Marijuana and the Internet of Things, Part 2

Cannabis and the Internet of thingsPart 1 of this series was on the union of marijuana and the Internet of Things (IoT). This post is on the legal issues cannabis business lawyers face in representing companies involved in the Internet of Things.

What happens when you combine cannabis, whose laws are changing almost daily, with technologies that are constantly evolving as well? You get a lot of gray areas and issues of first impression. We typically analyze the following issues for our IoT clients:

  • Criminal liability. Just like other ancillary service and product providers to the cannabis industry, IoT providers could face criminal sanctions for aiding and abetting and/or conspiring to violate the federal Controlled Substances Act. Because of this, most of the IoT providers we represent seek only to work in those states with “robust regulations”  that comply with the Cole Memo. Though that narrows our IoT clients’ customer base, it correspondingly lessens their potential for criminal liability.
  • Product liability. Because IoT hinges on automated and connected devices that make various tasks tasks easier to do or to monitor, a product breakdown or malfunction can have a huge impact. As just one example, suppose a watering or nutrient device malfunctions and, for whatever reason, destroys part or all of a massive cannabis crop. Will the IoT device manufacturer be liable for all of the damage? Will the IoT device manufacturer’s liability disclaimers be sufficient to prevent liability? Let’s just say that one of the most important things we do for our IoT clients is to draft their liability disclaimers. See Nest Thermostat Glitch Leaves Users in the Cold and Marijuana Product Recalls: You Can’t Touch This. What happens if a vape pen manufacturing company partners with an IoT software company whose software tracks or recommends patient dosing for medical marijuana and the software malfunctions and the patient suffers because of that? Which company will bear the burden of the malfunction, the vapor pen company or the IoT software business? The answer will usually be based on the contract between these two companies. What happens if the Iot Software malfunctions and publishes on the internet the names and addresses of all those who are using the vape pens and exactly how much cannabis they are consuming? Taking this a step further, what happens if the local police mount an investigation of some of those on the list and arrests occur?
  • Intellectual Property Protection. Most of our IoT clients are on the bleeding edge of innovation, oftentimes with respect to their software and their hardware and with the processes used to combine the two and to make them work effectively together. The last thing they want is for someone else to be able to duplicate what they were able to achieve through years of research and development. We spend a lot of time figuring out how we can protect our client’s IP. And because virtually all IoT devices are made in China, the IP issues become international. See China and the Internet of Things, China NNN Agreements and China Product Development Agreements. See also Cannabis IP Licensing: It’s Complicated.
  • Insurance. IoT companies need insurance that will cover them against product liability and cybersecurity lawsuits and this is usually neither inexpensive nor uncomplicated. Many insurers will not provide insurance unless and until the IoT company has proper contracts in place.  Insurers have sought to avoid paying cannabis related insurance claims by arguing federal illegality of cannabis. See Marijuana Inventory is Insurable. We should expect an insurer to assert the same argument against a marijuana-friendly IoT company, especially if the damage incurred involves the plant itself.
  • Investors. If investors are salivating over IoT and cannabis (and they are), they are salivating even more over the combination of the two, especially since investing in ancillary cannabis businesses is legally less risky (and usually less tricky legally as well) than investing in a business that deals directly with the plant. Nonetheless, because marijuana is still federally illegal, marijuana related  should disclose this illegality and discuss what that means by way of investment and even criminal prosecution risk. See Marijuana Business Investments: Not Simple
  • Privacy issues. Part 1 of this series addressed some of the privacy issues inherent in many IoT businesses. What will the IoT business do with the data it collects? How might its data be hacked? What might its own employees do with the data? Our job as lawyers, is to draft privacy policy notices and disclaimers.

Any business doing cannabis IoT or even doing business with a cannabis IoT entity should be considering the above issues. The intersection of marijuana and the IoT is filled with new and different landmines and preparation is the best way to avoid them.