You are at a board meeting of your charity. Board member Jane mentions her friend Peter, and says he might be interested in making a donation. Peter, she says, is the owner of a large software company.
Peter, to be clear, is NOT A CURRENT DONOR. He has not opted in or opted out or opted for anything at your charity.
Back at the office you put Peter’s name into Google. It’s in your legitimate interests to do so, and Peter would expect you to do this.
Turns out that Peter’s business is based in Newcastle.
You are in London, so there is time and travel cost to consider if you are to visit him. You use Companies House to find out about Peter’s shareholding and the company’s profits. These figures help you estimate Peter’s gift capacity. Again, it’s legitimate for a charity to estimate the size of a potential donation before it decides to spend money on a visit to Newcastle.
At an invitation-only event on the 21st of February, the Information Commissioner’s staff will tell charities and the Fundraising Regulator whether or not they can do this search.
The future of philanthropy in the UK hangs on the ICO’s reply to this one question.
Can a prospect researcher do the search outlined above?
If the answer to the question is “No”, then high-value philanthropy in the UK will change dramatically.
It will no longer be possible to use public-domain information to identify or understand potential donors. Charities, universities, museums, hospitals and theatres will have to stop, immediately, all proactive forms of reaching out to new high-value supporters.
How will high-value philanthropists react? They will give less. When charities stop asking, people of wealth will stop giving, or give less and less often.This is not just an assertion – it is demonstrated by research. In “Richer Lives: why rich people give”, Theresa Lloyd and Beth Breeze report that 69% of rich donors give ‘If I am asked by someone I know and respect.’ Charities, from cancer research to the lifeboats, will have to adapt to a dramatic cut in their income.
Some philanthropists will respond by setting up their own foundations. We know from Factary’s New Trust Update that they are already doing this in some numbers. They will manage their own projects via these foundations, meaning less money for mainstream charities.
If the answer to the question is “No”, then the ICO is taking on not just the charity sector, but pretty much every business in the UK. Because every day hundreds of thousands of secretaries, assistants and marketing people do this exact search to check up on potential customers. Can that really be the ICO’s intent?
If the answer is “Yes”, then the ICO is affirming prospect research. We CAN continue to research, understand, and evaluate potential donors and, with permission, actual donors.
We will know the future of philanthropy in the UK on the 21st of February.
Chris Carnie is the author of “How Philanthropy is Changing in Europe”, published by Policy Press. He writes in a personal capacity.
I don’t want to be the bearer of bad news however I am not optimistic about the situation. I believe it is the end of Prospect Research (or as ICO will call it, wealth screening). I would try and get consent to ensure business continuity Chris.
I received an invitation on behalf of my charity and will be there on the 21 February.
I am going to try and review your question objectively with my legal hat on. I hope this will explain why I am not optimistic.
– Peter is not a current donor and has NOT opted in.
– There is NO legitimate interest as there is not a contractual relationship or consent.
– Searching & obtaining information is “processing” (under the definition of the DPA)
– Principle 1 & 2 : Personal data is fair & lawfully obtained.
So, I have already pre-empted what the ICO will say. Processing done in “secret” is not fair and lawful. There is no legitimate interest if the data subject is unaware they are being screened/researched. How can they opt out if they don’t know this is going on?
Stop or else you will be next.
It has been a good ride but the gravy train has reached its destination. The judgement was inevitable and it has been made clear in the GDPR (which has an Article which explicitly covers this scenario and profiling).
What’s your strategy?
Thanks for your comments, Gareth. I am not really questionning the law. I am questionning the common sense behind the law, and the ways in which the law has been interpreted. If what you say is correct, in other words that my pre-penultimate paragraph is the ICO’s view, then what happens to Google? And all those secretaries, assistants and marketing people around the country? Are the ALL breaking the law? And if that is the case, why is the ICO picking on charities and not, say, banks, for this practice?
And finally, if you know prospect researchers, you’ll know that we are definitely not riding on a gravy train; salaries for prospect researchers are substantially lower than those for fundraisers!
Thanks for your response Chris.
In relation to the gravy train comment, I did not mean it as in “pay” for prospect researchers – but the “method” used which has substantially assisted in fundraising. Most legal and data protection experts knew it was straddling the legal limit but fortunately there was no ICO attention (until now).
I don’t see it as the ICO targeting charities. I believe it was an article by Daily Mail which provided enough evidence to the ICO that these practices were going on. Prior to that, I doubt the regulator were even aware of this. I think that’s why we’ve managed to be outside of their radar.
I do agree that ICO should focus on other sectors too – maybe that is something that’ll be raised at the Conference.
What is your plan going forward Chris? Out of interest, has the ICO approached Factary?
Gareth, I think you are completely mistaken about the “legitimate interest” ground for lawful processing. DPA 1998 says that the following, amongst other things are grounds for lawful processing:
a. A Contract
b. Consent
c. The Legitimate Interest of the Data Controller.
ICO on its website gives a somewhat extreme example of Legitimate Interest – a debt collection agency pursuing someone for payment. There is clearly not consent for that processing, nor is there any contract between agency and debtor. However it’s in the legitimate interest of the data controller to find the person.
So in Chris’ example the questions are
1. whether or not ICO regards public domain information as available for the kind of processing which Chris describes
2. how and at what time the charity delivers the fair processing information to the data subject. I specifically asked an ICO policy person about this at the Researchers in Fundraising conference. I was told that a “layered approach” was appropriate. I understand that to mean, in the example above “tell the person when you first contact them who you are and that you’d like to see them to talk about whether they’d be interested in hearing more about the charity. Then when you meet them make it clear that ultimately you’d like to see whether they would give their financial support, and give them a copy of the charity’s privacy notice.”
May I respectfully ask whether your charity has any significant major gift income? The irony is that ICO has produced absolutely no evidence whatsoever that wealth screening (which is not the same as broader prospect research) has caused anyone any harm – indeed the impact on most people who’ve been screened in this way is zero. And FRSB data shows only a tiny number of complaints about major gifts fundraising.
Adrian,
With all due respect, I think you’re wrong. I have worked on Data Protection issues within the Charity sector for over a decade and legitimate interest is somewhat clear. You even acknowledge it but then consider the ICO’s interpretation of legitimate interest as “extreme.” Yes, there is obviously legitimate interest for a debt collector to find their debtor, they ofcorse wouldn’t need consent or contract (the contract they would rely on would be with the relevant bank/finance organisation who would be allowed to sub-contract enforcement via relevant financial legal frameworks).
I’m open minded, please provide me an argument which you’ll think which could be defended in a court of law as legitimate interest for wealth screening/prospect research. I need some optimism.
In relation to your discussion to a person in policy, it is irrelevant. I am talking as a matter of law. The enforcement department has made a decision which is clear that wealth screening is not legal and they did not appeal against it. I am sympathetic with organisations like Factary, PFG etc. The practices (albeit a breach of the DPA) has dramatically increased funds for charities. I just believe it is the end of the road.
I asked Chris whether Factary has been approached by ICO because it may provide me with some optimism if they haven’t. If they have, it’ll just confirm my suspicions for February.
You have said that “The irony is that ICO has produced absolutely no evidence whatsoever that wealth screening (which is not the same as broader prospect research) has caused anyone any harm”. I will refer you to the powers of the Information Commissioner. Under Section 55(A) , you’ll find that the ICO doesn’t even need to prove harm or detriment. They just need to prove that “the contravention was ((of a kind likely)) to cause substantial distress/detriment. The charities could have appealed on the basis of “likely” but it decided that would have been a risk.
Personally, I would have advised my board against appealing. There is a likelihood of an increased fine in the tribunal & potentially all our documents/investigation findings would be on public display. It would not help with public relations.
Just to clarify the above, a contract must be with the subject themselves, not with anyone else. A debt collection agency would be acting on behalf of someone who does have a contract with the subject, and so it’s more likely that the above scenario would be covered by contract. It’s also very difficult for a interest to be legitimate if it is pursued secretly or otherwise unfairly.
The issue of personal data in the public domain is not difficult to clear up: which section of the Data Protection Act makes public domain information exempt? None of them. Which section applies an exemption to public domain information? Section 34, but it only applies to bodies who are obliged to publish data by law. Personal data in the public domain is still personal data – those who want to use it have to square that use with the Act (and in 2018), the GDPR.
The ICO’s fines don’t ban any form of processing, and ICO guidance isn’t automatically the law. Any charity that disagrees with the Commissioner is entitled to do so, as long as that view is based on the Data Protection Act. Neither of the charities that received fines has appealed, and at least one charity have signed an undertaking that goes further than what the law requires (in my opinion).
If the ICO is so wrong, charities and fundraisers should take them on. But they shouldn’t forget that processing data secretly or unexpectedly is always a breach, and to act accordingly.
Why can’t Jane suggest to Peter that he could make contact with you? Or ask him if he’s ok with his details being passed to you?
Why does it have be done without his knowledge?
I’m with Chris on this one. Public Domain information is just that. Journalists and their researchers do it all the time ahead of an interview or feature. The subject only becomes aware when agreeing (or disagreeing) to the interview. The feature can run even without the subject’s consent. There is therefore no logic (and we all know that the law can be “…a ass”) in banning major gift research whilst permitting journalistic curiosity.
Journalists have a clear exemption from most of the Data Protection provisions in Section 32; the same is true of the upcoming GDPR. Charities do not have such an exemption, so I’m afraid the comparison does not work.
So if I am organising a public event on the goals of my charity, I would not be allowed to find suitable guests for the event? Using internet research? To undertake any sort of public affairs you would need to surely know who you wanted to invite or not, using the Internet…