Ill. Admin. Code tit. 68 § 1291.308

Current through Register Vol. 49, No. 2, January 10, 2025

Section 1291.308 - Purchaser Privacy

a) Dispensing organizations are prohibited from obtaining, collecting, maintaining, recording, and/or storing a purchaser's personal information from the transaction itself without the purchaser's consent. Any identifying or personal information of a purchaser obtained or received during a transaction shall not be retained, used, shared, or disclosed for any purpose except as authorized by the Act or this Part. Dispensaries shall ensure their internal systems delete all purchaser personal information within 24 hours after any purchase is completed.

b) Personal information includes, but is not limited to, a purchaser's name, address, birthdate, and/or email address.

Ill. Admin. Code tit. 68, § 1291.308

Added at 48 Ill. Reg. 13377, effective 8/20/2024