November 30, 2017

Oregon Marijuana User Privacy Law


This article originally appeared in the June 4, 2017 edition of the Portland Business Tribune. 

The legalization of the use of marijuana for recreational purposes is a trend gaining steam, especially in the Western states.  While medicinal marijuana is legal in over half the country, eight states and the District of Columbia have now passed laws legalizing recreational use.  Half of these states – Alaska, Colorado, Oregon, and Washington – now allow the operation of dispensaries selling the drug for recreational use to consumers of legal age, generally on a regulatory model similar to liquor stores.  While this has led to new business opportunities in Oregon, these businesses must nevertheless operate under a cloud of risk and uncertainty as the sale and possession of marijuana remain illegal under superior Federal laws.  Such risks may have increased under the Trump administration, whose Attorney General, Jeff Sessions, is a vocal opponent of legal marijuana.  The generally hands-off approach of the previous Obama administration may be coming to an end.


In response, the Oregon legislature acted quickly, and with broad bipartisan participation, to pass a law providing for increased marijuana consumer protections, similar to laws or industry practices already in place in other states with recreational dispensaries.  Senate Bill 863A, which was signed into law by Governor Kate Brown on April 26 (with a retroactive effective date of April 17), now prohibits the collection by dispensaries of information that personally identifies their recreational consumers.  Where dispensaries were often registering users and collecting consumer information upon entrance, usually from State IDs, and linking such information to purchase histories for marketing purposes, dispensaries may no longer “record and retain any information that may be used to identify a consumer.”  An exception exists for consumers who provide informed consent to the collection of such information, which can be used only for providing discounts, coupons, or other marketing information, and may not be disclosed, transferred, or sold to “any other person.”   Consumer information obtained prior to the new law was to be destroyed within 30 days of its passage on April 17 (i.e., May 17).  Oregon dispensaries currently retaining such information without informed consumer consent are in violation of the law.


It is currently unknown whether the U.S. Department of Justice (DOJ) will opt to enforce federal marijuana prohibitions in states operating recreational dispensaries.  For its part, Congress has signaled its intent to adhere at a minimum to recent practices with regard to medicinal marijuana.  Since 2014, each annual federal budget bill—including the one presently before Congress –has included the so-called Rohrabacher-Farr amendment, which restricts the DOJ from using any of its Congressional appropriations to prevent the implementation of state laws authorizing medical marijuana.  Similar Congressional action regarding recreational marijuana has not yet been forthcoming.


This uncertainty has not deterred the Oregon legislature from forging ahead in support of the cannabis industry.  Currently before the Legislature is SB 307, which would allow the licensure and operation of public “cannabis lounges,” as well as licensure for marijuana consumption at certain “temporary events.”  Nevertheless, the new privacy law demonstrates that operating a “cannabusiness” in Oregon requires a stomach for risk-taking and the ability to creatively adapt to unresolved legal questions.   Conflicts between federal and state law, and federal tax provisions like Section 280E, which restrict the deductibility of common business expenses by cannabis businesses, continue to make dispensary operations a uniquely challenging business proposition.


For more information on this topic, please contact or call (888) 598-7070.

Back to Top