- This story was corrected on 17 February; please see final paragraph
The Information Commissioner’s Office has said wealth screening and data matching should not be done without giving donors an explicit, detailed explanation of how a charity plans to use their data.
The ICO has added that charities must notify people of plans to use their data even if it comes from publicly available sources.
The warnings came in a conference paper called Fundraising and Regulatory Compliance, released before the ICO’s planned joint data-protection event with the Charity Commission and the Fundraising Regulator on Tuesday.
The 12-page document sets out how practices uncovered by ICO investigations into charity fundraising over the past 18 months "seriously violate" the principles of the Data Protection Act 1998.
In December, the ICO levied combined fines of £43,000 on the RSPCA and the British Heart Foundation in relation to wealth screening and data matching, saying that in some cases donors had not been told what was happening to their data, nor informed that it would be passed to a third-party company to carry out wealth screening.
It has since said it intends to fine a further 11 charities for breaches of data-protection law.
In the conference paper, the ICO says wealth screening is the kind of processing that individuals are highly unlikely to expect as a result of their charitable giving.
So, it says, charities need to inform donors that they plan to carry out wealth screening by means of a privacy notice.
But the paper says: "Individuals are unlikely to understand what wealth screening is.
"So simply stating that you may analyse their personal information to predict future levels of donation is likely to be too vague.
"Your privacy notice must be detailed enough to ensure they have a reasonable understanding of what wealth screening is and how you’ll use their personal information to do it."
This applies, the paper says, even if the charity plans to do wealth screening in-house, and charities should make it clear if they plan to use third-party companies.
The paper also casts doubt on whether the ICO would ever consider data matching acceptable, except under specific circumstances.
With data matching, charities use information they have to find out more about a donor. For example, they use an address to track down a telephone number, or an old address to find a new address when the donor has moved.
In a section headed "So is data matching and tele-appending never ok?", the paper says that unless the donor has a "clear, legitimate expectation" that the source the charity has obtained the data from would pass it along to be used in that way, it is likely that using that data would be unfair and would breach the DPA.
"It could be argued that individuals may have forgotten to give you the information or update you about moving house, for example," the paper says.
"But you cannot assume this is true. Even if they’ve forgotten, they still wouldn’t reasonably expect you to contact them via a phone number or email address they never gave you."
The paper also warns that just because information about a person is publicly available, it cannot be considered "fair game" and charities cannot assume they consent to that data being used for any purpose.
"Even if you’ve got the personal data from publicly available sources, you must still provide a privacy notice to individuals," it says. "It must explain who you are and what you are doing with their data."
The paper also says the Fundraising Preference Service could allow people to opt out of receiving communications from specific types of charities, not just individual organisations, describing signing up to the FPS as "a clear and specific objection to a particular type of call from particular organisations or types of organisations".
- The story originally said charities must seek permission to use data even if it comes from publicly available sources.
If you’re interested in fundraising, you can’t miss Third Sector’s Annual Fundraising Conference on 23 and 24 May. Click here for more information and to book at the Early Bird rate.