Data protection

All societies must comply with the Data Protection Act 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 when promoting share offers. Any organisation keeping personal data on individuals is obliged to be registered with the Information Commissioner’s Office (ICO), which is responsible for enforcing both the Act and the Regulations.

The Data Protection Act sets out eight principles relating to the use of personal data by organisations. In the context of community shares, these principles require that personal data obtained from supporters and/or members should only be used for the purposes for which it was originally acquired. This personal data should be accurate and up-to-date, should not be excessive, and should be disposed of when no longer necessary for the original purpose or purposes. The organisation is responsible for ensuring the protection of this data from unauthorised or unlawful use, either by design or by accident.

The Data Protection Act gives individuals the right to prevent their personal data from being used for direct marketing purposes. An individual can, at any time, give written notice to stop receiving direct marketing communications from an organisation. These communications have to stop within a reasonable period, taken to be within four weeks for electronic communications and up to two months for postal communications.

The Privacy and Electronic Communications Regulations provide rules about direct marketing or advertising by electronic means such as automated phone, email, fax, text and picture messaging. It also has rules about website cookies, traffic data, location data and security breaches. These rules apply not only to the promotion of goods and services, but also to campaigning activities by not-for-profit organisations.

The ICO is responsible for enforcing the law and regulations, and has the power to impose fines of up to £500,000 for serious breaches.

Among the more serious breaches is the use of personal contact details for a different purpose from that for which they were obtained. This includes using the membership lists of a community organisation that supports the aims and objects of the society, but where the members have not consented to their details being passed on to other related organisations.

There is no restriction on sending marketing materials to people who have specifically requested such materials. So, if a person completes an on-line form requesting the organisation to send them a newsletter, offer document or some other form of community shares marketing materials, then it is free to do so. For more information see http://communityshares.org.uk/resources/handbook/data-protection-privacy-and-electronic-communications