Tag Archives: GDPR

A Year In Review: Canadian Recreational Reform Year 1

By Marguerite Arnold
No Comments

There is certainly, in retrospect, much to be proud about in Canada – home of one of the most disruptive international cannabis industries in the world. And certainly an early mover.

That starts with having the national mojo to begin this journey in the first place, not to mention pivot and even admit faults along the way. For all the complaints and whinges, however on the ground, most Canadians are proud that they tackled the canna question at a federal level.

As the industry now does a bit of an annual review and revisit, what are some of the largest accomplishments, takeaways (and let’s be honest, major f*ckups) so far? And where is this all headed as the industry at least tries to gear up for another year, if not quite Cannabis 2.0?

The Big Bravos

Launching in the first place. Yes Full Monty Recreational was scary, and delayed a few months last year. And even though there have been many problems (retail outlets, online sales, privacy, supply chain issues in every direction, ex im, foreign markets and etc.), it is up and running.

In comparison, the Brits have been haranguing over Brexit for the last three years and are still not really there.

Further, it is also apparent that the agencies in charge of the new industry are themselves giving a bit of a shake after CannaTitanic (CannTrust). That was embarrassing for them too, although of course, while a bit of a negative compliment, the recall system seems to work.

Even if it needs a few jump starts via whistleblowing.

That in and of itself is a fact that is still in the room, although perhaps the pancaking of the stock price of most of the public industry of late was also another much needed wakeup call.

The Devil In The Details

Domestic Requirements. Health Canada is getting hip to the fact that the industry needs a bit more of a heavy hand. See the book thrown at CannTrust. No matter what, Canadians are demanding to know where their cannabis comes from, and further are also demanding that it be at least free of pesticides that can harm them.

Licensing. Many cannapreneuers are complaining, still, about the delays in licensing, particularly for retail outlets in the provinces who are taking the cannabull by the horns.  That said, there are still lots of enterprises who are perfectly happy to dodge the requirements all together and sell to the black or gray market. No licensing fees, and no taxes is a wonderful dream, but that is not exactly how regulated democratic capitalism works – at least at this level.

Supply Chain Logistics and Related Technologies. Canadians are struggling to implement a regulated industry in a country where patient home grow is constitutionally protected, and in an environment where who can sell what, and to whom including online, is still evolving. Predictably, no matter how groovy the solution works at home, (or the U.S.), no it will not fly in Europe. See GDPR regs, for starters.

Seed Culture (Aka Strain Protection). No matter how much the lawyers in the colonies are gearing up to sue each other over Huey’s Half Baked, in Europe, there are tomato and pepper farmers who are laughing, literally, all the way to the bank on this one. While hip to be a “strain defender,” the reality in a medical market looking for cheap cannabinoids is rather different. Effective, clean product, which can be reproduced reliably and cheaply, is the name of the game. Girl Scout Cookies, and such ilks will be a long time in coming as anything but highly expensive, niche products you can find in a Dutch Coffee Shop.

GMPDomestic Requirements Vs International Export. Canadian standards, so far, have been widely divergent in an environment where exports to Europe in particular are part of the story for the biggest companies. That said, GMP, and in particular EU GMP, has become at least a buzzword if not a standard to live up to.

Privacy. California might be considering its own form of GDPR (European privacy legislation) but so far, the industry has largely failed to protect consumers (from themselves). Ideas about owning huge data troves on cannabis users for someone else’s profit are still very much in the room. After all, data is the new oil, whether people know their data is being harvested or not. And just like big oil has done for most of its existence, those in the driver’s seat so far show little compunction about harvesting personal information, to become in the words of the now departed CEO of Canopy Growth Bruce Linton, “the Google of Cannabis.” Won’t happen. Starting with the fact that in not just Europe but now even California, people, far beyond pot users are tired of a world where privacy is a second class right.

While the issue first hit in Canada on the recreational side, the reality is that companies know who their clients and patients are in a way that is not only disturbing but increasingly being challenged.

european union states

Frontline Pharmacy: The Battle For The Footprint of Medical Cannabis Europe

By Marguerite Arnold
2 Comments
european union states

This summer, as new distributors continue to get into the cannabis game (in Germany, the UK and beyond), and at least two countries (Greece and Macedonia get GMP-certified), the battle is now on not just for cultivation and distribution licenses, but the end point of sale, pharmacies.

Pharmacies were always going to play a large role in cannabis distribution in Europe, starting with the fact that there will not be a separate “dispensary” system (as there is in the United States and Canada). Further, in some jurisdictions, notably Germany, the idea of the “apotheker” is one that is not going to go away anytime soon. No matter how intriguing the concept of online pharmacies actually are to everyone else (see the British).

Further, the shift to what is widely being referred to as “tele” or “digital” health is only going to increase in prevalence as discussions continue. Cost and access (to all medications, not just cannabis) are an issue near and dear to the average European. So is the right and consumer safety issues of being able to consult with a local pharmacist, who might even know you personally, and can advise on the health effects of the medicines they pass over the counter.

german flag
Photo: Ian McWilliams, Flickr

Jens Spahn, the current Health Minister of Germany, is touting a move to personal management of health records and digital prescriptions by next year. However, nobody knows exactly what that means, much less the functionality of the same.

Further, the German pharmacy situation in particular is one that has implications across Europe no matter how aggressively “digital health” solutions are implemented here. By law, no more than three (in some rare cases four) brick and mortar pharmacies can be owned by the same owner. There is no such thing as “Boots” (a British chain) or “Walgreens” (an American one).

Doc Morris, the Dutch online pharmacy, has always been an option for Germans just across the border. The problem of course is that insurers so far have been refusing to pay for critical parts of this idea. The company is currently experimenting with working with insurers- but do not expect the average chronically ill person in any country to suddenly get expedited access. So far, the only innovations in this market have hit as the privileges of the privately insured.

Second class status (and significantly lagging behind those with private healthcare) is also very much in the room as a political issue- and cannabis access has only sped this up.

If the scenario in the EU two years ago could be described as the race for import licenses and cultivation rights, this year, the focus of the big guys is very much trying to mainstream their product and get it on as many “shelves” as possible.

In Europe, however, since nobody can ship straight to the patient (as in Canada), the next most obvious step is securing access to pharmacies.

The Cannabis Industry Cometh

Even before Aphria announced its purchase of CC Pharma (one of Germany’s largest distributors)  in a deal that finally closed in January of this year, the larger companies have been looking for a more efficient supply chain situation. Owning a distributor is certainly one way to go about this.

Israeli Together bought into a large German distributor last summer.

As of May 2019, Aleafia Health and its wholly owned subsidiary, Emblem, entered a JV with Acnos Pharma GmbH – with access and reach to 20,000 German pharmacies. And Wayland announced its merger with ICC, with pharmacies across the world.

As early as October 2017, Tilray and Cronos together tried to storm the German market (by inking a deal to reach the 20k plus pharmacies in the German system). Two years later, and this still has not made a huge difference in access.

Regardless of these larger industry players, however, or perhaps so far because of their statements and the resulting continued lack of access for most patients, it is also fact, particularly in both Germany and the UK, that merely having relationships with pharmacies is not enough. This year, there is also a fairly major price drop in the cards for the cannabis industry. And while the larger players may blanket the market with relationships, actually providing access to GMP-certified medical cannabis at a decent if not competitive price, is going to continue to have an impact on every market, particularly in those situations where compliant online access can be connected to indie distribution.

It is also an environment where the advantage still does not necessarily go to the “big guys” – a strategy that Wayland, for one, has been playing strategically for the better part of the last two years better than any other Canadian in the market. Especially when supply chain issues, beyond price, are still in the room.

Right now, pharmacies are well aware of their growing influence in this space in Europe. How much of an influence they will continue to have however, also rests on how effectively they preserve their right to have such an influence on the end consumer (as in Germany) or not (see the many discussions about this issue in the UK right now).

Further, as many of these entities are also realizing, and this is true far beyond the cannabis discussion, pharmacies are increasingly caught in the middle between consumer, doctor and insurer (this is certainly the case both for cannabis and also for all expensive orphan drugs).

How the pharmacies, in other words, begin to solve other issues, beyond just having a contractual relationship with a cannabis distributor/producer, is very much a part of the conversation right now. Access to cannabis via distribution deals with a Canadian or even Israeli partner certainly helps sales but it does not guarantee them.

One thing is for certain. The impact of new privacy legislation is having an effect, so even in an environment where a distributor/producer buys a pharmacy, what they can then do with customer information they also might have been interested in purchasing, is not only highly limiting, but in the future it may be the best approach to handling liability, and from multiple directions that includes everything to access to affordable, certified product to cyber security issues.

Why Does GDPR Matter for The Cannabis Industry?

By Marguerite Arnold
2 Comments

The global cannabis industry is hitting thorny regulatory challenges everywhere these days as the bar is raised for international commerce. First it was recognition that the entire production industry in Canada would basically have to retool to meet European (medical and food) standards. And that at least for now for the same reasons, American exports are basically a no go.

However, beyond this, the battle over financial reporting and other compliance of a fiscal kind has been a hot topic this year on European exchanges.

As of this summer, (and not unrelated to the other two seismic shifts) there is another giant in the room.

If you haven’t heard about it yet, welcome to the world of EU GDPR (European Union General Data Privacy Regulation).

The German version is actually Europe’s highest privacy standard, which means for the cannabis industry, this is the one that is required for operations here across the continent if you are in this business.

What is it, and what does it mean for the industry?

GDPR – The Elevator Pitch

Here is why you cannot ignore it. The regulation affects bankers as much as growers, distributors as much as producers and of course the entire ecosystem behind medical production and distribution across Europe and actually far beyond it. Starting of course, with patients but not limited to them. The law in essence, applies to “you” whoever you are in this space. That is why it becomes all that much more complicated in the current environment.

While this is complex and far reaching, however, there are a couple of ways to think about this regulation that can help you understand it and how to manage to it (if not innovate with it).

The first is, to American audiences at least, that GDPR is sort of like HIPAA, the federal American privacy civil rights statute that governs medical privacy law. Except, of course, this being Europe, it is far more robust and far reaching. It touches every aspect of electronic privacy including data storage, retention, processing and security that is applicable to modern life. And far, far, beyond just “patients.”

On the marketing side, GDPR is currently causing no end of headaches. Broadly, the legislation, which came into force this year, with real teeth (4% of global revenues if you get it wrong), applies to literally every aspect of the cannabis industry for two big reasons beyond that. Medical issues, which are the only game in town right now in Europe (and thus require all importers to also be in compliance) and financial regulatory requirements.

The requirements in Germany are more onerous than they are in the rest of Europe. Therefore, they also affect the cannabis industry in a big way, especially since there is at this point a great deal of European cultivation with the German (and now British) medical market in mind. Further Germany is becoming European HQ for quite a few of the Canadian LPs. That means German standards apply.

The UK, for those watching all Brexit events with interest, will also continue to be highly affected by this. Whether it stays in the EU or not, it must meet a certain “trusted nation” status to be able to transact with the continent in any kind of favoured nation status.

Bottom line? It is big and here and expensive if you screw it up. If considering doing any kind of business with European customers, start hitting the books now. Large mainstream media organizations in the United States and Canada right now are so afraid of the consequences of getting this wrong that they have blocked readership from Europe for the present. Large financial institutions also must not only be in compliance but compliance of companies also guides their investment mandates on the regulatory front.

For all of these reasons, the cannabis industry would do well to take note.

What Does This Mean for The Cannabis Industry?

The Canadian and rest of the global industry is still struggling with compliance and this will have some interesting repercussions going forward.patient data must be handled and stored differently

Immediately, this means that all websites that are targeted to German eyes (read Canadian LPs and international, even English-only press) should hire German side compliance experts for a quick GDPR audit. There are few European experts at this point, and even fewer foreign ones. It is worth a call around to find out who is doing this auf Deutschland and bite the bullet.

It also means that internally, patient data must be handled and stored differently. And furthermore, it is not just “patients” who have this right, but everyone who transacts with your electronic or other presence. That includes consumers, subscribers to email newsletters and other stakeholders in the industry.

As the cannabis industry also starts to embrace technology more fully, it will also have highly impactful influence on what actually passes for a compliant technology (particularly if it is customer facing) but not limited to the same.

On the marketing side, GDPR is currently causing no end of headaches. Starting with PR and customer outreach teams who are trying to figure out how much of their master mailing lists they can keep and which they cannot. On this front, Mail Chimp is undeniably the go-to right now and has also implanted easy to understand and use technology that is being adopted by European marketers and those targeting Europe.

Stay tuned for more coverage on GDPR as we cover how data protection and privacy regulations will impact cannabis businesses, their marketing and outreach, plus service design efforts (in particular to patients) and other areas of interest.