{"id":37133,"date":"2023-09-27T23:00:00","date_gmt":"2023-09-28T03:00:00","guid":{"rendered":"https:\/\/www.cccc.org\/news_blogs\/?p=37133"},"modified":"2023-09-27T09:08:48","modified_gmt":"2023-09-27T13:08:48","slug":"trading-donor-lists-make-sure-donors-consent","status":"publish","type":"post","link":"https:\/\/www.cccc.org\/news_blogs\/legal\/2023\/09\/27\/trading-donor-lists-make-sure-donors-consent\/","title":{"rendered":"Trading Donor Lists? Make Sure Donors Consent!"},"content":{"rendered":"\n

The Office of the Privacy Commissioner of Canada<\/a> (OPC) found a charity did not comply with privacy requirements when it traded donor lists. The charity relied on opt-out consent to share donor contact information with other charities but this did not meet the standard of meaningful consent that is required under privacy legislation.<\/p>\n\n\n\n

Background<\/h2>\n\n\n\n

On September 19, 2023, the OPC published findings from a 2021 complaint<\/a> about a charity that traded donor contact information with another charity.<\/p>\n\n\n\n

The donor regularly gave to Charity A using a paper form. The donor received a request for donations from Charity B in the mail. Charity B confirmed that it received the donor\u2019s name and mailing address from Charity A. The donor looked at Charity A\u2019s form and found an opt-out checkbox for donors who \u201cprefer not to have [their] name traded with other organizations.\u201d The donor complained to Charity A. After a long delay, Charity A responded but the donor was unsatisfied and filed a complaint with the OPC.<\/p>\n\n\n\n

Charity A argued that trading donor information was necessary to fulfill its objectives, that trading \u201cis a long-standing, widely used practice among not-for-profit organizations,\u201d that participation is voluntary, that the donation form\u2019s check-boxes are few and are clear, and that donors can opt-out.<\/p>\n\n\n\n

Using its Guidelines for Obtaining Meaningful Consent<\/a>, the OPC concluded that by relying on opt-out consent to share donor contact information with other charities, Charity A did not obtain meaningful consent as required by the Personal Information Protection and Electronic Documents Act<\/a> <\/em>(PIPEDA).<\/p>\n\n\n\n

The OPC made several findings and compliance recommendations.<\/p>\n\n\n\n

Findings<\/h2>\n\n\n\n

Information Not Sensitive, No Risk of Significant Harm<\/h3>\n\n\n\n

The information shared was not sensitive, nor did the sharing create a risk of significant harm to the donor.<\/p>\n\n\n\n

But the OPC emphasized that sensitivity of information is context-specific. For example, the nature of a charity could infer sensitive information about a donor, particularly if the charity represents specific interests or supports marginalized groups (e.g. religious beliefs, health conditions, criminal history).<\/p>\n\n\n\n

\n

Takeaway: <\/strong>ensure you take the nature of your charity into consideration when assessing whether a donor\u2019s name and address could be sensitive.<\/p>\n<\/blockquote>\n\n\n\n

Donor\u2019s Reasonable Expectations Not Met<\/h3>\n\n\n\n

Sharing the donor\u2019s information requires express consent because such sharing falls outside the donor\u2019s reasonable expectations.<\/p>\n\n\n\n

The OPC accepted that trading donor lists may be common practice, but common practice does not dictate donors\u2019 reasonable expectations. Donation processing or sending tax receipts fall within donors\u2019 reasonable expectations as to why their information may be disclosed, but donors would not expect disclosure for \u201cthe secondary purpose of enabling third parties to solicit donations\u201d.<\/p>\n\n\n\n

Further, where \u201cthe act of donating to charity is a private matter (e.g. for religious reasons) [donors] would not expect that their personal information [would] be disclosed in this manner.\u201d<\/p>\n\n\n\n

\n

Takeaway:<\/strong> put yourself in the donor\u2019s shoes and ask what you would reasonably expect. In other words, apply the golden rule!<\/p>\n<\/blockquote>\n\n\n\n

Charity Did Not Provide Sufficient Information to Support Meaningful Consent<\/h3>\n\n\n\n

The charity had not provided sufficient information to support meaningful consent.<\/p>\n\n\n\n

The OPC cited various sections of PIPEDA to determine whether the charity provided enough information to the donor to meet the standard of meaningful consent.<\/p>\n\n\n\n