>

Guidance for storing alumni data and communicating with alumni

From DARSwiki
Jump to: navigation, search

Compiled by the University of Oxford Alumni Office

Preface

Updates to this article may be required in response to changes in the law, changes to business processes or errors.

Please think twice before printing this article. If a printed copy is necessary, ensure it is printed double-sided and always recycle old versions.

Content Last Modified: July 2015

Introduction

Direct communication with alumni is a powerful way of improving engagement (attendance at events, registration for online services, etc) as part of an alumni relations strategy. The information and guidelines below have been compiled to help you ensure that your use of various methods, including email and phone calls, is effective and lawful.

Organisations engaged in collecting and processing personal data, and using that data for marketing purposes, have to comply with legislation, including the Data Protection Act 1998 and the Privacy and Electronic Communications Regulations 2003. Breaches of these laws can be serious and can result in fines of up to £500,000 imposed by the Information Commissioner’s Office (ICO) – the UK’s independent authority set up to uphold information rights. Compliance is, therefore, vital.


Data Protection Act (DPA) 1998

Summary

The DPA is based on eight data protection principles, including:

  1. Personal information must be fairly and lawfully processed
    This means we must tell alumni in advance what we intend to do with their data.
  2. Personal information must be processed for limited purposes and not reused in any way incompatible with those purposes
    This means we must only use alumni data in ways they would reasonably expect.
  3. Personal information must be accurate and up to date


For the list of eight principles see: https://ico.org.uk/for-organisations/guide-to-data-protection/data-protection-principles/


Under the DPA, individuals are entitled to make a ‘subject access request’ in order to obtain a copy of any data held about them, irrespective of format. When drafting an email/minute/letter you should assume that anything you say about a person will be disclosable to them in response to a subject access request.

More information

ICO’s guide to data protection:

https://ico.org.uk/for-organisations/guide-to-data-protection/

University of Oxford’s Data Protection guide for staff:

https://www1.admin.ox.ac.uk/councilsec/compliance/dataprotection/staffguide/

DPA:

http://www.legislation.gov.uk/ukpga/1998/29/contents

Privacy and Electronic Communications Regulations (PECR) 2003

UsefulInfo.jpg Note: Paragraph numbers of ICO’s guidance on direct marketing and PECR are shown in brackets.

Summary

  • PECR provide rules about sending marketing and advertising by electronic means (the rules referring to emails, calls and texts are stricter than those referring to mail marketing).
  • The definition of direct marketing is not limited to advertising goods or services for sale but includes promoting an organisation’s aims and ideals (44). Alumni communications are therefore subject to PECR.
  • Organisations must not send marketing emails or texts to individuals without their specific prior consent. Consent must be knowingly given, clear and specific.
  • It must involve some positive action by the individual giving consent. Organisations cannot assume consent from a failure to opt out (i.e. non-response to an email).
  • Consent can be withdrawn at any time.
  • In general terms, an organisation cannot make unsolicited marketing calls to numbers registered with the Telephone Preference Service (TPS).

Do

  • Identify your organisation:
“An organisation must always say who it is. It also has to provide contact details, so that an individual can make contact if they want to opt out of the marketing (21).”
  • Gather consent:
“The clearest way of obtaining consent is to invite the customer to tick an opt-in box confirming that they want to receive marketing messages (63).”
  • Respond to objections by updating databases:
If an individual objects to receiving a marketing message, stop sending these messages. The ICO expects calls, texts or other electronic communications to stop within 28 days of receiving the objection, postal communications within two months (12).
  • Keep up-to-date records:
“To be valid, consent must be knowingly given, clear and specific. Organisations should therefore make sure that they keep clear records of exactly what someone has consented to, and when and how this consent was obtained, so that they can demonstrate compliance in the event of a complaint (51).”

Don’t

  • Don’t send emails without specific prior consent:
“Organisations can generally only send marketing texts of emails to individuals if that person has specifically consented to receiving them (116).”
  • Don’t email or text to ask for consent (66).
The full guidance is as follows: “Note that organisations cannot email or text an individual out of the blue to ask for consent to future marketing messages. The email or text is in itself sent for the purposes of direct marketing, and so is subject to the same rules as other marketing texts and emails.”

More information

ICO’s guidance on direct marketing and PECR:

https://ico.org.uk/media/for-organisations/documents/1555/direct-marketing-guidance.pdf

ICO’s direct marketing checklist:

https://ico.org.uk/media/for-organisations/documents/1551/direct-marketing-checklist.pdf

PECR:

http://www.legislation.gov.uk/uksi/2003/2426/pdfs/uksi_20032426_en.pdf


University of Oxford’s procedures and policies

Collecting consent

When alumni register for an Oxford Alumni Online account (BBIS account), they are asked to opt-in to the Terms and Conditions. From the Terms and Conditions web page (www.alumniweb.ox.ac.uk/oao/termsandconditions) , there is a link to the Privacy Policy (www.alumniweb.ox.ac.uk/oao/privacypolicy), which mentions the following: “Upon registering for the Oxford Alumni Online website, your data will continue to be used for the purposes of communication and marketing activities by post, e-mail, telephone, fax or text message unless you indicate otherwise.


The Privacy Policy also refers to the following uses, by the University, of the information provided by alumni. These include:

  • To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.
  • To update the information held about you in DARS.
  • To notify you about changes to our service.


If alumni would like to opt out of such communications, they are advised, from the same web page, to do the following: “You can set this opt-out through the Email preferences page, or by contacting us at enquiries@alumni.ox.ac.uk.”

Directories

When alumni register for an Oxford Alumni Online account, they are also asked to opt out (via a tick box) of the following: Oxford Alumni Community, My College Communities, and My Department Communities. We need to assess the value of these directories as they are of limited use as they contain limited information and are not used extensively by alumni. Also, the reference to the directory known as the Oxford Alumni Community is confusing as the Oxford Alumni Community is also the name for the new Graduway platform at: www.oxfordalumnicommunity.org.

Informing alumni about their information rights

In addition to the privacy policy and the University’s Data Protection Statement at [www.alumni.ox.ac.uk/data_protection], the following statement is added to the cover sheet of Oxford Today magazine:

We want to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. Your data will continue to be used for the purposes of communication and marketing activities by post, email, telephone, fax or text message, unless you indicate otherwise. We use tools to monitor the effectiveness of our communications with you, including email tracking, which records when an email from us is opened and/or how many links are clicked within the message. The data from this tracking are generally used in an aggregated and anonymised form. If at any time your details change or you wish to add to or remove from the list of communications sent to you then please contact us.


Your data

Your data are held securely in the University’s shared Development and Alumni Relations System (DARS), which will help ensure your details are up to date and improve our communications with you. The data may be used by colleges, faculties, departments, administrative units, international offices, recognised alumni societies, sports and other entities associated with the University, and agents contracted by the University in that capacity.


Full details on how your data are held and used are set out in our Data Protection Statement at www.alumni.ox.ac.uk/data_protection or you can request a hard copy from the address below. Some sensitive personal data may be held in DARS. If at any time you have any queries about the use of your personal data in DARS, or wish to change the fact of, or extent of, use of your personal data, please contact the Alumni Office, quoting your alumni number (if you have one), at: (post) University Offices, Wellington Square, Oxford, OX1 2JD United Kingdom; (email) enquiries@alumni.ox.ac.uk ; (tel) +44 (0)1865 611610.

In Michaelmas term every year the back of the Oxford Today cover sheet is pre-populated with all the information held about the recipient. This is to comply with the law and to encourage alumni to update their details.


The following information is included on the cover sheet to gather consent from alumni for future marketing messages:

Giving us consent to use your email address will mean that we can update you with University news, share information with you relating to events, offers and resources related to your location, subject of study, or other recorded interests, and keep you informed about how you can support Oxford.


"Tickbox2 I am happy to hear from Oxford about relevant news, events, offers and opportunities for alumni by email.


Do’s and don’ts checklist

Do

  • Identify your organisation in mailings, emails and over the phone
  • Gather consent for marketing messages by using an opt-in tick box similar to the box on the Oxford Today cover sheet, e.g:
"Tickbox" I am happy to hear from Oxford about relevant news, events, offers and opportunities for alumni by email
  • If an individual objects to receiving a marketing message, stop sending these messages.
The ICO expects calls, texts or other electronic communications to stop within 28 days of receiving the objection, postal communications within two months (12).
  • Keep up-to-date records:
“To be valid, consent must be knowingly given, clear and specific. Organisations should therefore make sure that they keep clear records of exactly what someone has consented to, and when and how this consent was obtained, so that they can demonstrate compliance in the event of a complaint (51).”
  • Do refer to data protection in your email signature.
Staff in the Alumni Office use the following statement at the bottom of their email signatures:
Please see www.alumniweb.ox.ac.uk/oao/dataprotection for information on the way in which your personal data is held and used in the University's Development and Alumni Relations System (DARS). If you no longer wish to be contacted by the University Alumni Office by email, or wish to alter the way in which your data is held and used, please send a suitably worded email to enquiries@alumni.ox.ac.uk. Please don't print this e-mail unless you really need to.
  • If an individual asks for a copy of the information held about them on an alumni database, in the case of alumni on DARS, they should be directed to darren.wilson@devoff.ox.ac.uk, 01865 611578, or, in other cases, to the University’s Information Compliance team – data.protection@admin.ox.ac.uk, 01865 280299
  • If an individual asks about making a Freedom of Information request, they should be told to put their request in an email to foi@admin.ox.ac.uk
  • Do ask for advice if you are unsure about the law or University policies (see contacts below)


Don’t

  • Don’t send emails without consent from the recipient
  • Don’t email or text to ask for consent
  • Don’t ignore requests to be removed from mailing lists
  • Don’t ignore requests for information about personal data held on the University’s databases
  • Don’t ignore Freedom of Information requests


University of Oxford contacts

Alumni Office:

Paull Hammond-Davies Head of Alumni Communications & Marketing

paull.hammond-davies@alumni.ox.ac.uk

01865 611616


For questions about the DPA or PECR:

Max Todd Assistant Registrar (Compliance), Council Secretariat

data.protection@admin.ox.ac.uk

01865 280299


For technical questions about information security:

Jonathan Ashton Information Security Officer

infosec@it.ox.ac.uk

01865 283672
Personal tools
Namespaces
  • Page
  • Discussion
  • Variants
    Actions
    Navigation
    DARS User Support
    DARS Support Centre
    Advancing Oxford
    Tools