Among the Third Sector it appears common practise to utilise the National Change of Address (NCOA) database managed by Royal Mail to ascertain new contact details of their supporters.
However, after a recent paper published by the Information Commissioner’s Office on ‘Fundraising and Regulatory Compliance’, we wanted to gain clarity on whether using the NCOA actually goes against the Data Protection Act 1988 (DPA).
The paper discussed all aspects of the DPA relevant to charities and fundraising organisations covering its stance on wealth screening, re-using publicly available information, how the ‘legitimate interest’ condition applies to processing, fair processing notices and how the Fundraising Preference Service (FPS) and the Telephone Preference Service (TPS) interact.
Our cause for confusion arose around the section dedicated to Data Matching and Teleappending, which are activities involved in “obtaining personal data from other sources which individuals did not give you when you initially collected their personal information.”
This suggests that using a third party, such as Royal Mail, to ascertain a supporter’s new address after they’d moved to a new house would be going against the DPA.
The paper goes on to provide examples of wrong doing:
After contact with the Fundraising Regulator, we have gained clarity on what charities and NFPs need to know about NCOA and the DPA. A Standards Officer at the Fundraising Regulator has confirmed:
“If the individual, of their own volition, instructs Royal Mail to redirect all of their personal mail via this service, there is no problem with a charity acting on this request and using the new details”
In summary, charities and NFPs can use data for Data Matching and Teleappending if they are satisfied that the source is legitimate and the supporter has made it clear, by ticking a box or some other positive action that they wanted to inform third parties of the change of address.
To conclude, charities and other fundraising organisations can utilise Royal Mail’s NCOA service to ascertain new contact details of the supporter, if they have opted-in for you to do so via a third party when submitting their new personal information.
Charities and NFPs must only use the data that they already had permission for, i.e. if the charity had a supporter’s postal address and are provided with confirmation of the supporter’s new address, that is fine. If the charity also receives an email address when the supporter moves home that they did not previously have, they would need to gain permission from the supporter to use this new method for communication or direct marketing.
If you have any questions or comments relating to the Fundraising Regulator’s Conference Paper and how this relates to the data management within your organisation, please get in touch.