360Giving Data Standard » Guidance for publishers » Data protection

Data protection

Key tasks

  1. Check your privacy policies and grant agreements.
  2. Check whether your 360Giving data could include personal data.
  3. Consider the responsible data implications of sharing data.
  4. Remove or anonymise personal data or get informed consent to share it.
  5. Decide whether to notify your grantees about your 360Giving data.

Publishing grants to individuals?

The guidance provided below focuses on data protection considerations for funders of grants to organisations. Guidance relevant for funders intending to publish data about their grants to individuals can be found in the Guide for grants to individuals.

Overview

The data collected by funders about the awards made to grantees belongs to the funder, and information about organisations and the grants they receive is not personal data. However, grants to individuals, grants to smaller organisations, or named contact details for organisations, may contain or constitute personal data.

In general, open data should not contain personal or sensitive personal data that could allow a living person to be identified. Data to be published using the 360Giving Data Standard which does relate to identified individuals should be removed or anonymised to protect their privacy.

Although there are circumstances where publishing personal data is in the public interest, in the case of 360Giving data, personal data should only be included with the consent of the individual concerned.

The guidance below sets out what to consider when publishing your grant data openly for the first time, and notifying your grantees about your 360Giving data.

Checking privacy policies and grant agreements

If your organisation already announces details of grants through annual reports, web pages or press releases, you should already have processes in place that establish your rights to share this information publicly.

  • Check the terms of your grant agreements for any existing clauses relating to publicity and disclosure of information about grants.
  • Check if your organisation has a privacy policy, or terms and conditions that applicants agree to when submitting grant applications.

Reviewing your policies

When reviewing your grant agreement or terms and conditions:

Include:

  • An explicit statement that public information might be shared in open datasets.
  • A clear statement of scope (state whether you will release just summary information, or you will release detailed grant information, including payments and results).
  • If applicable, a clear statement of any personally identifying information you plan to publish (e.g. names, addresses), and details of how grantees should opt-in, or opt-out of which data being shared.

Avoid:

  • Statements that imply published information will only be used by specific partner organisations (as this restriction cannot be placed on openly licensed data).

Public vs personal information

Attention should be paid to any data you intend to publish which may be personally identifying under the Data Protection Act 2018, including:

  • Grants to named individuals.
  • The contact person, and their contact details, at an organisation you have funded.
  • Personal/residential addresses, for example when an organisation is registered at a home address.

If you intend to publish information about individuals that could be personally identifying, you should either:

  1. Make sure you have explicit opt-in consent to publish this within an open dataset.
  2. Or remove or anonymise the information in line with the Information Commissioner‘s anonymisation code of practice.

If you do not intend to publish personal data

In general, information about organisations and the grants they have received can be published as open 360Giving data without concern.

However you should still check for personal data appearing by accident. For example descriptive text may include the names or contact details of individuals involved in a project or organisation.

  • Check Title, Description and Recipient Org:Description fields, as well as recipient or beneficiary location data, to ensure that this information, on its own or when combined, cannot be used to identify the individual concerned.
  • Pay particular attention to any text fields where the source information is entered by applicants via an online application form, especially if the text does not get checked and edited during the grant assessment process.

If you need to take further steps to anonymise or remove potentially identifying data, make a note of the changes you make to ensure these checks and steps are taken each time you publish new data.

Organisations registered at a home address

If the address of an organisation is a private home address, which can be the case for grassroots or informal groups and small registered charities, this information is not suitable for inclusion in 360Giving data in full.

Redacting street-level addresses, and including only the postal town and the postcode may be sufficient to prevent the information from identifying an individual. However the appropriate approach to redaction will depend on the context of the data, for example by only including the first digits of the postcode if the address is in a sparsely populated rural area.

Some publishers avoid the possibility of publishing home address data by sharing recipient location data using geocodes instead of address information.

This option has been used by funders who frequently fund smaller or informal groups where there is a high likelihood of home addresses appearing in their data. This approach also suits funders who award large volumes of grants where distinguishing which recipients use home addresses would be challenging or time-consuming.

For further information see our guidance about how to convert postcodes into geocodes.

Responsible data

There can be cases where grant data is sensitive for reasons other than privacy. For example, the address of a women’s refuge might be inappropriate to include in data about a grant to that organisation.

Consider whether any of your grant data might contain other sensitive information, and make sure you have a process in place to review and redact it (or seek consent to publish) where required.

Sharing Data Responsibly – A Conversation Guide for Funders is designed for funders and grantmakers who want practical advice on how to treat their grantees’ data responsibly. Published by the Ariadne Network and Engine Room, this report is aimed at Human Rights funders working internationally, but has relevant information for all other types of funders.

Access the Responsible Data guide.

The guide follows the grant management cycle, providing information to guide decisions at each stage:

  • Data collecting: managing data in the application, monitoring and reporting phases.
  • Storing grantee data: how to provide clear information on which data is collected and why, and how you will store it.
  • Sharing and publishing information: sharing and publishing information in a considered, responsible way.

Notifying grantees about your 360Giving data

Even if you will not be sharing personally identifying information and so do not need to gather extra consents, you may wish to let your grantees know about your 360Giving publication, as a courtesy. This can also be a good opportunity to solicit any updates from them.

If your organisation has not shared detailed information about your grants before, your communication can provide reassurance that their personal data will continue to be handled in accordance with your privacy policy, and also provide an opportunity to outline the benefits.

For example, in your communication with grantees you could cover the following:

What data will be published?

The data will include the name of the grant recipient organisation, amount, date and a brief description of the purpose of the grant. (This section should be updated to reflect the fields included in your data.)

How will data be published?

The data will be available to download from our website (insert link). The data will then be available for tools that use open data, for example GrantNav. This is a tool created by 360Giving, but anyone could create a tool that uses the data.

Why are you publishing data in this way?

We are proud to be associated with our partner organisations and this is a way to share information about our collective work that can support learning and better decision-making in the charitable giving sector. Publishing open data about grants awarded in this way complements the news shared about the partners’ work and achievements.

For more information about the 360Giving initiative visit their website: https://www.threesixtygiving.org/

If you do intend to publish personal data

We encourage publishers to carefully consider the value of publishing any personal information as part of their 360Giving data and discourage sharing of special category data (including racial or ethnic origin and health information).

Before making a decision on including personal data:

Start by publishing what you can

You can still take steps toward publishing your data, even if you find that there are some data protection policy issues to address. Consider which fields and grant records are not affected by any barriers, and move forward with publishing these. The learning from this process can then be applied back to other grants once the policy issues are resolved.

Example open data policy

An example of an open data policy is available, written by some of the experts who helped create the 360Giving Data Standard. It can be used as a template for any organisation’s data policy and adjusted to reflect specific circumstances and needs.

Adopting an open data policy for your organisation will help to guide the checks you make before publishing data, and record the range and type of changes that may need to be made to your grant information before sharing it openly.

Further information about data protection

If you want to discuss this data protection guidance and how it relates to your specific circumstances, please contact 360Giving Helpdesk via support@threesixtygiving.org.

What‘s next?

Read our guidance about how to prepare your grant data ready for publishing as 360Giving data.

Getting further help

This guidance aims to support funders through the 360Giving publishing process. If you can't find the information you need or you have further questions email 360Giving Helpdesk. You can help us improve this guidance by filling out our feedback form.