Is your Church or Charity falling prey to these GDPR myths?

General Data Protection came into effect on 25^th May 2018, it is an update to the UK Data Protection act of 1998 and sets out requirements for how organisations need to handle personal data. There is an abundance of information on GDPR which can make it difficult for churches and charities to decipher what does apply to them and what doesn’t. In this article we debunk a few GDPR myths and correct a few misconceptions, so that you can move forward with clarity and peace of mind.

10 GDPR Misconceptions

1. We’re a charity, GDPR doesn’t really apply to us

If you fundraise, collect donations or use feedback or enquiry forms of any kind, you’ll be storing and using individuals’ personal information. This will occur when recording names, addresses and contact details, sending information or using publicly available information to research and contact new supporters. This means that you will be ‘processing data’ under GDPR and are subject to the regulation.

2. GDPR is bad news for our church or charity

GDPR is actually a good thing. It exists to protect us in terms of how data is being used and stored and gives us all the right to know what information organisations hold on us, how they are using it and also the right to have our information removed. GDPR is about honesty, integrity and transparency, all of which are important for building trust and long-lasting relationships. Although many organisations and charities have had to remove a number of people from their mailing list, these organisations also report that those they continue to communicate with, are more responsive and engaged with their work and initiatives. In the long-run, these regulations will help strengthen your relationships with your community and key stakeholders.

3. GDPR is just about email

GDPR does mean that you must have permission to email your database of contacts, but it is about so much more than email. It is fundamentally about data not channels of communication. It has an impact on your charity’s technology, marketing and processes.

4. GDPR means that email is dead

Email marketing has changed but it is still one of the most effective forms of marketing. There is nothing that can replace email and as such not even GDPR can eradicate it for 10 very simple reasons.

• Everyone online has an email address.
• It’s one of only two universal digital channels – the other being SMS.
• Nobody owns it. It’s not subject to commercial pressures of a single brand owner
• It’s an open system. Anyone can join in.
• It’s very low cost.
• It’s easy for users to understand. Works for beginners or experts.
• It’s fast. Messages usually take just a few seconds.
• It’s flexible. You can send many different types of information.
• It’s got a huge installed infrastructure. It takes something x10 better to get that replaced
• It works.

(Source: Even GDPR can’t kill email)

GDPR impacts all organisations that store or process user data.

5. Everybody on my charity or church database has to re-consent

If you already have the appropriate permission ‘Affirmative Consent’ to contact people on your database, you don’t have to ask for permission again. According to article 4(11) of GDPR, Affirmative Consent is defined as:

Any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, signifies agreement to personal data relating to them being processed… …Silence, pre-ticked boxes or inactivity should therefore not constitute consent.

You may also have Legitimate Interest to contact people on your database. According to the Information Commissioner’s Office (ICO); Legitimate Interest is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.

6. GDPR was last year now I can move on

If you ensured that your church or charity was compliant last year before GDPR came into effect that’s great, you’ve done much of the hard work but there is still work to do. For example:

• Do you have an up to date GDPR compliance folder on your computer so that if you needed to, you could prove all that steps you’ve taken to ensure that you are compliant?
• Have you updated your website recently and added opt-in forms or maybe a website tracking tool such as Google Analytics, do you have an updated cookie policy?
• Do you have a Data Protection Officer to ensure that you’re staying on top of GDPR?
• If you have had requests to update or remove contact data have you complied?

7. I can outsource my responsibility to another company

Your organisation’s responsibility for personal data doesn’t end when it gets passed to others for processing. For example, if you outsource your Gift Aid or use an email management system, you will still be processing some information and you have to ensure that those businesses you outsource to are legally compliant, even if they are based outside the EU.

8. The UK is leaving the EU so GDPR won’t apply

GDPR has come into force in the UK and will stay in force after Brexit. In its February 2018 Brexit whitepaper, the government said it would seek to “maintain the stability of data transfer between EU Member States and the UK” as it recognises the stability of data transfer is important.

9. If I delay GDPR obligations I won’t be fined

The ICO wants to first educate organisations before giving huge fines but ultimately if your church or charity is not compliant, you will be fined. It’s also worth noting that The Charity Commission is becoming increasingly stringent in the area of compliance.

10.  GDPR is complicated and confusing

GDPR might seem complicated but it’s simpler than you may think. Ultimately it involves 5 key steps and GoodtoGive can help you with each of them:

1. Find your data – identify where your data is held and how it is relevant
2. Take action – delete the data you don’t need and sort the rest
3. Apply GDPR policies – decide how to handle the data you hold on individuals and how you will process it in the future
4. Secure the data – make sure your data is cyber secure
5. Provide reporting – keep a record of the steps your church or charity has taken and will continue to take to remain compliant

GoodtoGive can support you with the implementation of your GDPR processes. We have a number of Charity Compliance Events & Training each month and our G-Flow software also helps churches and charities manage GDPR. Contact us to find out more