Privacy and Philanthropy

1. Privacy and Philanthropy David Lamb Prospect Research Consultant Blackbaud Analytics

2. Agenda • Privacy as a key issue in philanthropy • APRA’s Privacy Position Paper • Rules to live by • Fiduciary relationship • Ethical and legal guidelines • Vendors must be legal and ethical • Provide a privacy policy to reassure donors • One step further: a prospect research policy • Case situations

3. Privacy troubles • Personal information at risk • April 22, 2008 Binghamton University notifies 11 students and 120 applicants of theft of a laptop containing their names and SSNs • Laptop belonged to a consultant implementing Banner • Laptop also contained similar info on thousands of constituents at other institutions • Incident highlights the danger of using SSNs as ID numbers • Nonprofit Privacy Rights Clearinghouse reports that more than 225 million US citizens have had their private information exposed due to security problems since 2006 • Trouble in the prospect research world • Stories reinforce unrealistic expectations • People think you’re a voyeur • Irony for prospect researchers

4. APRA position on privacy • Availability of information does not drive its collection nor supercede ethical use • Follow federal, state and local laws • Policies and procedures change with technology and law • Vendors must be held to the same standard as ourselves • Share information only when confidentiality is assured • Search only for relevant information

5. APRA position on privacy (continued) • Fundamental principles • Protection of confidential information • Accurate recording of all data • Relevancy of the information • Honesty in revealing our identities and purpose • Accountable for our actions

6. Rules to live by • Development professionals have a fiduciary relationship to prospects • Actions of development professionals are limited by legal and ethical boundaries • Development professionals must hold vendors to the same standard of conduct

7. Fiduciary “One who obligates himself or herself to act on behalf of another (as in managing money or property) and assumes a duty to act in good faith and with care, candor, and loyalty in fulfilling the obligation”-Merriam Webster Dictionary of Law

8. Rules to live by • Development professionals have a fiduciary relationship to prospects • Actions of development professionals are limited by legal and ethical boundaries • Development professionals must hold vendors to the same standard of conduct

9. Ethical basis of privacy APRA’s statement of privacy • Record only relevant information • Don’t hide your identity or your purpose when requesting information • Be an expert on the reliability of sources • Present information clearly and objectively • Clearly differentiate between known fact and speculation

10. Legal basis of privacy • “The right to be left alone” • Legally recognized forms of invasion: • The unreasonable intrusion on the privacy of another • The appropriation of another’s name or likeness • Unreasonable publicity given to another’s private life • Publicity that unreasonably places another in a false light before the public

11. Laws impacting privacy issues • Freedom of Information Act, 1966 (FOIA) • Federal Education Rights and Privacy Act, 1974 (FERPA) • Health Insurance Portability and Accountability Act, 1996 (HIPAA) • American Competitiveness and Corporate Accountability Act, 2002 (Sarbanes-Oxley)

12. Sarbanes Oxley and Nonprofits • Assumption that, since nonprofits don’t offer stock, SOX does not apply • Two provisions apply to all corporations, for- and non-profit • Protection for whistle blowers • Document destruction • Other provisions with obvious nonprofit implications • Accounting transparency and independence • Loans to executives

13. Rules to live by • Development professionals have a fiduciary relationship to prospects • Actions of development professionals are limited by legal and ethical boundaries • Development professionals must hold vendors to the same standard of conduct

14. Working with vendors • Commercial data brokers aggregate and organize data • Thomson Financial • Reuters Data • Experian • Dun & Bradstreet • ChoicePoint • Most of what is collected by data brokers must be disclosed by the source • Some of it is voluntarily disclosed • Data brokers make the data easier to access

15. Laws that govern data brokers • Fair Credit Reporting Act (FCRA) Sets rules for how consumer reporting agencies (such Experian, Equifax, and TransUnion) store, allow access to, and permit corrections to data that they collect on consumer credit • Gramm Leach Bliley Act (GLBA) Includes provisions to protect consumers’ personal and financial information held at financial institutions

16. Fundamental principles behind data broker privacy laws • Ensure consumers have control over their information • Establish guidelines for record use and release • Set accountability guidelines for records use and release • Balance public responsibility with privacy protections

17. Vendors must be legal and ethical • Require vendors to demonstrate compliance with applicable laws • Read the privacy and confidentiality statements provided by vendors • Review with your counsel and ask for clarification or modification if necessary • Monitor industry watchdog groups • Electronic Privacy Information Center (www.epic.org) • Charity Navigator (www.charitynavigator.org)

18. The upside to less privacy • Benefits of “databasification” • Privacy is traded for efficiency • Privacy is not necessarily the ultimate goal of society • If the common good can be served through disclosure, perhaps that is best • Most thefts of personal data don’t result in fraud

19. It’s getting hot in the kitchen • Does the act of prospect research present too great a risk? • Why do we keep doing it? • Ask the right person for the right gift • Doing your homework • Helping generous people do good things

20. Questions to ensure privacy • Is it truthful? • Is it relevant? • Is it respectful?

21. Make a statement • What information is collected? • How will personal information be used? • How will it be saved-protected-shared? • Will information be sold or traded? • Under what circumstances will prospects be contacted? • Does self-disclosure imply consent? • What other information may be collected? • Give the donor the ability to “opt out”

22. A model statement: The Nature Conservancy • What info they collect • How the NC uses your info • Who the NC shares your info with • How they protect info • Opt-out

23. A prospect research policy • From time to time we use publicly available data to help us raise private support more efficiently and to be better stewards of received donations • Info only used for fundraising purposes • All research must be approved by a responsible officer • All research will be logged and reported periodically • Access to resources used for prospect research will be limited to authorized personnel • Access to research data will be limited to development office personnel • Suitable measures will be taken to ensure the security of the data

24. Case Situations • Would your organization ever do a criminal background check on a donor? • Would your organization ever share data from your file on a donor with another nonprofit? • Is email secure enough as a medium for transmitting donor/prospect data?

25. Resources • Charity Navigator: a watchdog group www.charitynavigator.org • Privacy Rights Clearing House: a privacy watchdog www.privacyrights.org • Independent Sector’s recommendations for nonprofit responses to SOX www.independentsector.org/issues/sarbanesoxley • TRUSTe Model Privacy Policy www.truste.org/docs/Model_Privacy_Policy_Disclosures.doc • TRUSTe’s Guide to writing an online privacy policy www.truste.org/pdf/WriteAGreatPrivacyPolicy.pdf • Online Privacy for Nonprofits: How to Protect Members' Privacy and Personal Information www.privacyrights.org/fs/fs28-nonprofits.htm • Good examples: • Nature Conservancy: nature.org/aboutus/misc/ • Minnesota Public Radio: minnesota.publicradio.org/about/site/privacy/ • This link to advancement research standards on the web site of the Association of Professional Researchers for Advancement has several items of interest, including the APRA statement of ethics and a position paper on privacy www.aprahome.org/advancement/index.html