The Context for this consultation
The Code of Fundraising Practice outlines the standards expected of all charitable fundraising organisations across the UK. This includes standards related to fundraising where individuals’ personal data is used.
The last substantive changes to the Code on data protection were made in March 2016. After reviewing the Code over the summer, the Fundraising Regulator has identified that urgent updates are necessary on data. This review is intended to encompass developments in the law and guidance including:
- Issues identified in fixed penalty notices levied by the Information Commissioner’s Office in 2016 and 2017 against a number of charities for breaches of the Data Protection Act, including wealth screening, data matching and tele appending and use of publically available data.
- Findings from a National Council of Voluntary Organisations (NCVO) working group in September 2016 into charities’ relationships with donors, including proposed guidelines on use of legitimate interest.
- Guidance issued by the ICO and the Fundraising Regulator on Direct Marketing.
- The need to bring the Code up to date on data protection to take account of the General Data Protection Regulation and associated guidance ahead of 25 May 2018 when it becomes law (whether this is introduced through EU regulations or separately through the Government’s recently announced Data Protection Bill).
The ICO has announced the intention to release final GDPR guidance on consent in December 2017. However, the Information Commissioner has said that charities and others should ready themselves for GDPR and that the final guidance on consent is not likely to differ significantly from ICO’s March consultation document. She has also said that legitimate interest remains a way of contacting individuals provided there is a case to do this. The Fundraising Regulator’s proposals contained in this consultation are guided by this advice and the existing GDPR Consent guidance draft.
The purpose of this consultation
The purpose of this consultation is to make the Code as clear as possible about fundraiser’s duties in relation to data protection, and, in particular, to ensure that they:
- Understand and comply with their legal duties regarding personal data.
- Recognise the data protection implications and duties for any activity involving personal data and manage these adequately with individuals.
- Adequately inform individuals about how they will use their data.
- Have an appropriate basis for sending Direct Marketing to individuals:
- Hold clear, unambiguous and adequately evidenced consent where this is used as a basis for contact and review existing consents held.
- Use the “legitimate interest” condition appropriately, sensitively and transparently when contacting individuals.
What we are seeking views on
The consultation includes:
- an annotated revised version of sections 5, 6 and 7 of the Code (the areas of the Code of most relevance to data protection), outlining where specific changes have been made and why (annex A);
- a “clean” amended version of sections 5, 6 and 7 of the Code (annex B); and
- a table of other data-related rules within the Code which we have identified as requiring amendment and the revised wording proposed (annex C).
The Fundraising Regulator seeks views on:
- the proposed changes and reordering of the Code
- how we can ensure any changes are communicated and implemented effectively
How to respond
Responses should reach us by Friday 8 December 2017 at the latest. Earlier responses are welcome.
This consultation is closed.
If you have any questions, please contact us for more information.
Handling your response
We anticipate publishing all responses. However, if you ask for your response not to be published we will consider your request seriously.
Next steps in the process
A summary of responses will be published on the consultation web pages together with the Fundraising Regulator’s final decision regarding changes to the Code.
Comments and complaints
If you have any comments about how this consultation exercise has been conducted, please contact us.