Evidence base for letter to universities re wealth screening

The request was partially successful.

Dear Information Commissioner’s Office,

I understand that you wrote to a number of universities in October 2018 about what you call wealth screening. This request concerns the factual basis for some of the assertions you have made in the letter to universities.

1. You state on page 1: "Wealth screening raises privacy concerns because it is the kind of processing that individuals are unlikely to expect as a result of providing their personal data to a university..."

Please provide details of the evidence that ICO has used to come to this conclusion. Has it carried out research amongst donors and / or alumni of universities to ask whether this is the case?

2. You also state "Even when individuals make a charitable donation, they would not reasonably expect the organisation to profile their wealth to see whether they are likely to increase their donations or leave a legacy donation."

In response to a request I made to you on 17 Feb 2017 after you made a similar assertion in a conference paper, you said that you had "no specific evidence base" for making this claim.

Please explain whether or not the ICO has carried out any research to support this assertion since that time, and if not, please explain on what basis ICO continues to make this unsubstantiated claim, especially in the light of a) the Daily Mail articles which gave rise to your letter which substantially raised public awareness of wealth screening and 2) the delivery of privacy notices by a number of universities explaining this in some detail in response to which there has been a vanishingly small rate of objection.

3. On page 3 you say "Wealth screening is a separate and distinct activity that requires its own lawful basis for processing."

If ICO believes wealth screening is so different from fundraising that it is a separate and distinct activity, please explain what purpose ICO believes wealth screening serves if it is not fundraising.

Yours faithfully,

Luscinda Smith

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

1 November 2018

 

Case Reference Number IRQ0798121

 

Dear L Smith

Thank you for your recent request for information. We received your
request on 29 October.
 
We will be considering your request under the Freedom of Information Act
2000. You can expect us to respond in full by 26 November. This is 20
working days from the date we received your request. If, for any reason,
we can’t respond by this date, we will let you know and tell you when you
can expect a response.
 
If you have any questions please contact me using the IRQ case reference
number above or by replying to this email and leaving the subject field
unchanged.
 
Thank you for your interest in the work of the Information Commissioner's
Office.
 
Yours sincerely 
 

Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [3]privacy
notice

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

20 November 2018

Case Reference Number IRQ0798121

Dear L Smith

Thank you for your recent request for information. We received your
request on 29 October.
 
We have considered your request under the Freedom of Information Act 2000.
 
Your request
 
‘This request concerns the factual basis for some of the assertions you
have made in the letter to universities.
1. You state on page 1: "Wealth screening raises privacy concerns because
it is the kind of processing that individuals are unlikely to expect as a
result of providing their personal data to a university..." Please provide
details of the evidence that ICO has used to come to this conclusion. Has
it carried out research amongst donors and / or alumni of universities to
ask whether this is the case?
2. You also state "Even when individuals make a charitable donation, they
would not reasonably expect the organisation to profile their wealth to
see whether they are likely to increase their donations or leave a legacy
donation." In response to a request I made to you on 17 Feb 2017 after you
made a similar assertion in a conference paper, you said that you had "no
specific evidence base" for making this claim. Please explain whether or
not the ICO has carried out any research to support this assertion since
that time, and if not, please explain on what basis ICO continues to make
this unsubstantiated claim, especially in the light of a) the Daily Mail
articles which gave rise to your letter which substantially raised public
awareness of wealth screening and 2) the delivery of privacy notices by a
number of universities explaining this in some detail in response to which
there has been a vanishingly small rate of objection.
3. On page 3 you say "Wealth screening is a separate and distinct activity
that requires its own lawful basis for processing." If ICO believes wealth
screening is so different from fundraising that it is a separate and
distinct activity, please explain what purpose ICO believes wealth
screening serves if it is not fundraising.’
 
 Our response  

 1. There is no specific “evidence” held by us. Our work was focused on
the practices of Universities and what the law says. The GDPR requires
organisations to process personal data lawfully, fairly and in a
transparent manner.
 
 2. There is no specific “research” held by us. You will be aware that the
practice of wealth screening was a factor in our decision to issue
monetary penalties to both the RSPCA and the British Heart Foundation.
Our investigations identified that donors were not provided with
sufficient information by these charities to enable them to understand
what would be done with their personal data.

The charities fair processing information, which is usually included
within privacy notices, should have provided information on this. The fact
that it didn’t meant that donors could not have reasonably expected this
type of processing of their personal data and they could not therefore
make an informed decision and exercise their rights over their personal
data.
 
Goal 4 of the Information Commissioner’s Office (ICO) Information Rights
Strategic Plan 2017-21 is ‘to increase the public’s trust and confidence
in how data is used and made available’.
 
The ICO has commissioned ‘Information Rights Strategic Plan: Trust and
Confidence’ research which you may find of interest.
[1]https://ico.org.uk/media/about-the-ico/d...
 
The main aim of this research is to gauge public perceptions and awareness
on how data is shared and used within organisations and to monitor any
change in the trust and confidence in how data is used and made available.
 
When asked if they agreed or disagreed with the following statement:
‘Q5. Do you agree or disagree with the following statements about the use
of personal information in the UK?
Businesses / organisations are open and transparent about how they collect
and use personal information’
66% of people surveyed disagreed with this statement.
 

 3. The GDPR requires data controllers to be transparent with individuals
about how their information will be used. It sets out the information
data controllers should supply and when individuals should be
informed. Individuals have the right to be informed about the
collection and use of their personal data.

 
Data controllers must have a valid lawful basis in order to process
personal data. In accordance with the GDPR there are six available lawful
bases for processing. Data controllers such as Universities must determine
their lawful basis before they begin processing personal data. If a data
controllers purposes change, they may be able to continue processing under
the original lawful basis if the new purpose is compatible with the
initial purpose, unless the original lawful basis was consent.
 
May I refer you to the letter the ICO sent to Universities, which advised
the following on page 1:
 
“Wealth screening raises privacy concerns because it is the kind of
processing that individuals are unlikely to expect as a result of
providing their personal data to a university, even where this data is
given for the purposes of fundraising. Even when individuals make a
charitable donation, they would not reasonably expect the organisation to
profile their wealth to see whether they are likely to increase their
donations or leave a legacy donation.
 
This means that if you have collected data from individuals for one
purpose, such as monitoring alumni employment patterns or administering
donations, using that data for the purposes of wealth screening or
profiling them for their potential to make future large donations is
likely to be incompatible with your original purpose. It would thus be
unfair, and a breach of transparency obligations, to use people’s personal
data for wealth screening purposes, or to share their data with other
prospect research organisations, without informing them you are going to
do this.”
 
Next steps
 
I hope this response is clear. If you would like me to clarify anything
about the way your request has been handled please contact me.
 
You can ask us to review the way we have handled your request. Please see
our review procedure [2]here.
 
Following our internal review, if you remain dissatisfied with the way we
have handled your request, there is a statutory complaints process and you
can report your concern to the regulator. I have included information
about how to do this separately.
 
Yours sincerely,
 

Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322  F. 01625 524510  [3]ico.org.uk  [4]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [5]privacy
notice

References

Visible links
1. https://ico.org.uk/media/about-the-ico/d...
2. https://ico.org.uk/media/about-the-ico/p...
3. http://ico.org.uk/
4. https://twitter.com/iconews
5. https://ico.org.uk/global/privacy-notice/

Dear Ms Whelan

Thank you for your response to the freedom of information request made by myself.

You kindly said I could ask for further clarification if I needed to, and I wish to do so.

My question 1: no clarification needed.

My question 2: You have confirmed that you have no specific research to support your claim that people wouldn’t expect a charity to investigate how wealthy a donor might be following the receipt of a donation.

Instead you have referred me to the December 2016 and April 2017 fines which you say related to a lack of transparency, but you do not appear to have suggested that universities have been un-transparent. In any case, in my request I pointed out that public awareness of wealth screening is far higher now than it was when you investigated the charity sector in 2016. Further, I pointed out that universities have “provided” – to use the GDPR term – privacy notices describing these practices in considerable detail so it seems hard argue a lack of transparency about these practices, especially in the university sector. I therefore do not understand how transparency has any bearing on your response.

You then referred me to your Trust and Confidence Research. This research contains no mention of the charity sector whatsoever. It relates to “business and organisations” with some mention of Government, the public sector and public companies. Since respondents were asked to respond to a questionnaire under these headings, it would be a considerable stretch to apply the results of this research to the charity sector in general and to the university sector in particular. And in any case you concentrate again on transparency which is not in question for the reasons I have outlined above.

Thus the only conclusion that can be reached is that, as with the first question, your assertion that “when individuals make a charitable donation, they would not reasonably expect the organisation to profile their wealth to see whether they are likely to increase their donations or leave a legacy donation.” is based largely on conjecture.
If it is not based on conjecture then please you could explain your basis for making this assertion in the context of the now very detailed university and charity privacy notices which explain the practice.

My question 3: In a paragraph about the legal basis for processing for fundraising purposes, your letter to universities said “Wealth screening is a separate and distinct activity that requires its own lawful basis for processing.” I asked you to explain what purpose ICO believes wealth screening serves if it is not fundraising. I am afraid you did not answer that question, and I would be grateful for its answer.

Yours sincerely

Luscinda Smith
also my associate Madeline Bowles

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

5 December 2018

 

Case Reference Number IRQ0798121

 

Dear L Smith

Thank you for contacting the Information Commissioner's Office (ICO)
through the [1]whatdotheyknow.com (WDTK) website.
 
The WDTK website was created to help people request information from
public authorities under the Freedom of Information Act (FoIA) and the
Environmental Information Regulations (EIRs).
 
The ICO is the regulator responsible for overseeing information rights
legislation. We are also subject to the legislation we oversee.
 
As a public authority the ICO is subject to the FoIA and EIRs and so if
people want to request information we might hold about our work as a
public body, they can do this through WDTK.
 
As we advised in our response we do not hold recorded information in
respect of your request. The information previously provided was for the
purpose of advice and assistance.  

The correspondence you have sent to us is not a request for information we
might hold. It is an enquiry about the legislation we oversee. We provide
a range of advice services for organisations and for the public. However,
we do not provide these through the WDTK website. 
 
Please visit our website at [2]www.ico.org.uk where you will find a great
deal of advice about the legislation we oversee. You can also contact our
helpline on 0303 123 1113 where a member of our team will be happy to help
you.
 
If you would like to submit your enquiry in writing you should email it to
[3][email address] .  We will respond as quickly as we can. However,
as we explain on our website there is currently a high demand for our
services and it may take us some weeks to deal with your enquiry.
 
Please do not reply to this message through the WDTK website. We make no
commitment to respond if you do.
 
Yours sincerely
 
The Information Commissioner's Office
 
 

 

References

Visible links
1. http://whatdotheyknow.com/
2. http://www.ico.org.uk/
3. mailto:[email address]