Privacy and the Prospect Researcher

1
Privacy and Philanthropy
David Lamb Prospect Research Consultant Blackbaud
Analytics
2
Agenda

• Privacy as a key issue in philanthropy
• APRAs Privacy Position Paper
• Rules to live by
• Fiduciary relationship
• Ethical and legal guidelines
• Vendors must be legal and ethical
• Provide a privacy policy to reassure donors
• One step further a prospect research policy
• Case situations

3
Privacy troubles

• Personal information at risk
• April 22, 2008 Binghamton University notifies 11
  students and 120 applicants of theft of a laptop
  containing their names and SSNs
• Laptop belonged to a consultant implementing
  Banner
• Laptop also contained similar info on thousands
  of constituents at other institutions
• Incident highlights the danger of using SSNs as
  ID numbers
• Nonprofit Privacy Rights Clearinghouse reports
  that more than 225 million US citizens have had
  their private information exposed due to security
  problems since 2006
• Trouble in the prospect research world
• Stories reinforce unrealistic expectations
• People think youre a voyeur
• Irony for prospect researchers

4
APRA position on privacy

• Availability of information does not drive its
  collection nor supercede ethical use
• Follow federal, state and local laws
• Policies and procedures change with technology
  and law
• Vendors must be held to the same standard as
  ourselves
• Share information only when confidentiality is
  assured
• Search only for relevant information

5
APRA position on privacy (continued)

• Fundamental principles
• Protection of confidential information
• Accurate recording of all data
• Relevancy of the information
• Honesty in revealing our identities and purpose
• Accountable for our actions

6
Rules to live by

• Development professionals have a fiduciary
  relationship to prospects
• Actions of development professionals are limited
  by legal and ethical boundaries
• Development professionals must hold vendors to
  the same standard of conduct

7
Fiduciary

• One who obligates himself or herself to act on
  behalf of another (as in managing money or
  property) and assumes a duty to act in good faith
  and with care, candor, and loyalty in fulfilling
  the obligation-Merriam Webster Dictionary of Law

8
Rules to live by

• Development professionals have a fiduciary
  relationship to prospects
• Actions of development professionals are limited
  by legal and ethical boundaries
• Development professionals must hold vendors to
  the same standard of conduct

9
Ethical basis of privacy

• APRAs statement of privacy
• Record only relevant information
• Dont hide your identity or your purpose when
  requesting information
• Be an expert on the reliability of sources
• Present information clearly and objectively
• Clearly differentiate between known fact and
  speculation

10
Legal basis of privacy

• The right to be left alone
• Legally recognized forms of invasion
• The unreasonable intrusion on the privacy of
  another
• The appropriation of anothers name or likeness
• Unreasonable publicity given to anothers private
  life
• Publicity that unreasonably places another in a
  false light before the public

11
Laws impacting privacy issues

• Freedom of Information Act, 1966 (FOIA)
• Federal Education Rights and Privacy Act, 1974
  (FERPA)
• Health Insurance Portability and Accountability
  Act, 1996 (HIPAA)
• American Competitiveness and Corporate
  Accountability Act, 2002 (Sarbanes-Oxley)

12
Sarbanes Oxley and Nonprofits

• Assumption that, since nonprofits dont offer
  stock, SOX does not apply
• Two provisions apply to all corporations, for-
  and non-profit
• Protection for whistle blowers
• Document destruction
• Other provisions with obvious nonprofit
  implications
• Accounting transparency and independence
• Loans to executives

13
Rules to live by

• Development professionals have a fiduciary
  relationship to prospects
• Actions of development professionals are limited
  by legal and ethical boundaries
• Development professionals must hold vendors to
  the same standard of conduct

14
Working with vendors

• Commercial data brokers aggregate and organize
  data
• Thomson Financial
• Reuters Data
• Experian
• Dun Bradstreet
• ChoicePoint
• Most of what is collected by data brokers must be
  disclosed by the source
• Some of it is voluntarily disclosed
• Data brokers make the data easier to access

15
Laws that govern data brokers

• Fair Credit Reporting Act (FCRA)
• Sets rules for how consumer reporting agencies
  (such Experian, Equifax, and TransUnion) store,
  allow access to, and permit corrections to data
  that they collect on consumer credit
• Gramm Leach Bliley Act (GLBA)
• Includes provisions to protect consumers
  personal and financial information held at
  financial institutions

16
Fundamental principles behind data broker privacy
laws

• Ensure consumers have control over their
  information
• Establish guidelines for record use and release
• Set accountability guidelines for records use and
  release
• Balance public responsibility with privacy
  protections

17
Vendors must be legal and ethical

• Require vendors to demonstrate compliance with
  applicable laws
• Read the privacy and confidentiality statements
  provided by vendors
• Review with your counsel and ask for
  clarification or modification if necessary
• Monitor industry watchdog groups
• Electronic Privacy Information Center
  (www.epic.org)
• Charity Navigator (www.charitynavigator.org)

18
The upside to less privacy

• Benefits of databasification
• Privacy is traded for efficiency
• Privacy is not necessarily the ultimate goal of
  society
• If the common good can be served through
  disclosure, perhaps that is best
• Most thefts of personal data dont result in fraud

19
Its getting hot in the kitchen

• Does the act of prospect research present too
  great a risk?
• Why do we keep doing it?
• Ask the right person for the right gift
• Doing your homework
• Helping generous people do good things

20
Questions to ensure privacy

• Is it truthful?
• Is it relevant?
• Is it respectful?

21
Make a statement

• What information is collected?
• How will personal information be used?
• How will it be saved-protected-shared?
• Will information be sold or traded?
• Under what circumstances will prospects be
  contacted?
• Does self-disclosure imply consent?
• What other information may be collected?
• Give the donor the ability to opt out

22
A model statement The Nature Conservancy

• What info they collect
• How the NC uses your info
• Who the NC shares your info with
• How they protect info
• Opt-out

23
A prospect research policy

• From time to time we use publicly available data
  to help us raise private support more efficiently
  and to be better stewards of received donations
• Info only used for fundraising purposes
• All research must be approved by a responsible
  officer
• All research will be logged and reported
  periodically
• Access to resources used for prospect research
  will be limited to authorized personnel
• Access to research data will be limited to
  development office personnel
• Suitable measures will be taken to ensure the
  security of the data

24
Case Situations

• Would your organization ever do a criminal
  background check on a donor?
• Would your organization ever share data from your
  file on a donor with another nonprofit?
• Is email secure enough as a medium for
  transmitting donor/prospect data?

25
Resources

• Charity Navigator a watchdog group
  www.charitynavigator.org
• Privacy Rights Clearing House a privacy watchdog
  www.privacyrights.org
• Independent Sectors recommendations for
  nonprofit responses to SOX www.independentsector.o
  rg/issues/sarbanesoxley
• TRUSTe Model Privacy Policy www.truste.org/docs/Mo
  del_Privacy_Policy_Disclosures.doc
• TRUSTes Guide to writing an online privacy
  policy www.truste.org/pdf/WriteAGreatPrivacyPolicy
  .pdf
• Online Privacy for Nonprofits How to Protect
  Members' Privacy and Personal Information
  www.privacyrights.org/fs/fs28-nonprofits.htm
• Good examples
• Nature Conservancy nature.org/aboutus/misc/
• Minnesota Public Radio minnesota.publicradio.org/
  about/site/privacy/
• This link to advancement research standards on
  the web site of the Association of Professional
  Researchers for Advancement has several items of
  interest, including the APRA statement of ethics
  and a position paper on privacy
  www.aprahome.org/advancement/index.html