Fundraising and data protection pitfalls

Scenario: A case study of how a school encountered problems when ramping up its fundraising activities and guidance on how you can keep to the rules.

Scenario

We have a small group of dedicated parents who have supported the school with various fundraising activities.  However, we are looking at expanding our fundraising.   

1. We intend to send out emails and follow up with a mailshot to past and present parents and pupils, suppliers and other contacts to launch a new appeal.

2. We have checked our contact details and felt much of it was out of date or incomplete.  We are aware of some mail service agencies who can match our contact detail and update it with current address, phone number and emails; all from legal sources, nothing underhand!

3. One of these agencies will manage the whole fundraising process for us, for a fee. They also offer services such as searching for grants and using their own donor contact lists.

4. We have in mind a particular appeal to fund refurbishing the sixth form common room and the staff room. It would also be helpful to add to our bursary fund as we hear the talk about increasing the demands on schools if they want to retain charitable status.

Guidance on the law

Issue 1

• The Data Protection Act (DPA) imposes various obligations on those who hold or use data about living individuals. From 2018 the rules on consent are tightening and schools will need to be able to evidence that consent is express, freely given, informed and specific. There is already a shift away from the opt-out ('tell us if you don’t want to receive information about…') to the opt-in ('do you want to hear more about…') 
• Why do you hold contact information? For parents it will be to keep them informed about matters concerning their child and to manage their contract with the school, including for payment of fees.  That does not imply that you can contact them to ask for donations.   The fact that a parent has donated before does not of itself give consent to be contacted about any new appeal. The new 2018 rules will reinforce the need to ensure parents know what you will use their data for.  
• You will likely need to update your consents; most certainly you will need to update your record keeping. 
• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) complements but goes further than the DPA.  In broad terms a school cannot send direct marketing emails without consent. Unsolicited marketing covers anything that is not specifically asked for, for example a prospective parent may ask for a Prospectus which you send out in response. Any further contact would be unsolicited, and subject to PECR. 
• There is a well used exception referred to as the 'soft opt-in' for existing contacts but that only applies to marketing goods and services.  Fee paying schools may be able to stretch this to highlight prospective services to parents or prospective parents but this is unlikely to cover emails to past parents and others asking for donations for the staff room.  The message must match the exception. 
• The Charity Commission fundraising guidance (CC20) reminds governors that they have overall responsibility and accountability for the school and this includes fundraising, even if the actual task of fundraising is carried out by others.  This includes planning effectively, supervising fundraisers, protecting the charities reputation and complying with relevant laws and practice which apply to the different forms of fundraising.

Issue 2 

• DPA requires that schools ensure that personal data is accurate and, where necessary, kept up to date. So a list which is out of date, or which does not accurately record people’s marketing preferences, could breach the DPA. 
• Can you justify and evidence consent for you to hold information about past pupils and parents, including the length of time you will hold it for?  Alumni networks can help with this.   
• The school will need to evidence express consent if you are data matching (to correct or fill in the gaps). Information may be in the public domain, but that does not give your school the necessary consent to use it. 
• Nor does it permit some agency to give, or share, that information with you. You need consent to share data, but this is not the same as using the services of someone who will process information on behalf of the school.

Issue 3 

• New rules for professional fundraisers or commercial participators came into effect in Nov 2016, but the Fundraising Regulator is allowing until March 2017 for charities to put in place the formal written agreements required to cover existing arrangements, including identifying fees paid to fundraisers.

Issue 4 

• An appeal for funds can fail if it raises insufficient sums, in which case donors may be entitled to a refund. If it raises excess funds, a Charity Commission scheme may be needed to re-direct that excess.  It is important to get the message right in terms of what the funds can be used for, for example to include a statement that if there are insufficient or surplus funds then they will be applied for the school's general charitable purposes, such as for the provision of bursaries.

The School governors must take responsibility and plan.  Whether this is left to parents or an outside agency it is important to agree what can be done, including approval of any messages being sent out, in the name of the school.  Such agreement will include who has responsibility for compliance with the various rules which govern fundraising activity.

Fines

Many schools have overlooked the issue of consent and fall into the trap of assuming they can use contact details for all purposes.  The ICO has already made plain a willingness to penalise charities which do get it wrong. At present fines are up to a maximum of £500k and from 2018 that changes to 4% of income.

Recently the ICO has fined RSPCA and British Heart Foundation for data matching and sharing and other activities (issue 2), with a number of well known charities under review. The ICO fines have also sparked a Charity Commission compliance enquiry on whether trustees have satisfied their duties.

This article was written by Wrigleys for the education publication, Governance Insight. Full details of this publication are available here