Washington pot applicants’ info subject to data breach

SEATTLE — The Washington State Liquor and Cannabis Board is working to notify marijuana license applicants whose personal information was accidentally distributed by the agency in response to a public records request.

The data may include social security numbers, driver’s license numbers, financial information, tax information and attorney-client privileged information. The LCB had redacted the documents for the records request, but a folder containing the personal information was accidentally included.

The agency confirmed the breach Tuesday and said it was working to notify affected individuals.

“We’re going through and talking with the Attorney General’s office and planning some communications to those who have been specifically affected,” LCB spokesman Brian Smith told The Cannabist.

The LCB declined to state how many applicants it plans to contact regarding the disclosure. “We want to be able to communicate first with the people who may be affected by this,” Smith said. “We are working to notify them as early as today.”

The personal information was provided after a records request by Washington activist John Novak, who runs a website called 420 Leaks that is critical of the agency and the state’s legalization law. Novak told The Cannabist he requested documents related to marijuana applications filed under a recently enacted law that allows unlicensed medical cannabis collectives to apply for state licenses.

“The first batch I got were actually files for a completely different records request,” Novak said. “He sent me back an email saying, can you delete those? We sent you the wrong thing. We’re gonna redo it.”

The agency then sent Novak the correct records, which he posted on 420 Leaks in early May, where anybody could access them. Novak said he subsequently received a phone call from the agency explaining the situation, asking him to delete the records from his website and any copies in his possession.

“When we realized that info had been released to Mr. Novak, he was contacted and asked to take that information down from the website and to destroy what he had and we would provide a redacted version. It’s my understanding that this has happened,” Smith said.

Novak said he deleted the records from his website, but did not agree to delete his personal copies. He is unsure who might have downloaded them from the 420 Leaks site. “I checked the logs to see if anybody downloaded it, but the logs didn’t go back that far. I know some of our research team downloaded them. A lot of press got the original link.”

Novak is concerned about changes to Washington cannabis regulation that will see medical cannabis patients voluntarily registering with the government starting next month — a first since Washington enacted a medical cannabis law in 1998. “The state is trying to start a registry with patient information on the authorization form that the state is going to put into a database beginning July 1,” Novak said.

According to state information about the Cannabis Patient Protection Act (SB 5052) on Gov. Jay Inslee’s website, regarding the voluntary patient registry: “Privacy will be ensured at the highest possible level, and the database does not in any way violate HIPPA.”

The Cannabist reviewed some of the new, redacted files on the agency’s download site, and discovered an unredacted social security number in one of the documents. The agency was notified about the apparent error. “I’ll go back and talk to our public records people about that,” Smith said.

Novak isn’t certain how many social security numbers are in his original records. “I’m not interested in people’s social security numbers or personally-identifying information. I’m concerned about the leak of the information. It’s a massive leak of privacy that should never have happened.”