data

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, signed into law in March 2018, is an Act to provide trans-border access to communications data in criminal law enforcement investigations.

First, the Act amended U.S. law to authorize U.S. law enforcement to unilaterally demand access to data stored outside the U.S., despite widespread criticism from the international community. When the U.S. orders a company to produce communications data, the Act provides a mechanism for a communications provider to challenge the order if disclosing the data would risk violating foreign law. Under the CLOUD Act, the legal protection of an individual's rights depends on the objection by a provider. There is no direct mechanism for individuals to challenge an order under the CLOUD Act. A court will consider a provider's challenge of an order for disclosure of data data and review the request under a multi-factor "comity" analysis to assess foreign and other interests at stake. However, U.S. court can require production of that data despite the objection, even where the laws of another nation would be violated.

But what about Canada? How are we different? We don’t have to comply with the U.S. laws when the data lives on non-U.S. soil, isn't owned by a U.S. company and doesn't run on software produced by U.S. companies. That’s why at mailhive, we research all the companies that make the software we use, to ensure we have no ties to the U.S.

Any of the big three U.S. email hosting companies would willingly hand over your data without you ever knowing. At mailhive, we strive to ensure your privacy and confidentiality in the cannabis space, and protect your emails for up to 7 years in read-only format. While not currently required to do so, the Government of Canada, similar to the CRA, could implement legislature that stipulates all emails must be kept for auditing purposes for up to 7 years.

"It's better to be proactive now, than to get caught off guard later on."

When it comes to cannabis production, manufacturing and retail outlets, we’re future proofing email in Canada. Come join the companies that already trust their email and compliance requirements with us.