1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

Montana permits the sale of hemp-derived CBD oil products to the public. Industrial hemp containing no more than 0.3% tetrahydrocannabinol (“THC”) is considered an agricultural crop. Mont. Code Ann. § 80-18-102. Hemp-derived CBD oil containing 0.3% THC or less can be purchased over-the-counter at retail stores (health food stores, vape shops, and gas stations) throughout the state.

Montana also permits the sale of marijuana-derived CBD oil products in accordance with the Montana Medical Marijuana Act, Mont. Code Ann. §§ 50-46-301 et seq. (“Act”), and associated regulations, Admin.R.Mont. §§ 37.107.101 et seq. A “marijuana-infused products provider” or “MIPP” is a person licensed by the Montana Department of Public Health and Human Services to manufacture and provide marijuana-infused products for a registered cardholder. Mont. Code Ann. § 50-46-302(13)(a). A “marijuana-infused product” is a product containing marijuana which is intended for use by a registered cardholder by means other than smoking. Mont. Code Ann. § 50-46-302(12)(a).

Montana does not permit the sale of marijuana-infused products, such as marijuana-derived CBD oil, for recreational use purposes. The sale of these products is a crime, Mont. Code Ann. § 45-9-101, unless the product is sold by a MIPP to a registered cardholder in full conformance with the Act and associated regulations.

On February 2, 2019, the Montana Department for Public Health and Human Services issued a memorandum regarding the use of industrial hemp ingredients and hemp-derived CBD oil in conventional food products and dietary supplements. The memorandum confirmed that while verifiable foodgrade industrial hulled hemp seeds and oil from such seeds are allowed in food and dietary supplements if certain conditions are satisfied (e.g., not marketed with any health or health-related claims), hemp-derived CBD extracts are not allowed to be included in food or dietary supplements.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

Montana has not adopted its own version of GDPR; however, the laws of this state provide robust privacy protections. The right of privacy in Montana is an explicit constitutional right. Mont. Const. Art. II, § 10 (“The right of individual privacy is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest”).

Any person or business that conducts business in Montana and that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the data system following discovery or notification of the breach to any Montana resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. Breaches of personal information are to be reported to the Office of Consumer Protection, which is under the Montana Department of Justice. Mont. Code Ann. § 30-14-1704.

Any licensee or insurance-support organization that conducts business in Montana and that owns or licenses computerized data that includes personal information shall provide notice of any breach of the security of the system following discovery or notice of the breach of the security of the system to any individual whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. Mont. Code Ann. § 33-19-321.

House Bill No. 457 (“The Internet Access Service Customer Privacy Act”) was introduced during the 2019 Legislative Session and sought to prohibit any entity that provides an internet access service from using, disclosing, selling, or permitting access to a customer’s personal information, unless the provider first obtained affirmative express opt-in consent from the customer. House Bill No. 457 died in committee on April 25, 2019.