The last substantive changes to the code on data protection were made in March 2016. After reviewing the code over the summer, the Fundraising Regulator says it has identified that urgent updates are necessary.

These include issues identified in fixed penalty notices levied by the Information Commissioner’s Office (ICO) in 2016 and 2017 against a number of charities for breaches of the Data Protection Act, including wealth screening, data matching and tele appending and use of publicly available data.

It also reflects findings from a National Council of Voluntary Organisations (NCVO) working group in September 2016 into charities’ relationships with donors, including proposed guidelines on use of legitimate interest, and the need to bring the code up to date on data protection to take account of the GDPR and associated guidance ahead of 25 May 2018 when it becomes law.

The consultation seeks to update the code to mirror the GDPR requirements and to make the code as clear as possible about fundraiser’s duties in relation to data protection.

This includes sections covering the need to recognise the data protection implications and duties for any activity involving personal data and manage these adequately with individual, and to adequately inform individuals about how they will use their data.  Charities also need to have an appropriate basis for sending direct marketing to individuals, which includes holding clear, unambiguous and adequately evidenced consent where this is used as a basis for contact and review existing consents held.

The code outlines the standards expected of all charitable fundraising organisations across the UK. The regulator is seeking views on views on both the proposed changes and reordering of the code, and on how it can ensure any changes are communicated and implemented effectively.

The deadline for comments is 8 December.

Fundraising code consultation is here.

Report by Pat Sweet