Introduction
In general, open data should not contain personal or sensitive personal data that could allow a living person to be identified. Data to be published using the 360Giving Data Standard which does relate to identified individuals should be removed or anonymised to protect their privacy. All funders publishing 360Giving data need to consider data protection and privacy, and review their policies to ensure they can share the data about their grants responsibly.
360Giving’s general guidance on Data Protection provides an overview of what to consider when sharing open grants data for the first time, focused on considerations for funders of grants to organisations.
Data Protection for grants to individuals
For funders of grants to individuals, extra careful planning and clear processes are needed to ensure the data about these grants can be shared, while ensuring the privacy and confidentiality of the recipients.
The guidance below sets out the principles funders should follow, and the steps they should take to embed data protection into their 360Giving data publishing processes.
Anonymising data about grant recipients
A person’s name is a key piece of personal data which is expected to be anonymised in 360Giving data.
It is recommended that Recipient Ind:Name field is populated with the generic text Individual Recipient to ensure the privacy of the person receiving the funding.
However even with the name removed, there are other ways that a recipient could be identified which need to be considered, so that appropriate processes are put in place to prevent this information from being published. These include:
- Identifiers taken from internal systems
- Description text
- Location
- Demographic data
Identifiers taken from internal systems
Two of the 10 core fields are unique identifiers for each grant and each recipient – Identifier and Recipient Ind:Identifier.
Normally the grant Identifier is taken from a funder’s grants management system or database, so that the reference in their internal systems matches that used in the 360Giving data.
As these internal system references are specific to each recipient, they could be used to identify that person. When these identifiers are securely held and are only accessible to people who are authorised to access the grant recipient’s personal data, then it can be appropriate to publish these in 360Giving data. However, if the system identifiers are shared with third parties alongside recipient names or other personal details as part of the grantmaking process – for example with referral agencies, or as part of monitoring and reporting – then these could be used to identify people in your 360Giving data.
Recipient Ind:Identifier may also be created using a system reference, and so should be treated with the same caution as grant Identifiers.
Please note: If there is a data sharing agreement in place with the third party which means it is acting as a data processor on behalf of the funder, then the identifiers may be published. Otherwise an alternative source of identifiers should be used.
Title and Description text
Searching Title and Description text is one of the main ways that users identify what is being funded when exploring data using GrantNav. This means that the Title and Description fields provide an opportunity to provide more information about each grant, which will let users know why you made the award and what it is for.
Using clear and unambiguous language will help users to understand the purpose and reason for the grant, and the type of activities, communities or places being supported by the funding.
However, the text published about grants to individuals must be kept generic to avoid including any information that could be used to identify the recipient.
For example
A grant to pay for vocational training
- Do: Mention the area of learning or skill, and why the person is taking the course.
- Don’t: Name of the course or specific learning provider.
A grant to buy household items for an older person who is an armed forces veteran experiencing financial hardship
- Do: Mention the type of items to be purchased and that the recipient is an older person who is a veteran.
- Don’t: Name specific brands or models of items. Don’t include specific demographic information about the individual together, such as exact age, ethnicity and gender.
If no suitable grant description text is available because the information you hold is too specific to each individual, text describing the overall grant programme could be used instead.
For funders with internal categories for grants, these can also be included in the description to provide further details, as a comma separated list.
Demographic data
Specific demographic data which describe the recipient‘s protected characteristics should not be included in published data, as this information – combined with other details from the grant – could potentially be used to identify the individual.
This is true whether the demographic data is collected through bespoke internal systems or using the DEI Data Standard.
Demographic data about recipients is useful data, but it should only be published about individuals at aggregated levels, to ensure privacy and confidentiality. If you do choose to publish aggregate data about the demographics of your grantees, you may wish to publish this on your website alongside your 360Giving data, but in a separate file or section.
Demographic data about the recipient may also be linked to the reason for the grant, when a funder or grant programme has criteria which restricts funding to, for example, older or younger people, or is only available to women or people with specific disabilities or illnesses. In these cases, this demographic information can be included as part of the grant programme or description fields, when expressed in general terms.
360Giving Take Down Policy
A fundamental aspect of publishing using the 360Giving Data Standard, and publishing open data in general, is that once the information is released it may be downloaded and used by anyone.
A publishing organisation can decide to stop publishing data and/or can remove the data from their website at any time, however the information that has been published may still be held and used by anyone who has already downloaded it.
For publishers intending to publish grants to individuals the goal is to ensure that no information is shared in 360Giving data that could allow an individual to be identified. However, in the event that data is published that needs to be removed to prevent or limit a breach of privacy, 360Giving will follow our Take down policy for the data linked from our Data Registry and loaded into our tools, so we will remove any published data on request.