FUNDRAISING STANDARDS BOARD STAGE 3 ADJUDICATION REPORT

(1)

Fundraising Standards Board 65 Brushfield Street London E1 6AA t. 0333 3218803 e. [email protected] www.frsb.org.uk twitter: @thefrsb

FUNDRAISING STANDARDS BOARD STAGE 3

ADJUDICATION REPORT

Case Number: W20150311-FS02044

Respondent: Breast Cancer Campaign/Insight CCI Limited

Complaint: The complainant believes that their Telephone Preference Service (TPS) registered telephone number was used unlawfully for marketing purposes by Insight CCI Limited making fundraising calls on behalf of Breast Cancer Campaign. The complainant maintains that they have never given permission for the charity to contact them and does not understand how their number ended up in the possession of Insight CCI.

Potential Breach(s):

a) Potential breaches of Section L14.0 (Data Protection) of the Institute of Fundraising’s Code of Practice (IOF Code). Namely;

L14.5.2 ((a) iv): “Personal data shall be accurate and kept up to date” L14.5.3 (a): “Data must be processed fairly.”

b) Potential breach of Section 1.2 (c) (General Principles) of the IOF Code which states that “Organisations OUGHT NOT to exaggerate facts relating to the potential beneficiary.” c) Potential breaches of Section 8.0 (Telephone Fundraising) of the IOF Code. Namely;

8.2.2: “The following categories of potential telephone recipients MUST be excluded; all those who have registered with the Telephone Preference Service.

8.3.1 (b): “If the telephone call is first contact with a donor, the caller OUGHT to ask if the recipient consents to being contacted at that time. If the recipient asks not to be called again, the fundraising organisation MUST comply with the request.”

(2)

1. STAGE 1 SUMMARY

1.1 The complainant initially contacted Breast Cancer Campaign on the 24th of November 2014 to inform the charity that they had received a “cold call” from a telephone fundraiser and requested information on its telephone fundraising policy and how it had obtained their contact details.

1.2 Breast Cancer Campaign initially responded to the complainant by telephone to confirm that it had contacted them because they had expressed interest in hearing from the charity whilst answering questions during a telephone based lifestyle survey. The complainant confirmed that they did not recall taking part in such a survey and Breast Cancer Campaign referred the complainant to its third party telephone fundraising supplier Insight CCI to investigate.

1.3 Insight CCI responded to the complainant by email on the 26th of November 2014. In that response, the agency confirmed that it uses either “warm” data (contact information pertaining to an individual who has or is supporting the charity in question) or “Opt in” data (contact information pertaining to a household in which someone has agreed to be contacted by a particular organisation and thereby overriding TPS registration).

1.4 Insight CCI confirmed that it had listened to the call it had made to the complainant and accepted that the fundraiser had not confirmed that the person they were speaking to was the “named person” on the data that it held and apologised. The agency also confirmed that it had added the complainant to its “never call” list.

1.5 Insight CCI also provided the complainant with details of the “data supplier” (PDV Limited) who it works with to obtain “leads” and who provided the agency with the complainant’s telephone number. Insight CCI encouraged the complainant to contact PDV directly and provide their telephone number so that it could “suppress the details

and stop the data being passed to other organisations.”

1.6 The complainant emailed PDV Limited on the 26th of November asking the company to clarify why their telephone number had been shared with Insight CCI.

1.7 PDV Limited responded on the 28th of November 2014 to confirm it had supplied the complainant’s number to “two selected clients” after it had been supplied to them by a company called Dynaxon IT Services. Dynaxon (based in India) had conducted the telephone survey designed to create “opt in” leads for a variety of charities and commercial companies; among which was Breast Cancer Campaign.

(3)

1.9 PDV Limited confirmed that it had now taken steps to ensure that the complainant’s details would not be used by any third party and that the suppression would take 14 days to become active.

1.10 The complainant subsequently got back in touch with Breast Cancer Campaign to share their concerns about the manner in which the charity had obtained their phone number. 1.11 Breast Cancer Campaign responded on the 1st of December expressing regret that the complainant did not seemingly approve of telephone fundraising and confirming that, in its view, TPS legislation had not been breached due to the fact that someone in the complainant’s home had agreed to be contacted.

1.12 The complainant responded on the same day to reassert their view that it was inappropriate for Breast Cancer Campaign to obtain data from companies operating outside of the UK who are not subject to the Data Protection Act and TPS rules. In addition, the complainant stated that no-one in their home had given permission to be contacted by representatives of Breast Cancer Campaign.

1.13 Breast Cancer Campaign responded with a referral to the FRSB before it had been through all stages of its own publicly available complaints policy.

1.14 The complainant contacted the FRSB on the 2nd of December 2014 to request its intervention and the complaint was escalated to Stage 2 of the FRSB complaints process.

2. FRSB EXECUTIVE STAGE 2 ASSESSMENT

2.1 As part of the Stage 2 investigation, the FRSB listened to the call made by Insight CCI on behalf of Breast Cancer Campaign, requested a recording of the lifestyle survey call that led to the complainant’s number being used for telemarketing purposes and reviewed the correspondence that had passed between all parties to date.

2.2 Based on that information, the FRSB secretariat concluded that there may have been a breach of Principle 4 of the Data Protection Act as summarised in Section L14.5.2 of the Institute of Fundraising Code of Practice which states that “Personal data shall be

accurate and up to date.”

2.3 The FRSB also concluded that there was a lack of clarity between the parties involved as to who was taking ownership and ultimate responsibility for the complaint.

3. STAGE 2 RESOLUTIONS ATTEMPTED

(4)

person at the start of the call; ascertaining this information at the start of a call is standard practice in the context of telephone fundraising calls.

3.2 In addition, the FRSB secretariat felt that the complainant’s concerns could have been more appropriately managed by Breast Cancer Campaign and Insight CCI at Stage 1; particularly in relation to the fact that the complainant was passed between PDV, Dynaxon, Breast Cancer Campaign & Insight CCI which only served to cause them confusion and additional frustration and demonstrated that there was a lack of appropriate complaint management on the part of both FRSB members (Breast Cancer Campaign and Insight CCI).

3.3 The FRSB secretariat continued to liaise with Breast Cancer Campaign about obtaining a recording of the call made by Dynaxon and the charity confirmed that it had made several requests via Insight CCI to obtain a copy. The FRSB sent a holding response to the complainant on the 19th of December 2014, making them aware of the fact that it was waiting for some additional information before it could provide a comprehensive response.

3.4 The FRSB secretariat continued to press Breast Cancer Campaign for a recording of the lifestyle survey. On the 21st of January 2015, Breast Cancer Campaign confirmed by telephone that Dynaxon was reluctant to share a full recording of the call due to concerns that doing so may constitute a breach of the Data Protection Act. However, a partial recording of the lifestyle survey call was provided to the FRSB by the charity during which a woman answered and confirmed that she was the individual that was later named during the course of the investigation by both Dynaxon and PDV Limited as having been the recipient of that call. Insight CCI sent an email to the FRSB later that day outlining the difficulties it had encountered whilst attempting to obtain the recording. 3.5 Upon receipt of this email, the FRSB secretariat sought advice from the Information

Commissioner’s Office (ICO). It confirmed that in sharing the recording Dynaxon would not be in breach of the Data Protection Act due to the fact that the FRSB was a legitimate regulatory body and would only be using the recording for complaint resolution purposes.

3.6 This information was shared in writing with Insight CCI who then forwarded it to PDV Limited for their response. PDV contacted the FRSB secretariat by email on the 26th of January 2015 to confirm that it was its understanding that the complainant and the individual who had taken part in the original lifestyle survey call were part of the same household and therefore had the same telephone number.

3.7 PDV confirmed that due to the fact that it had acted as a “broker” in this instance, it did not have any further details to share.

(5)

knowledge of the individual with whom PDV claimed they allegedly share their household telephone number with.

3.9 The FRSB secretariat responded to the complainant on the 29th of January to confirm that it wished to discuss potential next steps with the FRSB’s Chief Executive. During that discussion, it was agreed that it would be appropriate to seek further clarification from PDV Limited regarding the complainant’s assertion that they did not share their household or telephone number with this individual. The FRSB secretariat also concluded that it was important to make the complainant aware of the FRSB’s and IOF Code’s remit and highlight the fact that the issue of charities using data that had been gathered by companies outside of the EU was not currently covered by the Code. 3.10 The FRSB emailed PDV Limited on the 5th of February 2015 to share the complainant’s

assertion that they did not share their household or telephone number with the individual named by PDV and Dynaxon. PDV responded on the 6th of February to confirm that Dynaxon’s call had been answered by this named individual and that they had taken the number in “good faith”.

3.11 The FRSB responded on the 9th of February and asked PDV to confirm what role the company had in sharing the telephone number, whether or not Dynaxon was abiding by TPS regulations even though it is not based in the EU and whether it was intending to carry out further investigations to determine what had gone wrong.

3.12 PDV responded on the 10th of February to confirm that it had simply acted as a “list broker” between Dynaxon and Insight CCI and that Dynaxon would be getting in touch to summarise the outline of its investigation into the incident. In addition, it confirmed that Dynaxon does ensure that the data it uses is either “fully opted in and/or has been cleaned against the TPS register.

3.13 A summary of Dynaxon’s investigation was provided by PDV on the 16th of February 2015 confirming that Dynaxon had carried out an investigation and was “at a loss” to explain what had happened.

3.14 The FRSB emailed the complainant on the 19th of February 2015 with an update and, ultimately, the complainant requested a Stage 3 adjudication on the 21st of February.

4. FRSB BOARD ASSESSMENT

The FRSB Board considered the complaint within the context of Section L14.0 (Data Protection) and Section 8.2 of the IOF Code.

OUTCOME

(6)

In addition, the Board reached several preliminary findings regarding potential breaches of the Data Protection Act and Privacy and Electronic Communications (EC Directive) Regulations 2003 but concluded that it would be appropriate to refer the case to the ICO which would have ultimate authority in determining whether those breaches have taken place.

4.1 Section 1.2 (c): “Organisations OUGHT NOT to exaggerate facts relating to the potential beneficiary.”

OUTCOME: UPHELD

The FRSB Board noted that Insight CCI’s fundraiser had expressed a personal opinion during the call to the complainant that the current breast cancer survival rate of 85% was “mainly due” to Breast Cancer Campaign’s breast tissue banks. The Board was of the view that this statement could not be accurately substantiated, thereby constituting an exaggeration and, in turn, a breach of the clause.

4.2 Section 8.2.2: “The following categories of potential telephone recipients MUST be

excluded; all those who have registered with the Telephone Preference Service.”

OUTCOME: REFERRAL TO ICO

The FRSB has concerns that Section 8.2.2 of the Code may have been breached. During the adjudication, it was noted that an individual’s registration with the Telephone Preference Service can be overridden if that individual opts in to receive contact from specific organisations.

Based on the recording of the lifestyle survey call that was supplied to the Board, it was concluded that the call handler may not have secured an appropriate “opt in” from the recipient. This is because, at the opt in stage of the call, the call handler does not specify any particular organisations, but instead offers the call recipient to opt into contact from Dynaxon’s “affiliates”.

4.2 Section 8.3.1 (b): “If the telephone call is first contact with a donor, the caller OUGHT to

ask if the recipient consents to being contacted at that time. If the recipient asks not to be called again, the fundraising organisation MUST comply with the request.”

OUTCOME: UPHELD

The FRSB Board concluded that Insight CCI’s call to the complainant breached the OUGHT requirement of this clause as the fundraiser did not ask the complainant if they consented to being contacted at that time.

(7)

The Board has concerns that this principle of the Data Protection Act may have been breached due to the fact that the recipient of the lifestyle survey call appears to have no association with the complainant.

4.4 Section L14.5.3 (a): “Data MUST be processed “fairly” OUTCOME: REFERRAL TO ICO

Based on what the Board was informed was a partial recording of the lifestyle survey call it has concerns that the recipient of that call may have been misled as to the purposes for which their data was to be processed.

It was noted that the call handler conducting the survey states that the recipient’s details may be shared with the company’s “affiliates” but, based on the supplied recording, the call handler does not identify who those affiliates will be. As such, the FRSB concluded that the recipient of the lifestyle survey call may not have been treated “fairly” as defined by the Data Protection Act.

4.5 By way of a general comment, the FRSB Board considers that Breast Cancer Campaign should have taken ultimate responsibility for the campaign that was being delivered in its name and that it had failed to appropriately demonstrate that responsibility in its responses to the complainant.

5. FRSB BOARD RECOMMENDATIONS

5.1 The FRSB Board recommended that the FRSB Chief Executive contact both Breast Cancer Campaign and Insight CCI to make them aware of its findings. The FRSB has since met with both organisations to discuss the adjudication outcome and has been encouraged by their joint commitment to making improvements going forward.

5.2 The FRSB Board requested that the FRSB refer the case to the Information Commissioner’s Office for their investigation so that it can ultimately determine whether or not breaches of the Data Protection Act and Privacy & Electronics Communications Regulations have taken place.