The ICO to issue profiling guidance for fundraisers

The ICO gave fines to the RSPCA and BHF in December for failing to notify donors that their information would be used for profiling.

Information Commissioner Elizabeth Denham said: “The millions of people who give their time and money to benefit good causes will be saddened to learn that their generosity wasn’t enough. And they will be upset to discover that charities abused their trust to target them for even more money.”

This decision alarmed some marketers because of possible ramifications for other forms of generic profiling, such as targeting offers to customers/donors on a recency/frequency model.

Because the charities failed to state in their data collection or privacy notices that donors’ personal information would be used for wealth-screening purposes, the ICO found that the charities had gone beyond what donors would have considered fair and reasonable and therefore the charities were in breach of the fair and lawful processing principle, the first principle in the Data Protection Act 1998.

Wealth screening was carried out without the knowledge of donors and the charities passed donor’s personal information to a third party, who would then aggregate the information supplied by the charity with other pieces of information about the donor to provide the charities with information about that particular donor’s giving capacity . By doing this the charities were able to tailor their fundraising accordingly.

The ICO accepts that guidance is needed across the whole marketing industry and not just the charity sector on what information should be included in data collection/privacy notices about profiling.

The ICO accepts that any such guidance needs to be GDPR ready and will also deal with the GDPR provisions on profiling in the guidance. At the meeting the DMA explained to the ICO how widely generic profiling is used in the industry. The ICO will work on its guidance and will present its initial thoughts at the Privacy Officers Conference in Manchester on March 6 which the DMA is attending.

However, those two civil monetary penalty notices were part of a wider investigation into the charity sector after the scandals that rocked the sector in 2015. In all the ICO is looking into 24 organisations as part of their investigation.

The ICO told the DMA that the investigation stage was now in its closing stages and would release further information over the next week about further formal enforcement action

The DMA will keep members updated of further developments in this area through the website.