Fundraisers are now prohibited from sharing donors’ data with third parties unless they have that person’s express consent to do so, the Institute of Fundraising has ruled.
A new requirement introduced to the Code of Fundraising Practice earlier this month says that charities cannot share an individual’s personal data with third parties to use for marketing or fundraising purposes unless that person has provided explicit consent. This applies even if a charity will not be receiving payment for sharing the data.
The code is currently set by the IoF’s standards committee, which is chaired by the former Immigration Services Commissioner Suzanne McCarthy, but responsibility for it is due to transfer to the new Fundraising Regulator this summer.
The new rule, which was made official on 4 March, says explicit consent means that an individual must have provided a positive indication that they agree to their personal data being shared.
It says: "This could take the form of ticking an opt-in box, or another action that signifies agreement, such as oral confirmation, or the provision of contact details where the individual has been clearly informed that by giving these details they agree to their data being shared."
The code change first came to light in early September: The Sunday Times carried a front-page story quoting Richard Taylor, chair of the IoF, as saying he expected data-selling by charities to be tackled by the introduction of an opt-in system through which donors would be explicitly asked if they were willing for their data to be passed on to third parties.
Several weeks later, the IoF announced the change had been approved by its standards committee, along with a raft of other changes that were originally called for by the Fundraising Standards Board last summer.
All but two of these changes were made official in December, but an IoF spokesman said at the time that the introduction of the rule concerning opt-in consent to share data had been delayed because the IoF was waiting for the ICO to announce new direct marketing guidance about consent.
In the event, the IoF introduced the rule several weeks before the new ICO guidance was published last week.
Daniel Fluskey, head of policy and research at the IoF, told Third Sector that rather than waiting for the guidance to come out, the IoF had instead decided to ask the ICO directly for its view on the new rule it was proposing.
"We were proactive because we wanted to bring this new rule in," he said. "We talked to the ICO to make sure it had no concerns about it and what we were saying was consistent with its own guidance."
Fluskey said he did not expect any more changes would need to be made to the code as a result of the new direct marketing guidance, which was published online alongside a blog from Steve Wood, the ICO’s head of policy delivery, last Thursday.
Asked for the IoF’s view of the guidance, Fluskey said the institute welcomed the clarity it had provided on donor consent, which he said made it clear to charities that they could not just assume they had consent to contact an individual because that person had donated to them.
He said the IoF also believed the guidance could have gone further by clarifying the exact words or phrases fundraisers should use in their permission statements and by providing examples of things that organisations were allowed to do, as well as the activities they were prohibited from doing.
But he said it was not the responsibility only of the ICO to provide the reassurance and guidance fundraisers had been seeking about their practices.