34-20G-89. Cardholder data maintainable by establishment limited--Authorization to maintain PII.

Except as otherwise provided in this section, information kept or maintained by a medical cannabis establishment may identify a cardholder only by registry identification number and may not contain names or other personally identifiable information.

A cardholder may, in writing, authorize an establishment to maintain the cardholder's name and other personally identifiable information, for the limited purpose of receiving direct communication regarding the cardholder's:

(1)    Individual medical needs; or

(2)    Use of a specific product.

Source: Initiated Measure No. 26, approved Nov. 3, 2020, eff. Jul. 1, 2021; SL 2023, ch 124, § 1, eff. Mar. 8, 2023.