The cannabis industry is taking shape right before our eyes. What might be ahead in regulation, consolidation, new entrants to the market, and more? How can stakeholders best the ride wave of new technologies and data to business opportunity?

Here’s what we’ve been thinking about in Q1 of 2022. Click one of the links below to skip to a specific article.

• Data privacy for cannabis companies: Learning from the California Privacy Rights Act (CPRA)  
• Why the alcohol excise tax model would fall short for legal cannabis
• Act now to unlock the power of your data
• From around the industry: Insights from SCC and MCBA

These articles are part of CannaQuarterly, our new quarterly email newsletter for cannabis industry stakeholders, developed by a wide array of CohnReznick specialists plus contributors from around the industry. Subscribe now to make sure you receive future issues, and visit these pages to explore the other articles included in Q1 2022: Perspectives on Growth | Technically Speaking… (Tax and Audit insights)

Data privacy for cannabis companies: Learning from the California Privacy Rights Act (CPRA)

Bhavesh Vadhani, Daryouche Behboudi, Deborah Nitka

With privacy laws tightening across the U.S. and globally, data privacy continues to be a growing concern for the medical and recreational cannabis industry. As cannabis producers and retailers grow, so does the volume of consumer data they handle – which can make them a prime target for bad actors who see opportunities to steal, sell, and/or ransom large, valuable sets of data.

While data privacy can be a challenge for any company, for the cannabis industry, the problem is further compounded by a number of factors: 

• Businesses operate under an ever-changing legal and regulatory framework, especially as they expand into new states and have to track multiple sets of rules. 
• As cannabis enterprises grow into more connected technologies and more sophisticated, automated operations, security and privacy policies and controls may lag behind.
• Like the healthcare industry, cannabis-touching enterprises may hold highly sensitive health-related data – and breaches may violate the Health Insurance Portability and Accountability Act (HIPAA).   
• Breaches can be catastrophic for consumer trust and company reputation – and in an emerging market, trust and reputation are critical.  

Plus, in many jurisdictions, cannabis businesses face difficulty in obtaining insurance coverage, and cyber insurance is no exception.

A starting point: The California Privacy Rights Act

In reviewing and boosting their policies and controls around data privacy, a good place for cannabis operators to start is the laws of California, a state that’s key to the industry and has the most robust requirements seen in the U.S. today. The state was already at the forefront of data privacy regulation with the California Consumer Privacy Act (CCPA) of 2018. The California Privacy Rights Act (CPRA), approved by California voters in November 2020, amends and effectively expanded the rights granted under CCPA giving California residents more control over how businesses may collect, use, process, retain, and share their personal data. 

The CPRA will apply to any organization that processes the records of 100,000 California consumers or households – up from the CCPA’s 50,000 threshold – so any business with a large California customer base should take note. Plus, the CPRA’s advocates believe it will help drive the push for national data privacy standards, so it may be worth studying now even if it does not apply directly to your company.

The CPRA expands the definition of personal data previously established by the CCPA to further include information that is likely to be collected throughout the course of a dispensary transaction, such as (as listed in the Act text):

• A consumer’s Social Security, driver’s license, state identification, or passport number
• A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
• A consumer’s precise geolocation
• A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership
• The contents of a consumer’s mail, email, and text messages, unless the business is the intended recipient of the communication; and
• A consumer’s genetic data

Other key CPRA details include:

When: Companies will be expected to start complying with the CPRA in January 2023, with enforcement scheduled to begin in July 2023. (But, note that it applies to data collected starting Jan. 1, 2022, so businesses should now be applying the CPRA’s expanded definition of “private data.”)

Notable rights and responsibilities: Between the original rights created by the CCPA and the CPRA’s new and expanded ones, here are the key points for cannabis operators to be aware of:

• The CPRA expands the consumer’s right to know what personal information has been collected and how long it will be retained, and strengthens their right to opt out of sharing personal information for advertising purposes. 
• Under a new “right to correct,” businesses will be required to use “commercially reasonable efforts” to correct information that consumers report as inaccurate. (And, they will have to take steps to make sure consumers know they have the right to request corrections.)
• Consumers can place limits on how a business uses and discloses their personal information.
• Service providers, contractors, and third parties will be required to cooperate with businesses’ requests to delete personal information. (So, if your company isn’t directly subject to CPRA, but you’re a vendor to a company that is, be prepared for these requests.)
• Under the CPRA, a consumer will be able to bring claims against a company for unauthorized access to or disclosure of an email address and password, or if a security question and answer that permits access to the consumer’s account is disclosed and data is exposed. 

Enforcement and penalties: 

• To uphold these rules and levy penalties for violations, the CPRA establishes the California Privacy Protection Agency (CPPA) – the first state agency dedicated to protecting individual privacy rights. 
• Enforcement will include administrative proceedings and fines that range from $2,500 to $7,500 per violation – including $7,500 per incident for violations involving consumers under the age of 16.
• The CPRA will require regulatory guidance mandating ongoing risk assessments and cybersecurity audits, and in certain cases, the CPPA will maintain the right to audit companies to gauge their compliance. 
• While there was previously a 30-day “cure” period for addressing infractions, the CPPA will now be able to set a time period for curing based on the intent of the business to violate privacy provisions. 

What to do now

While there is no way to predict how the CPRA will morph over time, one trend we are seeing is the move toward more stringent privacy laws. And, again, it is likely that other states will follow California’s lead and enact their own laws along these lines, if they haven’t already. (Two other states with legal adult-use cannabis, Virginia and Colorado, passed their own privacy laws last year, and other states have proposals working their way through their legislatures.) To be prepared, cannabis industry leaders should continually be proactive about their cybersecurity and privacy programs so they can react agilely to changes and help avoid any risks to their companies and their customers alike.

• Update consumer privacy notices in line with CPRA requirements (and/or any other state laws in the company’s jurisdiction).
• Review and update procedures to respond to consumer data requests.
• Review the company’s liability insurance policy to confirm that it covers data breaches. If not, procure specific cyber liability insurance. If the company already has cyber liability insurance, review the coverage in light of the higher penalty amounts under CPRA.
• Conduct a full audit of the company’s cybersecurity and data privacy controls, including what data is collected, processed, and shared; how it is stored, retained, protected, and destroyed; who can access it; and other key details (read more).
• Require that any third parties with access to consumer data agree to protect that information.
• When considering an acquisition, assess the target company’s consumer base to understand whether its addition would push the acquiring company over the “100,000 California consumers or households” threshold for CPRA jurisdiction (or any comparable state rules as applicable).

Contact

Bhavesh Vadhani, Principal, Global Leader, Cybersecurity, Technology Risk, and Privacy

703.847.4418

Daryouche Behboudi, Managing Director, Cybersecurity, Technology Risk, and Privacy

703.744.8507

Deborah Nitka, Manager, Cybersecurity, Technology Risk, and Privacy 

646.762.3372

Return to top

Why the alcohol excise tax model would fall short for legal cannabis

Michael Harlow

Amid the many debates along the road to federal cannabis legalization, one of the most convoluted of them all is taxation – and in particular, the possibility of an excise tax structure. 

The current leading proposal, the Cannabis Administration and Opportunity Act proposed by Sens. Cory Booker, Ron Wyden, and Chuck Schumer, is the second we’ve seen that would impose an excise tax in a manner akin to the tax levied on tobacco and alcohol, i.e., based on a volume (per-ounce) rate in the case of flower, or potency (per milligram) rate of THC in the case of extract. The general tax rate would start at 10% and increase annually; then, starting in Year 5 after enactment, the applicable rate would be, per ounce or per milligram, equal to 25% of “the prevailing price of cannabis sold in the United States in the prior year.” Taxation would be at the wholesale level: “tax is determined and payable when cannabis products are imported or removed from the premises of a permitted cannabis producer,” the proposal summary states.

While applying principles of alcohol taxation to cannabis may be an expedient solution – an existing model that policymakers and the Treasury are already familiar with – industry differences are enough to render this model problematic. Whether or not this proposal will be enacted in the current administration or longer term, it’s worth taking a look now at its potential pitfalls, and what the industry might aim for instead.

Where the excise model misses the mark

1. Assessing the tax at the wholesale level does not work in a vertically integrated model such as cannabis, where processing and retail are often controlled by the same entity, and where transfer pricing methodologies have not been firmly established. Regulations would likely be needed to prevent diversion of product and avoidance of tax, and could lead to measures such as state-licensed distribution centers – all of which would be burdensome for producers and governments alike.

2. Tying the tax rate to the prior year’s average price of cannabis would result in a higher effective tax rate for products that sell below the average national price – an extra challenge for operators trying to produce lower-cost products to compete with the lower-priced illicit market, and something of a penalty for the consumers who choose to buy from them.  Fluctuations in pricing year-to-year would also affect planning, from both a tax payment and revenue generation perspective.  

3. Calculating THC content is not as straightforward as calculating the percentage of alcohol in a given product. And using THC as the basis for assessing the tax may have broader ramifications than what is intended. A model that looks to measure THC will likely incentivize manufacturers to create new synthetic alternatives with lower THC, resulting in high potency and lower excise tax, or to dilute their pure products with troublesome additives. This would be not only dangerous but also counterproductive to the industry, as it would counteract some of the health and public safety motivations foundational to the push for federal legalization. 

What the industry might aim for: Simplicity and transparency

Many of the concerns of the current model might be addressed by simply assessing the excise tax at retail, at a flat rate on the final sale price to the consumer. 

Capturing everything sold through a licensed retailer could help mitigate the risks of product diversion and tax avoidance, as receipts, cash deposits, and credit card transactions could provide the requisite audit trail. 

As important, a tax at the retail level could provide vital transparency to the consumer, which could be key in winning converts from the illicit market. Delineating actual product cost from excise, state, and local taxes could help consumers understand pre-tax value and justify pricier post-tax purchases. If all a consumer sees at a dispensary is an $80 charge for a product they can get for $50 from trusted sellers on the illicit market, they might not convert; but if they see that it’s the same $50 product and the price difference is made up of taxes, they may be more willing to change their buying behavior. It is widely assumed that buyers will pay some premium for legal cannabis, though a question is how much of a pricing premium the consumer will reasonably tolerate. Again, the alcohol analogy falls short in this regard, as the U.S. does not currently have an illicit-market alternative for alcohol consumers comparable to cannabis.

Though the current proposal is still ripe for amendment, and we may not see it or anything like it passed for some time, revenue generation will remain a critical part of the legalization discussion. (Rep. Nancy Mace’s proposed States Reform Act also includes an excise tax, at 3%.) As such, it’s incumbent for stakeholders to be aware of pending legislation and advocate for policies that further their interests and those of their constituents and customers.  

Most stakeholders recognize that federal legalization will require some revenue-generating component for the federal government. However, there is not broad consensus among industry stakeholders about how best to balance the federal government’s desire to generate excise tax revenue with an excise tax model that is transparent to the consumer, is easy to administer for the operator, and encourages consumer conversion to the regulated market.

Contact

Michael Harlow, CPA, Partner

301.907.2330

Return to top

Act now to unlock the power of your data

Chris D’Arduini, Stacie Jefferies, Heather Carter, Amanda Goldston

The role and promise of data in business has evolved far beyond just collecting financial and operational metrics to create a record of production and sales. Data can improve operational visibility, drive value, and unlock potential across all facets of your cannabis organization – if you know what to collect and how to use it.

Take the ever-shifting landscape of consumer preferences as an example. Continued diversification of the cannabis market means a constant push toward new and different customer experiences. In many markets, cannabis products must first go through an arduous regulatory process to be released. In other states, regulations may be less rigid, but costs of bringing a product to market are still high. In either situation, it is critical to first determine if customers desire a product – and are willing to pay for it – before making investments.

Answers to this and more can be found by analyzing data from mission-critical systems and leveraging these information sources to create a stream of continuous value. This value can empower operators and take the form of increasing margin capture; uncovering inventory optimization opportunities; finding and optimizing operational efficiencies; developing accurate production schedules, capacity plans, and consumer demand forecasts; and so on.

So why hasn’t everyone jumped on the data bandwagon? In general – not just in the cannabis industry – operators often do not know how to fully or properly capture, classify, and analyze relevant data. Many companies collect data to look at current business conditions but do not necessarily know how to unlock it or analyze it to create relevant information. 

Challenges imposed by in-house technical constraints can widen the chasm between business leaders and the timely, high-quality data they seek. Leaders have an expectation that data should be current, easy to replenish, and readily available to inform decision-making. The reality may be data that is incomplete, locked in disparate systems that may be incompatible, or not organized with the end user in mind. 

Do you want to fast-track your journey to harness the power of your data? Here are three things you can do to get started now:

• Define a common language to ensure that data is captured in a way that it is more usable to the collective group of stakeholders who are impacted by that data. 
• Plan across all functions. While historical sales are an important data element, sales teams should not be the only perspective in the room. To get the proper lenses on your data, create a data strategy that includes finance, procurement, cultivation, manufacturing, distribution, sales, quality, and human resources. This all-in approach will enable organizations to identify current issues and make decisions more effectively. 
• Standardize business processes and data according to the language that was agreed upon by stakeholders. The more well-defined the process, the more likely it will be to produce high-quality data. (Make sure to incorporate data governance throughout the process, so that data remains accurate and has controls in place to govern it.) Equally important to that objective is to identify what may be missing for analytical resources to address those opportunities.

When data is well-managed, it transforms simple reporting into valuable insights. When combined from rich internal and external sources, data can inform businesses on ways to respond to the market, optimize functions across the supply chain, and develop forward-thinking enterprise strategies. 

We will talk more about how to harness your data for better insights in future issues of this newsletter. Subscribe now to make sure you don’t miss any. 

Contact

Chris D’Arduini, Senior Manager, Enterprise Technology, Global Consulting Solutions

312.854.1223

Stacie Jefferies, Senior Manager, Enterprise Technology, Global Consulting Solutions

973.364.7842

Heather Carter, Senior Consultant, Enterprise Technology, Global Consulting Solutions

862.245.5137

Amanda Goldston, Senior Consultant, Enterprise Technology, Global Consulting Solutions

646.448.5473

Return to top

From around the industry

Supply chain issues lead to sustainability

The ongoing supply chain woes may offer a silver-lining by-product for the cannabis industry: Greater sustainability. Read how one company took a supply chain tangle as an opportunity to find more sustainable and readily available building materials in this article from the Sustainable Cannabis Coalition (SCC). Read article >

MCBA National Cannabis Equity Map and Report

The Minority Cannabis Business Association’s National Cannabis Equity Map offers information on state and municipal social equity programs and other relevant policy, and the corresponding Report highlights the findings of 41 policy points explored in the Map. This timely project is a valuable resource for anyone seeking to create diversity, lower barriers to entry, and otherwise make sure that as we build this industry, we do so in the most equitable way possible. Explore resource >