At the end of 2016, the Information Commissioner’s Office (ICO) reported that they had issued monetary penalty notices against the British Heart Foundation and the RSPCA as a result of data protection breaches when engaging in the following activities:
- sharing and swapping the personal data of donors
- using wealth screening companies to analyse the financial position of supporters
- data-matching and tele-matching.
As a result of these penalty notices, the CCEW and the Regulator issued a joint alert to charities, reminding trustees that they must comply with their legal duties when overseeing their charity’s fundraising. The key steps that the regulators expect trustees to take are to:
- immediately cease activity in breach of data protection law
- review and assess activities in the areas of data collection, storage and use to ensure compliance
- review and assess current data governance systems and processes to ensure they are fit for purpose and evidence sufficient oversight, control and are operating and effective.
Where breaches are identified ensure you review the requirements and comply with them.
Where breaches have occurred consider the risk to those whose data has been breached and any action required to mitigate risks to those individuals and their data. Notify the Charity Commission about any investigation of their charity by the ICO.
With a further 11 charities informed of the intention to issue fines for breaching the Data Protection Act in January 2017, this is an area that charities must ensure they comply with. More information is available here.
This article features in our Charity Newsletter Spring 2017. To see the full version please click here.
If you would like to find out more about any of the topics covered in our Charity Newsletter and how we at Robinson Reed Layton can assist, please contact our Charities Partner, Mark Williams, on 01872 276116 or mark.williams@rrlcornwall.co.uk. You can signup to receive our Charity Newsletter here.
This publication has been prepared by Robinson Reed Layton. It is to be treated as a general guide only and is not intended to be a comprehensive statement of the law or represent specific advice. No liability is accepted for the opinions it contains, or for any errors or omissions. All rights reserved.
Updated 24 April 2017