DENVER — Pot advocates are concerned that the Colorado Marijuana Enforcement Division’s recently unveiled seed-to-sale tracking program has the potential to violate privacy. The program uses tagged labels to allow regulators to track each marijuana plant from the time it’s planted to the day it’s sold as product in a pot shop.
According to an auditor’s report released earlier this year, there is an automated interface between the Colorado Department of Health’s patient registry and the Colorado Crime Information Center, part of a national law-enforcement database. Patients are wary that their private information might flow between the databases insecurely, opening up avenues to abuse. The new Marijuana Inventory Tracking System or MITS requires licensed facilities to enter into the database registry numbers for patients and their associated plant-count numbers, which determines the number of the plants each center is allowed to cultivate. Critics worry about what information the state’s marijuana division will be able to access from the registry.
The division says public fears are understandable but unsubstantiated.
“I mean we get it. We understand it is very personal private information,” said division spokesperson Julie Postlethwait. She explained that the division has no access to private information about patients on the state marijuana registry, and emphasizes there is no interface between the department of health and the marijuana division.
“We’ve really done all that we can to keep the MITS database protected, and there’s really nothing that, in and of itself, would give away private information.”
The Cannabis Therapy Institute planned to protest the conference announcing the new tracking system last Wednesday, but only one protester showed up outside the marijuana division headquarters. William Chengelis, chair of the U.S. Marijuana Party, stood there alone.
“I’m an army of one right now,” he said.
Rolling out the tracking system has been a long and tangled process for a department that has been underfunded, understaffed, and reprimanded in state audits. The project was shelved due to lack of funding in 2012 just nine months after the division contracted with a Florida company, Franwell, to develop the high-tech Radio Frequency Identification (RFID) for the seed-to-sale program. It took a year to get the program started again, by which time Coloradans had passed Amendment 64 to legalize marijuana for recreational use. The successful passage of tax Proposition AA in November guarantees more money for the cash-strapped division, which will inflate its staff and boost confidence on the part of federal regulators. So far, the marijuana division has spent $1.2 million developing the tracking system.
Jeff Wells, CEO of Franwell, walked through the process of encoding each plant with the license number, plant serial number and secure ID involved with inventory tracking. Employees will enter information about each plant into the online database, while a physical RFID tag is attached. The RFID stays with the plant as businesses grow it, process it, and package it, up to the point of sale. The MITS database is updated as the plants change location.
“This results in a traceable chain of custody,” Wells said.
In compliance checks, regulators will be able to use short-range scanning technology to verify that the number of registered plants in any cultivation site corresponds to the number of plants registered on the tracking system. It should help regulators track missing shipments or irregularities within the system. Regulators said the data gleaned from the system will be instrumental in determining market rates in order to set the tax on retail prices in the future.
Meg Collins, executive director of the Cannabis Business Alliance, said the industry is supportive of the steps the the marijuana division is taking.
“They want to be compliant,” Collins said of state pot businesses. She noted that many centers already use one of a few independent inventory tracking systems, pursuant to regulations that require facilities to be accountable for their products. So far, the tracking system cannot interact with the independent software. “As we go forward, I would imagine that Franwell is going to get to the point that the systems are going to talk to each other, I think.”
Collins did not think the system would create privacy breeches.
“Presumably [the developers] are taking all the safeguards,” she said.