Hawaii, which requires companies to file a written consent form at least ten (10) days before a charitable sales promotion begins, has recently begun to enforce its statutory late filing fee of $20 per day (up to $1,000 maximum penalty) for failure to timely file a written consent.  In order for the written consent to be timely filed, it must be “fully executed” by both parties through an electronic approval process. A delay in obtaining either party’s electronic consent can mean late fees will begin to accrue.

While not new, companies should be also be aware that South Carolina regularly imposes administrative fines of $10 per day for late filing of campaign reports, up to a maximum fine of $2,000 per report. Illinois, which requires companies to register under their charitable trust law to conduct charitable sales promotions, has been enforcing its $100 late filing fee for campaign reports.

While California 1 has the statutory right to impose a late fee of $25/month for registration statements or campaign reports, we have not observed this late fee being regularly imposed.

To avoid incurring late fees and penalties, companies should ensure that they are monitoring their filing deadlines and planning ahead in order to avoid getting hit with significant and unanticipated financial penalties.

For a general overview of the laws regulating commercial co-ventures and charitable sales promotions, please read Do Good And Sell It Well: An Overview Of Cause Marketing Regulation on Engage for Good’s website.

1 Registration in California is not required if certain contract and related compliance requirements are met, including transfers of payments every 90 days. However, note that some companies engaging in online campaigns may need to register as a charitable fundraising platform in California beginning on January 1, 2023. For more information, see the post California Enacts New Law to Regulate Charitable Fundraising Platforms.

The post What are the Penalties for Making a Late Filing of CCV Registrations and Campaign Reports? first appeared on Staging Perlman and Perlman.

Does GDPR apply to your organization?  For virtually every organization, the answer is “yes.”  In basic terms, any US entity that has a web presence and markets to or gathers information on EU residents is subject to GDPR.  More specifically, Article 3 of the GDPR says that if you collect personal data or behavioral information from someone in an EU country, your organization is subject to the requirements of the law.  It’s important to note that a financial transaction doesn’t have to take place to be subject to the regulation. The bottom line is that the GDPR applies to any organization that collects and holds “personal data” of individuals residing in the EU, regardless of the organization’s location.

Failure to comply could result in significant fines and penalties. On top of that, complying with GDPR will require organizations handling EU residents’ data to undertake significant operational reform.  Below I summarize the main mandates imposed by GDPR that organizations should focus on. I will be writing a further series of posts to provide additional guidance on insuring full compliance.

It’s My Data – GDPR is a game changer

From a US perspective, GDPR imposes a new paradigm.  Perhaps most significantly, it redefines what has traditionally been considered to be protected information by broadening the concept of personal data to anything that can be used to identify a person, including an email address, twitter handle or even an IP address associated with a mobile device. It’s crucial to recognize that personal data that is collected is never owned by the organization, for it is the individual who perpetually retains control over personal data.  This key public policy maintains that data belongs to the person it identifies, and that the person has a right to control how it is processed. Therefore, while organizations may use, within well-defined limits, the data they collect, they will need to obtain explicit consent from those individuals who “own” it.

Explicit Consent is the New “Opt In” – What is It?

While organizations may continue to rely on “consent” as a lawful basis to collect, use and transfer personal data under the GDPR, what constitutes acceptable “consent” is now at a higher bar.  No longer will “implicit” or “opt-out” consent be acceptable.  Rather, GDPR requires that the individual signals his or her agreement by “a statement or a clear affirmative action.”   It’s also important to note that GDPR introduces restrictions on the ability of children to consent to data processing without parental authorization.

No “Passing the Buck” – Responsibility for Third-Party Vendors

GDPR squarely puts the onus on the organizations which collect data to ensure that their third-party vendors (data-processors) are acting appropriately, and that any “processing activities” are performed in compliance with the regulations. Organizations must “implement appropriate technical and organizational measures” not only not only to ensure compliance, but to be able to demonstrate the measures that they have in place.  Under certain circumstances, organizations will have specific responsibility for carrying out data-protection “impact assessments.” Most importantly, the organization will be liable for the actions of its third-party vendors and any failure on their part to comply with GDPR’s personal data processing principles.

“Use It – Then Lose It” – Limits on Data Retention

Many organizations keep personal data information for much longer than is reasonably necessary.  GDPR imposes restrictions on this practice, effectively mandating that organizations create, implement, and then follow a data-retention policy.

“It Don’t Come Easy” – New Obligations for Cross-Border Data Transfers

The GDPR permits personal data transfers to a third country or international organization subject to compliance with a number of conditions, including conditions for onward transfer. For those countries that are not considered to provide an “adequate” level of data protection, transfers are only permitted under certain circumstances, such as by use of standard contractual clauses or binding corporate rules.   Note that the United States is not considered to have an “adequate” level of protection, so organizations wishing to transfer data to the US must take additional actions.

A “Target” on Targeting? – Restrictions on Profiling

Today, nonprofits often engage in donor-data analysis for a variety of purposes, including drawing conclusions about a donor’s wealth and capacity to give to develop target marketing campaigns. In its sweeping efforts to define and enhance the subject’s rights to control personal data, the GDPR contains many restrictions on such automated data processing – and decisions based upon such processing – to the extent they can be characterized as profiling.

A Higher Bar – New Data Security and Breach Notification Obligations

GDPR imposes strict obligations on organizations with regard to data security as well as expected security standards. The GDPR also adopts specific breach notification guidelines for the first time.

It’s All About Them – Additional Rights to Control Personal Data

As part of its effort to expand individual control over the use of personal data, the GDPR introduces two new rights. The first is the literal right to be “forgotten.”  This empowers individuals to request that your organization delete their personal data.  It also mandates that if requested, you provide an individual’s personal data to them. The GDPR also augments the existing rights of individuals to receive notice about your processing activities, gain access to the information that is being processed, and to request that any inaccuracies be remedied.

Keep “em” Separated – “Pseudonymization” of Personal Data

The concept of “personally identifying” is one of the essential elements driving and informing GDPR.  Any “personal data,” defined as “information relating to an identified or identifiable natural person ‘data subject’,” falls within the domain of GDPR.  The regulation introduces the concept of “pseudonymization” into European data-protection law. Pseudonymization is the separation of data from direct identifiers so that linkage to a person is not possible without additional information that is not digitally connected. The intent is to minimize the risks associated with sharing and processing of data.

Closing Thoughts

I can certainly appreciate that the regulatory obligations summarized above may seem overwhelming – they are – and that organizations may be tempted to take a “wait and see approach.”  It is essential, however, to keep in mind that by any measure the fines for violations of GDPR are severe (regulators are authorized to levy fines in amounts exceeding the greater of 20 million euros or four percent of annual global revenue). So in this case, an ounce of prevention will truly be worth the pound of cure.

The post GDPR is coming. Will your organization be ready? first appeared on Staging Perlman and Perlman.

1. National Localized Cause Marketing

According to the 2013 Cone Communications Social Impact Survey, Americans want companies to support issues that affect the quality of life locally (43%) more than nationally (close behind at 38%) or globally (20%). Companies are increasingly developing national cause marketing campaigns that allow their local retail stores to choose their own community-based nonprofit organization to support within a unified and nationally-branded campaign.

Structuring a multi-state, localized campaign requires significant planning and coordination to ensure success and compliance by all participants. Companies must ascertain that the charities selected by the local retail stores are appropriate to the brand. They must ensure that the partner organizations are in compliance with all applicable charitable fundraising regulations.  In the past the charities needed to educate companies new to cause marketing that charitable fundraising regulations may be applicable to their campaigns (e.g., the company may need to be registered as a commercial co-venturer in certain states and comply with advertising disclosure requirements).  [See my comments on this issue in an earlier blog post]  The growing trend of developing charitable campaigns involving numerous local charities flips the roles; it is often the national companies which are familiar with knowledge of the applicable regulations while the smaller local charities are typically unaware of such requirements.

When a national company invites small, community-based nonprofits to participate in a cause marketing campaign, the company often has to introduce fundraising compliance concepts to the local charity partners (e.g., the need for the charity to be registered to solicit contributions in the state where the campaign will take place, which is typically the state where the charity is located).  Many of these small charities aren’t aware they need to be registered to solicit funds or to benefit from a fundraising or cause marketing campaign.  Newer charities may not understand the request for documentation confirming its state charitable fundraising registration status and provide IRS determination letters and Certificates of Incorporation instead.  On a positive note, because of the unique opportunity to partner with a national company, bring in new supporters, and increase awareness about the work they are doing locally, the charity partners are usually willing to take the steps required for compliance.

Conducting a national localized cause marketing campaign can mean dealing with compliance issues with dozens, if not hundreds, of charity partners.  Building a detailed compliance schedule and set of procedures, along with appropriate contract templates (which may require some customized state-specific compliance provisions where applicable), will help ensure a smooth roll-out of the campaign across retail stores nationwide.

2. Grassroots, Community Interest Fundraising

There is a lot of energy that charitable organizations can harness from local, national, and virtual communities that share a common interest.  Such niche groups can form strong bonds, whether around a popular form of exercise (think spin cycling or Zumba^® classes) or online gaming. Plugging a charitable campaign into the shared activity can drive both awareness and funds to charitable causes in big ways.  The use of social media to engage these shared interests communities may be one reason why these grassroots fundraising efforts are on the rise.

Grassroots, community interest fundraising often begins at an experimental level, with individuals who are part of the interest group presenting a new fundraising opportunity to a potential charity partner. When the campaigns are successful, they can be replicated regionally or nationally across multiple sites.  This model is frequently structured to benefit a particular national charity.

Here are a few legal compliance issues to be considered when undertaking a scalable grassroots fundraising campaign:

• Who is legally responsible for conducting the fundraising activities? Charities must determine if they are a passive beneficiary of a voluntary fundraising effort or the legal owner of the fundraising campaign.  National charities often do not want to take responsibility for a new fundraising idea developed outside of the organization (until the concept takes off!).  If the concept proves successful enough to replicate nationwide, the charitable beneficiary may need to consider taking control and ownership of the campaign in order to ensure effective and efficient execution, including legal compliance.
• Who will own the intellectual property relating to the campaign? If the campaign is a coordinated fundraising effort to benefit one specific charity, the charity generally needs to maintain control over the campaign’s trademarks and other IP in order to maintain quality control and protect the organization’s reputation.
• Is any legal entity or individual being paid to provide advice and counsel on fundraising activities, or to directly solicit contributions?  These campaigns often start out being organized by individuals within a local or virtual community on a voluntary basis, but as campaigns begin to grow and take on new levels of complexity, it often becomes practical to compensate someone to manage it.  Fundraising efforts may happen at different levels simultaneously.  For example, the solicitation of corporate sponsors and the recruitment and management of individual participants engaged in peer-to-peer fundraising in various regions of the country.  If an individual or entity who is not an employee of the nonprofit is paid to advise or assist with these fundraising efforts, they may need to register as a fundraising counsel or professional fundraiser in the states where the charity and individual/entity are located, and potentially in other states where their fundraising efforts are targeted.

Engaging communities locally and harnessing grassroots social networks can be a powerful driver of awareness and source of funds for social good. Careful planning is required for compliance and success.

The post Trends in Fundraising & Cause Marketing – Local and Grassroots Engagement first appeared on Staging Perlman and Perlman.

Although it might seem onerous to provide disclosures on a website, it can be used as an opportunity to direct potential donors to the site. For example, information on a social media page can offer the solicitation, embedded on the website, through the means of a link. Once on the website, donors have access to more information about the organization.

Tax exempt organizations should regularly review all of their written solicitation materials, including their websites, to consider whether they comply with the state disclosure requirements. More information about  states that require solicitation disclosures is available on our website.

The post Website Solicitation first appeared on Staging Perlman and Perlman.