Who is Sebastian Rieger? Can you give us some information about your professional background?
«With pleasure. I work as an attorney-at-law at Dufour Advokatur AG in Basel in the area of commercial law with a focus on foundations and NPOs. At the same time, I work for proFonds, the umbrella organization of charitable foundations in Switzerland. There I am responsible for legal and tax matters. One focus area is, of course, the new data protection law. I am also involved in various foundations and boards».
At the last proFonds Stiftungstag, the topic of the revised Federal Act on Data Protection, which will come into force next fall, was raised. What are the most important changes in the law?
«First of all, it is important to note what remains the same. In Switzerland – in contrast to the EU – any data processing is permissible as long as I, as a data processor, adhere to the principles of data protection law. This is important. Processing data is not illegal. Incidentally, the principles have not changed. Accordingly, the data processing that is permissible today continues to be permissible in principle. What has changed? People are taking a much closer look and are much more aware. The topic is becoming more and more important.
To enable data subjects to better exercise their rights, the obligations of data processors have been significantly expanded. One of the most important changes is the duty to inform. As a data processor, I must provide information when I obtain the data. In addition, I must provide information about data processing upon request. In other words, I must state which data I intend to process, for what purpose and for how long. The new Federal Act on Data Protection provides for a whole catalogue of measures that I must take organizationally to ensure data protection. In addition, I must report data protection violations as quickly as possible. Data subjects have the right to have their data deleted. Of course, I may not be able to delete the data because I am required by law to retain it. In accounting, for example, data must be kept for ten years.
The new Federal Act on Data Protection also requires a whole new set of documents to be created. Foundations and NPOs must conduct a data protection impact assessment, they may have to create an inventory of processing activities and adapt their agreements».
What are the key points of the new data protection law that affect fundraising?
«Especially in fundraising, a lot of data is processed. Donor data is very important for fundraising NPOs. Accordingly, it is also advisable to handle this data with care. Data processing is only permissible if the person concerned can identify which data is being processed and for what purpose. Therefore, the question always arises whether donor data, which is provided voluntarily and knowingly, can also be used for advertising purposes».
Can I also put a donor on the mailing list for further mailings or for the newsletter?
«It depends on whether the donor was informed at the time he provided his data that his data would also be used for other purposes. If this was not apparent, I may not use the data for anything other than processing the donation. A central aspect will therefore be the duty to inform. In my opinion, one of the biggest challenges will be communication».
Privacy is a major concern when working with patrons and philanthropists. What challenges do philanthropy specialists face in this area?
«The Federal Act on Data Protection does not differentiate between different categories of donors or between patrons and philanthropists. When dealing with patrons, the same applies as when dealing with all personal data. However, it is of course the case that these people often expect special discretion and are not approached with ordinary mailings or informed by newsletters. Accordingly, it is advisable to store the data separately and to process it separately. I can also imagine that in dealing with patrons, comprehensive transparency about what happens with their data can be very important. So legally, there is no difference to all other donors, but communicatively, there may be».
Why is data protection so important, especially when it comes to working with donors?
«In fundraising, a great amount of data is processed. The economic value of data is particularly evident in fundraising. The more improved a database is, the more donations it can generate. Data processing is therefore a central element of successful fundraising.
At the same time, data protection is also important in the relationship with donors. Donors must be sure that their data will be handled correctly. No one is willing to support a NPO that processes their data illegally or even against their express wishes».
Can addresses of potential donors be bought from address brokers?
«The problem with these bought or rented address banks is that the people whose data is in these databases often do not know that they are in these databases. It is therefore also not apparent to them for what purpose their data is being processed. If the data subject does not know that his or her data is stored in such databases or does not know the purpose of the data processing because completely different NPOs use these databases, the principles of data protection law are not fulfilled. The data processing is not allowed».
May databases specialized in patrons and philanthropists continue to store UHNWI data?
«The question is how to obtain this data. There is also the question of whether UHNWIs know that their data are being processed and know the purpose of the processing. If this is guaranteed and none of the persons recorded in the database objects to the storage or requests deletion, this is possible in principle. Here too, therefore, the central issue is how the data is compiled. Have the owners of this database fulfilled their duty to inform when gathering the data? Are the data subjects informed about the data processing and its purpose? If not, the same applies as already mentioned: the data processing is not permitted».
What must be observed when exchanging data by mail? What are the obligations of fundraising consultants?
«In addition to the organizational measures already mentioned, data processors must also take technical measures to protect the data. Thus, it is always checked whether the technology corresponds to a contemporary standard. Of course, the principle of proportionality also applies here. This means that a small organization with a limited budget does not have to meet the same standard as a large one. In the case of mail exchange, this means that I, as the data processor, am responsible for ensuring that there are no violations of data protection in this form of data transfer. I must therefore choose a provider that meets the state of the art. If I am working with particularly sensitive data, it is advisable to obtain the consent of the data subjects. The same applies if the data processors are subject to professional secrecy.
If I do not work with the people from whom the data originates, but exchange it with a third party, I must ensure technically that data protection is guaranteed. If this is the case, I can also send the data by e-mail».
What are some mistakes a fundraiser can make regarding data protection?
«Being non-transparent. I believe it is very counterproductive and does not help successful fundraising if I, as a fundraising organization, process data opaquely or even improperly. Therefore, it is highly recommended that I clearly inform about the data processing, which I have to do by law anyway. An angry or annoyed donor is usually not a good donor».
What are your tips for successful fundraising in compliance with the new law?
«This ties directly into what I said earlier. Understand transparency as a market advantage and provide clear information about data processing. It is clear to everyone that I process donor data in fundraising. A donor will have no problem with that. So if I clearly say: dear donor, I need this data from you, this data would be useful for me, this is done with your data and it will be used exclusively for this purpose, then this transparency can give me an advantage on the donor market. Transparency takes the same approach with how donations are used. If I know what happens to my donation and how much actually gets effectively into the projects, I am more likely to donate. It is the same with data».
