Oregon’s SB-863 – How it Affects Licensee Compliance

Oregon SB-863: Update 435 Build Documentation

UPDATED: May 10, 2017

As an extension of a previous post where we outlined what we would be doing to address the changes stemming from SB-863, we’re now releasing the build update in phases.  Here’s everything you need to know about Build 435, which addresses compliance related to SB-863.

Over the next few days, we will be contacting all of our customers in Oregon to schedule a time to update your system to build 435, which will address any compliance issues stemming from SB-863. In the meantime, here are all of the items addressed in the new update along with a step-by-step PDF and video walking you through the new processes.

5 changes were made to BioTrackTHC be compliant with SB-863:

  1. We will no longer be able to store or use a driver’s license to scan/check in patients. Also, the fields for the driver’s license and its expiration date have been removed from the system.
  1. A “Customer Consent to Retain Contact Information” Checkbox has been added to the customer profile. If this is not checked, the customer profile will be deleted after the sale if they are a recreational customer, and will be masked if they are a medical customer.
  1. If a medical customer does not consent to retain contact information, the customer profile will not be deleted, but all information other than the medical card number and expiration will be deleted and the customer name will automatically be changed to “No Consent Given”. Loyalty points and member level will be stored with the customer profile.
  1. Under “Administration>Customers>Purge No Consent Customers” users will now be able to purge any customer profiles that have not given consent to store information, at any time administrators would like. This feature will show all customer profiles ready for deletion prior to performing the action.
  1. The “Customer List Report” has been updated with a column for “Store Data Consent” which will signify which customers have given consent. This will be useful for users to review before they purge all customers; after the purge, they will lose all data on all recreational customers that have not given consent, including loyalty points and discounts.

What We Recommend:

Obtaining Consent – While the state is not clear on what type of consent is required, it’s highly suggested that you obtain a written consent form to retain customer information.  Users can scan/copy these forms into BioTrackTHC and save them with the customer profiles as an extra measure to make sure you maintain thorough records.

Saving Loyalty Points – We realize this may be a tedious process, but we will highly suggest that your facility proactively reaches out to each individual customer and ask them whether or not they would like to provide consent to store their information.  This can be done with two actions:

  1. As customers come to your location before May 18, 2017, simply ask them each if they would like to provide consent, which will allow users to retain all loyalty points and discount info earned by that customer. As an extra precaution, we suggest requesting a signed consent form to be saved with the customer profile.
  1. Many customers may not visit a given location before the May 18 deadline, which is why we recommend calling each customer individually to obtain consent. While this may be tedious, it can help prevent significant backlash from customers whose loyalty points will inevitably be purged if they do not provide consent.  All of the customer’s contact info will be available within their profile until the data is purged by the user.  We highly recommend users take advantage of this info before it is gone for good.  When performing this process, you can make a note in the customer’s profile after they’ve provided consent that it was done verbally on the phone.  That way, next time they come into your location, the employee will see the note in their profile and know to request a written consent form.

Performing these two actions leading up to the May 18, 2017, deadline will allow businesses to retain as many loyalty points and discounts as possible before the purge. Users are also able to close the customer profile and gain consent before completing a sale on the customer’s next visit, as long as it’s before May 18th, 2017.  On May 18th, licensed organizations must purge all non-consented customers from the system.  Failure to do so will result in non-compliance.

It will be difficult for organizations to contact all customers for consent, so in the event that customers come in upset that they have lost their loyalty points and/or discount, here are a few suggestions we offer on how you may reconcile the situation:

  • Comp them with some bonus points in an amount that makes sense with your program
  • Offer some type of discount such as a BOGO
  • Offer a “reconciliation period” during which customers can gain 3 and 4x more points than normal

Unfortunately, there is no way for BioTrackTHC to recover any of this information on behalf of our customers because the information will be permanently deleted. If you have any questions, please refer to the documentation below or this video.

Step-by-Step Documentation on Update 435:

Build 435 Update Documentation Regarding Oregon SB-863




Oregon SB-863: How it Affects Your Business Using BioTrackTHC

April 21, 2017

As some of you may already know, on 4/17/17, SB-863 was signed into law by the governor of Oregon.  This law goes into effect immediately and all recreational customer data must be purged on or before May 18th; 30 days after signing as stated in the bill. The OLCC sent out a message instructing all current licensees not to retain customer data, BioTrackTHC users have the ability to do so as outlined in this message. Here’s what you can do to stay compliant, and what we’re doing to make this easier for you going forward.

What Changed in the Law?

In SB-863, it states that a marijuana business is not allowed to store any information obtained from a driver’s license, Military ID, Passport, or any form of identification that bears a picture of the customer. If this information is obtained, they are required to destroy it after the sale. The law (Section 2. (5)) also goes on to state that OLCC Licensees are able to retain customer contact information for the purposes of discounts, coupons, and marketing, as long as they get consent from the customer.

What do we plan on changing over the next 15 days to address this?

  1. As stated in the bill, information that may be used to identify a consumer may not be stored in your system, so the driver’s license field and expiration field will be removed from the customer profile page for BioTrackTHC systems in the state of Oregon and the recreational box is checked under the location. Following the change, BioTrackTHC will not be able to retain any information outlined in SB-863.
  2. We will be adding a customer consent check box in the customer’s profile to signify that the customer consented to retain the information for the purpose of notifying the consumer of services that the marijuana retailer provides, including discounts, coupons, and other marketing. IT WILL STILL BE UP TO THE DISPENSARY TO OBTAIN CONSENT.
  3. If the Consent Check box is not checked, then the customer profile will be purged after the sale.
  4. A manual button will be added to purge any customer profiles that are not checked as having consented.

What should I do in the meantime? 

If you would rather just not use customer profiles, then perform all recreational marijuana sales (as a rec customer without using the customer profile) and do not use customer profiles without consent. For medical patients, you will have to use the customer profile because you still have to report the medical card number to Metrc on the daily upload.  Because of this, you will need all medical patients to provide consent.
Keep in mind that all data does not need to be purged until May 18th. Also, this does not change any reporting done to Metrc.

You can also watch this video, outlining these steps.

Questions or Concerns? 

If you have any questions or concerns, please feel free to familiarize yourself with the new law, SB-863, which goes into effect on May 18th, or contact support in one of three ways:

Make sure you’re following BioTrackTHC social media for regular news and updates. Sign up for the CannaPulse newsletter for regular updates right to your inbox!

Instagram - BioTrackTHC

Translate »