CHAPTER 16. Records [26160. - 26163.]

Cal. Business and Professions Code - BPC 16.

in effect

Cal. Business and Professions Code - BPC § 26160. Section 26160.

(a) A licensee shall keep accurate records of commercial cannabis activity. (b) All records related to commercial cannabis activity as defined by the department shall be maintained for a minimum of seven years. (c) The department may examine the records of a licensee and inspect the premises of a licensee as the department, or a state or local agency, deems necessary to perform its duties under this division. All inspections and examinations of records shall be conducted during standard business hours of the licensed facility or at any other reasonable time. Licensees shall provide and deliver records to the department upon request. (d) Licensees shall keep records identified by the department on the premises of the location licensed. The department may make any examination of the records of any licensee. Licensees shall also provide and deliver copies of documents to the department upon request. (e) A licensee, or its agent or employee, that refuses, impedes, obstructs, or interferes with an inspection of the premises or records of the licensee pursuant to this section, has engaged in a violation of this division. (f) If a licensee, or an agent or employee of a licensee, fails to maintain or provide the records required pursuant to this section, the licensee shall be subject to a citation and fine of up to thirty thousand dollars ($30,000) per individual violation.

Cal. Business and Professions Code - BPC § 26161. Section 26161.

(a) Every sale or transport of cannabis or cannabis products from one licensee to another licensee must be recorded on a sales invoice or receipt. Sales invoices and receipts may be maintained electronically and must be filed in such manner as to be readily accessible for examination by employees of the department or California Department of Tax and Fee Administration and shall not be commingled with invoices covering other commodities. (b) Each sales invoice required by subdivision (a) shall include the name and address of the seller and shall include the following information: (1) Name and address of the purchaser. (2) Date of sale and invoice number. (3) Kind, quantity, size, and capacity of packages of cannabis or cannabis products sold. (4) The cost to the purchaser, together with any discount applied to the price as shown on the invoice. (5) The place from which transport of the cannabis or cannabis product was made unless transport was made from the premises of the licensee. (6) Whether the cannabis or cannabis products are designated for donation to a medicinal cannabis patient. (7) Any other information specified by the department.

Cal. Business and Professions Code - BPC § 26161.5. Section 26161.5.

(a) A licensee shall not disclose a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance. (b) A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction. (c) For purposes of this section, “personal information” has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code. (d) For the purposes of this section, “third party” does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumer’s personal information for any other purpose or share a consumer’s personal information with any party other than the contracting licensee. (e) This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.

Cal. Business and Professions Code - BPC § 26162. Section 26162.

(a) Information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the office or the department for the purposes of administering this chapter are confidential and shall not be disclosed pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code), except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance. (b) Information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the department for the purposes of administering this chapter shall be maintained in accordance with Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code, Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code, and other state and federal laws relating to confidential patient information. (c) Nothing in this section precludes the following: (1) Employees of the department notifying state or local agencies about information submitted to the agency that the employee suspects is falsified or fraudulent. (2) Notifications from the department to state or local agencies about apparent violations of this division or applicable local ordinance. (3) Verification of requests by state or local agencies to confirm licenses and certificates issued by the department or other state agency. (4) Provision of information requested pursuant to a court order or subpoena issued by a court or an administrative agency or local governing body authorized by law to issue subpoenas. (d) Information shall not be disclosed by any state or local agency beyond what is necessary to achieve the goals of a specific investigation, notification, or the parameters of a specific court order or subpoena.

Cal. Business and Professions Code - BPC § 26162.5. Section 26162.5.

(a) Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, Part 1 (commencing with Section 6001) and Part 14.5 (commencing with Section 34010) of Division 2 of the Revenue and Taxation Code, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee. (b) Information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver is hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, Part 1 (commencing with Section 6001) and Part 14.5 (commencing with Section 34010) of Division 2 of the Revenue and Taxation Code, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.

Cal. Business and Professions Code - BPC § 26163. Section 26163.

(a) The department shall, upon the request of the CalSavers Retirement Savings Board, furnish to the board, as applicable, the following information with respect to every licensee: (1) Licensee. (2) Licensee’s physical and mailing addresses. (3) Federal employer identification number if the licensee is a partnership, or the licensee’s individual taxpayer identification number or social security number for all other licensees. (4) Type of license. (5) Effective date of license or a renewal. (6) Expiration date of license. (7) Whether license is active or inactive, if known. (b) Information shared with the CalSavers Retirement Savings Board shall be used only for the purposes of administering the CalSavers Retirement Program.

Source: CA Legislative Counsel Bulk DataURL: https://downloads.leginfo.legislature.ca.gov/pubinfo_2025.zipFetched: 6/27/2026