31 January 2018
In November, following a Daily Mail exposé into the use of wealth screening and third party donor prospecting services by leading UK universities, the Information Commissioner, Elizabeth Denham, has announced an investigation by her Office ('ICO') into fundraising practices within the sector.
The Daily Mail's allegations are based on requests made to various public universities under the Freedom of Information Act 2000 and subject access requests by reporters for their personal data under the Data Protection Act 1998 ('DPA'). Twenty four Russell Group universities confirmed using external service providers to conduct wealth profiling of alumni and potential major donors.
The ICO's investigation is likely to include examining the practices of certain universities in their charitable activities who use screening or profiling to better target their fundraising. The latest Daily Mail campaign echoes its 2015 news investigations in relation to fundraising practices of leading UK charities. These sparked a major regulatory investigation and, in April this year, resulted in the ICO issuing fines against a number of charities for unlawful data processing practices (including wealth screening and data sharing) in breach of the DPA. In particular, affected individuals were not properly informed and would not 'reasonably expect' their personal data to be used for these purposes.
Although investigations will be on-going, in a public statement Ms Denham has reiterated the principle that 'profiling individuals for a fundraising campaign itself is not against the law but failing to clearly tell people that you're going to do it, is'. It remains to be seen whether the Daily Mail's investigation will have quite the same impact as it did on the fundraising sector a couple of years ago. Initial indications were that the reaction was rather more subdued than in 2015. Nevertheless, anyone engaging in prospect research, wealth screening or profiling is reminded to make sure that they have complied with the DPA's fair and lawful processing principle and in particular made this clear in an appropriate privacy notice or statement.