Section 1291.308  Purchaser Privacy

a)         Dispensing organizations are prohibited from obtaining, collecting, maintaining, recording, and/or storing a purchaser's personal information from the transaction itself without the purchaser's consent.  Any identifying or personal information of a purchaser obtained or received during a transaction shall not be retained, used, shared, or disclosed for any purpose except as authorized by the Act or this Part.  Dispensaries shall ensure their internal systems delete all purchaser personal information within 24 hours after any purchase is completed.

b)         Personal information includes, but is not limited to, a purchaser's name, address, birthdate, and/or email address.

(Source:  Added at 48 Ill. Reg. 13377, effective August 20, 2024)