Catch the Pidgeon

Even before the fundraising sector met its Data Protection nemesis in December, with two charities cruelly hung out on the rack, forbidden ever to raise funds again (CORRECTION: given two of the smallest fines in Data Protection history and not forbidden from doing anything), various blogs, and tweets showed that anguished tin-rattlers were confused about what they were accused of.

A classic of the genre was published just over a week ago by Third Sector, penned by Stephen Pidgeon, a “consultant and teacher” (one assumes modesty prevented the publication from mentioning that until recently he chaired the Institute of Fundraising’s Standards Committee, responsible for the until-recently legally incorrect Code of Fundraising Practice). Pidgeon made a series of assertions in his article, and the most important of them is wrong.

Pidgeon describes profiling as a serendipitous activity – a fundraiser innocently planning some door-drops (not a hint of pestering spam in this charming scenario, nor any resort to a data-mining outfit like Prospecting for Gold) happens to notice that a donor has sold a business, and so decides to add his details to an existing campaign. The scheme is ruined by the ICO who says: “That’s not allowed – it’s against the Data Protection Act without express permission“. As Pidgeon points out, the DPA is much vaguer than that. If the Commissioner had indeed said this, it would be nonsense. The problem is, they didn’t.

Both charity notices set out the ICO’s position on charity profiling – it cannot be secret. The same is true for data sharing and appending new data to records that the subject didn’t provide. Neither notice finds profiling without consent to be a breach. Admittedly, of the Data Protection only offers one other option to justify profiling in these circumstances (legitimate interests), but either Pidgeon doesn’t know what the notice says, or he is deliberately misleading his audience. The word ‘permission’ does not appear in either notice, and the word ‘consent’ isn’t mentioned either.

Pidgeon also asserts that wealth profiling is not confined to charities:

This issue is not confined to charities. Yet, in all the 100-plus ICO adjudications in 2016, I could not find a single commercial firm censured for wealth screening.

To be pedantic, they’re not unenforceable ‘adjudications’, they’re formal legal notices, and if you add up all of the DP and PECR monetary penalty and enforcement notices in 2016, you don’t get to 100. He might be including the undertakings, which could be compared to the blancmange adjudications that charities have grown used to, but they’re irrelevant in a conversation about enforcement. The more important point is that like others, including the fundraising apologist academic Ian McQuillin and the researcher Matt Ide, Pidgeon claims that everyone does wealth screening but only the charities are getting punished for it. The Daily Mail hasn’t exposed Marks and Spencers or Greggs for wealth screening – possibly because they’re good at keeping it secret, but a more likely explanation is that they don’t do it. Until someone in the charity sector shows evidence of another organisation doing secret profiling, it’s just a distraction from the fact that – as Pidgeon claims – most of the charity sector have been doing it unlawfully for years.

Many in the sector also seem persuaded that the ICO action is a weird anti-charity vendetta. MacQuillin’s contributions to the Critical Fundraising Blog pondered the mystifying question of why the data protection regulator has taken action when household name organisations have been exposed for breaching data protection. The ICO takes action for three reasons – an organisation reports itself for something, ICO gets lots of complaints about something, or something makes a big splash in the press. There were thousands of complaints about charity fundraising, but all went to the toothless Fundraising Standards Board, who hardly ever passed them on to ICO. So it was the Daily Mail’s headlines that did the trick – the heartbreaking story of Olive Cooke but more importantly for the ICO’s purposes, the flamboyantly unlawful way in which charities treated Samuel Rae, trading his data relentlessly with anyone who wanted it.

In pursuing his false claim about consent, Pidgeon derisively summarised what charities might have to say to prospective donors: “We want to find out how rich you are; tick here to agree”! As a first draft, this has some merit, but a charity involved in wealth screening should also add ‘We want to know whether you are worth more alive or dead‘. The consent claim is a red herring, but perhaps unwittingly, Pidgeon has hit on the real problem for fundraisers: daylight. The foundation of Data Protection is fairness, and the only way to achieve it, regardless of whether consent is part of the mix, is to tell the subject the purposes for which their data will be used. Stretching the law as far as they can, the ICO has invented the concept of ‘reasonable expectations’. Reasonable expectations doesn’t appear in the Data Protection Act, but the ICO’s idea is that if you are only doing something that the person would expect, you don’t have to spell it out. One might take issue with this because it’s not in the Act, but it’s a sensible idea. The ICO’s emphasis has always been on being transparent over unexpected or objectionable processing.

Tesco’s Clubcard scheme is a useful example. Clubcard is a loyalty scheme, clearly based on profiling. The user knows that when they swipe their card, their purchases are analysed so that tailored offers and vouchers can be provided. Needless to say, Tesco also use the data for their sales and marketing strategy. If you look at the T&Cs for the Clubcard scheme, you will not find references to data sharing with third parties for wealth screening. They don’t need to – they can analyse your purchases instead. The user knows that profiling is inherent to the scheme, and they are not required to participate when shopping at Tesco. I have a Clubcard because I understand the system and I don’t believe that Tesco flogs my data. The profiling is the basis on which the whole thing operates. I have a choice about whether to shop at Tesco, and separately, whether to have a Clubcard when I do.

On the other hand, the RSPCA profiled seven million donors after they donated; presumably the lion’s share of all people who donated to the charity. The RSPCA did not tell people that this was the purpose for which their data will be used, and nobody outside the charity sector was aware of what was happening. Unlike Clubcard, donors could not participate without being screened and analysed by the charity. I have used the wealth-screening example on many of my training courses. The reaction is always surprise, and often revulsion.  Nobody ever leaps to the charity’s defence because secret profiling is a dodgy way to do business.

Pidgeon’s squeamishness about describing the process – the daft example of the story in the newspaper, his emphasis on data being gathered from the public domain – suggests that fundraisers are more ambivalent about their methods than they might like to admit. The existence of five facts in five separate publicly accessible places is different to the combination of those facts in one place, gathered with the intention of tailored marketing. A profile is greater than the sum of its parts, and people should be told that it exists. Pidgeon isn’t alone in his approach – Chris Carnie, the founder of ‘prospect research’ company Factary erroneously characterised myself and others as saying that using public domain data is “an intrusion into an individual’s privacy. That searching for a named individual in Companies House fundamentally affects the rights of that person“. All I said was that such research should be transparent, but this isn’t news that Carnie and his colleagues find palatable. Ide’s company goes as far as to assess the ‘ethical credentials‘ of a donor, which sounds a world away from noticing a story in a paper.

The Daily Mail is a revolting newspaper – the worst combination of small-minded, petty conservatism and curtain-twitching prurience. It is a matter of ongoing annoyance to me that the Mail is one of the very few national news outlets that covers Data Protection issues with any enthusiasm. I really wish the Guardian or the Times had exposed the ghastly exploitation of vulnerable people like Samuel Rae, or their hunger for information about possible donors. I wish Dispatches’ fine work on the shameful state of some fundraising call centres had got more attention. Nevertheless, none of this is the Mail’s fault, and fundraisers’ relentless blame-shifting needs to be called out for the cant that it is. Everyone knows whose fault this is.

The charity and fundraising sector isn’t in a mess over data protection because of the Daily Mail, and it isn’t there because of the Information Commissioner. This problem is the fault of some fundraisers and their agents not obeying the law, and trustees who didn’t ask them enough questions. MacQuillin claims that almost everything that has happened to the fundraising sector over the past two years is because of ‘fake news‘; Olive Cooke’s death wasn’t, her family says, the result of the spam tsunami that charities subjected her to. For one thing, this claim disgracefully ignores Samuel Rae, whose story would have caused the same interest even if it wasn’t the sequel to Olive Cooke. Moreover, it is itself fake news. If some of Pidgeon and MacQuillin’s compadres had done their job with a greater interest in the law, they wouldn’t be here now. This is the second or third time I have written this blog. With 11 more possible fines, and fundraisers still in denial about what they have done, I’ll probably have to write it again before long.

Small change

Some senior figures in the charity sector have sought to deal with the Information Commissioner’s recent enforcement against the RSPCA and the British Heart Foundation by suggesting that the ICO’s action is disproportionate and unfair. The fundraiser sorry, academic, Ian MacQuillin has written two blogs which touch on the theme, while a few days ago, Robert Meadowcroft, the Chief Executive of Muscular Dystrophy UK tweeted:

If the is impartial regulator it will investigate practices of and not simply pursue charities

As 2016 is now disappearing over the horizon, I thought it was worth testing the hypothesis that the ICO is taking disproportionate action against charities, and the fines and other enforcement against charities are unrepresentative. TL:DR – it’s complete nonsense.

In 2016, the ICO issued 34 civil monetary penalties – 11 under the Data Protection Act, and 23 under the Privacy and Electronic Communications Regulations (PECR). There are a number of different ways of looking at the figures, and none of them show any evidence of disproportionality.

1) Charity CMPs as a proportion of the total in 2016

Of the 34 penalties, 2 were against charities, so 6% of the ICO’s CMPs in 2016 were against charities.

2) Amount charities were fined, as a proportion of the total in 2016

The CMP total was £3,225,500. The total of CMPs issued against charities was £43,000. This is 1.3% of the total.

3) Proportion of Data Protection CMPs issued to charities in 2016

If you look only at the CMPs issued under Data Protection, the charity proportion is not insignificant – there were 11 DP CMPs, so the 2 charity CMPs are 18% of the total – the same as the police, 1 more than councils, but less than the private sector or the NHS (3 each). However, this is the only comparison where charities feature significantly, and they are not the dominant sector. The next two comparisons are also instructive.

4) Proportion of PECR CMPs issued to charities in 2016

None. This is despite widespread breaches of PECR by charities, including phoning donors who are on TPS and sending texts and emails without consent (for example, the vast majority of mobile numbers gathered via charity posters in 2016 were obtained in breach of PECR).

5) Proportion of CMPs issued for marketing related activities in 2o16

There were 21 PECR CMPs related to marketing, and 2 DP CMPs related to marketing, making 23 marketing CMPs in all. 2 were against charities, which is 9.5% of the total. Given the big charities’ disastrous approach to marketing, this relatively small number is astonishing.

6) Level of CMPs in 2016

The average DP CMP was £108,500; the average charity DP CMP was £21,500.

The average PECR CMP was £84,666.75; there were no charity PECR CMPs.

The highest DP CMP was £400,000; the highest charity DP CMP was £25,000.

7) Other enforcement in 2016

There were 22 enforcement notices issued by the ICO in 2016, 8 under DP and 14 under PECR. 1 of the 8 DP enforcement notices was against a charity, which is 4.5% of the total, or 12.5% of the total DP enforcement notices. Either way, it is a small percentage of the total. Again, if you count the number of marketing related enforcement notices, there were 15, of which 1 was against a charity. This is 6.6% of the total.

8) CMPs since 2010

There have been 69 DP CMPs since 2010 that I can find (they drop off the ICO’s website after a few years); 4 were issued against registered charities, which is 5.8% of the total. The average DP CMP was £114, 163, whereas the average charity was £78,250. It is worth noting that these figures are slightly skewed by the £200,000 penalty against the British Pregnancy Advisory Service, which is a registered charity but receives most of its funding from the NHS.

The CMP against the British Heart Foundation was the 8th lowest CMP overall, while the CMP against the RSPCA was the 9th lowest. The only organisations to receive lower penalties than the charities were small businesses, unincorporated associations, and a bankrupt lawyer.

There have been 47 PECR CMPs that I can find since 2012; none have been issued on charities, which is 0% of the total.

Conclusion

These figures will likely be different in 2017. The ICO has signalled that more DP enforcement against charities is coming, and so the proportion of DP penalties may rise when the totals are in, but that depends on a variety of different factors including the number of other penalties and the ICO’s general approach. However, when you look at the facts for 2016, MacQuillin and Meadowcroft are wrong. Despite years of ignoring the Data Protection and PECR requirements in favour of a flawed, fundraiser-driven approach, the ICO has not taken disproportionate action against the charities. The action taken is a small percentage of the overall total. Special pleading and blame-shifting will not help the sector. Compliance with the law will.

Fair Cop

The bedrock of Data Protection is fairness. You cannot gain consent without fairness. Your interests are not legitimate interests if they are secret interests. Unless you have an exemption or you claim that telling the person represents disproportionate effort (i.e. the effort of telling outweighs the actual impact), you have to tell the person whose data you are using the purposes for which their data will be used, and any other information necessary to make the processing fair.

The ICO’s Privacy Notices Code of Practice is not ambiguous, nor was its predecessor. It is impossible to read the ICO’s published guidance on fair processing without taking away the key message, consistently repeated for more than a decade: if something is surprising or objectionable, especially if it involves some kind of impact or sharing outside the organisation, it should be spelt out. New-ish Information Commissioner Elizabeth Denham seems to have chosen to reverse the ICO’s previously timid, unimaginative approach to the first principle with a pair of civil monetary penalties against charities. We have one each for the Royal Society for the Prevention of Cruelty to Animals, and the British Heart Foundation, with the promise of more to come. You might say it was unfortunate that charities are first in line rather than, say, credit reference agencies or list brokers (to be a touch tautological). It was the charity sector’s misfortune to fall under the Daily Mail’s Basilisk gaze, and they have to accept that we are where we are.

To issue a civil monetary penalty, there are three hurdles for the ICO to clear. Firstly, there must be a serious breach. Both charities used commercial companies to profile thousands (and in one case, millions) of donors, buying up data from publicly available sources* to assess their wealth and resources, they shared data with other charities whose identity they did not know via a commercial company, and in the case of the RSPCA, they bought contact details to fill in data that donors had provided. The average donor did not have any idea that this was happening. I can see there’s a problem that when everyone in the charity sector knows that wealth screening goes on, it seems normal. But I’ve been using it as an example on my training courses ever since the Mail revealed it, and bear in mind that these are often seasoned data protection professionals who know about data sharing and disclosure, attendees are invariably shocked and some cases revolted by what I tell them.

There is no doubt in my mind that this processing needed to be spelt out, and there is no doubt from the notices that it was not. Carefully selected third parties or partners has been a stupid lie in marketing for years, but not even knowing where the data goes is much worse than the usual flogging it to all comers. At least the list broker knows who he’s flogging it to, even though the only careful selection is the ability to pay.

The second hurdle is the need to show that the breach is likely to cause damage or distress to the affected data subjects. It’s been known for quite some time that the ICO was planning to take enforcement action over the Mail stories, and the gossip I heard from charities was that fines were likely. I’ll be honest, I wasn’t convinced. The Information Commissioner lost a Data Protection Tribunal appeal from Scottish Borders Council because they bungled the damage / distress element of a £250000 CMP over pension records found in recycling bins. ICO made a flawed claim that the loss of paper pension records was likely to result in identity theft, but Borders had an expert witness who could argue convincingly that this was not true. The link between the breach (the absence of a contract with the company processing the data) and the damage was broken, and the ICO lost.

But this case is different. The ICO does not need to make a link between an incident and a breach, because they are bound up together here. Both notices show that the ICO has given considerable thought to the distress angle. There is no question that the charities breached the first principle, and their only hope for an appeal is to convince the Tribunal that people would not be caused substantial distress by secret profiling and data sharing after an act of generosity. This is not science, and all I can say is that I am persuaded. But for an appeal to be successful, the charities will need to persuade a Tribunal with strong experience and knowledge of DP and PECR from the numerous (and almost exclusively doomed) marketing appeals.

The third element requires the breach to be deliberate or a situation where the charities ought reasonably to have known about the breach. As I have already said, the ICO’s position on fair processing is well known in my sector and available to anyone who can type the ICO’s web address. I think it’s possible that the charities didn’t know what they were doing was a breach, but in my opinion, this is because the Institute of Fundraising and the Fundraising Standards Board effectively acted as a firewall between charities and reality. The advice (often inaccurate and out of date) came from the IoF, and complaints about charities went to the FRSB and no further. When your code of practice is written by the people who earn their living from fundraising and most in your sector are doing the same thing as you are, it’s not hard to fool yourself into thinking it’s OK. But ‘everybody does it’ will cut no ice with the Tribunal. The RSPCA and the BHF are not tiny charities flailing in the dark – they are massive, multi-million pound operations with vastly greater resources than many of my clients.

Daniel Fluskey, head of Policy for the Institute of Fundraising, whose apparent lack of experience or qualifications in Data Protection does not prevent him from writing inaccurate articles for the charity sector on GDPR, has already weighed in, saying that the ICO should be providing the specific wording that charities require: “Charities need more detail on the ICO’s view of what lawful practice looks like: what form of words would have passed the test?” The Information Commissioner is the regulator for every organisation, of every size and shape, that processes personal data. If they start writing tailored wording for charities, they will have to do it for everyone else as well. It is a ridiculous demand. I think the ICO should move on to the data pools, wealth screeners and list brokers, but if she could find the time to issue an enforcement notice on the Institute of Fundraising, forbidding them ever to speak or write on Data Protection matters again, the third sector would have a fighting chance of complying.

Besides, how hard is it to find compliant wording? Nobody – especially not the trade association for fundraisers – should be allowed to present this as a byzantine and complex task. The individual doesn’t need to know what software you’re using, or whether cookies are involved. They need to understand the purpose – what are you collecting, what are you going to do with it, who are you going to give it to? This should be presented without euphemism or waffle, but it’s when you strip out the legalistic nonsense, you see the problem. It isn’t that the poor charities were labouring under the burden of complex data protection rules. They could not comply with the Data Protection Act because what they were doing (and in RSPCA’s case, are apparently still doing) is so unattractive:

  • We will share your details with unspecified charities via a commercial company. We don’t know who they are.
  • We will buy your phone number, postal or email address from a commercial company if you have not given it to us.
  • We will use commercial companies to compile a profile of your wealth and property to work out whether to ask you for further donations. If you are likely to be worth a lot when you die, we will use this information to ask you for a bequest.

When Reactiv Media appealed their PECR penalty, the Tribunal rejected their appeal and increased the penalty. Like a lot of the spammers, they put themselves into administration to avoid paying up, but this option is not available to household name charities. If either the RSPCA or BHF appeal, they are dragging themselves deeper into the mud, and very possibly spending thousands more of donors’ money to do so. If they say that what they did wasn’t a breach, or that they couldn’t have been expected to know that it was, their officers, advice and business model will be scrutinised to a doubtlessly painful extent. The claims management company Quigley and Carter found themselves described as “feckless” and “most unimpressive” in the course of being filleted during a recent failed appeal. Do charities really want that? Even if they decide to roll the dice solely on distress, does either charity really want to acknowledge a serious breach that they knew or ought to have know about in the hope of getting the fine overturned on a technicality? Do they want ICO to call donors as witnesses?

The business model of pressure selling, TPS-busting, heavy texting, data sharing and donor-swapping adopted by some of the UK’s most celebrated charities resembles nothing so much as the activities of the claims management, PPI spammers (i.e. the scum of the earth). For all the noise and bluster on Twitter and in the charity press this week, there is an uncomfortable truth that has to be faced. The hated Daily Mail unearthed it, and the ICO has rightly acted on it. Some big charities have run an end-justifies-the-means approach to marketing and they have got away with it for a decade. Fundraisers ruled the roost, and compliance has been sidelined or ignored. Given how much money the RSPCA and the BHF have raised from fundamentally unlawful practices, they should pull back and rethink how they get donations in the future. They should ignore the Institute of Fundraising’s every word on Data Protection and PECR, and like every other charity, concentrate on reading and applying the ICO’s Code on Privacy Notices and guidance on Direct Marketing.

And right now, if there is a fundraiser sitting with the two CMP notices working out how to at the same time devise a method to raise loads of cash for their cause while complying with Data Protection and PECR, I hope they wipe the floor with everyone else.

*citation needed

Age of Consent

Ever since the Daily Mail first started to report on the nefarious fundraising activities of certain large charities, confusion and contradiction have reigned supreme. We have had fundraising codes of practice confused with the law, constant claims that the ICO has changed the law (which is something they haven’t done, and couldn’t do anyway), and the bizarre spectacle of undertakings being signed publicly by organisations who, according to Wilmslow, haven’t done anything wrong.

One might hope that the General Data Protection Regulation, designed as it is to clarify the mess of DP across the European continent would come to our aid. But no, sadly and inevitably, people are just as determined to misunderstand the GDPR as they are the Data Protection Act.

John Mitchison, head of preference services, compliance and legal at the Direct Marketing Association was speaking at a fundraising event organised by Third Sector magazine, and he passed comment on the apparent confusion over opt-in and opt-out rules on marketing. I don’t know exactly what he said because I wasn’t there. However, he is reported as saying that charities would not need consent for postal and phone marketing, unless a person was on the telephone preference service. The GDPR requirement for unambiguous consent did not change this position. Mr Mitchison also apparently said that he didn’t understand where all the confusion in the charity sector was coming from.

I think I can tell him. Enter Daniel Fluskey, head of Policy and Research at the Institute of Fundraising (yes, the organisation responsible for much of the confusion with their diabolical fundraising code). He wrote an article on the UK Fundraising website following up on Mitchison’s comments, including this statement.

“Our understanding is the same as the DMA’s and what we’ve heard from solicitors – that ‘unambiguous consent’ does not mean there has to be an ‘opt in’ tick box. Consent will be able to be given ‘unambiguously’ through an ‘opt out’ mechanism. So, statements that ‘opt in’ is coming in through law seem likely to be misleading – what’s coming in is a requirement that the consent is ‘unambiguous’

Fluskey then invents his own test for unambiguous consent:

To me, ‘unambiguous’ consent seems like a three-stage test:

  1. Did someone give their information freely?
  2. Were they presented with straightforward information so that they had a clear understanding of what marketing/fundraising communications they could expect to receive?
  3. Did they have a clear and easy ability to choose to accept this, or to object if they didn’t want to receive future marketing?
    If the outcome of the engagement leads to these three questions being able to be answered with a ‘yes’ then it would seem very likely that the donor has given ‘unambiguous’ consent. That seems very much like achieving the spirit and ethos of ‘opting in’ even if there isn’t necessarily a tick box.”

This is all – to use a technical term – bollocks.

Mitchison is correct – consent is not necessary for postal marketing and phone-calls to those not on TPS. However, this has nothing to do with the nature of unambiguous consent. The explanation is reasonably straightforward. To use any personal data, you need to meet a condition under the DPA – this is the position now and it remains so under the GDPR. Consent is one of the conditions but not the only one. If an alternative condition can be found, you can forget consent and use the other one instead. The GDPR recognises that the legitimate interests condition can be used to justify marketing, and so this can apply to postal marketing. You don’t need consent because you can use legitimate interests. The opt-out bit is a red herring in this context – the marketer offers an opt-out because  it’s good practice and the subject has an automatic right to opt-out of any marketing anyway. It would be nice if such opt-outs were respected instantly and permanently, but that’s an issue for another time.

Electronic forms of marketing are not just covered by Data Protection. They are also covered by the e-Privacy Directive, implemented in the UK as PECR. PECR adds a layer of rules, and in some cases insists that only consent applies. You can’t rely on legitimate interests for automated calls, email or text marketing, because PECR says that only consent will do.

Live calls straddle both conditions. You can rely on legitimate interests for cold calls to people who are not on TPS, but you need consent for those people who are. Again, this is nothing to do with DP, this is an extra rule laid on by PECR. I hold no brief for Mr Mitchison, but the DMA are usually robust about the effect of marketing law, so my guess is that this is the point he was making.

I haven’t explained completely why I think Mr Fluskey’s comments are bollocks. Permit me to do so now. I suspect he hasn’t even read the Regulation, despite the fact that he is issuing clear (if bogus) advice about it to a sector that has wallowed in ignorance for far too long.

The definition of consent in Article 4 is plain for all to see: “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” – indication means active, given means active, clear affirmative action means active. Everything about the definition of consent means that the subject has to do something to consent. It’s obvious that Fluskey hasn’t read the regulation because he happily takes ‘freely given’ out of its context as part of the definition of consent and pretends that it relates to the provision of information. If there was any doubt (there isn’t, but we’re here now), Recital 32 helpfully addresses any possible uncertainty:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

Once again, just in case you missed it: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”  Compare that to what Mr Fluskey says: “‘unambiguous consent’ does not mean there has to be an ‘opt in’ tick box”. They saw him coming. That’s exactly what it does mean, that’s what it says. Consent has to be active, and it has to be demonstrable. Silence or inaction does not mean consent, but that’s exactly what an opt-out model represents – assuming consent from silence or inaction. Under the GDPR, opt-out consent is dead. There’s an argument that this is the case under the current DP as well, but leave that to one side. Nobody who has read the full Regulation can think that opt-out is a valid way to get consent, and only those who have read it should be giving advice to others.

The problem with the Institute of Fundraising is that their code of practice has created a fog of uncertainty about what is law and what is practice or industry standard. And here they are, doing it again: “That seems very much like achieving the spirit and ethos of ‘opting in’ even if there isn’t necessarily a tick box.” Complying with the regulation isn’t about trying to capture some phantom ethos – it’s clear, and unambiguous. No opt-outs, never again.

Don’t get me wrong. Fundraising companies have a problem. For many years, they have built profitable businesses, employed lots of people, and made lots of money, some of it even for the charities who hire them. The GDPR makes clear what was not clear, emphasises what has been underplayed, and gives new rights to subjects that will directly challenge the business model of some fundraisers. Consent has to be clear and it has to be opt-in. Profiling has be to explained to subjects, and they have significant rights to challenge and object to it. Data sharing cannot be justified on tiny, badly-explained clauses buried in interminable terms and conditions. I can understand that the more they delve into the GDPR, the more fundraising companies may despair.

But denial and confusion is not the answer, and this nonsense must end. The Institute of Fundraising has to stop issuing inaccurate and confusing guidance which, let’s assume coincidentally, has the effect of maximising the number of calls, texts and emails that can be made and sent. Charities have been battered for a while now, some with more justification than others. But they have no hope of emerging from the mess and getting back to where they should be if this endless stream of misinformation continues to be sprayed at them. The problem for some fundraisers is not that the GDPR is confusing. It is that it is not.

Raising hell

One of the irritating things about the introduction of the EU Data Protection Regulation, the timing and final shape of which is still up in the air, is the way in which marketing companies are buzzing around, fearful of what the changes might mean. Most of them fret about the perceived emphasis on unambiguous consent, and what irritates me is that none of these idiots seem to be aware that active consent has been needed for email and text marketing since 2003 (under the Privacy and Electronic Communications Regulations, or PECR). The big change they are worried about happened more than ten years ago.

A slightly different take on the problem is doing the rounds in the charity fundraising sector. An article on the Civil Society News website encapsulates it with a suitably hysterical headline: “EU data protection proposals would kill fundraisers’ mailing lists, says report“. If the regulation contained provisions to ban marketing in general or marketing by charities in particular, this would be true and terrible. Stephen Pidgeon, a “fundraising consultant” and trustee of the Institute for Fundraising is quoted:

“if the EU introduce compulsory ‘opt-ins’ for direct mail then the cold mailing lists that still drive minor donor fundraising will disappear and, with them, millions of pounds”

Full marks for the euphemism ‘cold mailing list’ there, when what Mr Pidgeon means is ‘junk mail’. The author of a report into this nefarious proposal, Andy Taylor, a consultant at a charity marketing agency called ‘The Desired Effect’, is equally scathing:

“There is a balance to be struck between the donor’s right to privacy and our ability to fundraise, and the current draft of the proposals doesn’t get this right.” 

The factual content of the article is awful – it asserts that charities can make marketing calls unless told not to, ignoring the existence of the Telephone Preference Service which applies to charities as it does to everyone else. It also claims that charities can use the ‘soft opt-in’ for email marketing, which allows an organisation to operate a tight opt-out system when marketing similar products to existing customers. PECR clearly refers to the soft opt-in being engaged during a ‘sale’, and the Information Commissioner’s guidance is unambiguous about what that means:

“the ‘soft opt-in’ exception can only apply to commercial marketing of products and services… [not for profit organisations] will not be able to send campaigning texts or emails without specific consent, even to existing supporters” (page 12)

The Civil Society article also complains about the possibility that the Regulation may interfere with a charity’s ability to profile potential donors. What this means is made more explicit in a recent piece published by Fundraising UK, which complained:

“charities would no longer be able to target direct marketing campaigns at specific donor profiles and would severely hamper the ability to build up prospect donor information”

I think some charities’ good works can be diluted by a sense of entitlement (I’ve blogged about the human embodiment of this in the past), and their fund-raising methods can be awful. Few commercial organisations would expect to get away with the antics of chuggers, but charities expect a free pass when hassling unwilling citizens in the street and paying a cut of donations to the companies they employ to do so. The attitude on display by Fundraising UK is even worse – would you be happy if a charity assembled information about you without your consent and then sent unsolicited marketing to you? I’d be fascinated to know if charities that profile ‘prospect donors’ comply with the first Data Protection principle by informing the ‘prospect’ that they were doing so – regardless of consent, there is no exemption from fair processing available.

I hope that those fundraisers agitating against explicit consent for marketing fail. Expecting an organisation to have permission before sending marketing isn’t just a legitimate way of setting up privacy law, it’s basic courtesy. There are already a lot of circumstances where our data is used without consent – many justified, some not. But where there is not some legal or security requirement that makes consent inappropriate, it should be the default for everyone, regardless of the effect on profit, innovation or donation. One vital aspect of privacy is having a right to be left alone, to be able to close your door and not be bothered by anyone else. The position of these fundraisers and consultants is that charities should be able to override that to get their cash. The headline of the Civil Society article is nonsense because explicit consent doesn’t kill charity mailing lists, it just makes them fair. It ensures that those people who are on the lists want to be on the lists. If fundraisers are concerned about the effect of Data Protection on their income, perhaps they should approach their targets with more respect.