Some of the UK’s biggest charities have been caught ‘selling’ people’s personal data

The government has fined 11 of the UK’s biggest charities for breaches of the Data Protection Act (DPA). Some of them had been secretly targeting people for more donations. And others sold people’s personal data to other charities.

The organisations

The Information Commissioner’s Office (ICO) has fined the 11 charities a total of £138,000. The organisations were:

• The International Fund for Animal Welfare (IFAW) – £18,000.
• Cancer Support UK (formerly Cancer Recovery Foundation UK) – £16,000.
• Cancer Research UK – £16,000.
• The Guide Dogs for the Blind Association – £15,000.
• Macmillan Cancer Support – £14,000.
• The Royal British Legion – £12,000.
• The National Society for the Prevention of Cruelty to Children – £12,000.
• Great Ormond Street Hospital Children’s Charity – £11,000.
• WWF-UK – £9,000.
• Battersea Dogs’ and Cats’ Home – £9,000.
• Oxfam – £6,000.

The breaches

In summing up the charities’ breaches of the DPA, the ICO said:

ICO investigations found many of the charities secretly screened millions of donors so they could target them for additional funds. Some charities traced and targeted new or lapsed donors by piecing together personal information obtained from other sources. And some traded personal details with other charities creating a large pool of donor data for sale.

The official breaches committed by the 11 charities were:

• Finding peoples’ personal information, that they hadn’t given to the charity.
• Ranking donors based on their wealth.
• Sharing peoples’ personal data with other charities, no matter what the cause.

Millions affected

Specific cases included Cancer Support UK sharing 3,075,550 donor records; Great Ormond Street Hospital Children’s Charity sending on average 795,000 records per month to a wealth screening company; the International Fund for Animal Welfare sharing 4,948,633 donor records, and many of the charities finding out people’s telephone numbers using searching methods.

In total, it is estimated that 12,632,544 donor records were shared by the 11 charities. The ICO said:

Millions of people will have been affected by these charities’ contravention of the law. They will be upset to learn the way their personal information has been analysed and shared by charities they trusted with their details and their donations. No charity wants to alienate their donors. And we acknowledge the role charities play in the fabric of British society. But charities must follow the law.

Concerning

Actions like these, from some of the UK’s most prominent charities, are concerning. When the UK is already facing an existential crisis, regarding public services being cut, charities are being relied upon more and more. But when they appear to abuse the trust of their donors, it’s bad news for everyone.

The Canary asked the 11 charities for comment.

A WWF spokesperson said:

We take our data protection responsibilities extremely seriously and are committed to ensuring our data practices not only follow the law but also serve the best interests of all our supporters. We sincerely apologise for any instances where we have failed to meet the high standards our supporters expect of us. We have fully implemented the ICO recommendations. We are hugely grateful to all our supporters, they are critical to our success and at the heart of everything we do. Without them our work, ranging from supporting threatened species like tigers and rhinos through to campaigning to stop climate change, would not be possible.

An NSPCC spokesperson said:

The NSPCC is disappointed by the ICO’s decision to issue what we regard as an unjustified fine. Ninety per cent of our donations come from the public and we fiercely protect the trust our supporters place in us to fight for every childhood. If anyone has been affected by these unintentional failings, then of course we apologise. Significant changes have been made to the way we fundraise to ensure these mistakes don’t happen again. We want to be clear: we have never, and will never, sell or share our supporters’ data with other charities. We have gone much further than the ICO has required us to do in terms of how we handle supporters’ data and want to be a standard-bearer for best practice when it comes to fundraising. In the meantime, friends of the charity have said they will pay this bill so not a single penny of any donation will be diverted from our work.

An IFAW spokesperson said:

IFAW has considered whether to appeal, as we do not agree with many of the ICO findings. We are extremely disappointed that the ICO has chosen to impose a fine. We take our responsibilities to our supporters very seriously – they choose to support us because they trust us to rescue and protect animals around the world. We work tremendously hard to use their donations in the most effective way possible to have the maximum impact. The fundraising activities that IFAW carried out were considered acceptable practice throughout the charitable sector, and there was little to no guidance or concern about the practices from the ICO or other regulators. We welcome the fact that the ICO and Fundraising Regulator are issuing clearer guidelines and are fully committed to high standards for our fundraising. IFAW has fully cooperated with the ICO throughout the investigation, has ceased activities of concern as soon as they were raised and has taken significant steps to review and enhance, where necessary, our data protection and fundraising practices, both before and during the investigation. Despite the fact that we disagree with the ICO’s decision to issue a fine, we do not believe it is in the best interests of our supporters to fight the finding, which would detract from our work to fulfil our mission to rescue and protect animals. It is also possible that the costs of appealing could be greater than the fine itself. We intend to pay the fine from our investment income.

Gemma Holding, CEO of Cancer Support UK (CSUK), said:

CSUK’s newly appointed board of trustees and I take the fundraising practices of the organisation and its associated responsibilities for managing donor data very seriously. As CEO of Cancer Support UK, I am hugely grateful to our donors who have continued to give generously to the charity. I want to assure our supporters that we have processes in place to ensure that we will only ever contact them or otherwise use information that we hold about them in a respectful manner with which they have agreed, and apply their donations wisely. I am also thankful of the new staff and Board of Trustees of Cancer Support UK who have been instrumental in helping the organisation to move forwards to become a charity that we can and should be proud of, committed to offering meaningful support to those with cancer. Prior to the ICO’s investigation the charity had already implemented all the necessary changes (explained below) to improve our direct mail and data protection practices and ensure gold standard compliance, all of which has been explained in detail to the ICO. In light of these changes we are therefore extremely disappointed that the ICO has today issued us with a fine of £16,000. We consider the fine to be ill founded, excessive and disproportionate. We significantly changed our operational and strategic approach in 2016, which included parting company with all our US based fundraising advisers (including our US founding charity), which collectively had been delegated responsibility for all our fundraising activity. Instead we appointed UK based fundraisers with the Board assuming direct oversight of fundraising activities. This change is the single most important factor in moving forward to becoming a more effective, transparent and accountable organisation – well placed to offer relevant services to people with cancer across the UK. We made these changes understanding that doing so would be to the detriment of our fundraising income but recognising that our reputation and the integrity of our fundraising practices must always come before fundraising results. Despite this being a difficult decision, we knew it was the right one. Our change in approach extended beyond fundraising and we have remodelled all our activities to ensure we place people with cancer at the heart of everything we do. To reflect what we view as a complete turnaround for the organisation in its ethos, mission and values we have recently relaunched as Cancer Support UK (CSUK). Notwithstanding the unfortunate outcome of the ICO investigation, we are confident that the examples above demonstrate that we have identified and implemented a number of transformational changes within the organisation since concerns were identified. Indeed, we have received external recognition in this regard. Cancer Support UK won its first award from ACEVO in December 2016 for ‘Brave and Inspirational leadership’ which acknowledged the fundamental changes to our operations. ACEVO is the UK’s largest and most influential network for charity leaders.

Our disappointment in the ICO’s fine is compounded by a number of factors. We had explained to the ICO the measures we have taken and clarified a number of factual and legal inaccuracies in their penalty decision as well as highlighting the material impact that this will have on a charity of our size – all of which it seems the ICO has ignored. More generally we do not understand the ICO rationale for punishing small charities like ours which have voluntarily taken the remedial steps which we have. In light of all of the above, our trustees will consider whether it is in the interests of the charity to appeal this decision, given our extremely limited resources.

A spokesperson for Battersea Dogs & Cats Home said:

We are very disappointed by the Information Commissioner’s Office (ICO) decision to issue monetary penalties to eleven charities, including Battersea. We fully support all charities being held to the highest of fundraising standards but it would be most unfortunate if any supporters’ or beneficiaries’ donations were diverted from such vital causes to pay ICO fines. Like other charities, we intend to pay this fine swiftly and in doing so, it will be reduced to £7,200. We are entirely reliant on the generosity of the public, and our Trustees would like to reassure all our supporters that their donations will not be used to pay the reduced ICO penalty. Instead, this will be achieved solely from investment income. Battersea has been fined by the ICO today for what is known as tele-matching and not including adequate information in our privacy policy. We have not been fined for what is known as wealth screening or data swapping. As like many charities that used telematching, we wanted to make sure the telephone numbers we had for our supporters were correct. However, to reassure our donors, we stopped tele-matching in July 2015, as soon as the ICO highlighted it as a potential issue to charities. We would also like to assure our supporters that none of their data has been lost, sold or compromised in any way. Building lasting relationships with supporters is really important to Battersea, and we value the opportunity to talk to them over the phone about the difference their donations are making to our animals. On every telephone call Battersea makes, we ask our supporters whether they are happy to take our call and whether they may be happy to hear from us in the future. Battersea is an active and committed leader within UK fundraising and will continue to help set new standards to ensure the public can have trust and confidence in the work of charities as a whole.

Sir Harpal Kumar, Cancer Research UK’s CEO, said:

The ICO has found that there were two areas related to our fundraising where we should have explained more clearly how we may use supporters’ data. We have addressed these two issues. Cancer Research UK has not used supporters’ data in ways which we believed were incompatible with their desire to help us beat cancer sooner. In fact, our supporters have consistently told us that they want us to use our funds efficiently and only send them information that is most likely to interest them. That is what we have tried to do, but the ICO has ruled that we were not clear enough with our supporters on these points. I sincerely apologise for this. We have made additional changes to our data management, privacy and fundraising policies over the last few years, and we have not shared data with other charities for many years. It is really important to Cancer Research UK that we have the trust of our supporters. It is only thanks to them that we have been able to fund pioneering research in the prevention, diagnosis and treatment of cancer, work that has helped save millions of lives.

Tim Johnson, Chief Executive of Great Ormond Street Hospital Charity, said:

The ICO investigation concerns practices that we no longer carry out but were undertaken in good faith, working to sector guidelines as we understood them at the time. We are disappointed with this outcome, however we will continue to work with the ICO and other regulators to ensure we operate to the highest standards. We know this is what our supporters would expect from us; it is only through their generosity that we are able to make such a difference to seriously ill children. We are sorry for any mistakes that we made, we continually review the way we fundraise so that we are working to best practice. Over the last three years, we have changed the way we manage our supporters’ personal information. This is set out in our updated privacy policy. We have also published a commitment to our supporters setting out the standards and ethos that they can expect from us. We regularly check with supporters that they are receiving the right amount of communication. A small group of supporters has come forward to make a donation that will specifically cover the cost of the fine. I can therefore reassure all other supporters that their donations will not be used for this purpose.

Get Involved!

– Support The Canary, so we can keep bringing you the news that matters.

Featured image via Flickr