Tag: data protection

Annus Horribilis

Posted on by Chris

2016 has been my personal annus horribilis, at least in the public domain. (Privately, I’m fine thanks.)

It has been the year when two of my working-life projects have fallen apart.

First, my life as a European was cut off at a stroke by England’s vote for Brexit.

And then as an early Christmas present, the Information Commissioner decided that more or less everything that I had dedicated my working life to doing – understanding philanthropists so that charities could work better with them – was illegal, immoral and subject to multi-thousand pound fines.

The Brexit decision is too political a story for this blog. Suffice it to say that when one choses as a UK citizen to live in another EU country, learn its languages, learn and enjoy its rich cultural traditions, and feel thoroughly welcome as an immigrant, it is physically painful to know that a cabal of alt-right Ministers in Westminster are determined to throw you out.

So let’s focus on the Information Commissioner’s announcement yesterday. We would expect the Commissioner to use cautious language. She does not. She piles right into the topic by claiming that ‘millions of people who give their time and money to benefit good causes will be saddened to learn that their generosity wasn’t enough.’

This is a clear example of evidence-based policy making. The Commissioner has evidence, we assume, that there are ‘millions of people’ who will be saddened that their generosity did not suffice. Given the paucity of information on donors in the UK, it would be so helpful if the Commissioner would share this data with the rest of us.

If the subjects gave their permission, of course.

Given that we are living in an age of austerity in which the ICO’s paymasters in government (of whichever colour) are cutting back on benefits, rights and payments, I would be utterly astonished if there were even ten donors, let alone millions, who would feel that their generosity was enough. It is never enough. Ask any of the homeless people in London if it is enough. Or the 960,000 people living in poverty in Scotland.

The Commissioner then applies the same broad brush approach to what she describes as ‘wealth screening.’ The language is purposefully vague and catches within its apparent scope almost all customer-focused, relationship-building, fundraising. It appears, on one reading of the statement, that it is somehow wrong to use information including ‘supporters’ names and addresses, dates of birth and the value and date of the last donation.’ It appears that to investigate ‘income, property values, lifestyle and even friendship circles,’ may be illegal, along with the ability to model ‘donors most likely to leave money in their wills.’

Adrian Beney has pointed out in an excellent blog that this is to do not with information or privacy, but our attitudes to money.

For me, it’s an Edwardian view of ‘charity.’ It’s a penny in an old man’s hat. Thanks guv’nor. Lord bless your little ones. It is about a one-way relationship, donor to ‘charity.’

There is a load of evidence (yes, actual evidence Commissioner) that this is not how donors want to relate to ‘charities’ (or, as we now call them, non-profits, or Social Purpose Organisations.)

Here is just one of dozens of research reports I could cite; ‘Donors respond to personalised communications from charities that they have a relationship with, and prompts from family, friends or colleagues.’ (source, Bagwell, Sally, Lucy de las Casas, Matt van Poortvliet, and Robb Abercrombie. ‘Money for Good UK: Understanding Donor Motivation and Behaviour’. London: New Philanthropy Capital, March 2013. http://www.thinknpc.org/publications/money-for-good-uk/., page 3).

And yet the Commissioner rails against non-profits that identify ‘friendship circles.’

The Commissioner has, either purposely or unwittingly, threatened the development of high-value philanthropy in the UK. By using this broad language, by focusing on an evidently outdated view of ‘charity’, and above all by fining organisations that are trying to build relationships with their supporters based on mutual understanding and knowledge, she has ensured that UK charities will step back, return to the door-knock and the ‘appeal’, never knowing (because the ICO bans such research) who is behind the door or receiving the letter.

This lack of research will drive a wrecking-ball through relationships between high-value philanthropists and non-profits. It is not coincidental that so many people of wealth are now establishing their own foundations; it is already hard enough to persuade them that they should build a relationship with an existing non-profit.

Thanks to the ICO, that job just become harder.

 

Chris Carnie is the author of ‘How Philanthropy is Changing in Europe‘, to be published by Policy Press in January 2017.

The Edge of Privacy

Posted on by Chris

We live in interesting times, privately.

Confusing, contradictory times, when lawmakers require us to lock-down data whilst revealing their intimate thoughts on Twitter. Times when it is OK for a dominant search engine to track our billions of tiny searches, for our wrist watch to measure and transmit our sleeping and walking in the name of fitness. Times when we choose to tell our life stories in Facebook.

And times when our private underbelly is revealed to the world. Two stories have exposed privacy in all its moral complexity; the Panama Papers, and the Ashley Madison data breach. Both have been stories about activities that are legal (being a director of an offshore company and having an affair, or both simultaneously, are not illegal activities.) Both are about normal immorality.

Both stories are to some degree about power. The Panama Papers show us that the powerful are willing to mix their businesses with drug dealers, dictators and money launderers in order to avoid taxes. If you need to be reminded about just how powerful these people are, bear in mind that just one person was prosecuted out of the 1,000 UK names released in the last big tax-related data breach; the Falciani/HSBC affair [Source: ‘Tax Havens don’t need reform, but abolition’, Richard Brooks, Guardian Weekly, 8/4/16]

Both the Panama Papers and Ashley Madison are about relationships, a subject at the heart of prospect research. John knows Jane because both of them invest in the same company in the British Virgin Islands. And John knows Mary because he signed up for Ashley Madison and she’s his new friend.

John is a donor to your charity. He’s in your database, and he has turned up in a screening (carried out, naturally, by Factary). We’ve spotted him in Companies House, a public domain data set, as a director of an investment firm in Holborn, so we have flagged him as interesting.

When you transferred the data to Factary you took the utmost care over the process, using our sFTP (secure FTP) site and thus ensuring that John’s details were encrypted and safe. You checked that the computer link was over a HTTPS network. You made sure that the data would be stored in servers in the UK, in a physically safe and secured building. You did that because you are a conscientious prospect researcher, using the best practice required by the law.

John did not take the same care. When he invested in the British Virgin Islands via Mossack Fonseca he did so through the open web, by email. He joined Ashley Madison the same way, signing up on their website; no encryption, no security. Worse, he was voluntarily exporting his data outside of the protection offered by the European Union through its Data Directive.

And now John has a photograph of him and Mary together at a work conference and he’s posted it on his Facebook page.

Where is the edge of privacy?

Is it the frontier between long standing public domain records and the new stuff, between Companies House and Facebook, for example?

Is it between voluntarily released information and stuff that is Wikileaked?

Is it between Victorian morality and modern – between a marriage notice in the Telegraph, and Ashley Madison?

Above all, is it where people of power dictate it should be? So that we are allowed to see the company directorships of the little people, but cannot see into the murky world of British Virgin Islands connections? Or into the equally dark corners of political connection and patronage?

This is where we are, like it or not, in prospect research. Prospect researchers live on the edge of privacy, using personal information that is in the public domain, for public good. We research John Doe in order to help our fundraising colleagues reach out to him for a donation that will benefit a poor person, or a scholarship kid, or an eye-opening cultural event.

But the power of research comes with a responsibility; it is our profession that must lead the debates on power and privacy, on public domain and private.

Thank goodness it is us, because prospect researchers have a special moral compass. We have chosen to work for causes we believe in, to make sacrifices (anyone want to talk about pay rates for researchers?) for something we believe to be right and good. We have chosen not to sit in the glory seat in fundraising; we are clearly not in this for vanity or fame. We know the value of information, and we have seen the intimacies and the inanities that people are willing to share on the web. We chose every day between information that is right and relevant, and rubbish.

Prospect researchers are the best placed people in the non-profit sector to describe where a private life becomes public.

But we had better get out there and get talking; our donors, our colleagues and our organisations need our guidance as we walk, together, along the edge of privacy.

Safe Harbour in a Storm

Posted on by Chris

On Wednesday it was headline news in Luxembourg where I was working with clients: the European Court of Justice had struck down the Safe Harbor agreement. Max Schrems had won a battle with Facebook and the Irish data protection authorities.

The court ruling that European Commission Decision 2000/520 is invalid means that we can no longer share data easily with US colleagues: Texting your New York colleague with your UK donor’s data of birth just became illegal.

There have always been two routes to data transfer from the EU to the USA: Safe Harbor, and the use of a model contract. The latter route is still open, according to the lawyers; there are useful posts on the ruling and its implications from Norton Rose here and from Clifford Chance here.

So how will this affect prospect research, fundraising and philanthropy?

First, it underlines the relevance of employing prospect researchers. Increasingly, prospect researchers are the custodians of personal data relating to potential and actual supporters. We act as the interface between fundraisers who want to know everything about everybody and the law which restricts what we can record and what we can share. Especially, what we can share with colleagues outside the EU.

Second, it reminds us that personal data is personal. There is an increasingly uncertain frontier between what is public and what is private as social media carries more and more of our donor’s lives. At Factary we have long had concerns about the material that people post in their Facebook pages, and have excluded it from profiles as a general policy. All of us in prospect research should continue to review and re-review our protocols to ensure that we are up-to-the-minute in data protection.

Third, it will mean some hard work over the coming weeks for organisations (universities, arts and culture, NGOs…) with sisters outside the EU (for example, your “Friends of” organisation in Washington DC) to revise or renew agreements that allow data transfer.

Fourth, it means UK suppliers such as Factary should review their data processes to ensure that all of their data is held inside the EU. At Factary we did this some time ago, and yes, all our data and servers are inside the EU.

Finally, this will be especially difficult time for fundraising and philanthropy. Increasingly philanthropists are international – a home here, a business there, and a foundation somewhere else. To work with a donor who lives in Paris but works out of New York we need to be able to share data quickly and effectively with our team. Our philanthropists (major donors, strategic donors) want us to react quickly and to provide coordinated, joined-up service. That is going to be a delicate, difficult job following this ruling.

The closure of Safe Harbor means choppy seas for all of us.

The Prospect of Power

Posted on by Chris

The Researchers in Fundraising conference this week in London feels like a milestone in our profession – the arrival of a real community of professionals.

There were signals everywhere that we are a real profession. We, the community, have our networks – I saw lots of ‘Hello again! How are you?’s. We have an emerging group of personalities – Martin Mina (Action on Hearing Loss) is the personification of the funny-but-with-a-message presenter. We have our academics – Dr Beth Breeze (University of Kent) continues to uncover the emotional underwiring that supports philanthropy and fundraising. We have international appeal, with Helen Brown (Helen Brown Group) and Gerry Lawless (iWave) flying all the way across the Atlantic to join us.

We have suppliers anxious to win our business and therefore competing (this is normal and healthy) to innovate for our sector. We have media – social media – as conference attendees Tweeted #RIFConf2014 to the world. We even have the beginnings of politics, the politics of women and women’s rights in a workplace where too many bosses (mea culpa) are still men, celebrated by Beth Breeze in her sense of enjoyment at a conference audience that was mainly female.

And we have the intellectual and ethical challenges that define a real profession, personified in Karl Newton of LSE with his intimate description of the Gaddafi incident.

So what’s missing? At the conference the missing ingredient, reported again and again by researchers, was power. They didn’t use that word. What they said was ‘I just can’t get my boss to take research seriously’, or ‘I couldn’t get the budget’, or ‘My boss wrote our policy and I can’t get him to change it.’

Power, and the lack of it, is not a new topic at RiF. But now that we have a real, fully-fledged profession the lack of it is becoming more painful. We need the power to influence our fundraising colleagues. We need the power to write strategy, manage people and influence policy in the fundraising community. We need the power to set budgets, hire and fire. We need the power to commission research, development and innovation in our field. With the Sword of Damocles of new EU data protection legislation hanging over us, we need the power to influence legislation.

We need power, and we need it now.

We know how power works. We research it all the time. It is linked to circles of influence, to people with a strong voice, to a community united behind one or two clear ideas simply expressed.

We don’t have to call it that. We can call it “voice” , or “influence” or “a seat at the high table.” We can be subtle about winning power or we can be loud and proud. We can fight or argue, persuade or hint.

We need friends high up in the non-profit trees. The Chief executive of a brand-name national charity who ‘gets’ research. The MPs and MEPs who used to work in nonprofits, who befriend research. Senior staff at the Institute of Fundraising. We need to find these people (ha! easy for us prospect researchers!) We need to cultivate them and we need to persuade them with one or two clear simple messages. And then, like good fundraisers, we need to steward them.

We can use the power of research. We can do this.

An Open Letter to the Information Commissioner

Posted on by Chris

Dear Mr Graham

It must be tough being the Information Commissioner today. This morning’s newspaper will be a crumpled mess on your breakfast table after you read more of the revealing allegations from Edward Snowden. The Government that pays you to keep our private stuff private has also been paying the wages of the spooks at GCHQ who are, apparently, listening in to everything we send or hear.

It’s a classic State job creation scheme; GCHQ dig the holes and you cover them over.

This is all horribly relevant to prospect research, because we researchers live in the legal and moral minefield of personal privacy. Snowden’s allegations change the moral game.

If we are to believe Mr Snowden then the Government has been merrily breaking the spirit of the law. By plugging a USB into the transatlantic fibre-optic cable they are listening to much of what we say and do, most of it private. They must be storing terabytes of personal stuff including an email to my son in the USA about his shopping habits, or the note I sent a friend about her cooking (it was delicious, Martha). In amongst the banalities there will be stuff about race, politics, religion, trades unions, health, sex and crime – the “sensitive personal data” that the European Data Directive has tried to keep properly private. This is all being gathered into the State apparatus for the “greater good.”

Imagine that I were to include a little sensitive personal data in a prospect profile, in contravention of the European Data Directive. For example that a prospect was reported to have had cancer, or malaria, or to have a prosthetic limb. I would be breaking the law, but – given that the State must be collecting this stuff too, could you really, morally, claim, Mr Graham, that I had done wrong?

And then there are the Terrible Twins – Google and Facebook. These two, according to Mr Snowden, have been knowingly handing over to the US Government our search habits, our locations, our friends and our connections.

So if I were to gather some personal stuff about a prospect from her Facebook page and pop it into a profile, could you really, morally claim, Mr Graham, that I had done wrong?

To rub salt in your wounds these companies have been doing this while manipulating our Governments’ tax system in their favour. You, Mr Graham, have been doubly duped. You have (massively) failed to protect our personal data. And your 2012-13 grant-in-aid from the Ministry of Justice was cut…because your paymasters have not been taxing the same Terrible Twins.

The moral justification that allows the State to gather and hold this personal information is the “greater good” of public security; the State collects this data to protect us citizens from the bad guys. A greater good that, if Mr Snowden’s allegations are correct, overrides our laws.

But I have a greater “greater good.” My greater, greater good is to raise the money to feed the starving, to send them to school, to build their hospitals and to show them the beauty of the arts. The greater, greater good of philanthropy.

Does my greater, greater good also override the law?

So if I were to break the law by failing to protect a prospect’s personal data, just as you have failed to protect ours, could you really, morally, claim Mr Graham that I had done wrong?

Prospect researchers protect prospects’ personal information because we are ethical people. We believe that it is right that personal privacy should be protected. We work on the moral and ethical frontier of personal data, taking decisions every day about whether to pass on information to our fundraising colleagues, or to press “Delete.” Yes, the law provides some framework, but it is our moral and ethical belief which provides the foundation.

We will continue to do that – to guard personal information, to respect privacy. But the Snowden allegations have undermined the whole legal framework for data protection. They have made your job impossible.

It must be very tough, being the Information Commissioner today.

Yours sincerely

Chris Carnie
www.factary.com