Privacy Update - November 7, 2018

November 7, 2018 – The Ontario Cannabis Store (OCS) takes privacy and security very seriously. Protecting customer information has been the number one priority throughout the development of OCS.ca.

Late on November 1, 2018, the Canada Post Corporation notified the Ontario Cannabis Store (OCS) that limited delivery information of approximately 2 per cent of OCS customer orders (approximately 4,500 orders) was accessed by an individual through the Canada Post delivery tracking tool. Delivery data shared with the OCS also included information relating to customers of other Canada Post clients.

Upon learning of this incident, the OCS immediately engaged the Office of the Information and Privacy Commissioner (IPC) of Ontario. Since November 1, the OCS has worked closely with Canada Post to identify the cause of this issue and to prevent any further unauthorized access to customer delivery information. The OCS has encouraged Canada Post to take immediate action to notify their customers. To date, Canada Post has not taken action in this regard.

Although Canada Post is making its own determination as to whether notification of customers is required in this instance, the OCS has notified all relevant customers.

Based on information obtained from Canada Post there were approximately 4,500 orders where limited delivery information was accessed. Canada Post has advised that any information obtained was deleted and not further disclosed. The specific delivery information was:

• Postal code
• Name or initials of the person who signed upon delivery
• Date of delivery
• OCS reference number
• Canada Post tracking number
• OCS corporate name and business address

No other order details were included, specifically: the name of the person who made the order (if not the same as the individual who signed for the delivery), the delivery address, payment information, and the contents of the order were not accessed. Please note OCS.ca was not impacted in any way.

The OCS has sent an email notification today to the approximately 4,500 customers impacted. If you are an OCS customer and did not receive an email notification from the OCS regarding this matter, your order delivery information was not accessed.