Oregon Health Authority

ELLEN F. ROSENBLUM ATTORNEY GENERAL [LOGO] FREDERICK M. BOSS DEPUTY ATTORNEY GENERAL # DEPARTMENT OF JUSTICE Justice Building 1162 Court Street NE Salem, OR 97301-4096 Telephone: (503) 378-4400 August 21, 2018 No. 8293 This opinion responds to questions from the Oregon Health Authority (OHA) about disclosing medical marijuana grow site addresses in bulk to local law enforcement. # QUESTIONS AND SHORT ANSWERS # QUESTION 1 Can OHA provide a complete list of medical marijuana grow site addresses to a local law enforcement agency? # SHORT ANSWER No. ORS 475B.882(1)(b) makes grow site addresses, patient cardholder names, and primary caregiver names confidential. ORS 475B.882(2)(b) permits disclosure of this information to state and local law enforcement, but only as necessary to verify that an address is a registered grow site, or that a person is a registered patient cardholder or caregiver. This limitation suggests that disclosure is permitted when there is a legitimate law enforcement need for the information in the course of a particular investigation. Bulk disclosure of all the grow site addresses in a particular jurisdiction is inconsistent with this limitation. Because ORS 475B.882(1)(b) specifically makes grow site addresses confidential and spells out a specific procedure for disclosing these addresses in certain circumstances, this confidentiality controls over the more general ORS 475B.879(2), which permits OHA to disclose information in its tracking database to law enforcement. # QUESTION 2 If a local law enforcement agency provides a list of all addresses within its jurisdiction, is OHA permitted to verify which addresses are registered grow sites? 1 # SHORT ANSWER No. OHA may disclose grow site addresses to law enforcement only when there is a legitimate law enforcement need. Verifying which addresses in a jurisdiction are grow sites would in effect provide law enforcement with a list of all grow site addresses. Absent a legitimate and specific law enforcement need, this violates ORS 475B.882(1)(b). # DISCUSSION OHA administers and enforces the Oregon Medical Marijuana Act, ORS 475B.785 to 475B.949. The Act permits the legal production, processing, transfer, and use of marijuana for medical purposes.¹ Personally identifiable information about patients,² their designated primary caregivers, and the persons they designate to produce marijuana at grow sites, is submitted to OHA as part of the registration process.³ In addition, registered grow sites, processing sites, and dispensaries submit monthly reports to OHA tracking the production and transfer of marijuana plants and products, and usable marijuana.⁴ OHA is required to maintain a database of this tracking information,⁵ which helps OHA to ensure that grow sites comply with possession limits and that marijuana is transferred only between registered entities and individuals. Strong confidentiality provisions in the Act protect personally identifiable information. For example, ORS 475B.882(1)(b) makes patient names, caregiver names, and grow site addresses confidential. ORS 475B.885(1) makes confidential any personally identifiable information collected in registering grow sites, processing sites, or dispensaries, with an exception for names and addresses associated with processing sites and dispensaries. And ORS 475B.885(2) protects any personally identifiable information submitted with the monthly tracking data. ¹ See ORS 475B.907 (providing, with some exceptions, that persons engaged in or assisting in the medical use of marijuana are exempt from criminal laws for the possession, delivery, and manufacture of marijuana, as long as they comply with the Act). ² The Act refers to patients who are registered for the medical use of marijuana as “registry identification cardholders.” We refer to patient cardholders as “patients,” to distinguish them from caregiver cardholders and grow site cardholders. See OAR 333-008-0010(47) (“patient” has same meaning as “registry identification cardholder”). ³ See ORS 475B.797(2)(b) (requiring a patient applying for registration to submit name, address, and date of birth); ORS 475B.797(2)(e) (requiring a patient who is designating a primary caregiver to provide the caregiver’s name and address); ORS 475B.810(2) (requiring a patient who produces marijuana or has designated another person to produce marijuana to provide the address of the grow site and the name of the person responsible for the grow site). ⁴ See ORS 475B.816 (grow sites); ORS 475B.846 (processing sites); ORS 475B.867 (dispensaries). For grow sites, the tracking requirement does not apply to patients who grow for their own use. See ORS 475B.816 (requiring monthly reports from only “[a] person designated to produce marijuana by a * * * cardholder”). ⁵ ORS 475B.879(1). 2 However, OHA is permitted or required in certain circumstances to disclose information to state and local law enforcement, cities and counties, and state agencies. For example, ORS 475B.882(2)(b) permits OHA to disclose patient names, caregiver names, and grow site addresses to law enforcement, “but only as necessary to verify that” a person is a registered patient or caregiver, or that an address is a registered grow site. ORS 475B.882(4) permits OHA to disclose to state or local law enforcement “the minimum amount of information necessary to enable [law enforcement] to determine whether an individual or location is in compliance with [the Act].” ORS 475B.882(5) permits OHA to disclose information it obtains from an investigation or complaint of an alleged violation of the Act to state or local law enforcement, or to any other state or local government agency with jurisdiction over the matter. ORS 475B.888 requires OHA to provide information on disciplinary action taken against a grow site, processing site, or dispensary to law enforcement. ORS 475B.876 requires OHA to maintain a telephone hotline for verifying to cities, counties, water districts, and the Water Resources Department that an address is the location of a registered grow site, processing site, or dispensary. And finally, ORS 475B.879(2) permits OHA to disclose information stored in its tracking database to law enforcement and city or county regulatory agencies, with some exceptions. These provisions plainly allow disclosures to law enforcement in specific circumstances or in the course of a particular investigation. But law enforcement may prefer to receive a bulk list of patient names, caregiver names, or, in particular, grow site addresses. Two provisions potentially allow bulk disclosure of grow site addresses: ORS 475B.882(2)(b), which does not expressly address whether bulk disclosure is permitted; and ORS 475B.879(2), which does not expressly mention disclosing grow site addresses, whether in individual circumstances or in bulk.⁶ To determine whether either of these provisions permits bulk disclosure of grow site addresses, we examine the legislature’s intent by considering the statutory text in context, with reference to pertinent legislative history.⁷ Context includes “other provisions of the same statute and other related statutes,”⁸ and statements of statutory policy.⁹ For provisions of the Act that were enacted by the voters in Ballot Measure 67 in 1998, the same interpretive principles apply.¹⁰ # I. ORS 475B.882 ORS 475B.882(1) requires OHA to maintain a confidential list of patient names, caregiver names, and grow site addresses. ORS 475B.882(2)(b) permits disclosure of information from the list to state and local law enforcement, “but only as necessary to verify that” a person is a registered patient or caregiver, or that a location is a registered grow site. ORS 475B.882(1)(c) complements that provision by requiring OHA to develop a system so that law enforcement can verify this information. ⁶ We understand OHA to be asking not whether bulk disclosure is permitted under its current rules, but whether OHA can adopt rules permitting bulk disclosure. ⁷ State v. Gaines, 346 Or 160, 171–72, 206 P3d 1042 (2009). ⁸ PGE v. Bureau of Labor & Industries, 317 Or 606, 611, 859 P2d 1143 (1993). ⁹ Havi Group LP v. Fyock, 204 Or App 558, 564, 131 P3d 793 (2006). ¹⁰ PGE, 317 Or at 612 n 4, 859 P2d 1143. 3 The narrow language used in ORS 475B.882(2)(b) indicates an intent to restrict disclosures to law enforcement to circumstances involving a legitimate law enforcement need in the course of a particular investigation. That is, it is only “necessary to verify that” a location is a registered grow site when law enforcement already has some reason to believe that marijuana is present at that location. The use of “verify” supports this conclusion because the word presumes that the verifier already has some initial data that needs to be checked or tested. Specifically, “verify” means “to check or test the accuracy or exactness of: confirm the truth or truthfulness of by or as if by comparison with known data or a recognized standard of authority” and “to confirm or establish the authenticity or existence of by examination, investigation, or competent evidence.”¹¹ In this context, “verify” logically implies that law enforcement already possesses information about whether a certain location is or is not a grow site. The words “only” and “necessary” further emphasize that disclosures to law enforcement are restricted. This conclusion finds contextual support in the surrounding statutory provisions. First, registration as a patient, caregiver, or grow site “does not constitute probable cause to search the person or property of the registrant.”¹² This indicates that merely registering under the Act should not warrant law enforcement scrutiny, and suggests that law enforcement does not have a legitimate need for a bulk list of patients, caregivers, and grow site addresses. Second, the Act was designed to allow patients with debilitating medical conditions to access marijuana for medical benefit “without fear of civil or criminal penalties.”¹³ Bulk disclosure of patient and caregiver names to law enforcement could stoke fears that the Act expressly seeks to avoid. Based on this review of text and context, we conclude that ORS 475B.882(1)(b) and (2)(b) do not allow the bulk disclosure of grow site addresses to law enforcement. Nor may OHA verify in bulk which addresses in a particular jurisdiction are registered grow sites.¹⁴ ## II. ORS 475B.879 As of 2015, the Act requires grow sites, processing sites, and dispensaries to submit monthly reports to OHA tracking the possession and transfer of marijuana plants and products and usable marijuana.¹⁵ OHA is required by ORS 475B.879(1) to maintain a database compiling this tracking information. Under ORS 475B.879(2), OHA may disclose information stored in this database to law enforcement and city or county regulatory agencies. However, significant amounts of information are excepted from this permitted disclosure: ORS 475B.882(2)(c) does not permit the disclosure of “[a]ny information related to the amount and type of usable ¹¹ Webster’s Third New Int’l Dictionary 2543 (unabridged ed 2002); see State v. Briney, 345 Or 505, 511, 200 P3d 550 (2008) (courts give words of common usage their plain, ordinary meaning). ¹² ORS 475B.922(1). ¹³ ORS 475B.785(2). ¹⁴ The pertinent legislative and ballot measure history does not provide any reason to believe that the voters or legislature intended for the bulk disclosure of patient names, caregiver names, or grow site addresses. ¹⁵ See ORS 475B.816 (grow sites); ORS 475B.846 (processing sites); ORS 475B.867 (dispensaries). While patients growing their own marijuana do not report tracking data, for brevity’s sake we refer to all grow sites. 4 marijuana, medical cannabinoid products, cannabinoid concentrates, and cannabinoid extracts” transferred to or from grow sites, processing sites, and dispensaries. Because those transfers are the primary information reported by processing sites and dispensaries,¹⁶ these provisions appear to contemplate disclosures mainly about grow sites’ possession of marijuana plants and usable marijuana.¹⁷ ORS 475B.879 does not expressly require the database to include grow site addresses, or any other personal identifying information associated with grow sites, processing sites, and dispensaries. However, context and legislative history suggest that the database would include such information. First, for the database to be useful to OHA, the tracking data would need to be associated with the particular grow sites, processing sites, and dispensaries the data was received from. Second, ORS 475B.885(2) expressly makes confidential any personally identifiable information submitted to OHA under the tracking statutes (or pursuant to ORS 475B.879), while ORS 475B.879(2)(c)(A) prohibits OHA from disclosing any personally identifiable information related to a patient or caregiver from the database. If the database were not to include personally identifiable information, there would be no reason to make that information confidential. Third, during a committee work session discussing the database, Representative Peter Buckley explained that a grow site’s reporting “could be as simple as a * * * one-page document * * * that says name of grower, location of grow site, number of patients, [and] number of plants.”¹⁸ Because ORS 475B.879(2) permits the disclosure of information stored in the database to law enforcement, and information stored in the database could include grow sites addresses, it could be argued that OHA is permitted to disclose these addresses to law enforcement in bulk. The difficulty with this interpretation is that bulk disclosure conflicts with several other statutes. First, it conflicts with ORS 475B.882(1) and (2), which, as discussed above, make grow site addresses confidential and allow disclosure only in specific circumstances. Second, to the extent the grow site addresses stored in the database come from information collected during registration, bulk disclosure would conflict with ORS 475B.885(1), which provides that any personally identifiable information obtained in registering a grow site is confidential. And third, to the extent the grow site addresses stored in the database come from the monthly reports on tracking data, bulk disclosure would conflict with ORS 475B.885(2), which provides that any personally identifiable information submitted to OHA under the tracking statutes or pursuant to ORS 475B.879 is confidential. ¹⁶ See ORS 475B.846 (requiring processing sites to submit information on the transfer of usable marijuana, and cannabinoid products, concentrates, and extracts); ORS 475B.867 (primarily requiring dispensaries to submit information on the transfer of usable marijuana, and cannabinoid products, concentrates, and extracts). ¹⁷ See ORS 475B.816(1) (requiring grow sites to submit possession information on marijuana plants, usable marijuana, and marijuana leaves and flowers being dried). ¹⁸ Audio Recording, Joint Committee on Implementing Measure 91, SB 844, Apr 27, 2015, at 1:20:15, http://oregon.granicus.com/MediaPlayer.php?clip_id=9435 (emphasis added). 5 To resolve this conflict, we begin and end with ORS 475B.882(1)(b), which specifically provides that grow site addresses are confidential. We note that “[w]hen a general provision and a particular provision are inconsistent, * * * a particular intent controls a general intent.”¹⁹ Here, ORS 475B.882(1) and (2) specifically make grow site addresses confidential, and permit their disclosure to state and local enforcement only in specific circumstances. ORS 475B.879 refers more generally to any information stored in OHA’s tracking database, without expressly providing for the disclosure of grow site addresses. Statutory context supports this conclusion. At the same time the legislature enacted ORS 475B.879, it required that OHA provide certain information to law enforcement in the event of disciplinary action against a grow site, processing site, or dispensary.²⁰ The legislature made clear that this disclosure applies “notwithstanding ORS 475B.885,” that is, the disclosure overrides any confidentiality provided for in ORS 475B.885.²¹ However, the legislature did not provide that ORS 475B.879(2) applies “notwithstanding ORS 475B.882(1)(c).” Because the legislature was aware of the potential conflict between disclosure and confidentiality provisions and knew how to resolve this conflict, the lack of “notwithstanding” in ORS 475B.879 suggests that the legislature did not intend that the disclosure of information from the database overrides the confidentiality of grow site addresses. In addition, interpreting ORS 475B.879(2) to allow the bulk disclosure of grow site addresses is inconsistent with the surrounding statutes that permit disclosure only in certain circumstances. In addition to ORS 475B.882(2) (allowing the disclosure of patient and caregiver names and grow site addresses only when there is a legitimate law enforcement need), ORS 475B.882(4) permits OHA to disclose “the minimum amount of information necessary to enable [state or local law enforcement] to determine whether an individual or location is in compliance with [the Act].” The disclosures contemplated by ORS 475B.879(2) fit the statutory scheme best if interpreted to authorize disclosing data on individual grow sites when there is already a specific need for such information. Some legislative history weighs against this conclusion. In describing the amendments that permitted disclosure of database information, Deputy Legislative Counsel Mark Mayer explained that, in the context of express restrictions on what could be disclosed to law enforcement, “I would assume what that would mean would be that information related to actual license holder and that type of information that’s on the license—address, person who owns, person responsible for—that would be primarily what would be able to be shared with law ¹⁹ ORS 174.020(2). ²⁰ See Or Laws 2015, ch 614, § 85e(2) (permitting disclosures from database); § 88e (requiring disclosure of disciplinary information notwithstanding other confidentiality provisions). Section 88e was codified as ORS 475B.464, and subsequently renumbered as ORS 475B.888. ²¹ See O’mara v. Douglas County, 318 Or 72, 76, 862 P2d 499 (1993) (“The function of a ‘notwithstanding’ clause in the statute is to except the remainder of the sentence containing the clause from other provisions of a law that is referenced in that particular notwithstanding clause.”). 6 enforcement * * * .²² While Mr. Mayer did not explicitly mention the bulk disclosure of grow site addresses, his comment could be read to suggest that grow site addresses stored in the database could be disclosed to law enforcement without limitation. However, in interpreting statutes, “text and context remain primary, and must be given primary weight in the analysis.”²³ To the extent that Mr. Mayer interpreted the wording to permit bulk disclosure of grow site addresses, his assumption is inconsistent with the express confidentiality of grow site addresses, and with the surrounding statutory context authorizing certain disclosures to law enforcement only in specific circumstances. If the legislature intended ORS 475B.879(2) to primarily serve as a mechanism for the bulk disclosure of personally identifying information from grow sites, it could have accomplished that end unambiguously.²⁴ In fact, the joint committee considering this legislation had opportunities to adopt amendments proposing exactly that.²⁵ In particular, the -11 amendments specifically allowed the disclosure of grow site addresses from the database. They were rejected in light of concerns about the past attitude of law enforcement towards the legalization of medical marijuana. For example, in discussing access to the database, Senator Ginny Burdick explained that “not all law enforcement agencies are supportive of the program, and the issue is where do you draw the line between effective law enforcement and harassment or just mining for information inappropriately.”²⁶ And Senator Floyd Prozanski noted that “we have seen in previous years where there’s been documentation where it appears that access to that information has been misused or misappropriated.”²⁷ At most, the relevant legislative history is ambiguous. It does not persuade us that we should revise our earlier analysis based upon text and context.²⁸ ²² Audio Recording, Joint Committee on Implementing Measure 91, SB 844, May 11, 2015, at 26:40, http://oregon.granicus.com/MediaPlayer.php?clip_id=9617 (discussing the -19 amendments, dated May 7, 2015). The legislation on database disclosures from Senate Bill 844 was later incorporated into Senate Bill 964, and then finally enacted as part of House Bill 3400. ²³ Gaines, 346 Or at 171, 206 P3d 1042. ²⁴ We emphasize the disclosure of grow site information, because there is no prohibition under the Act for disclosing in bulk the names and addresses associated with processing sites and dispensaries. See ORS 475B.885(1) (making confidential any personally identifiable information obtained in registering grow sites, processing sites, and dispensaries, but excepting names and address associated with processing sites and dispensaries). ²⁵ SB 844 (2015), -11 amendments (Apr 29, 2015) (“Except for the address where a marijuana grow site, marijuana processing site or medical marijuana dispensary is located, the authority may not provide to a law enforcement agency any personally identifiable information stored in the database * * *.); SB 844, -13 amendments (Apr 30, 2015) (“Upon request, the authority may provide the address of a marijuana processing site or a medical marijuana dispensary that is stored in the database * * * to a law enforcement agency.”). ²⁶ Audio Recording, Joint Committee on Implementing Measure 91, SB 844, Apr 29, 2015, at 1:19:42, http://oregon.granicus.com/MediaPlayer.php?clip_id=9486. ²⁷ Id. at 1:23:30. ²⁸ See State v. Walker, 192 Or App 535, 545–46, 86 P3d 690 (2004) (legislative history was inconclusive where single statement of committee counsel was contradicted by legislator’s comments); see also State v. Stamper, 197 Or App 413, 424–25, 106 P3d 172 (2005) (“[W]e are hesitant to ascribe to the Legislative Assembly as a whole the single remark of a nonlegislator at a committee hearing.”). 7 # CONCLUSION The Oregon Medical Marijuana Act does not allow OHA to disclose grow site addresses to law enforcement in bulk, or to examine a list of all addresses in a jurisdiction and verify which are grow sites. Bulk disclosure is inconsistent with the limited disclosures contemplated by ORS 475B.882(2) and with the surrounding statutory scheme, which allows OHA to provide information to law enforcement in specific circumstances. Interpreting ORS 475B.882(2) to allow bulk disclosure of grow site addresses to law enforcement would also allow the bulk disclosure of patient and caregiver names. That result would conflict with the goal of the Act to encourage persons with debilitating conditions to take advantage of the medical marijuana law. And while ORS 475B.879(2) generally allows OHA to disclose information from its tracking database, the more specific confidentiality of grow site addresses in ORS 475B.882(1)(b) controls. ELLEN F. ROSENBLUM Attorney General ER1:nog/DM8962466 8