Some of the UK’s biggest charities have been caught ‘selling’ people’s personal data
The government has fined 11 of the UK’s biggest charities for breaches of the Data Protection Act (DPA). Some of them had been secretly targeting people for more donations. And others sold people’s personal data to other charities.
The Information Commissioner’s Office (ICO) has fined the 11 charities a total of £138,000. The organisations were:
- The International Fund for Animal Welfare (IFAW) – £18,000.
- Cancer Support UK (formerly Cancer Recovery Foundation UK) – £16,000.
- Cancer Research UK – £16,000.
- The Guide Dogs for the Blind Association – £15,000.
- Macmillan Cancer Support – £14,000.
- The Royal British Legion – £12,000.
- The National Society for the Prevention of Cruelty to Children – £12,000.
- Great Ormond Street Hospital Children’s Charity – £11,000.
- WWF-UK – £9,000.
- Battersea Dogs’ and Cats’ Home – £9,000.
- Oxfam – £6,000.
In summing up the charities’ breaches of the DPA, the ICO said:
ICO investigations found many of the charities secretly screened millions of donors so they could target them for additional funds. Some charities traced and targeted new or lapsed donors by piecing together personal information obtained from other sources. And some traded personal details with other charities creating a large pool of donor data for sale.
The official breaches committed by the 11 charities were:
- Finding peoples’ personal information, that they hadn’t given to the charity.
- Ranking donors based on their wealth.
- Sharing peoples’ personal data with other charities, no matter what the cause.
Specific cases included Cancer Support UK sharing 3,075,550 donor records; Great Ormond Street Hospital Children’s Charity sending on average 795,000 records per month to a wealth screening company; the International Fund for Animal Welfare sharing 4,948,633 donor records, and many of the charities finding out people’s telephone numbers using searching methods.
In total, it is estimated that 12,632,544 donor records were shared by the 11 charities. The ICO said:
Millions of people will have been affected by these charities’ contravention of the law. They will be upset to learn the way their personal information has been analysed and shared by charities they trusted with their details and their donations. No charity wants to alienate their donors. And we acknowledge the role charities play in the fabric of British society. But charities must follow the law.
Actions like these, from some of the UK’s most prominent charities, are concerning. When the UK is already facing an existential crisis, regarding public services being cut, charities are being relied upon more and more. But when they appear to abuse the trust of their donors, it’s bad news for everyone.
The Canary asked the 11 charities for comment.
A WWF spokesperson said:
We take our data protection responsibilities extremely seriously and are committed to ensuring our data practices not only follow the law but also serve the best interests of all our supporters. We sincerely apologise for any instances where we have failed to meet the high standards our supporters expect of us. We have fully implemented the ICO recommendations. We are hugely grateful to all our supporters, they are critical to our success and at the heart of everything we do. Without them our work, ranging from supporting threatened species like tigers and rhinos through to campaigning to stop climate change, would not be possible.
An NSPCC spokesperson said:
The NSPCC is disappointed by the ICO’s decision to issue what we regard as an unjustified fine. Ninety per cent of our donations come from the public and we fiercely protect the trust our supporters place in us to fight for every childhood. If anyone has been affected by these unintentional failings, then of course we apologise. Significant changes have been made to the way we fundraise to ensure these mistakes don’t happen again. We want to be clear: we have never, and will never, sell or share our supporters’ data with other charities. We have gone much further than the ICO has required us to do in terms of how we handle supporters’ data and want to be a standard-bearer for best practice when it comes to fundraising. In the meantime, friends of the charity have said they will pay this bill so not a single penny of any donation will be diverted from our work.
An IFAW spokesperson said:
IFAW has considered whether to appeal, as we do not agree with many of the ICO findings. We are extremely disappointed that the ICO has chosen to impose a fine. We take our responsibilities to our supporters very seriously – they choose to support us because they trust us to rescue and protect animals around the world. We work tremendously hard to use their donations in the most effective way possible to have the maximum impact. The fundraising activities that IFAW carried out were considered acceptable practice throughout the charitable sector, and there was little to no guidance or concern about the practices from the ICO or other regulators. We welcome the fact that the ICO and Fundraising Regulator are issuing clearer guidelines and are fully committed to high standards for our fundraising. IFAW has fully cooperated with the ICO throughout the investigation, has ceased activities of concern as soon as they were raised and has taken significant steps to review and enhance, where necessary, our data protection and fundraising practices, both before and during the investigation. Despite the fact that we disagree with the ICO’s decision to issue a fine, we do not believe it is in the best interests of our supporters to fight the finding, which would detract from our work to fulfil our mission to rescue and protect animals. It is also possible that the costs of appealing could be greater than the fine itself. We intend to pay the fine from our investment income.
Gemma Holding, CEO of Cancer Support UK (CSUK), said:
CSUK’s newly appointed board of trustees and I take the fundraising practices of the organisation and its associated responsibilities for managing donor data very seriously. As CEO of Cancer Support UK, I am hugely grateful to our donors who have continued to give generously to the charity. I want to assure our supporters that we have processes in place to ensure that we will only ever contact them or otherwise use information that we hold about them in a respectful manner with which they have agreed, and apply their donations wisely. I am also thankful of the new staff and Board of Trustees of Cancer Support UK who have been instrumental in helping the organisation to move forwards to become a charity that we can and should be proud of, committed to offering meaningful support to those with cancer. Prior to the ICO’s investigation the charity had already implemented all the necessary changes (explained below) to improve our direct mail and data protection practices and ensure gold standard compliance, all of which has been explained in detail to the ICO. In light of these changes we are therefore extremely disappointed that the ICO has today issued us with a fine of £16,000. We consider the fine to be ill founded, excessive and disproportionate. We significantly changed our operational and strategic approach in 2016, which included parting company with all our US based fundraising advisers (including our US founding charity), which collectively had been delegated responsibility for all our fundraising activity. Instead we appointed UK based fundraisers with the Board assuming direct oversight of fundraising activities. This change is the single most important factor in moving forward to becoming a more effective, transparent and accountable organisation – well placed to offer relevant services to people with cancer across the UK. We made these changes understanding that doing so would be to the detriment of our fundraising income but recognising that our reputation and the integrity of our fundraising practices must always come before fundraising results. Despite this being a difficult decision, we knew it was the right one. Our change in approach extended beyond fundraising and we have remodelled all our activities to ensure we place people with cancer at the heart of everything we do. To reflect what we view as a complete turnaround for the organisation in its ethos, mission and values we have recently relaunched as Cancer Support UK (CSUK). Notwithstanding the unfortunate outcome of the ICO investigation, we are confident that the examples above demonstrate that we have identified and implemented a number of transformational changes within the organisation since concerns were identified. Indeed, we have received external recognition in this regard. Cancer Support UK won its first award from ACEVO in December 2016 for ‘Brave and Inspirational leadership’ which acknowledged the fundamental changes to our operations. ACEVO is the UK’s largest and most influential network for charity leaders.
Our disappointment in the ICO’s fine is compounded by a number of factors. We had explained to the ICO the measures we have taken and clarified a number of factual and legal inaccuracies in their penalty decision as well as highlighting the material impact that this will have on a charity of our size – all of which it seems the ICO has ignored. More generally we do not understand the ICO rationale for punishing small charities like ours which have voluntarily taken the remedial steps which we have. In light of all of the above, our trustees will consider whether it is in the interests of the charity to appeal this decision, given our extremely limited resources.
A spokesperson for Battersea Dogs & Cats Home said:
Sir Harpal Kumar, Cancer Research UK’s CEO, said:
The ICO has found that there were two areas related to our fundraising where we should have explained more clearly how we may use supporters’ data. We have addressed these two issues. Cancer Research UK has not used supporters’ data in ways which we believed were incompatible with their desire to help us beat cancer sooner. In fact, our supporters have consistently told us that they want us to use our funds efficiently and only send them information that is most likely to interest them. That is what we have tried to do, but the ICO has ruled that we were not clear enough with our supporters on these points. I sincerely apologise for this. We have made additional changes to our data management, privacy and fundraising policies over the last few years, and we have not shared data with other charities for many years. It is really important to Cancer Research UK that we have the trust of our supporters. It is only thanks to them that we have been able to fund pioneering research in the prevention, diagnosis and treatment of cancer, work that has helped save millions of lives.
Tim Johnson, Chief Executive of Great Ormond Street Hospital Charity, said:
– Support The Canary, so we can keep bringing you the news that matters.
Featured image via Flickr
We know everyone is suffering under the Tories - but the Canary is a vital weapon in our fight back, and we need your support
The Canary Workers’ Co-op knows life is hard. The Tories are waging a class war against us we’re all having to fight. But like trade unions and community organising, truly independent working-class media is a vital weapon in our armoury.
The Canary doesn’t have the budget of the corporate media. In fact, our income is over 1,000 times less than the Guardian’s. What we do have is a radical agenda that disrupts power and amplifies marginalised communities. But we can only do this with our readers’ support.
So please, help us continue to spread messages of resistance and hope. Even the smallest donation would mean the world to us.