Purpose The purpose of this document is to outline data privacy guidelines that Waabigwan Mashkiki and subcontractors must follow to
ensure adherence to the Cannabis Compact Between White Earth and the State of Minnesota and to protect consumer data.
Scope This policy applies to all Waabigwan Mashkiki employees, Waabigwan Mashkiki subcontractors/subprocessors, the TRA, and the
OCM.
Responsibility All Waabigwan Mashkiki employees and subcontractors. Tribal Regulatory Agency employees and Minnesota State employees are
responsible for following data privacy regulations, as required in the Compact.
Acronyms and Definitions Business Confidential Information- Any nonpublic information about the Tribe, a Tribal Enterprise, or a Tribally Licensed Cannabis Business.
Compact- Shorthand for the regulatory contract between the Tribe and the State of Minnesota, referring to the “Cannabis Compact Between the White Earth Nation of
Minnesota Chippewa Tribe and the State of Minnesota”.
Minnesota Government Data Practices Act- Chapter 13 of the Minnesota Statutes, as amended.
Nonpublic Data- Any government data classified by statute, federal law, or temporary classification as confidential, private, nonpublic, or protected nonpublic.
OCM- Office of Cannabis Management; agency of the State of Minnesota which is authorized by Chapter 342 of the Minnesota
Statutes to oversee the enforcement of the State’s civil regulatory Cannabis program, as the same may be redesignated from time to time by the State.
Parties- The White Earth Band of the Minnesota Chippewa Tribe (“Tribe”) and the State of Minnesota (“State”) (individually, a “Party” and collectively, the “Parties”).
Personal Data- Any information that is linked or reasonably linkable to an identified or identifiable individual or household, including via a device and does not include de-identified data or publicly available information.
Sensitive Information- Includes Business Confidential Information and Personal Data.
TRA-Tribal Regulatory Agency; agency of the Tribe which is authorized by the Tribe’s governing body to oversee the enforcement of the Tribe’s civil regulatory Cannabis program, as the same may be redesignated from time to time by the Tribe in the Tribe’s sole
discretion.
Materials and
Equipment Ch. 13 MN Statutes, Compact, WHITE EARTH BAND OF THE MINNESOTA CHIPPEWA TRIBE ADULT-USE CANNABIS CODE, Dutchie
Privacy Policy, https://www.whiteearth.com/privacy
1. Confidential Information
a. Both parties (the Tribe and the State) agree to maintain the confidentiality of
Sensitive Information related to the Tribe, Tribally Licensed Cannabis Businesses, or Tribal Enterprises, including proprietary Business Confidential Information and Personal Data of employees and customers.
b. Any and all subprocessors and subcontractors shall be subject to substantially
similar contractual confidentiality obligations which receive, access, store or use any Sensitive Information related to Tribally Licensed Cannabis Businesses and
Tribal Enterprises, including proprietary business information and Personal Data of employees and customers.
i. For purposes of the Compact, “Sensitive Information” shall include both “Business Confidential Information” of the Tribe, the Tribally Licensed
Cannabis Businesses, and Tribal Enterprises, and the term “Personal Data.”
c. Business Confidential Information shall only be shared with third parties as necessary to ensure compliance with applicable laws and regulations.
d. OCM classifies Annual Site or Credible Suspicion inspection data as protected civil investigative data.
i. To the extent possible and reasonable, OCM will provide notice of any request or demand under the Minnesota Government Data Practices Act
from any person or entity for data relating to the Tribe, a Tribal Enterprise, or the Tribal Regulatory Agency received by or possessed by OCM under the terms of the Compact for which the Minnesota Data Practices Act or Tribal Code do not provide sufficient protection from release.
ii. OCM will not voluntarily disclose Personal Data or Business Confidential
Information under the Minnesota Government Data Practices Act. Business Confidential Information will be considered by OCM to be Protected
Nonpublic Data under the Minnesota Government Data Practice Act.
e. The Parties shall cooperate and collaborate with regard to requests or demands under the Minnesota Government Data Practices Act or other applicable statute or regulation for Sensitive Information.
i. To the extent possible and reasonable, the State shall provide reasonable advance notice to the Tribe of any intended action to release data
pertaining to the Tribe, a Tribal Enterprise, or the Tribal Regulatory Agency, including a copy of the data to be released.
f. Notwithstanding anything in the Compact to the contrary, the requirements on OCM set forth in the Confidential Information section shall apply only to OCM and to the Governor’s Office to the extent that the Sensitive Information arises out of the implementation of the Compact or the Sensitive Information is received
through OCM, but shall not be binding on any other agency or instrumentality of the State.
2. Data Sharing Protocols.
a. The TRA and OCM shall develop secure data sharing protocols acceptable to each to facilitate the exchange of information relevant to compliance monitoring and enforcement.
b. Both parties will ensure that data sharing complies with all applicable privacy and data protection laws.
c. For the avoidance of doubt, any data shared by the State under the Compact to the Tribe or the TRA for the purposes of their joint enforcement responsibilities under the Compact shall retain its classification and the Tribe and the TRA will not voluntarily disclose confidential data transmitted to it by OCM, subject to the Tribe’s laws and policies regarding data practices.
i. To the extent possible and reasonable, the Tribe shall provide reasonable advance notice to OCM of any intended action to release confidential
information pertaining to OCM or a State Licensed Cannabis Business.
3. Compact Arbitration
a. All discovery activities shall be expressly limited to the dispute being arbitrated. All discovery material received by a Party, including documents and data, shall be
maintained by the receiving Party in a safe and secure manner.
i. Access to that discovery material shall be limited to employees of the Parties assigned to work on the arbitration, their attorneys, and experts.
b. The State shall treat all data shared as part of the alternative dispute resolution process as trade secret data under Minn. Stat. §13.37 and civil investigative data under Minn. Stat. § 13.39.
c. The State and OCM shall cooperate with the Tribe as set forth in the Compact in connection with all public data and information requests.
4. Seed-to-Sale Tracking System (METRC)
a. The State and OCM shall not download, print, copy, collect, store, or share any Nonpublic Data while accessing or viewing the Tribe’s “Seed-to-Sale Tracking System” including without limitation any incidental downloading, printing,
copying, collecting, storing, or sharing of information or data by the State or OCM shall not be deemed to be a collection, creation, receipt, maintenance, or
dissemination of such information or data.
5. E-Commerce and POS (Dutchie)
a. A retailer must collect only the information necessary to complete a transaction. A retailer must only use collected information for the purpose of completing a
transaction.
b. Dutchie collects the categories of personal information listed in their Privacy
Policy. Dutchie collects the personal information provided to deliver services, to communicate with State Licensed Business on relevant services, or as otherwise necessary or appropriate in connection with the fulfillment of Dutchie’s legitimate business purposes.
c. By submitting personal information, the user agrees to the processing of
information in this manner. To learn more, review the Dutchie Privacy Policy.
d. Dutchie retains Personal Data for as long as reasonably necessary to provide services and carry out the purposes described in their Privacy Policy.
i. If necessary, they may retain Personal Data for longer periods of time, until set retention periods and deadlines expire, or for instances where they are required to do so in accordance with legal, tax and accounting
requirements.
ii. Once retention of the Personal Data is no longer necessary for the
purposes outlined in their Privacy Policy, Dutchie will either delete or de-identify the Personal Data or, if this is not possible (for example, because Personal Data has been stored in backup archives), then we will securely store the Personal Data and isolate it from further processing until deletion or deidentification is possible.
iii. Any customer has the right to request that a business delete their Personal Data.
1. Dutchie has established an individual rights portal for the purpose of submitting such individual rights requests, which can be
found here. A customer may also submit requests via email to privacy@dutchie.com.
6. Requests for Nonpublic Data
a. All customer data is private. No Nonpublic Data or Personal Data relating to a consumer or employee shall be shared with any federal agency, federal
department, or federal entity unless specifically ordered to do so by a state or federal court.
7. Data Breach
a. In the event of a data breach, the Tribal Business Enterprise will partner with Arvig Managed Services and coordinate with White Earth Nation regulators to identify
and contain information leaks and will follow all actions and guidance provided by the technical subject matter experts.