Data Governance/Privacy Archives

June 6, 2024 By Helen Brown

Building Research Systems That Work

This month we open the blog with a practical look at Research department guidelines by my colleague, Michelle Guzman, who has had plenty of practice setting up workable systems. For example, even if you have a research request system in place, if it’s been a while since you’ve taken time to re-evaluate it, the steps Michelle outlines may help you come up with ideas for an even more efficient or helpful way to receive and deliver information. ~Helen

Michelle Guzman

After sharing about imposter syndrome in a blog post last year, I’m excited to chat with you this time about setting up some guidelines for your research team and the larger development team at your organization.

Guidelines are essentially just formatted lists, right? And who doesn’t love making lists? So, let’s get our checkboxes ready to roll.

There are many guidelines you can establish around prospect development, and doing so can help you feel that you and your office have things under more control. For me, having a foundation and reference points that are agreed upon by leadership helps create better communication and a more useful end product.

Setting guidelines and timelines for what your team offers can be done at any point. Perhaps people in your organization kind of just know the “rules” or perhaps it is more of a free for all. Or maybe you just need to tweak your existing guidelines. I recommend that you follow a handful of steps to get through it.

First, write down – or type up – what deliverables/products/services you currently offer. This is a great time to also re-evaluate them. Are they still needed? Should you add another item that has not be officially offered but is needed?

Then, categorize them. For example, bios and ratings might go under the heading of “Deliverables”, and portfolio reviews might go under the heading of “Services”. Your office may focus purely on research or may add in areas of analytics and prospect management.

From there, you can consider the parameters you currently have set and then what you and/or leadership would like.

Next, think about product names. Are bios called profiles or overviews? Are these three names for different types of deliverables? If they are separate types of documents, make that clear and define them. Definitions can and should list what information is included in that deliverable.

For each deliverable or service, state how long it can take per prospect. This can be a range. I would recommend doing this per prospect so that it is not misinterpreted that a set of 6 bios would take 30 minutes to 1.5 hours. I mean, it could, but it is not likely. Instead, you would note:

Event Bio – 30 minutes to 2 hours per prospect

Giving yourself and your team a bit of padding on turnaround time will save some sanity in the end. This also allows you to schedule that 10 bios could take 5 hours to 3 business days – if you’re solely focused on just doing those, which is not always feasible. While considering how long the deliverable per prospect takes or could take, also consider how far out the deliverable should be requested and by whom.

Let’s walk through this a little bit using everyone’s favorite who, what, where, when, and why prompts, even if it is a little bit out of order.

Maybe right now, requestors can send an email requesting bios by the next morning. Maybe that works for you…. but probably it does not. So, let’s think about when it would be ideal to get the request.

For events, it might be ideal to have the guest list at least two weeks out from the event with the knowledge that there will always be last-minute additions. Now you have the time frame of two weeks out for event bios. Do you want that to be two weeks out from your deadline to get them to the requestor or two weeks out from the event? Whichever you choose, note that in your guidelines. Do you want to have a deadline for last-minute additions, such as having the cutoff be the end-of-business on the Thursday before a Saturday event? Or do you want it to be by noon on the Friday before? Or earlier?

You’re doing great. If you have gotten this far, you have thought through and written up at least one product name, the time frame it takes (or that you want the team to see it can take), and how far out the requestor should send the request/ticket. Now, it’s time to line out who should be requesting the items, which quickly tells us where it needs to go.

If, for example, the president’s office needs event bios, then who should be sending your office names for bios? My recommendation is that only staff members from that office should be sending you names. For example, it can become chaotic if many gift officers are sending you names they think the president should have bios on (but maybe they really don’t?). If the president’s office wants bios on people, they can let you know.

So, why would your office need to know the reason for the request? Well, as researchers it gives us a lot of context around how the product should be structured and can give us a place from which to consult with the requestor on what they need.

Are you now saying, “but Michelle, what does this actually look like?” Well, the format of this document can vary, of course. Your organization might have formatting standards. I would suggest you make it easy to read and understand for your office and the larger group. I have primarily done this using a table. The below is a very basic table you with an example:

Once you have completed the document – whether on your own or with your prospect development team – go over it with leadership. They can offer valuable edits like naming conventions or even what they want the gift officers to be doing. In the end, you will have their support. Having buy-in is very important and helpful when referencing the guidelines. These can be included with the policies of your office and the development policies, as well.

When you have the final version set, it will be up to you and the team on how you share the information. I have found that a great mantra to keep in mind for gift officers is “repeat, repeat, repeat”. We all have a thousand – or a million – things going on in our lives at work and at home. While we do this stuff every day, they do not. So, give handy guideline cheat sheets out at portfolio review meetings or consultation meetings that you have with gift officers. The guidelines are also great to include with training materials for new prospect development staff members joining your team.

Even if you don’t use these specific ideas, I hope they’ve helped give you some inspiration for creating guidelines that work for your organization!

May 16, 2024 By Melissa Bank Stepno

NEDRA 2024: Top Themes & Take-Aways

by: Melissa Bank Stepno, VP of Data Insight

A couple of weeks ago, the entire HBG team attended the NEDRA conference. Part annual team retreat, part professional development, we immersed ourselves in 3 days of learning, team building and networking.

It was so great to see everyone in person! Especially in our post-COVID world, with many more of us working remotely, I can’t understate the power of “togetherness.”

Now that the dust has settled and I’m back in my remote world, and in true HBG fashion, I wanted to pay it forward for those who were not at the conference.

So, here are three of the top themes and takeaways from our time together (at least in my perspective!):

1. Family Offices – one of the most interesting sessions was a plenary session on family offices, given by Josh Roach, who manages one such office. For those less familiar with the concept of a family office, these are typically small private business entities* that are owned by an uber-wealth family with the specific function of working on behalf of the family.

*Note that some large financial firms operate “family offices” that serve multiple families at the same time, however the information that Josh shared relates to single family offices that are fully dedicated to one family.

While Josh was clear that there is no typical or average, he did share that frequently, an office will serve multiple generations and broadly be responsible for supporting the family vision, assisting with transition of family leadership and assuring the family legacy is maintained. Specific responsibilities typically include wealth and asset management but can also include a wide array of other concierge-style services such as travel planning, property management, general accounting, arranging social calendars, and, you guessed it, providing advice on philanthropy.

These offices are incredibly discrete and private – by design – since part of their role is to protect the privacy of the family that they are serving. As such, sometimes one family office might not even know of the existence of another family office!

Families with family offices usually have net worth of at least $750 million – $1 billion and you rarely see one for families with net worth under $250 million. Why? They are expensive! The average family office runs an operating budget of $6 million and employees 6-8 full-time employees.

If you want to learn more about Family Offices, check out this benchmarking study conducted by The Wharton School at University of Pennsylvania or the Family Office Association.

***

2. Data Compliance is an ever changing, complicated quagmire.

In addition to the ever-present General Data and Protection Legislation, or GDPR for short, which covers all of Europe, in the past few years the United States has seen a significant uptick in legislation covering data privacy. In fact, there are currently 15 states with privacy laws in effect and 18 additional states with pending legislation. The IAPP manages a fantastic website that tracks both pending legislation and existing laws – without it, I’m not sure how we would keep up!

Just last month, a bill was introduced in Congress called the American Privacy Rights Act, or APRA for short (anyone else notice the irony that the acronym is APRA?).

The good news is that a national law would supersede the variations in all the state laws. The million-dollar questions are: what would be included in the final bill, when would it go into effect, and how would it impact our industry?

Heard at the end of the session: “I did not expect this to be a wild ride.” When was the last time you heard a comment like that at a Prospect Development conference!?

For more reading on this topic, check out my two colleagues’ recent Intelligent Edge Blog posts: Data Privacy: Where We’ve Been and Where We are Going by Michele Borucki and Data Privacy (Part 2): Practical Tips and Better Practices by Jessica Woodbridge.

***

3. Due Diligence – the conference included not one, but three sessions on due diligence. It truly is a statement as to how much more important this topic is becoming for our industry. Five years ago, there wouldn’t have been any sessions on this topic.

Essentially, due diligence is the subset of prospect research that focuses on the assessing the legal, reputational, and financial risk for our organizations when considering whether or not to develop a deeper relationship with, and/or accept a gift from, a donor.

At this point, it seems as though many organizations have a process in place for due diligence but the level of formality and how/when specific due diligence research is conducted varies from shop to shop.

It must be noted that what passes a due diligence “test” for one organization may not pass the test for another. Due diligence is, and always will be, highly contextual and nuanced. For more on my thoughts on the matter, check out my blog post Philanthropy’s Shades of Gray. Also, look forward to a joint report on due diligence by Xapien and BWF that will be published later this year.

***

Of course, there are a lot of other important topics in our industry right now. These just happened to be the three that piqued my attention the most during this particular conference.

If you missed the NEDRA conference, perhaps I’ll see you in Seattle in August at the Apra Professional Development conference? You can learn more about it and register here.

May 2, 2024 By Helen Brown

Data Privacy (Part 2): Practical Tips and Better Practices

This week we get the second half of a two-parter on data protection and legal compliance from HBG’s Jessica Woodbridge. Although it may not seem the most scintillating of topics, data compliance is an incredibly important topic to stay on top of, especially now when there is pending legislation that could impact our sector on the docket. If you missed Michele Borucki’s part-one article last week establishing where we are and how we got here, please take a minute to do so before forging ahead today. Then, come back with a notebook to save Jessica’s tips for making sure that your nonprofit’s data compliance checklist is up to date. ~Helen

Jessica Woodbridge

Being a good steward of data is not just a good idea, it’s a legal necessity. Nonprofits process donor information on a regular basis, and with this comes the responsibility of understanding the information you hold as well as how to maintain it in the most secure way.

As my colleague, Michele Borucki, mentioned in last week’s Intelligent Edge article, there have been 15 states that have passed comprehensive consumer data privacy laws since 2018 and there are even more to come. There’s also federal legislation pending that could bring consumer data privacy to the federal level if passed. This all goes to say that as data grows in our world, so must we adapt and learn how to be compliant with data security and protection laws.

Here are some practical tips and best practices you can use in your shops to ensure you are protecting your constituents’ information as well as your organization:

Applicability:

Understand your data.
What type of data gets stored?
Where is your data stored?
How is your data shared?
Who is your data shared with and how are they using it?
Determine which, if any, consumer data privacy laws apply to your organization.

Data Minimization:

“The principle of ‘data minimisation’ means that a data controller should limit the collection of personal information to what is directly relevant and necessary to accomplish a specified purpose.” – European Data Protection Supervisor.
Review the APRA Data Minimization Toolkit.
Provide training to your team on best practices for what to add in contact reports, notes, proposals, and other data points in your CRM system (such as inactivating old records/divorced persons).

Better Practices:

Share research through secure methods.
Review your organization’s privacy policy.
Practice data minimization.
Follow the stands of ethics set by Apra and the Association of Fundraising Professionals.
Use industry-standard, publicly available resources.
Provide training for your colleagues.

GDPR-Specific:

GDPR is based on geography, not citizenship; it pertains to any individual who has a residence (of any kind) in the EU and UK.

Create a GDPR-compliant research template:

Do not use a photo of the prospect.
Do not include country of birth.
Include education if it is provided by client or found on LinkedIn, corporate bio, or donor report listing class year.
Include business information if it is found on LinkedIn, corporate bio, or donor report listing class year.
Only include children’s names if supplied by client or public document over the age of 16.
Only include parent information if found in newspaper or public document.
Only include sibling information if found in newspaper or public document.
Do not use sources like Facebook.
Tag GDPR research so it can be sorted and easily deleted.
Delete research after 6 months.

Stay Informed/Resources:

Does your organization have someone who tracks data privacy laws? Here are a few examples of positions that would be able to assist your organization on data compliance:

Information technology consultants who can review your data security measures and help train your staff on implementation.
Nonprofit compliance experts who can ensure your organization follows key regulations, properly registers to solicit and files all necessary reports by their due dates.
Outsourced accountants who can assist in strengthening policies and procedures as well as compiling the financial data you need for effective reporting.

Protecting the rights of our clients and their constituents is of the utmost importance and is always at the forefront of our minds. By using best practices, following your organization’s legal guidelines, and generally being good stewards of data, you can ensure data compliance is being met. It takes all of us to take the necessary step to maintain data compliance and having the highest standards.

April 25, 2024 By Helen Brown

Data Privacy: Where We’ve Been and Where We are Going

This week on The Intelligent Edge we welcome Director of Research Michele Borucki to share a brief history of data protection laws in the United States, where they are headed in the near future, and how they’ll impact our nonprofits. It’s a great foundational part one of two, because next week our colleague Jessica Woodbridge will take up the topic, providing lots of resources to help your nonprofit learn and stay compliant. Michele and Jessica will be sharing their knowledge on the topic at the upcoming NEDRA conference in New Haven, May 2-4 – hope to see you there! ~Helen

Michele Borucki

Here at the Helen Brown Group, we’ve talked a lot over the years about data privacy laws that have impacted our work in the prospect development field. We’ve published in-depth blog posts, continue to share up to date resources with our wonderful community, and many of us on the team have created and executed webinars and presentations on the topic.

The one thing we haven’t done yet here on the Intelligent Edge is share with you the nuts and bolts of how we as a firm protect not only our clients’ information, but that of the constituents that they entrust us with on a daily basis.

Next week, my colleague Jessica Woodbridge will be sharing some awesome tips and tricks that we use (and you can too!) to make sure your shop is compliant with data security and protection laws. Before we get into that, please indulge me in a brief history of data privacy, what laws we already have in place here in the US, and what’s on the horizon.

The most famous of the privacy laws, the General Data Protection Regulation or GDPR, has only been in existence since 2018, but its roots go back much further. Where did the idea of data privacy come from?

In 1890 two US lawyers, Samuel D. Warren and Louis Brandeis, (Yup! That Brandeis) wrote a Harvard Law Review article called The Right to Privacy, arguing for the “right to be left alone” and using the phrase as a definition of privacy. Obviously, the type of data has since changed from the 1800’s with the evolution of technology, but even back in 1948 when the Universal Declaration of Human Rights was adopted (including the 12th fundamental right, i.e. the Right to Privacy) lawmakers understood that all humans and their information have the right to be protected.

The US hasn’t adopted a universal consumer data privacy law yet. Many iterations have been drafted and proposed, even as recent as earlier this month with the bipartisan American Privacy Rights Act. So far, only 15 states have passed comprehensive consumer data privacy laws: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. Six of those states have laws that have gone into effect: California, Colorado, Connecticut, Florida, Virginia and Utah. And in 2024, we will see laws in Montana, Oregon, and Texas go into effect.

These laws are only applied to for-profit companies, but Colorado’s consumer data privacy law is the first to apply to nonprofits. Oregon and Delaware’s laws (both of which will go into effect in 2025) will also apply to nonprofits.

In the case of Colorado, “an organization must have personal data on 100,000 or more Coloradans; or receive revenue or discounts from the sale of data (e.g., list rental and exchange) and have data for 25,000 or more Coloradans”. Even if your state is not yet on this list, if you are a business or nonprofit with a certain number of consumers/constituents from Colorado (or any state that passes a privacy law including nonprofit data management) this applies to you.

One of the main commonalities among these laws is that they give individuals the power to control their own information. At the same time, companies and organizations are responsible for being good pillars of data collection. Across the board, the following themes exist for consumer rights:

Right to access
Right to correct
Right to delete
Right to opt out of certain processing
Right to portability
Right to opt out of sales
Right to opt in for sensitive data processing
Right against automated decision-making
Private right of action

There are so many ways we can unintentionally do harm when it comes to data privacy. As nonprofits it’s important to understand what we can do to make sure that we are caring for our constituents’ personal information. Stay tuned for next week’s post and Jessica’s strategies for making sure your organization is on the right track and complying with current and future privacy laws.

September 14, 2023 By Melissa Bank Stepno

It’s Time: Highlighting Six Changes

Two weeks ago, I attended my last Apra Board Meeting, immediately followed by the 2023 Apra Prospect Development Conference. As a team building exercise, we kicked off our board meeting with “6 Word Memoirs.” As one might expect in a group of about a dozen people, the tone and tenor of our memoirs varied – some professional, some personal, some serious, some funny, some focused on being “in the moment”, others focused on lifelong characteristics. Mine was as follows:

This Year. Many Changes. Reflective. Bittersweet.

For those who do not know me, 2023 has been a year of change. About 6 weeks prior to the conference, I started in my current position at The Helen Brown Group. And, after 6 years of being on the Apra Board, my term was coming to an end.

As such, my mood was very, well, reflective. As you might imagine, a 6-year board tenure could feel like both a short and long amount of time.

On the one hand, some things within Apra and within our profession have not changed over the past 6 years – and maybe they never will. We are still debating whether the full prospect profile is “alive” or “dead.” We are still complaining about database conversion projects. Most of us are planning, in, or about to finish some type of large capital campaign. You get the idea.

On the other hand, over the past 6 years our industry has changed, evolved and grown substantially! Like many of us, I don’t always like change. But, change is not only a constant, it is also necessary. I have learned to embrace the later.

Also like many of us, I often have trouble seeing the forest through the trees. So, since the themes of change and sixes have both been on my mind, I thought: it’s time to highlight 6 “trees” that have sprouted in our industry’s “forest” over my 6 years on the Apra Board.

1. COVID – COVID had a transformative impact on almost every aspect of our lives – professional and personal. Did I really need to mention this? Probably not. However, it was so impactful that how could I not mention it? Enough Said.

2. ChatGPT, AI and similar – do I think ChatGPT or AI is going to replace our profession? No. Do I think they are going to change the way we do our work. Absolutely.

Some of us are old enough to remember when the Internet was rumored to replace our profession and it obviously didn’t. We are still here!

However, I think we’d all agree that the way we work is significantly different – more efficient and faster – than the days of library visits, stacks of books and lots of phone calls to request information. My suspicion is that this era of technology innovation will have the same type of impact, forcing (in a good way!) us to evolve.

3. DAFs – Did Donor Advised Funds exist 6 years ago? Yes. In fact, there’s a great blog post by my colleague Jayme Klein here that reviews the history of DAFs.

However, in the past few years the importance of DAFs and their impact on our industry really started to explode. In fact, according to the National Philanthropic Trust, DAFs grew 28% in 2021 alone.

Those who follow GivingUSA have also noticed that over the past couple of years there has been a decline in individual giving alongside an associated increase in foundation giving. Most experts attribute a portion of this shift directly to the impact of DAFs.

If donor giving patterns are changing, our industry must learn to adapt and keep up with those changes.

4. Data Governance and Privacy Landscape – while FERPA and HIPAA certainly existed for way longer than my six-year looking-glass, we now have an alphabet soup with GDPR, CCPA, PIPEDA and VCDPA added to the mix. This, of course, is an evolving landscape with legislation pending (or already in effect) in other states and countries.

Sites like The Nonprofit Alliance can help us track legislation. However, knowing about the law is only ½ the battle. Perhaps the bigger challenge will be in the nimbleness and complexity needed to adhere to all of variations across so many laws.

While my first 4 are broad and impact the entire philanthropic landscape, I wanted to reserve my last 2 specifically for Apra, since my tenure on the Apra board was the inspiration for this post. Of course, many trees have sprouted within Apra over the past 6 years. I’ll highlight two:

5. Apra’s DEI Data Guide – In 2021, Apra published its first version of a new DEI Data Guide (spoiler alert: an updated version is due to be published later this year, along with a brand new asset on data minimization!). The Guide’s purpose is to serve as a resource for best practices in the ethical collection, storage, and usage of DEI data.

Sure, Apra was talking about DEI 6 years ago. And, Apra has always prided itself on providing an ethical guidepost for the philanthropy profession. It even has an entire section of its website focused on Ethics and Compliance.

But talking about something and having text on a website does not make it a seminal cornerstone of a professional association.

It is to this end that the importance of the DEI Data Guide cannot be understated, especially as Apra is a community that lives, breathes and thrives on using data to advance philanthropy.

In quick stead, the Guide has also served as a launch pad that helped elevate Apra as “The Leader” in assuring the proper collection, use and protection of donor data across the entire philanthropic sector. In fact, the Guide has been promoted in efforts by AFP, CASE, aasp, and the Chronicle of Philanthropy, just to name a few.

6. Due Diligence – Okay, full disclosure: I was having a bit of trouble picking this last one. There was so much to choose from that I really couldn’t decide!

My mind was quickly made up when I read Heather Willis’s Intelligent Edge post last week on Comprehensive Due Diligence Research. Of course!

Due diligence has always been in the back of a researcher’s mind. I distinctly remember an example from my time as a Prospect Researcher at Boston University when a colleague realized that a prospective donor was possibly connected to a terrorist organization. Yikes! What to do? We talked about it and made some ad hoc decisions on how to handle next steps. We had no formal policy or procedure in place. This was twenty years ago.

Now, Due Diligence is a practice of its own with guideposts and guardrails to follow. We’ve come a long way, baby!

In addition to Heather’s great insight, also check out Apra’s Due Diligence Toolkit, published in 2020, along with about a dozen other resources in Apra University, all published in the last few years and including a 2021 webinar featuring HBG’s very own Michele Borucki and Jayme Klein! (note: some links require an Apra membership).

Each one of my “sixes” is worth a full blog post on its own! But for now, I’ll leave you with these brief thoughts on each as I set my sights on building my next 6 Word Memoir…

by: Melissa Bank Stepno, VP of Data Insight

Get the Intelligent Edge