Presented through the California Lawyers Association, this program features Shay Aaron Gilmore examining the increasingly urgent intersection of privacy law and the cannabis and hemp economy an area many operators overlook until a data incident or regulatory inquiry forces the issue. Cannabis and hemp businesses collect and process unusually sensitive categories of personal information: government-issued identification at point of sale, medical-patient status, loyalty-program purchase histories, biometric access controls, and seed-to-sale tracking data that can tie an individual consumer to specific regulated transactions. This session unpacks the legal obligations that attach to that data and the liability exposure that follows when those obligations are not met.
Gilmore situates the discussion within California’s leading privacy framework — the California Consumer Privacy Act as amended by the California Privacy Rights Act — and explains how its consumer-rights regime (access, deletion, correction, and opt-out of sale or sharing) applies to dispensaries, delivery services, cultivators, manufacturers, and the technology vendors that serve them. He addresses the special sensitivity of health-adjacent data in the medical-cannabis context, the tension between mandatory state track-and-trace reporting and consumer privacy expectations, and the contractual allocation of privacy risk among operators, point-of-sale providers, and marketing platforms.
The program gives practitioners a practical framework for advising cannabis and hemp clients on privacy compliance: conducting data inventories, drafting compliant privacy policies and consumer-request workflows, negotiating data-processing terms with vendors, and building incident-response readiness before a breach occurs. Gilmore also discusses the reputational and regulatory consequences of privacy failures in a heavily scrutinized industry, where an enforcement action can jeopardize not only civil liability but also the licenses on which the business depends.
Attendees come away with a clear understanding of why privacy is not a peripheral concern for cannabis and hemp operators but a core compliance obligation, and with concrete steps they can take to bring clients into compliance and reduce exposure. The session reflects Gilmore’s role as Chair of the California Lawyers Association Cannabis Practitioners Group and his focus on the operational, real-world compliance questions that cannabis and hemp businesses face.