Frequently Asked Questions Regarding Charitable Fundraising & The Personal Information Protection and Electronic Documents Act (PIPEDA)

Transcription

1 Frequently Asked Questions Regarding Charitable Fundraising & The Personal Information Protection and Electronic Documents Act (PIPEDA) On January 1, 2004, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) came into force for all organizations across Canada. This guide is intended to help answer some of the more common questions that charities and professional fundraisers are asking about PIPEDA and its requirements. A glossary of useful website links is available at the end of the questions. This document was prepared by a privacy working group of national fundraising and charity organizations, including the Association for Healthcare Philanthropy (AHP), the Association of Fundraising Professionals (AFP), the Association of Professional Researchers for Advancement (APRA), and the Canadian Centre for Philanthropy (CCP). Legal Disclaimer: The resource material provided in this document and the accompanying appendices is for general information purposes only. The material reflects interpretations and practices regarded as valid as of the date the document was released based on available information at that time. The material is not intended, and should not be construed, as legal advice or opinion nor is it intended to be endorsed as lawful practice. Organizations concerned about the applicability of privacy legislation to their activities are advised to seek legal advice based on their particular circumstances. FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 1

2 QUESTION #1: Does my charity have to comply with PIPEDA? ANSWER #1: PIPEDA s requirements are not based on the type of organization, but on the type of transaction. PIPEDA covers cover the collection, use or disclosure of personal information in the course of any commercial activity within a province, including provincially regulated organizations. The definition of commercial activity is any particular transaction, act or conduct or any regular course of conduct that is of commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. The majority of fundraising functions conducted by a charity are exempt from the requirements of PIPEDA. However, charities will be affected if they sell, barter, or lease their donor lists, or engage in other commercial activities. Charities should examine the kinds of activities they engage in and how they use the information they collect on donors and other individuals. QUESTION # 2: So if PIPEDA only slightly affects my organization, why is there all this concern about PIPEDA in the charitable sector? ANSWER #2: Even if your organization doesn t engage in any commercial activities as defined in PIPEDA, there are a couple of important reasons why it should take the issue of privacy seriously. First, PIPEDA is and will be the starting point for provinces that introduce their own privacy legislation. So even if your organization isn t affected by PIPEDA that much, additional provincial legislation is either on its way or already here (Quebec, Alberta and British Columbia all have their own provincial privacy laws). Second, the increasing number of privacy laws is in response to the public demand for greater privacy. The public is expecting that organizations will use their private information appropriately and respectfully (if they use it at all). Simply because PIPEDA doesn t significantly affect your organization does not mean that donors and others will not be expecting you to have privacy policies and procedures in place. While the government may make a distinction between commercial and non-commercial activities, your average donors probably doesn t. Ignoring PIPEDA and other privacy laws sends the message to the public that your organization doesn t respect their privacy wishes. Organizations should develop privacy policies and analyze how private information is being used and for what purposes. The document Privacy 101: A Guide to Privacy Legislation for Fundraising Professionals contains useful information on developing a privacy policy and beginning the privacy conversation in your organization. It can be found on the association websites listed at the end of this document. FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 2

3 QUESTION #3: How does PIPEDA interact with provincial privacy legislation? ANSWER #3: If the provincial privacy law has been ruled to be substantially similar to the federal law by the Privacy Commissioner of Canada, then the provincial law supercedes the federal law. (That is, the organization only has to comply with the provincial bill.) However, if the provincial law in question is NOT considered to be substantially similar to PIPEDA, then organizations operating in that province must comply with both the federal and provincial laws. If the province in question does not have a specific privacy bill, then PIPEDA must be complied with. At this time, only Quebec s privacy law has been deemed substantially similar to the federal law. Thus, if fundraising in Quebec, charities need only have to comply with the Quebec law. In all other provinces, both the federal and provincial bills must be complied with. So, for charities operating in British Columbia and Alberta, you must follow both the provincial and federal legislation. In Quebec, it is only the provincial legislation. And, in Ontario it is federal legislation only at this point. If passed, Ontario s draft Bill 31 Health Information Protection Act is scheduled to take effect July 1, QUESTION #4: Where can I find out about these provincial privacy laws and bills? ANSWER #4: This information is contained in Fundraising and Privacy: Complying with Federal and Provincial Laws. This document provides overviews of all current federal and provincial privacy laws and requirements. You can obtain a copy of the document at the websites listed at the end of this document. QUESTION #5: What does PIPEDA require my organization to do? ANSWER #5: If your organization gathers, uses and/or discloses information for commercial activities, then it must get consent from individuals before gathering information about them. Consent can be express or implied, and can be oral or written. Consent must also be received for each specific activity for which you intend to use the information. FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 3

4 Make a list of what information you need to gather for each specific commercial activity. This is the information for which you need to get consent from each individual. You don t have to get consent for each single piece of information. Obvious items can be grouped together, but organizations should keep in mind that PIPEDA uses the reasonable person test. If your organization indicates that it might gather contact information about donors, it wouldn t be reasonable for that information to include data about their volunteer activities or education background. QUESTION #6: Does PIPEDA require an opt-in mechanism, or can I continue to use an opt-out check-off box? ANSWER #6: In general, charities can continue to use an opt-out check-off box. The opt-out mechanism must be clear and easy for an individual to use. For more information, consult the Privacy Commissioner of Canada s web site at QUESTION #7: What if my organization already has an individual's consent to gather information about him or her, or if the organization already routinely allows individuals an opportunity to opt-out? Under PIPEDA, do I need to obtain individuals permission all over again? ANSWER #7: The answer depends on how your organization is planning to use the personal information it has already collected. For example, if your organization will continue to use the personal information for the original purposes for which you collected it, PIPEDA does not requires you to re-consent your donors. However, PIPEDA requires organizations to obtain consent for new uses of personal information. Best privacy practices also support this requirement. Charities should examine any new uses of personal information they may be contemplating in the future. For example, if a charity has informed its donors that it does nor rent, trade or sell its donor lists, and it then decides it wants to trade its donor lists or merge its lists with those of another organization, then the charity should inform donors of this activity and give them a meaningful opportunity to opt out. FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 4

5 QUESTION #8: Are there any exceptions to the consent rule? Is there any information I can gather about an individual without first getting consent? ANSWER # 8: Yes. Personal information under PIPEDA is defined as information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization. In addition, the regulations accompanying PIPEDA list several key sources of public available information from which charities can gather data without first getting consent. These include personal information consisting of the name, address and telephone number of a subscriber that appears in a telephone directory that is available to the public, where the subscriber can refuse to have the personal information appear in the directory. In addition, personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information, is okay. Your organization should only collect the personal information that is necessary to fulfill your stated purposes and is to be used in the near future. When in doubt, consider what type of information a reasonable person would expect your organization to collect and use for your each of your fundraising activities. QUESTION #9: How should my organization treat personal information used for planned giving? ANSWER #9: PIPEDA does not address specifically the issue of planned giving. However, there are best practice guidelines your organization should consider. Best practice guidelines recommend that all personal information, especially sensitive personal information, should be treated with the utmost of care. Consult your organization s privacy or security policy for information on the appropriate safeguards for protecting personal data. Information for planned giving is usually self-presented by the donor and should be noted appropriately as such in the file. Your organization may also retain planned giving information under a separate, centrally managed filing system with strict access controls (e.g. individuals must sign-out files and only certain individuals may be authorized to access the files). QUESTION #10: Stewardship Can my organization continue to publish donor lists? ANSWER #10: Again, PIPEDA does not address specifically this issue. However, there are best practice guidelines your organization should consider. FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 5

6 Best practice guidelines recommend that when thanking a donor, your organization should include information that his or her gift will be recognized within a specific range and mention the type of vehicle in which it will appear (e.g. newsletter). Include an opportunity to opt-out in the thank you letter. You may also want to consider whether your organization will publish donor names on its website without express consent since the Internet offers such a potentially wide audience. QUESTION #11: Under PIPEDA, can a charity continue to print the names of those individuals that they have received bequests from in their donor newsletters without permission from the deceased individual's estate? ANSWER #11: It is the opinion of the privacy working group that the printing of donor names from bequests is not a commercial activity, and, therefore PIPEDA does not apply in this circumstance. Charities should exercise best privacy practices in the absence of provincial privacy legislation or the applicability of PIPEDA in this area. If possible, charities should try to inform the executor or the next of kin about their intent to publish a donor s name. QUESTION #12: My organization doesn't have a check off box if online donors want future correspondence. Does this mean my organization is prohibited from soliciting past online donors who were never given the option to say whether they wanted future correspondence or not? ANSWER #12: Again, charities should consider the reasonable person test. Charities who have already received online communications or donations from individuals or who have corresponded with donors online can reasonably assume that these donors have already consented to the collection, use and disclosure of their personal information by virtue of their previous activity. Many charities have not communicated with their donors by , and would like to solicit them or correspond with them in this manner in the future. Charities are advised to solicit donors through only if they have invited donors to support similar programs through other means (e.g. telephone, mail). In this case, it would be reasonable for a donor to receive electronic communications from your organization. However, it is recommended that donors be given the option to opt out of online communications. Here is a sample opt-out clause for an solicitation: "You have been a generous supporter of the XXXXX with a past online donation. We want to thank you for your past generosity and we also want to ask you if you're willing to receive future electronic correspondence from the XXXXXX. If you don't want to receive fundraising appeals from us in the future, please send a message to FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 6

7 with the word "unsubscribe" in the subject line. For more information about our privacy practices, contact [insert appropriate web address and name and contact information for your organization s Privacy Officer]" QUESTION #13: Under PIPEDA, can I continue to collect and use information to prepare call reports? ANSWER #13: PIPEDA does not specifically address this circumstance. However, there are best practice guidelines your organization should consider. For example, when talking to a donor or prospect during a call, your organization should ask him or her for permission to take notes and to retain the information in the donor s or prospect s secure, confidential file. Note the permission in the file. Your organization can also remind the donor or prospect that he or she has the right to access his or her own file. Self-presented information is acceptable as long as it is documented in the file. Make sure your organization presents observational notes in a way that would not be offensive to the donor or prospect if he or she were to read their file at a later date. QUESTION #14: Under PIPEDA, can volunteers still provide names for event mailings and campaigns? ANSWER #14: The privacy working group believes that these instances do not fall under the definition of "commercial activity" (as it relates to PIPEDA), in which case you are not bound by the legislation for this activity. However, it is strongly recommended that charities employ a "best practice" approach to the collection, use and disclosure of personal information for all information-handling activities. For example, charities should ensure that the first contact with prospects includes a straightforward opt-out after receiving a tip or a lead from a volunteer. Also, event mailing lists must never be sold, rented or traded without express consent. PIPEDA and other provincial privacy laws apply to volunteers if volunteers have access to personal information. Charities cannot assume that volunteers are exempt from privacy requirements simply because volunteers are not employees or contractors of your organization. The same is also true of other individuals who may not have employee status, but who still may have access to personal information, such as students, researchers, physicians, consultants or third party suppliers. FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 7

8 USEFUL LINKS: Privacy Commissioner of Canada: Industry Canada Q & A list on PIPEDA: (The Industry Canada Q&A list is highly recommended. Although directed at healthcare fundraisers, most of the questions and answers can be applied to all categories of charities and fundraising.) The privacy working group s other documents (note, there is some duplication between the two FAQs documents and we encourage members to review both if in doubt): Privacy 101: A Guide to Privacy Legislation for Fundraising Professionals and Not-for-Profit Organizations in Canada Frequently Asked Questions About Ontario Bill 31 And PIPEDA Fundraising and Privacy: Complying with Federal and Provincial Laws can be found at member websites: o APRA Canada: o AFP International: o AFP Toronto: o AHP Canada: (click on the What s New? link) o CCP: FAQs Charitable Fundraising and PIPEDA (Jan. 04) Page 8