BHF and RSPCA disappointed by ICO decision

The British Heart Foundation and RSPCA have expressed disappointment with the Information Commissioner’s Office’s move to fine the charities for breaches of the Data Protection Act.

BHF chief executive Simon Gillespie said the charity considers the ICO’s findings “wrong, disproportionate and inconsistent”. Trustees are considering whether to challenge the decision.

RSPCA chief executive Jeremy Cooper disagreed with the ICO’s conclusions.

The ICO yesterday announced a fine of £25,000 for the RSPCA and £18,000 for the BHF for breaching the Act.

The ICO said wealth screening was one of three different ways both charities breached the Act by failing to handle donors’ personal data in-line with the law.

The watchdog said the RSPCA admitted repeatedly wealth screening all seven million of its supporters. The ICO said the charity did not have the donors’ consent to do so.

BHF told the ICO it had been screening donors since at least 2009, the ICO said. Between April 2010 and August 2014 it provided records to wealth management companies containing the personal data of several million people. The ICO said this was also done without consent.

The ICO said both charities also traced and targeted new or lapsed donors by piecing together personal information obtained from other sources, and traded personal details with other charities through a scheme called Reciprocate.

Donors were not informed of these practices, the ICO said, and so were unable to consent or object.

Gillespie said the trust BHF’s supporters place in the charity demands high standards of fundraising, and the foundation takes data protection responsibilities very seriously.

"The British Heart Foundation has endeavoured to ensure our practices follow ICO and Institute of Fundraising guidelines and we are committed to constantly evolving and improving our approach,” he said. "We find the decision surprising as earlier this year in June the ICO praised our data handling and said that they had no concerns about us as a data controller.”

BHF decided in June 2015 never to share its supporters’ data with other fundraisers, Gillespie said, and the charity has made this clear to supporters.

Cooper said there was one acknowledged contravention by the RSPCA through an inadvertent error, which the charity itself brought to the ICO’s attention.

“We always strive to ensure that our practices fully comply with all relevant legislation and are carried out to a high standard. We are listening to the public and are changing the way we ask people to support our vital work which meets their needs and expectations, whilst safeguarding potentially vulnerable people.”