A few weeks ago, we mentioned that cannabis companies that fall victim to a data breach are required, under state law, to inform employees and customers whose data was compromised by the intrusion. However, not every stolen piece of information demands notification. This post further dives into these laws—all 50 states have now enacted breach notification laws—by addressing the notification requirements imposed by the State of Oregon. Oregon Revised Statutes (“ORS”) 646A.602 defines “breach…

Yesterday, California Governor Jerry Brown signed a new piece of privacy legislation—AB-2402—which places restrictions on how licensed cannabis companies in California share information about their customers. AB-2402 is significant in that it prevents licensed cannabis businesses from sharing expansive categories of customers’ personal information with third parties—except in limited circumstances in connection with payments, or where a customer has consented to sharing his or her data with a third party. Notably, AB-2402 prohibits…

We’re still in the early days of the complete roll out of the Medicinal and Adult-Use Cannabis Regulation and Safety Act (“MAUCRSA”) in California. Currently, the only rules in play are the readopted emergency rules that are still full of ambiguities and unknowns, which will hopefully be addressed in the final permanent rules, which the state will likely release in coming months. We detailed the initial proposed permanent rules from back in July, the public…

We recently wrote about the new Oregon Liquor Control Commission (OLCC) rules for marijuana businesses, and observed that those rules were issued with the stated intent to stave off diversion of cannabis. In addition to its public-facing actions, we have seen an apparent shift in internal OLCC review policies and procedures. A few weeks ago, we covered the apparent adoption of new settlement policies. Today, we cover what appears to be increased scrutiny for…

As a general rule of thumb, employers are not allowed to discriminate against employees with disabilities. Both federal and state laws provide this protection. This means that an employer cannot take an adverse employment action against an employee because of the employee’s disability. Again, this is a “general” rule of thumb: In the cannabis context, things are always a bit different. Some states have passed legislation protecting medical marijuana users off work marijuana use. Employers…

The Racketeer Influenced and Corrupt Organizations Act (RICO) is a federal Nixon-era law originally intended to combat drug cartels and organized crime. Among other features, it allows average citizens claiming a loss in property value to bring suit for triple damages plus attorney’s fees against any “person” or “enterprise” that has a part in any neighboring “racketeering activity” which includes—you guessed it—“dealing in a controlled substance.” Currently, federal law continues to classify cannabis as a…

This is the second post in our three-part series on California development agreements. In our first post we provided an overview of the use (and misuse) of development agreements in the cannabis industry. This post breaks down the basics of development agreement laws. California’s development agreement statutes are located in Government Code sections 65864 – 65869.5. According to the legislative findings and declarations, the lack of certainty in the approval of development projects can result…