Do we need permission from grantees in order to publish?

Summary

Your existing Grant Agreements or Terms & Conditions should provide a framework for promoting information about the grants you make.
Information about organisations and the grants they receive is not personal data.
However, grants to individuals, grants to smaller organisations or named contact details for organisations may contain or constitute personal data. You will either need consent to share personally identifying elements of this information, or to make sure it is not included in your open 360Giving data.

In detail

If your organisation already announces details of grants through annual reports, web pages or press releases, you should already have processes in place that establish your rights to share this information.

Check the terms of your grant agreements for any existing clauses relating to publicity and disclosure of information about grants. Your organisation may also have a privacy policy or terms and conditions that applicants agreed to when submitting grant applications.

Public vs personal information

In general, information about organisations and the grants they have received can be published as open 360Giving data without concern.

However, attention should be paid to any data you hold which may be personally identifying under the Data Protection Act, including:

Grants to named individuals.
Grantee’s personal/residential addresses, for example when an organisation is registered at a home address.
The contact person, and their contact details, at an organisation you have funded.

For this information, you should either make sure you have explicit opt-in consent to publish this within an open dataset, or you should anonymise the information in line with the ICO’s anonymisation code of practice.

For example, by:

Replacing individual names with ‘Grant to individual’.
Redacting street-level addresses, and including just postal town or the first digits of a postcode. (Note: the appropriate approach to redaction will depend on the context of the data.)
Replacing individual contact person names with their roles (e.g. Project Manager) and generic e-mail addresses.

Responsible data

There can be cases where grants data is sensitive for reasons other than privacy. For example, the address of a women’s refuge might be inappropriate to include in data about a grant to that organisation.

Consider whether any of your grants data might contain other sensitive information, and make sure you have a process in place to review and redact it (or seek consent to publish) where required.

See the Publishing Personal Data section below for information about seeking and managing consent.

Notifying grantees of your 360Giving data

Even if you will not be sharing personally identifying information and so do not need to gather extra consents, you may wish to let your grantees know about your 360Giving publication as a courtesy. This can also be a good opportunity to solicit any updates from them.

If your organisation has not shared detailed information about your grants before, your communication can provide reassurance that their personal data will continue to be handled in accordance with your privacy policy, and also provide an opportunity to outline the benefits.

For example, you could cover the following:

What data will be shared?
The data will include the name of the grant recipient organisation, amount, date and a brief description of the purpose of the grant. [This section should be updated to reflect the fields in your data.]

How will data be shared?
The data will be available to download from our website. The data will then be available for tools that use open data, for example GrantNav.

Why you are sharing data in this way?
We are proud to be associated with our partner organisations and this is a way to share information about our collective work that can support learning and better decision making in the charitable giving sector. Sharing open data about grants awarded in this way complements the news shared about partner’s work and achievements.

Find out more:
For more information about the 360Giving initiative visit their website.

Reviewing Grant Agreement Terms

We have reviewed a number of grant agreement terms to explore the existing basis for information sharing. Many refer to online publication of grants information, although without making explicit that data will be published as open data.

When reviewing your grant agreement or terms and conditions:

Include:

An explicit statement that public information might be shared in open datasets.
A clear statement of scope (will you release just summary information, or will you release detailed grant information, including payments and results).
If applicable, a clear statement of any personally identifying information you plan to share (e.g. names, addresses), and details of how grantees should opt-in, or opt-out of such sharing.

Avoid:

Statements that imply published information will only be used by specific partner organisations (as this restriction cannot be placed on openly licensed data).

Publishing personal data

In practice: seeking consent

In cases where you do wish to seek permission to include personal or sensitive personal information in your 360Giving data, it is important to make sure grantees are aware of:

The specific information that will be included.
The terms under which it will be made available as open data.

You can find a definition of personal data and sensitive personal data – known as special category data – on the Information Commissioner’s website.

For example, if you were looking to publish names and abbreviated location information, you might include:

“We are seeking your permission to include the contact person for your grant and the first three digits of your postcode, alongside other general grant information, as part of open data about our grant making.

This information will be included in a public dataset under an open license. This means that any third party is free to access and re-use the data.”

You will need to write the permission request based on the particular information you plan to publish.

In practice: managing consent

Consider including additional fields in your internal data systems to log:

When a grant record includes personal, or personally identifying, data (e.g. an individual’s residential address as the registered address of a charity; grants to named individuals) or otherwise sensitive data (e.g. grants to a refuge or other location that should not be disclosed for safety reasons).
Whether or not consent has been obtained.

You may also wish to store the records of consent within your internal systems.

In practice: publish what you can

If you find there are some policy issues to address before you can publish all the details of your grants, don’t let that act as a block to any action on 360Giving. Consider which fields and grant records are unaffected by any barriers, and move forward with publishing these. The learning from this process can then be applied back to other grants once the policy issues are resolved.