|
|
|
|
|
| The law |
Refer to a lawyer |
Refer to an accountant |
| |
|
| |
1. How does the 1998 Act affect charities? |
| |
The 1998 Act applies to all data controllers and there are no special obligations or exemptions relating specifically to charities. Therefore, the extent to which a charity may be caught by its provisions (subject to the various exemptions) will be determined by virtue of the fact that it does or does not process personal data and not by virtue of its being a charity. |
 
| |
2. What exemptions might apply to charities? |
| |
There are no specific exemptions for charitable or non-profitmaking organisations and it is the responsibility of the organisation as a data controller to satisfy itself that certain exemptions apply. Many charities hold information about individuals. This might be in the form of mailing and membership lists, or details about volunteers, employees or beneficiaries. It is therefore advisable for all trustees to review what sort of personal information they hold, how they use it and who has access to it. They should then consider either seeking their own professional advice or contacting the Information Commissioner's Office (see section 3 of OG 58 A2) on the extent to which their charity is caught by the provisions of the 1998 Act. |
| |
The exemptions which might apply to a charity are those for mailing list purposes and for accounting purposes. Further details of these exemptions can be found in OG 58 B7 which sets out the transitional arrangements. |
| |
3. Do charities need to notify the Information Commissioner? |
| |
If a charity holds personal information about living individuals, unless all the processing of that data is covered by one or more of the exemptions, it will be required to notify to the Information Commissioner. |
| |
4. How do charities make their notification? |
| |
Any charity wishing to notify should telephone the Registration Department of the Information Commissioner's Office on 01625 545 740. The caller will be asked to state the broad nature of the organisation’s business. The caller should state that the data controller is a charity. A notification form designed to cover the likely purposes for which personal data are held by a charity will be sent to the charity. Those purposes might include: |
| |
- personnel/employee administration (which would also cover personal data relating to unpaid volunteers);
|
| |
|
| |
- membership administration;
|
| |
- charity and voluntary organisation objectives (this involves stating the objectives of the charity and setting out details of personal data held in relation to those objectives);
|
| |
- other consultancy and advisory services (this involves stating the general type of service or advice the charity provides).
|
| |
The form should be completed and returned with the appropriate fee. The standard fee is currently £35 per year. There is no reduced fee for charities. |
| |
The application for notification must be made in the name of the legal person (ie individual or body corporate) who controls the contents and use of a collection of personal data. Legal status of the organisation must be described by reference to its legal structure (ie trust, company limited by guarantee, charitable unincorporated association, as appropriate). "Registered charity" cannot be regarded as a description of the organisation’s legal status. |
| |
For legal and tax reasons, some charities set up a trading company. A trading company is a distinct legal person. If the trading company holds any personal data which is not exempt the trading company will be required to notify separately, even if it occupies the same premises, is run by the same staff as the charity and uses the same computers as the charity. The trading company is a separate legal person and therefore a separate data controller. |
| |
5. Telecommunications (Data Protection and Privacy) Regulations 1999 |
| |
Charity trustees who use direct marketing techniques will need to be aware of the Telecommunications (Data Protection and Privacy) Regulations 1999, which came into force on 1 March 2000 to coincide with the implementation of the Data Protection Act 1998. They relate to the protection of privacy and the use of personal data in the telecommunications sector. They also repeal and replace the Direct Marketing Regulations, which came into force on 1 May 1999. |
| |
These regulations prohibit the use of automated calling systems (ie those made without human intervention) for direct marketing purposes without the prior consent of the call’s recipient. They also prohibit the unsolicited use of fax communications for direct marketing purposes to corporate recipients, where they have specifically asked not to receive such calls, and to individuals, unless they have previously consented to the receipt of such calls. Charity trustees who use these direct marketing techniques should therefore ensure that their charity is acting in accordance with the regulations. |
| |
It may be the case that although a charity itself is not undertaking direct marketing it may employ a professional fund-raiser who uses these telesales methods whilst acting on behalf of the charity. We should therefore advise trustees to take steps to satisfy themselves that the fund-raisers they employ comply with these regulations. As a matter of good practice trustees might wish to consider including a reference to compliance with the 1998 Act and these regulations in fund-raising agreements. |
| |
6. Where can charity trustees go to for advice on their obligations under the 1998 Act? |
| |
Charity trustees may wish to seek advice from their professional legal advisors or from the Information Commissioner's Office, contact details for which can be found in section 3 of OG 58 A2. |
|