The University of Manchester Division of Development and Alumni Relations Legal Bases Assessment for Processing Personal Information

Summary and introduction

The Division of Development and Alumni Relations (DDAR) supports The University of Manchester through contact with alumni, students, staff, and current and potential supporters of the University. We do this by offering a range of academic, social and networking events and publications and providing access to University Library resources and employment and skills advice for recent graduates. We also fundraise to support the University’s students, teaching, research and capital projects. In order to fulfil this role, the DDAR collects, stores and processes the personal information of alumni, supporters and potential supporters as described in our Privacy Notice.

There is no requirement under EU or UK legislation for the University to conduct alumni and supporter relations or fundraising, and we therefore rely on our legitimate interest as the legal basis for processing personal information for these activities wherever possible and appropriate.  This is because alumni and supporter relations and fundraising:

• is of clear benefit to the University and those who we can support because of this activity – through teaching, research and in society more broadly;
• has a limited impact on the privacy of alumni, students, and current and potential supporters, whose interests do not override our legitimate interests and the wider public interest;
• is reasonably expected by our students, alumni, staff and current and potential supporters, who we do not wish to bother with disruptive consent requests when they are unlikely to object to processing.

Whilst the DDAR relies on legitimate interest as the legal basis for processing where this is appropriate and possible, it recognises that it is not the only lawful ground for processing personal information. As such, where appropriate the DDAR will sometimes process personal information on an alternative legal basis – for example, because we have been given consent or have a legal obligation to do so.

The aim of this document is to describe the processes we carry out, the groups of individuals to whom we apply this and the legal bases we rely on to undertake this work.

Alumni and supporters of the University of Manchester fall into a variety of ‘constituent types’, detailed in Table 1, below.  One person may fall into multiple categories. Where this is the case, we have only considered the legal bases where they apply to that specific relationship with the University.  For example, we only consider the legal basis for processing Gift Aid claims for ‘Donors and potential donors’ even though we understand that a donor may also concurrently be an alumnus/a and could also be a student, a member of University staff and/or a volunteer.

Table 1: University of Manchester constituent types, DDAR business processes and the legal bases for processing personal data to undertake this activity

*These activities are undertaken by various communications channels including post, telephone, email and face-to-face.  We always account for legislation applicable to each communication channel alongside your own communications preferences.
** See Section 3.1

1. Our business need for fundraising and alumni and supporter relations

Like many universities, the University is a fundraising institution and seeks philanthropic support for its objectives as set out in the Royal Charter awarded in 2004 of advancing education, knowledge and wisdom by research, scholarship, learning and teaching, for the benefit of individuals and society at large.[1]

Fundraising and alumni and supporter engagement revolves around personal relationships, and as with all personal relationships in human life there is no blueprint for how they unfold (or should unfold). By extension, there is generally no straight forward or risk-free approach to achieving uniform, immediate compliance with the regulations and laws governing personal information gathered in pursuit of those relationships. Our approach, therefore, balances the University’s interests in pursuing its constitutionally mandated functions of fundraising and alumni and supporter relations with the fundamental rights and freedoms of the data subject.

The University has been a fundraising organisation since its beginnings and has operated a dedicated department, the Division of Development and Alumni Relations (DDAR), to organise and promote this activity and associated alumni and supporter engagement programmes since 1988.  The case for university fundraising in the UK – though long understood – was furthered considerably by the publication of the Thomas Report (2004),[2] which stated:

‘firstly, the role of voluntary giving is to support the development of the institution towards achieving excellence […] It is not a substitute for other sources of higher education funding, particularly public funding. Secondly, institutions have a responsibility to build the commitment of stakeholders to their future success and to solicit donations from those that can afford it. Higher education institutions benefit from having a charitable purpose and should, in turn, take full advantage of this in asking for financial support.’

In 2012, the HEFCE-commissioned Pearce Report into philanthropy in higher education made further observations.[3]

‘Universities are charities, making a significant charitable impact. They have therefore not only the right but the obligation actively to seek and responsibly to handle philanthropic gifts. Higher education can deliver social progress across the spectrum, connecting with the widest range of passions and interests from donors. It changes students’ lives and improves their life chances […] It provides society’s best chance of tackling the big issues of our times, from the diseases that killed our parents to resource shortages, to the misery of war, to the ominous gap between rich and poor.’

Fundraising by UK universities continues to grow year on year.   The CASE Insights on Philanthropy report, published each year following returns from the sector, illustrates size and scope of fundraising activity in the United Kingdom, the importance of philanthropy to the country’s education system, and the belief of donors in giving to higher education.  The Insights on Philanthropy report is available here.

The University of Manchester, in common with its peer institutions, recognises that – though fundraising and alumni and supporter relations are worthy aims – they must be pursued in ways that are ethical, transparent, and do not infringe upon the rights of individual data subjects or cause them harm or distress.  Our fundraising is focused on alumni, students, staff, supporters who have a prior connection to us, or individuals and organisations who we believe have both the inclination and means to support the University.  Our philanthropic priorities are carefully considered to achieve social good, with individuals being asked for support at a level appropriate to them.  Moreover, we pledge to treat our alumni and supporters’ personal information with respect and not to do anything with this information that they would not reasonably expect, or which we have not told them about. The things we do with alumni and supporters’ personal information are made clear in the DDAR Privacy Notice, which we provide every electronic communication, and publication where possible. Individuals always have the chance to object to or prevent the processing of their personal information for any of our purposes, and to update, amend or correct any personal information the DDAR holds on them.

2. Our legal bases for processing personal information

The EU’s General Data Protection Regulation (GDPR), which came into force on 25 May 2018, required data-processing organisations to identify – and make clear in their privacy notices – at least one legal basis for the processing of personal information.  Following the completion of the UK’s transition period for leaving the European Union the University has followed the UK GDPR. Six legal bases – all of equal force – are available under the UK GDPR, including:

• performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
• the data subject has given consent to the processing of his or her personal information for one or more specific purposes;
• the fulfilment of a legal obligation to an official body of appropriate authority;
• for the purposes of the legitimate interests pursued by the controller or by their contractually-bound third parties, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, and excluding processing carried out by public authorities in the performance of their tasks.[4]

All four of these legal bases are used, at least in part, by the University for activities carried out in pursuit of its fundraising and alumni and supporter relations functions, but the most appropriate for many activities (and, in some cases, the only legal basis available) is ‘legitimate interests’ (see Table 1). The other available legal bases – processing personal information in fulfilment of a contractual obligation to a data subject, or in pursuit of the data subject’s vital interests – are not applicable to any area of the DDAR’s activity.

3. Our use of ‘legitimate interests’ as a legal basis for processing personal information

Where we have identified ‘legitimate interests’ as the most appropriate legal basis for the activities shown in Table 1, we have done so because:

• the work of the University’s fundraising and supporter relations programme is of clear benefit to the University and those who we can support because of this activity: through teaching, research and in society more broadly;
• we believe, based on: our daily interactions with alumni and current and potential supporters; the data we have on our fundraising and engagement work – not least the number of positive and negative interactions since 1988, when the University’s alumni office was first founded; the ever-increasing awareness in the UK of university fundraising and alumni and supporter relations highlighted by research by the Council for Advancement and Support of Education (CASE); and the expectation among our alumni that the University will continue to be in touch with them after they leave; that our alumni and supporters reasonably expect us to use their personal information to pursue that activity. As such, we do not wish to bother them with disruptive requests for consent;
• we have proactively provided (or, for new supporters, will provide as soon as it is practicable to do so) information to our alumni and supporters about how their personal information is used to pursue that activity(via our Privacy Notice), and how they can opt out of contact should they so wish;[5]
• we do not believe that processing their personal information (or any action we take as a result of that processing) is disproportionate, nor that it infringes the interests, rights and freedoms of our data subjects, who – in any case – reserve the right to update the personal information we hold, restrict the use of their personal information for any particular purpose, to exercise their right to be forgotten, or to have access to the personal information we hold about them. Given that the processing of personal information has a limited impact on the privacy of students, alumni, staff and current and potential supporters, we do not believe their interests override our legitimate interests and the wider public interest.

3.1 Research into donors and potential donors and ‘legitimate interests’

The DDAR Privacy Notice explains the types of information we may collect about our alumni and supporters in as transparent a way as possible. As well as information which they provide to DDAR themselves, we also carry out research into alumni, donors and potential donors (sometimes referred to as ‘prospect research’) using publicly available data sources. Additionally, we may on occasion use contractually bound trusted third parties to automate this research and assess the giving capacity of certain alumni and supporters (sometimes known as ‘wealth screening’).  Certain information obtained in these ways may, at our discretion, be appended to the individual records we hold on our database. Prospect research and wealth screening are standard practices across the charitable and higher education sectors as they are vitally important in achieving the target level of philanthropic fundraising required – in the University’s case, to meet our objectives of advancing education, knowledge and wisdom by research, scholarship, learning and teaching, for the benefit of individuals and society at large.

Our legal basis for carrying out these activities is ‘legitimate interests’ (see Table 1). We believe that our processing is within the reasonable expectations of alumni and supporters to whom we have provided our privacy notice and who have not objected to such processing. Furthermore, we believe that this processing does not, on balance, override the ‘interests or fundamental rights or freedoms of the data subject’ as outlined in UK data protection legislation. Information processed in pursuit of prospect research and wealth screening is only used to ensure that as professional, appropriate and relevant a fundraising approach as possible is made.  For most people we conclude from our research that we will not approach them for support and so in this their interests do not override our legitimate interest.  Where, from our research, we conclude that an individual is likely to have the capacity to support the University they may be assigned a relationship manager who is responsible for managing the University’s relationship with the potential donor.  In such instances this relationship will consist of: invitations to meetings or events; notifications of volunteering opportunities, such as serving on a University board or mentoring students; and if it is eventually deemed appropriate, receiving a tailored proposal for philanthropic support. The prospective donor is free to decline or to proceed with any opportunities with which they are presented at any stage of the relationship, and so in this regard their interests do not override our legitimate interests.  Given the evidence from our fundraising endeavours to date we believe this approach is lawful and sustainable, and in reality approaches to major donors informed by our prior research are usually warmly welcomed. In the absence of such processing, unwelcome and inappropriate approaches are more, not less, likely.

Our view is informed by research carried out among both wealthy UK donors, fundraisers, and the general UK population. An in-depth study of eighty-two wealthy donors found that two-thirds (65%) believed that ‘a more professional approach to seeking funds’ was a significant factor in the development of philanthropy in the UK.[6]  In 2017, a survey showed that 80% of fundraisers believe they would offer donors a worse experience if restrictions on conducting research for the purposes of fundraising were introduced.[7] A representative survey of the general UK population in 2017 found that 60% of those who prefer charities to communicate in a tailored way with them, think that charities should be able to use information that is publicly available – for example Internet research or newspaper articles – in order to tailor their approach to their supporters.[8]

From time to time the DDAR may carry out research into individuals (using publicly available sources) before we have provided our Privacy Notice to them. In such circumstances, we rely on Article 14.5.b of UK GDPR, which states that the obligation to provide a privacy notice shall not apply where its provision ‘is likely to render impossible or seriously impair the achievement of the objectives of that processing.’ Where this has applied, data subjects will still be provided with the Privacy Notice at the point of first contact or as soon as it is reasonable to do so.

4. Our use of ‘consent’ as a legal basis for processing personal information

For a small number of our activities we rely on consent as our legal basis for processing personal information under UK GDPR (see Table 1). In general, though, our view is that consent is an inappropriate legal basis on which to process personal information in pursuit of our functions of fundraising and alumni and supporter relations. We believe:

• that it is burdensome and without merit to collect consent to process personal information when we have evidence that alumni and supporters reasonably expect us to process this information in any case in pursuit of our functions and the legitimate interest of the University
• as consent must be refreshed periodically, it would be a further burden both to the University and to its alumni and supporters to make repeated requests to renew consent;
• the wide scope of our activity in pursuit of our functions of fundraising and alumni and supporter relations does not allow for the granularity required to rely on consent as a legal basis for processing under UK GDPR, and risks confusing our alumni and supporters;
• we would have no means of renewing or gaining consent from alumni and supporters with whom we have lost contact;
• that our ability to undertake new activities in pursuit of our functions of fundraising and alumni relations would be restricted by choosing consent as our main legal basis.

There are a small number of instances where we rely on the individual providing their consent as a legal basis for processing data.  In such instances the individual has usually taken a positive action towards the University which requires processing of their data to facilitate a response and/or their involvement with us.  Examples include:

• most of the events we organise require attendees to register for tickets beforehand, for logistical and safety reasons. Where this is the case we believe consent is the only viable option for processing personal information for this purpose. We believe we have consent in this this regard because attendees are freely making the choice to register for the event, and providing information to us to facilitate this choice. If we did not process their personal information for this purpose then we would be unable to provide the individual with the service they are requesting.
• to get involved in offering their time and talent in one of our volunteering programmes, we require individuals to actively indicate their willingness to participate.  Such instances equate to the provision of consent, which is therefore the legal basis for processing.
• an individual has enquired supporting the University, for example, by leaving a legacy in their will.
• individuals who are not students or alumni may engage with the University through public participation initiatives, for example fundraising or donating via crowdfunding platforms.  As part of this involvement they may be offered the opportunity to hear more about other opportunities to get involved with the University.  We will provide this information subject to an individual’s personal preferences as indicated by a positive action from them, i.e. their consent.

5. Our use of ‘legal obligation’ for processing personal information

For a small number of our activities, we are legally required to process personal information and so rely on ‘legal obligation’ under UK GDPR (see Table 1). We believe:

• we have a legal obligation to process donations made in support of the University’s philanthropic priorities in line with financial regulations. Supporters making a donation to the University of Manchester are provided with a version of the DDAR Privacy Notice during the data collection and payment process, which includes a link to the full DDAR Privacy Notice.  Regular gifts to the University are provided by a Direct Debit service that is outsourced, BACs approved, and covered by the Direct Debit Guarantee Scheme.
• for donors who provide a Gift Aid declaration we are required by law to collect and retain donor, address, gift and Gift Aid declaration information for a period of six years for compliance with HMRC audit. In order for that declaration to work and for the University to collect the Gift Aid payments we need the full home address of the donor, evidence of their agreement and confirmation that they have paid an equivalent amount of income or capital gains tax to cover the claim amount.  This information is shared with HMRC via an API process that transmits this information and records our claims with HMRC.

6. Our use of ‘public task’ for processing personal information

The University of Manchester, and the DDAR as part of the University, is obliged to carry out some tasks as a matter of public duty.  For a small number of our activities, we are required to process personal information and so rely on ‘public task’ under GDPR (see Table 1).  We believe:

• we must process personal information to fulfil the public task of assisting the Government in compiling official statistics. The University is required to provide personal information to the Higher Education Statistics Agency (HESA) for student, staff, and finance surveys.
• we also have a legal obligation to provide personal information to HESA for graduate destination surveys such as the Graduate Outcomes Survey (GOS). The DDAR has always been required to help with such returns by providing updated contact information to the HESA. This information is used to contact recent graduates to find out about their employment to provide feedback to the HESA.

HESA produces official statistics (such as university league tables) and its outputs are regulated by the UK Statistics Authority, which has a direct line of accountability to Parliament.  Information from the HESA Record is used by some organisations to help carry out public functions connected with education in the UK.  These organisations are data controllers in common under the terms of UK data protection legislation.  Such organisations may include:

• Department for Education;
• Department for Business, Energy and Industrial Strategy;
• Welsh Government;
• Scottish Government;
• Department for Employment and Learning, Northern Ireland;
• Higher Education Funding Council for England;
• Higher Education Funding Council for Wales;
• Scottish Further and Higher Education Funding Council;
• Research Councils;
• Education Funding Agency;
• National College for Teaching and Leadership;
• National Health Service bodies and organisations working with them, e.g. Health Education England;
• General Medical Council;
• Office For Fair Access;
• Quality Assurance Agency for Higher Education.

Conclusion

In conjunction with the DDAR Privacy Notice this document assesses the University’s approach to regulatory compliance for fundraising and alumni and supporter relations, and records our rationale for that position. This assessment demonstrates to our alumni, supporters and future supporters, and the appropriate regulatory bodies, that we have established our legal bases for processing by carefully considering the rights and freedoms of our data subjects against the processes and activities we conduct as a data controller in pursuit of the University’s educational charitable mission. We have established the best available approach to meet the expectations of stakeholders past, present and future, and to achieve our engagement and fundraising goals in support of our teaching, research and social responsibility agendas.

If you have any questions about this Legal Bases Assessment please contact us at:

Division of Development and Alumni Relations
The University of Manchester
Oxford Road
Manchester
M13 9PL
alumni@manchester.ac.uk
+44 (0)161 306 3066

For wider enquiries about how the University manages information please contact:

The Data Protection Officer
Information Governance Office
The University of Manchester
Oxford Road
Manchester
M13 9PL
dataprotection@manchester.ac.uk
+44 (0)161 306 2473 or +44 (0)161 275 8111

Future Changes

If our information practices or the appropriate legislation changes at some time in the future we will review this document and update it accordingly.

Last updated: 31 January 2024