Oral evidence: Fundraising in the charitable sector, HC 431Tuesday 20 October 2015

Oral evidence, 20 October 2015.

Witnesses

Christopher Graham, Information Commissioner, and Steve Eckersley, Head of Enforcement, Information Commissioner’s Office, gave evidence.

Chair

Welcome to our two further witnesses to this session on charitable fundraising. Could each of you identify yourselves for the record, please?

Christopher Graham

I am the Information Commissioner.

Steve Eckersley

I am Head of Enforcement at the Information Commissioner’s Office.

Chair

Thank you very much for being with us today.

Paul Flynn

What in your view is valid consent for an individual to be contacted by a charity?

Christopher Graham

It is consent that you know you have given. If you are taken by surprise and you say, “Why are you ringing me?” then you did not give consent. Best practice is that there should be a box that you would tick to opt in, but it depends on the circumstances. What we have discovered over recent months in the course of our investigation is that there are far too many people who say, “No, I never gave consent, go away,” which suggests that lists are being traded and passed around and people who may have given their consent for one purpose find that they are contacted by others basically trading on their goodwill.

Paul Flynn

If somebody fills out a lifetime survey that purports to be just an enquiry about their views on half a dozen subjects and includes a question saying, “If you were to give to a charity would you give to an animal charity or a medical charity or an elderly charity?” and answers that question what their preference would be, would you regard that as valid consent to be approached by that charity?

Christopher Graham

No, particularly if it was done many years ago, which is the case that we are all interested in. I think the message is getting across to the charity sector that the rules that apply to direct marketing apply to them, just as they apply to everybody else. Certainly in the case of phone calls, you have to have consent that would override somebody’s indication on the Telephone Preference Service that they did not wish to be disturbed, thank you very much. They just have to be better at making clear that they are approaching people who want to hear from them.

Paul Flynn

How confident are you that the charities are aware of their obligations under data protection legislation?

Christopher Graham

They are certainly more aware than they appeared to be a few months ago. We published very clear guidance when the Privacy and Electronic Communications Regulations came in, and we renewed that guidance in 2013. It is a matter of some disappointment that the Institute of Fundraising appeared to be resisting the reality that the direct marketing guidance did apply to the charity sector. We found a concern to find a balance between privacy of donors and the needs of charities and the good causes and so on. I have had to explain, “I am sorry, privacy is a fundamental right. The Privacy and Electronic Communications Regulations apply to all direct marketing and they apply to you.” But it took until, I think, 18 August to get the Institute of Fundraising to change the guidance they had on their website and to agree that the clarity that came from the 2013 Information Commissioner’s Office Direct Marketing Guidance really did apply to the charity sector.

Paul Flynn

They were sinners in the past. Are you satisfied that they are all virtuous now?

Christopher Graham

I think Steve might comment on the progress that we have been making in the one-to-ones with charities.

Steve Eckersley

Yes, Mr Chairman, one of the tactics that we used as part of our enforcement is to hold organisations to account. We hold a compliance meeting and what we do is we invite the organisation in and we have a face-to-face discussion, making sure that they have the checks and balances and due diligence that would ensure that they can comply with the Privacy and Electronic Communications Regulation or the Data Protection Act. We have been quite successful in this approach and this is the approach that we took for most of the organisations that we identified following The Daily Mail exposé.

Paul Flynn

The trustees of these charities are generally people doing work for the best of motives, usually at no remuneration for themselves. Are they in a position to impose better behaviour on their own charities? Are they informed enough? Do they have the powers to ensure that their charities do not stray?

Christopher Graham

Charity trustees, of course, have to work within the charity law and the law administered by the Charity Commissioner and I think this will be a wakeup call for the charity sector generally, including the trustees who I believe you are hearing from later. I think probably the direct marketing side of the charities were the ones who were being very buccaneering and felt they had right on their side. Their job was to raise as much money as they possibly could for good causes and that was manifestly a good thing to do. It has taken a lot of work to explain that the rules really do apply to them, but we think the message is getting through and if it still does not get through then we will not hesitate to use our enforcement powers to make sure the Privacy and Electronic Communications Regulations are observed.

Paul Flynn

Are you sympathetic with the charities who are competing for a shrinking pool of donations and they see a competitor charity using chuggers and using illegitimate methods of pressure on the vulnerable? Is it not inevitable that they have to compete in such a market and take on these bad practices?

Christopher Graham

No, I do not think it is inevitable and I think it is up to the regulator, including the Information Commissioner, to make sure that there is level playing field and everyone sticks to the rules. You could say isn’t it difficult for people operating in direct marketing generally because we are living in difficult times and people are buying less and so on, so surely you will turn a blind eye? The answer is no, I will not turn a blind eye, I will enforce the rules.

Paul Flynn

I am grateful to you, thanks.

Chair

Can we just go back to your notion of valid consent, which you said a few moments ago, if I recall correctly, that this is when somebody ticks a box in favour of being contacted?

Christopher Graham

Our best practice is that in a privacy policy or any communication there is an opportunity to opt in to receiving further communications, but it depends on the circumstances. There may be situations where opt out would be perfectly acceptable. The important thing is that the data subject, as we say, should be clear what the choice is and it is manifestly clear that if people are protesting that they are being bothered and contacted by charities, however worthy, that they do not want to hear from then they cannot be said to be consenting.

Chair

Is this a matter of law or is this a matter of best practice?

Christopher Graham

It is a matter of the Information Commissioner’s Office recommending best practice to comply with the law, with the Privacy and Electronic Communications Regulation and the Data Protection Act. But it is very difficult to say that in all circumstances a particular mode of consent is appropriate.

Chair

How much of what has been going on does not constitute valid consent, in your view?

Christopher Graham

Again, it depends on the circumstances. I think there was quite a lot of evidence from what we have been investigating that charities were using lists of names that were not their own supporters but were the supporters of somebody else or perhaps lists of people who had signed up to a lifestyle survey, as we have heard. They were likely prospects but they had not given their consent and that is what our investigation is really all about.

Chair

When did you first learn of these practices?

Christopher Graham

We were concerned about some of the big charities ignoring the Telephone Preference Service. We wrote to eight major charities in March 2014, so it was a long time before The Daily Mail got going. Interestingly, although we had very many complaints about nuisance phone calls, we had relatively few complaints about charities. It came as a surprise to us when we started investigating and we found that the Fundraising Standards Board were getting many, many complaints, but people were not complaining to the Information Commissioner’s Office, which was kind of odd because people are very ready to complain to the Information Commissioner’s Office about nuisance phone calls for commercial products. We have now established or are in the process of establishing a memorandum of understanding with the Fundraising Standards Board so we can share information. If they do have 50,000 complaints, then the regulator for the Privacy and Electronic Communications Regulations ought to know about that. But we did not.

Chair

If you knew about this long before The Daily Mail blew this into the public domain in a very big way, how satisfied are you that you were taking sufficient action about it?

Christopher Graham

I am very satisfied that we contacted the big charities that I mentioned—

Chair

That was not the question.

Christopher Graham

The answer to your question is that we have been engaged with dealing with nuisance phone calls on a very broad scale, working with other regulators over the past—

Chair

I will ask the question again. How satisfied were you, are you, that you were doing enough?

Christopher Graham

I do not think you can ever say we are doing enough. We are doing a lot. I am very satisfied that Steve Eckersley’s enforcement team is working very professionally with a whole series of police-like investigations on nuisance phone calls in general, of which charities are a part.

Chair

How long should a valid consent last for?

Christopher Graham

It absolutely depends on what the service is and what the offer was. You cannot say hard and fast.

Chair

If you tick a box or you fail to tick a box that excludes you from contact, how long should that negative consent last for?

Christopher Graham

I would say in the case of the gentleman who was the subject of the second Daily Mail investigation, to be deemed to have given your consent 14 years ago because you took out some pet insurance or signed a lifestyle statement is manifestly not consent.

Chair

What regulatory activity have you been involved in to deal with that problem?

Steve Eckersley

Mr Chairman, there are two investigations that I would like to highlight and one operation. First of all, Operation Linden is something that the Information Commissioner’s Office brought together and we are keen to work with other agencies in order to understand a little bit more about the way that list brokers and lead generators collect personal data and turn it into profit by selling it to large-scale organisations, and also the way that they trade personal data. I know it finds itself under what we call the data cycle. Quite often, that manifests itself further down the track with a resulting cold, unsolicited call, but more concerning is the fact that it also manifests itself into a scam, particularly targeting vulnerable members of the community, which obviously we are concerned about. We work closely with the police, trading standards and Citizens Advice to get a better foothold and hopefully disrupt that type of activity. Just turning to the two investigations, so first of all—

Chair

I asked a very short question and I am getting a very long answer. I am sorry, I am going to make you give me shorter answers because I think it will be more helpful. How effective has your regulatory action been at dealing with this problem?

Christopher Graham

Should I deal with that as the Commissioner? That is a bit like asking, “How long is a piece of string?” I am confident, as the Commissioner charged with regulating the Data Protection Act and Privacy and Electronic Communications Regulations, that the resources I have with my enforcement team are making a substantial impact on the scourge of nuisance phone calls, including charity calls. I can only know what is brought to my attention and what I am working on. You have asked for my opinion and my opinion is that we are being pretty effective, but I cannot know that there are not other concerns out there that are not being registered with the Information Commissioner’s Office.

Chair

I think that is a fair answer.

Mrs Gillan

Mr Eckersley, you were trying to give us two case studies that you were doing in your investigation, but the danger for me is that these charities in the case study you were trying to outline for us are very closely linked with scams, it would seem, which is a great shame because one sector is criminal activity and the other is trying to raise funds for good causes. However, will your investigations extend to looking at those charities who openly admit that they sell on their lists? We have been given evidence that there are at least two, if not more, charities that say to people, “We are going to sell on your details because it helps my charity make money.”

Steve Eckersley

The short answer to that, Mr Chairman, is yes, it will stretch to that, particularly under an offence in the Data Protection Act, and particularly under a breach of one of the principles, not least the first principle, which is fair processes.

Mr David Jones

Mr Graham, you mentioned the issue of how long a consent should be deemed to last. A lot of these tick boxes contain a phrase of the sort, “We will share your details with a select number of other companies, carefully selected” or words to that effect. We have had evidence that, in fact, these were being widely sold by the charities and in fact became a commodity that were traded widely in the marketplace. How would you interpret such a narrow consent?

Christopher Graham

In the case that is highlighted in the papers today of Pharmacy2U—it is not the charity—we have imposed a civil monetary penalty of £130,000 for just that activity. Information had been traded and has landed up in some very undesirable hands, including an alternative herbal remedy product that had been criticised by the Advertising Standards Authority for misleading advertising and, unbelievably, an Australian lottery scam. That is where a company takes unto itself the right to pass on information because they said, “We would like to pass your details on to companies that may have been of interest,” but I should not think anyone thought they were going to be dealing with an Australian scam lottery. We have imposed that civil monetary penalty because that is a breach of the first data protection principle under the Data Protection Act of fair processing. It is not fair processing. You have to see it to make that judgment: is that fair or not? Many times we find ourselves ticking boxes that companies will introduce us to other companies that they believe will be of interest to us, but it is stretching goodwill too far to include Australian scammers.

Mr David Jones

You mentioned a moment ago that you can only respond to complaints that are made to you. Do I understand that to mean that you do not act proactively?

Christopher Graham

We have an invitation on our website, which is now very well publicised, for people to register their concerns about scam mail, about nuisance phone calls, and we can build up a picture from all those small instances that lead us to where these mail shots are coming from and phone banks. That is how we are able to execute warrants to raid the warehouses where the mobile phones are firing these things off in Hove, Trafford and so on. Although it is as nuisance when you receive one of these calls to have to do something else, going on the ICO website and registering your concern really does help Steve and his team to identify who these people are and get on with it. But a bit of mystery shopping—am I allowed to say that?

Steve Eckersley

Yes.

Christopher Graham

We are also doing some mystery shopping where we buy SIM cards and we—perhaps I had better not go into too much detail about that. We set out to get called.

Mr David Jones

So you do act proactively?

Christopher Graham

Yes, we do. It is a combination of consumers contacting us and us then following up useful leads and doing a bit of mystery shopping.

Mr David Jones

How big is your enforcement department—Mr Eckersley’s department?

Steve Eckersley

A couple of years ago before the problem manifested itself we were around 28 strong and now it is just short of 60 strong, but not all those investigators are investigating this particular problem. In terms of the Privacy and Electronic Communications Regulations, cold calling, we have at any one time about 12 to 15 investigators investigating cases across the UK. We have been very successful. If you look at the amount of penalties that we have issued, it is quite substantial. There was a significant change, though, in April of this year when the Government removed the threshold. At one time in relation to breaches of PECR, as it is termed, we had to prove substantial damage and distress but we argued the case that that should be removed so that we could take more effective regulatory action, and that happened on 6 April. We have many fines in the pipeline and that is exactly what we are going to do. We are going to target organisations and we are going to hold them to account and issue fines where appropriate.

Mr David Jones

Mr Graham, you mentioned that last year you became aware of the activities of, I think, eight charities that were causing you concern?

Christopher Graham

Yes.

Mr David Jones

Given that, what was your personal reaction to the allegations made and published by The Daily Mail?

Christopher Graham

I was very shocked at the nature of the abuse that was uncovered, in particular the case of Olive Cooke, which I think we all found very distressing. This is something that we have been concerned about for the past five years and, working with the Serious Organised Crime Agency, trading standards and Citizens Advice, we are co-sponsors of a campaign called Think Jessica, which was specifically designed to raise attention so that people will watch out for vulnerable elderly people who were subject to mail scams and phone scams. It looked as if this was sort of a variant of that with somebody who was elderly, had a great sense of public spirit, wanting to help, a poppy seller and so on, just being driven to distraction by repeated requests for money by different charities. We are very aware that those people who are elderly and living alone are particularly vulnerable. They are at home for a start, they believe that when the phone rings it might be important and you answer it, and very often they have a sense of public spirit and they somehow feel guilty that they are not contributing. They need to be looked after particularly.

Mr David Jones

But you cannot have been wholly shocked, I would suggest, given what you had experienced the previous year when you obtained details of the other eight charities?

Christopher Graham

I think the circumstances of that particular case we would all agree were particularly distressing, but it was not the first time certainly, because of our involvement with Think Jessica, that I have heard of this sort of case, I have to admit. What I was shocked about in relation to the second case, Mr Rae, was I became increasingly concerned that the evidence was that the fundraisers believed that they were somehow above the law and a special case. It took an awful lot of persuading that there was not a trade-off to be done. I felt in the early contact with the Institute for Fundraising and with some of the major charities that they were concerned, not to comply with the law, but to see whether there was some wiggle room, and whether I would accept that there was a balance to be found between the privacy of individuals and the manifest needs of the charity and the fantastic work they were doing. I just had to explain, sometimes in rather blunt terms, to some leading charities, “I am sorry, there is not a trade-off here. That is the law. You have to stick to it”.

Mr David Jones

Were any of the charities identified by The Daily Mail among the charities that you had been concerned about the previous year?

Steve Eckersley

Yes.

Mr David Jones

This was well over 12 months before The Daily Mail published its article, so those organisations clearly were still carrying out those activities in June of this year, notwithstanding that you had approached them in the early part of last year?

Steve Eckersley

Yes.

Christopher Graham

We had drawn particularly to their attention the fact that the Telephone Preference Service could not be overridden except with prior consent. To the extent that one of the problems that The Daily Mail was issuing was the frequent overriding of the Telephone Preference Service because of this concept of warm donors and so on, that was certainly very disappointing. But I do stress the fact that the Fundraising Standards Board had apparently had 50,000 complaints was unknown to us. If we had had that level of complaints at the Information Commissioner’s Office, we certainly would have been faster on the case.

Mr David Jones

But with respect, you expressed concern in the early part of last year to some of the charities who were later identified by The Daily Mail. It is quite clear that they ignored what you told them, didn’t they? They just carried on with their previous practices?

Christopher Graham

It appears that that is the case.

Mr David Jones

Don’t you feel, frankly, that as a regulator you have failed in relation to those charities?

Christopher Graham

No, I absolutely don’t, because we acted on the information that we had. The information that bad practices were continuing was going to the Fundraising Standards Board and not to us. Meanwhile, in another part of the world, I have got the Home Affairs Committee demanding that we take action on the issue of private investigators. Steve’s team was heavily involved with another operation, Operation Spruce, dealing with that, and then working with the other regulators on nuisance phone calls generally—Operation Spruce and Operation Linden. We were not inactive, but we were active on a very wide front.

Mr David Jones

You may not have been inactive but what I am suggesting is that you were ineffective in curbing the activities of these charities, who continued their abuses until June when The Daily Mail exposed them.

Christopher Graham

All credit to The Daily Mail. We have been acting on that information, and the evidence is that the charities are now coming to heel. I am confident that we are going to be able to enforce the law. I think some of the suggestions that have come from Sir Stuart Etherington’s review are probably unnecessary and probably going to make the situation less clear than it is now. But there should be absolutely no doubt, from all the coverage of this issue and the interest of no fewer than three Whitehall Departments who have been scrambling to take action on the charity issue, that the problem is now being dealt with. It is easy to regret the locust years, but we are getting on with it now.

Mr David Jones

Do you consider that if the allegations of The Mail are true that those charities have broken the law?

Christopher Graham

That is what we are investigating.

Mr David Jones

So you do think there is a prima facie case that they have broken the law?

Christopher Graham

There is certainly a prima facie case. The investigation is to see whether the breaches are of a civil nature, or possibly in some cases of a criminal nature, and then decide what the appropriate thing to do about it is. But I am concerned to get compliance by hook or by crook, and I think we are succeeding.

Mr David Jones

Would you like the law to be tightened?

Christopher Graham

If I had a shopping list of things that I would like, I would like our direct marketing guidance to have the status of a code laid before the House and recommended by the Secretary of State. That is one of the recommendations that you might make, because then organisations like the Institute of Fundraising, or whatever is a successor body that is going to be the code-writing body, and the Fundraising Standards Board and so on, would have to have regard to a statutory code. I think that would be good. I am not in favour of the fundraising preference service idea, which I think is simply a confusion. The Telephone Preference Service is something I can enforce under the Privacy and Electronic Communications Regulations. I am worried that the fundraising preference service is something that I would not have any status to enforce, and it just might lead to greater confusion when we need clarity. One change I would like this Committee to consider would be to deal with individual rogue elements working within charities, where there is a criminal breach of the Data Protection Act. As we learned from the “Money Box” programme on Saturday, someone at Aviva had decided to put a whole load of customer information out there, and that is a criminal act that is being investigated by the police, or the story we saw in The Sun yesterday of the payday loan companies. Where you have individuals simply going rogue, the penalty under the current legislation, until an Act of Parliament that you have passed is commenced, is a fine-only regime in the Magistrates’ Court, and that is desperate. When you passed the Criminal Justice and Immigration Act in 2008, in section 77 you provided for the possibility of a custodial penalty, and that has never been commenced. The Justice Committee, the Home Affairs Committee, the Joint Committee on the Communications Data Bill and Lord Justice Leveson, have all said, “This ought to be commenced.” But it still has not been commenced, years after you passed it. It is increasingly clear that data, which is so valuable, is very vulnerable to rogue behaviour by individuals. I can impose all the civil monetary penalties I like for the civil breach, but we need a criminal breach.

Chair

We have got the point. In this case, we are not dealing with individuals. We are dealing with large charities and organisations who have contracted to work with charities.

Christopher Graham

Well, hang on, because until we have finished our investigations we do not know exactly what all the details of the chain have been.

Mr David Jones

Finally, could you tell us which were the charities that caused you concern last year that were identified in The Mail?

Christopher Graham

I will have to write to you on that, because I have this in the briefing but—

Mr David Jones

You will write and tell us that?

Christopher Graham

I will write and tell you that.

Oliver Dowden

You mentioned the story in The Mail today and the sale of the data to the Australian lottery company. As I understand it, that was in relation to over-70s, and there seems to be a pattern here of the sale of data in relation to vulnerable people. Is there a higher level of consent required for vulnerable people? Do you differentiate as to the level, the way in which people can consent, as between an ordinary person, a more elderly person, a more vulnerable person? Is there any differentiation there?

Christopher Graham

There is no differentiation in the law, but the £130,000 penalty was for the breach of the first data protection principle, which is that personal information must be processed fairly, and there is quite a lot of evidence of unfair practices. If people are being particularly singled out because they are elderly and vulnerable, that obviously would not be fair. Again, it is a question of looking at the individual cases and deciding what is appropriate.

Oliver Dowden

But you do not issue specific guidance to ask for a higher level of consent required from people who are, for example, suffering from dementia or very elderly?

Christopher Graham

I have mentioned the Think Jessica campaign that we have been involved in for the past five years, and our direct marketing guidance makes it very clear that the offer to the consumer has to be clear. The privacy notice has to be clear. There is no point in producing a load of either legal gobbledegook that nobody can understand or a tick box buried at the end of pages and pages of stuff when you are not quite clear whether the tick box is to opt in or opt out, or perhaps you are ticking a double negative. There is a lot of subterfuge involved in all this, and that is what we are trying to combat.

Chair

I think the point that Mr Dowden is making is that, if somebody is on the end of a telephone and they are clearly confused and there is persistent means to try to obtain a form of consent from that confused person, surely that is against the law? That should be against the law?

Christopher Graham

You can’t seek consent over the phone, because you should not be—

Chair

What about somebody who is already on a direct debit and you are seeking to get them to increase their direct debit and you have somebody confused on the end of the phone? We have had the evidence that this is what they do. When they are confused, they ask them not how much they want to give but whether they want to increase the amount and can they remember how much they have just said they are going to increase the amount. If they can remember, that constitutes consent. Off they go; they raid the bank account for more money.

Christopher Graham

I have to work within the Data Protection Act and the Privacy and Electronic Communications Regulations, but the Charity Commission and the new regulatory structure that has been recommended by Sir Stuart Etherington may very well have views about what charities ought to be doing in relation to more vulnerable people. The law does not make a distinction.

Chair

The law does not make a distinction, so what these call centres have been doing, in your view, is legal in that instance?

Christopher Graham

On that particular point, you might well take the view that it is not ethical, but that is a matter for charity regulation rather than data protection.

Chair

But doesn’t that raise a problem about the whole system of regulation that we have, which is that you produce guidance and rules and then there are going to be people who say, “If the rules don’t stop you doing that, that is okay and we will do that”? How would you bring ethics into a system where the rules themselves are just a reflection of what we try to get people to do ethically, but in themselves they do not carry values naturally. They do not make people better people. That is the problem, isn’t it?

Christopher Graham

Data protection law and the Data Protection Act and the Privacy and Electronic Communications Regulations is only part of the regulatory structure or the phenomenon that you are looking at, which is charity fundraising. The role of the Charity Commission and the role of the Fundraising Standards Board, or whatever its successor body will be, is important. But I am part of that bit that deals simply with the direct marketing operation, and the rules that we apply are the rules that apply to anyone who is in the direct marketing business. That is why I see it as part of the nuisance phone calls.

Mrs Gillan

In your written evidence to us you made a point, at point 20, that there are a number of enforcement tools available to you for taking action against anyone who breaches the PECR—the Privacy and Electronic Communications Regulations. There is criminal prosecution, non-criminal enforcement, consensual audits and power to serve a monetary penalty—to impose a fine of up to £500,000. Have you ever taken action against any charity?

Christopher Graham

We are in the process of conducting that investigation, and the answer is yes. I have imposed civil monetary penalty on a charity for a breach of the Data Protection Act. It was not for this activity; it was around a security issue. But I do not say, “Oh dear. Charity. Can’t go there”. The rule is that the rules apply to everybody.

Mrs Gillan

But it is just one charity over the last five years?

Christopher Graham

One springs to mind, and we will see where we get to with the investigations that are resulting from this latest flurry.

Mrs Gillan

It is just that you have had these powers for approximately five years, and also you raised the red flag over 12 months ago. I am surprised that you are not that much further on 12 months later. Do you think that you have possibly dragged your feet a little?

Christopher Graham

No, absolutely not. I think the Government dragged their feet in introducing the change that was brought in in April to lower the test that we had to prove so far as the Privacy and Electronic Communications Regulations were concerned. Previously, we had to establish that the activity had caused substantial damage or substantial distress, which was really quite difficult to do. It took an awful lot of persuading to get this change made, but since 6 April it is much easier and, as a result, in terms of phone activity generally, we have imposed a total of £1.7 million in civil monetary penalties, with another £1 million coming down the track. It is not all charity, but nevertheless the activity is being effectively dealt with.

Mrs Gillan

The change was 6 April this year?

Christopher Graham

Of this year, and we have been arguing for it for, what—

Steve Eckersley

18 months, two years.

Christopher Graham

We put the business case up and then nothing happened, and eventually I had to get extremely stroppy about it.

Chair

Which allegations is the investigation that you announced in September covering?

Steve Eckersley

First of all, the first part, Operation Cinnabar, is focusing on the allegations that were explored by The Daily Mail in the early part of the year, and the second investigation—

Chair

I am sorry, just tell us exactly what you understand those allegations to be.

Steve Eckersley

It was around charities making what were perceived as unlawful calls. It was around charities and other organisations buying and selling and trading personal data, which obviously stretches into the Data Protection Act, and you can see the interaction between the two legislations. That was the first aspect. We have held 13 compliance meetings with the organisations—

Chair

What is the second investigation’s aspect?

Steve Eckersley

The second investigation relates to the exposé uncovered by The Daily Mail in relation to Mr Rae. This is where he was contacted by apparently hundreds of organisations, and further down the track he suffered some actual fraud. I think he lost around £30,000 in personal finance. There are two investigations. Some of the charities are involved in both and, as Chris said, we will contact you in relation to that. But they focus on broadly the same issues: first of all, whether there are any breaches under the Privacy and Electronic Communications Regulations; and, secondly, whether there are any breaches under the Data Protection Act. These are civil-based investigations. But just picking up on the point made earlier, Mr Chairman, if we do uncover evidence that people have broken the law and breached section 55 of the Data Protection Act, which is a criminal offence, we will take action and, if necessary, prosecute them. The Information Commissioner’s Office is a Crown prosecutor. We are entitled, together with the CPS, to take enforcement action, and we will do if that presents itself.

Chair

A lot of this activity was carried out not by the charities themselves but people contracted to the charities. Does that mean the charity could be subject to prosecution, or does that just mean you prosecute the contractor?

Steve Eckersley

There is a possibility that the charity could be subject to a prosecution. I just want to make the distinction, though, if you are referring to prosecution, do you mean for a criminal offence or non-criminal?

Chair

I don’t know. I am asking you.

Steve Eckersley

Quite often it is misinterpreted. If we take civil proceedings in relation to an organisation that is responsible for a civil breach of the Data Protection Act or PECR, quite often we do hold the organisation to account and, on occasions, the organisation will have to pay a fine. But in terms of criminal conviction, we have various powers under the Data Protection Act. Non-notification, for example, where the organisation fails to notify the Information Commissioner’s Office that they are processing personal data, is a good tool for us in terms of our ongoing work in this particular area. Many organisations led by individuals have been prosecuted for that. If the opportunity does present itself, we will take the necessary enforcement action.

Chair

What happens to the individuals who are running call centre companies that have now gone bust? Are they potentially personally liable for civil or criminal investigation?

Steve Eckersley

They may be liable for criminal prosecution, but there was a difficulty that we have highlighted before in relation to individuals who basically go bankrupt or collapse an organisation, only to recover then and start off again as a phoenix organisation. We recognise the problems in relation to that, and this is something that we need perhaps to work with other partners to combat.

Chair

So the people who have dissolved their companies already have protected themselves?

Steve Eckersley

To a certain extent, yes. As I say, they may well have protected themselves from civil proceedings but not necessarily in relation to criminal proceedings.

Chair

To what extent will you pursue these people as incapable of being fit and proper people to be directors of companies?

Christopher Graham

We are working with the other members of the round table dealing with the nuisance phone call issues on the suggestion to Government that directors should be disqualified under similar circumstances, and that is an idea that is being given consideration to. One of the operations involved in this dissolved pretty quickly, went out of business pretty quickly, and then turned up as still fundraising.

Chair

Exactly. What can you do about that?

Christopher Graham

I think Ministers are well aware of the issue and it would involve a legislative change.

Chair

When will you be publishing the results of these two investigations?

Steve Eckersley

It is difficult to give you a specific date, but we will do it as quickly as possible. Operation Cinnabar is far more advanced than the second investigation involving Mr Rae, but as soon as we have an outcome we do intend to publish that.

Chair

Are we talking weeks or months or years?

Steve Eckersley

In relation to the first operation, probably months. I think Beaufort is much more complex than the first investigation, because it could lead to a criminal prosecution if there is evidence of wrongdoing or a criminal breach, so that is further down the track. As I say, I think it would be dangerous for me to suggest a particular date of completion.

Chair

What takes so long?

Steve Eckersley

What normally takes so long is gathering the evidence, and that evidence could be obtained from a wide range of sources including, for example, the organisations themselves. It may be that we need to interview witnesses. It may be that we have to share information and obtain evidence from other organisations.

Chair

How many people do you have on that particular investigation?

Steve Eckersley

There are around two or three investigating that particular aspect. They start the investigation off, developing the intelligence sources, finding out a little bit more about the general compliance history, about the organisation concerned, the charity concerned, to see whether they have breached the Data Protection Act previously or the previous electronic communication regulations. They bring that together and then we will grow the investigation and the team around that.

Chair

Mr Graham, how do you prioritise investigations in your organisation?

Christopher Graham

We assess the threat. We assess the level of noncompliance and misbehaviour. I am very glad that I have an enforcement team that is led by a distinguished, retired member of the Greater Manchester Police force, and many of his colleagues similarly. This is a very professional operation. But data protection has come so high up everyone’s list of priorities now that scarcely a week goes by without some new scandal being drawn to our attention, and deploy people on this, deploy people on that. I am reminded of being given a very hot time by Mr Vaz and the Home Affairs Committee in order to prioritise the investigation of private investigators. Naturally, Members of Parliament are very concerned that the Information Commission is doing its job. The organisation, over the past six years while I have been Information Commissioner, has grown in scale and complexity. We have over 400 staff now. It is a £20 million company. I think we do a pretty good job.

Chair

Can I just join in the festival of pressure on the Information Commissioner and suggest that the seriousness of the allegations made about the whole charitable sector are potentially extremely damaging to the whole sector? How important do you think it is to put more than three people out of 60 investigators on that particular investigation?

Christopher Graham

The enforcement department that Steve leads is able to flex to deal with particular investigations that need to be taken forward. Using the information hub, colleagues in other departments and so on, we can act very effectively. The fact you have three individuals working on that investigation at the moment, doing what needs to be done to get the information together, is probably fine.

Chair

Can I just ask Mr Eckersley a question? What is the relationship between the number of people you put on an investigation and how quickly you can do the investigation?

Steve Eckersley

It is a combination of things. Obviously, volume of information and evidence to review. It is identifying the different lines of inquiry; identifying whether there are other organisations that can support the investigation.

Chair

Yes, I understand that, but what is the relationship between—

Steve Eckersley

Although I have highlighted the fact that there are two or three individuals who are commencing the investigation, I did say that we would grow that in scale and size, and that is ordinarily what happens in our—

Chair

Can you answer the question? What is the relationship between the number of people on an investigation and how quickly you can conduct the investigation?

Christopher Graham

If I put 100 officers on it, I could do it more quickly.

Chair

Thank you.

Christopher Graham

Can I also make the point, though, that in another part of the organisation, our policy delivery department, our strategic liaison people are working with the charity sector to make sure that they understand what the rules are. Compliance is not just a question of going after what happened previously; it is also about making sure that standards are raised now.

Chair

Understood.

Christopher Graham

It is not just the enforcement.

Tom Tugendhat

Can I take on exactly from that point? Your point about compliance and working with others is very important. Could you tell the Committee a little bit about how you intend to work with the other regulators who do fundraising and seeing how you can take this forward, so that it is not only your three investigators but your three investigators plus the others?

Christopher Graham

I mentioned that we were developing a memorandum of understanding with the Fundraising Standards Board. I have had some good meetings with the Institute of Fundraising. I have had good meetings with individual charities, who I think now get it. But I do see this as part of a subset of the whole nuisance phone call scourge, and that is where we are working through Ofcom with the Telephone Preference Service, with the Consumers’ Association, Which?, and so on, to try to synchronise our swimming, to make sure we really make the—

Tom Tugendhat

I understand that, but while it is in some areas a subset of the nuisance phone call scourge, it is actually a very specific charity sector threat as well because of the ethics and the regulations surrounding it. Can you talk a little bit about the successor organisations that may come along and how your memorandum will affect those and when you hope it will come into effect?

Christopher Graham

I had a very good meeting with Sir Stuart Etherington and the National Council for Voluntary Organisations when he was producing his report. I will wait to see what institutions emerge from the new structure, but it will be very important to work in a joined-up way with them. Any memoranda of understanding that we have, we would then seek to have similar with the new bodies. We are part of the solution, we are not the whole of the solution, but we must not ever have a situation again where the Fundraising Standards Board is aware of complaints and we, as the backstop regulator with the statutory power to deal with it, were not aware.

Tom Tugendhat

No, indeed, but there is more to it than that as well, surely, from your perspective, which is to help to make sure that the code of conduct that is written for the Fundraising Standards Board, and whoever their successor organisation is, is not only compliant with the law but is compliant with the ethical construct that you would see as essential for all people holding information.

Christopher Graham

That is why I want statutory recognition of our direct marketing guidance because then the new bodies would have an obligation to have regard to a statutory code. Something can be done there, I think. There should not have been any doubt that the direct marketing guidance of 2013 applied to charities as it applied to everybody else. But I suppose it might have helped, in retrospect, for that to be a statutory code to which they had to have regard.

Tom Tugendhat

The last point I was going to ask is about your existing powers, and you are clearly asking for an extension of existing powers there in that particular area. On a very specific area, we have come back time and again here in this morning’s session, both in the public and the private session, to the abuse of vulnerable people, whether that be the elderly in general or whether that be more specifically those with dementia and with memory problems. I am very keen to nail home here this question: do you think that there should be specific regulation, specific powers under your authority, to protect those who are being targeted in a particularly nasty way, if I may say, which is those who may not be entirely aware of the surroundings of the call and who are being abused by those organisations?

Christopher Graham

I can give advice on best practice and working with other agencies through Think Jessica, and I think we were doing that. But I am a creature of statute; I am working with the Data Protection Act and the Privacy and Electronic Communications Regulations. To the extent that the landscape may change with the General Data Protection Regulation, which is being finalised in Brussels at the moment—and presumably there will be a knock-on to PECR—I will obviously apply whatever the law is. But best practice goes a bit beyond that. I think we have all learned from the experience of recent months, and to the extent that there are more and more people who are over 70 and who are apparently being targeted, then it is a question of all agencies taking that on board and doing what we can to protect them.

Tom Tugendhat

Do you think, though, there is more than that? I am really trying to get home here the fact that if I were to be bothered by nuisance phone calls I hope I would be aware enough to deal with it myself. If various of my relatives were to be bothered by it and they are in a vulnerable state, whether slightly mentally or slightly due to age, where it is not just a nuisance but abuse, surely it should be considered a crime.

Christopher Graham

Yes, but the point I am making is that it is not a crime under data protection law. But one of the encouraging things about the second Daily Mail story was that Mr Rae’s son, acting with a power of attorney, exercised rights under the Data Protection Act with subject access and blew the whole thing open. I think we all have a responsibility to look after elderly relatives, elderly neighbours. That is what the whole Think Jessica thing was about and I am proud that we were involved in that initiative.

Tom Tugendhat

Do you think you require extra powers in order to make sure you can fulfil that duty even more?

Christopher Graham

Not specifically that duty, but I would stress that if we commenced section 77 of the Act that I referred to and Steve knew that he was dealing with a recordable offence and, in the case of criminal reach of the Data Protection Act, could interview people under caution and require them to attend instead of having to ask politely, and if the perpetrators of this knew that a recordable offence would be on their record and that they could go to prison, that would make a huge difference to this whole dirty world of dealing in people's personal information.

Kelvin Hopkins

I think my colleagues have teased out or I suggest that you were asleep or at least dozing on the job before these newspaper reports came out. You mentioned in passing that you became aware there were 50,000 complaints that you apparently had not known about before, which suggests you have had a rather relaxed attitude toward this over a long time. Then also you seem reluctant to want the law to be strengthened and that you do not want Etherington to be beefed up, as I think I would personally. Don’t you think a bit more rigour, a bit more passion and a bit more enthusiasm would be a good idea?

Christopher Graham

I am sorry if I have not been conveying passion and enthusiasm and I do not recognise the sleeping bit. The 50,000 complaints, to be clear, were made to an organisation called the Fundraising Standards Board. They were not made to the Information Commissioner’s Office. I might have been alerted. I should have been alerted to this but I was not, so I am putting in place a memorandum of understanding to make sure that I am. We do get a lot of complaints about nuisance phone calls. We get surprisingly few about charities. We still get surprisingly few about charities despite all the hue and cry. I do not want to rehearse what I have already said to the Committee, but I think we are working hard, we are making a difference, we are calling the sector to order. I think it is unreasonable to criticise the Information Commissioner’s Office for doing what we can in this area and I think you will see a difference.

Kelvin Hopkins

Is it partly because the charities, or these companies that fundraise on behalf of charities, target elderly people in particular, people who are less likely to complain and perhaps less able to complain? We have a responsibility of linking with the Ombudsman and one of the problems I think with the Ombudsman is that, if you are articulate, confident and professional, you can deal with these people. But if you are not, and if you are an ordinary person dealing with institutions, even knowing about them and knowing where to complain, it is difficult. If you are relatively poor, relatively uneducated, and relatively more working class and elderly, you are not going to be in a position to complain, and you are going to be bullied by these people in a way that has led to at least one suicide it seems.

Christopher Graham

We are all concerned about the impact on elderly and vulnerable people but I suspect we are all subject to hypermarketing by the charity sector. Do we all complain? I know when I get a nuisance phone call I should go on to the ICO website and log the details but I do not. I just shout at the individual who has been doing that. But there is no reason why there should be fewer complaints about charity fundraising of that sort than there are of commercial companies unless it is that people feel some sort of sense of restraint because after all it is a good cause. But I have charities that are absolutely in overdrive in terms of direct mail and also phone calls, and I have to say hand on heart I do not always complain to the ICO. I do not think we should say it is only the over-70s and only the vulnerable who are being targeted in this way. I should not think the charities would raise very much money if they were.

Chair

But the law needs to protect the weakest, not the strongest.

Christopher Graham

Yes, but the point Mr Hopkins was making was that there are fewer complaints because it is the over 70 year-olds who are vulnerable who are being targeted.

Chair

Could you say when you are going to publish the Think Jessica report?

Christopher Graham

The Think Jessica report is a project that has been running for the past five years. I can send the Committee details about it.

Chair

Would it not be beneficial to everybody concerned if you did produce a report that people could draw upon while everyone is thinking about this?

Christopher Graham

I have two tasks as a result of this session. One is I am going to write to you with the names of the eight charities we contacted in March 2014 and warned about the Telephone Preference Service, and the other thing is I will send you details of the Think Jessica project.

Chair

That is very helpful, thank you, and we will publish it on our website. You have made some criticism of Etherington and there has been some reference to what additional powers you could do with. Could you send us a note summarising your critique of Etherington, what you think is good and what you think is going to be less helpful, and also what additional powers you think you will need?

Christopher Graham

Certainly, Chairman.

Chair

Am I right in saying that one of your obligations is to advise the Government on data matters?

Christopher Graham

Yes.

Chair

This comment my colleague makes that he feels you were asleep at the wheel, what advice were you giving the Government about all this before the newspapers hit?

Christopher Graham

I have already explained that we had been badgering the Government to make it easier to impose civil monetary penalties for nuisance phone calls over an 18-month period. Finally I threw all my toys out of the pram and the legislation was fast-tracked just before the general election and that has made a significant difference.

Chair

But there are other aspects of this that, for example, you did not know about or you were not being complained to about. What we really want to know is what you personally have learnt from this experience and what you think your organisation needs to learn from this experience.

Christopher Graham

Yes. The earlier question was what advice had I given to Government and I could not give advice to Government about complaints to the Fundraising Standards Board that I was not aware of.

Chair

I appreciate that. Let us go on to the question I just asked.

Christopher Graham

Yes. What have I learned?

Chair

What do you think you as Information Commissioner should learn from this in retrospect and your organisation should also learn?

Christopher Graham

That my organisation should be on the front foot in terms of enforcing the law. We should be proactive. We should be doing more of the mystery shopping rather than clearing up after the event. Then we should be horizon scanning. It is a fast-moving sector. We should not wait for problems. We should be looking for trouble, frankly, Chairman.

Chair

That is a good way of putting it. What was your first reaction as you looked at the front of The Daily Mail and these stories were being published? What was your emotional reaction?

Christopher Graham

I was sick to my stomach when I read of the lady who had thrown herself off the Clifton suspension bridge. In the case of Mr Rae, similarly I felt someone had been taken advantage of but I was proud that his son had used the rights that every citizen has under the Data Protection Act to get access to their personal information. In the son’s case, he was acting the power of attorney to get the information from various data controllers and that has provided the trail that will help us to find out what went wrong.

Chair

How much did you think, “Oh dear, I should have known more about this”?

Christopher Graham

I think if I spent a lot of time worrying about what I should have known—I have quite enough to deal with the things that I do know about, but it is certainly true that we need to be on the front foot rather than simply reacting to bad news that comes our way.

Chair

In our report we will try to make as positive suggestions as we can about recommendations about the Information Commissioner’s Office in this. But could I emphasise on behalf of the Committee that we know that public money is very scarce; I expect your resources are very scarce? I expect the people in your organisation work very hard. We thank them for what they do; we wish them well. We hope that the suggestions we make in our final report will be positive ones and ones you feel you can act on.

Christopher Graham

Thank you, Chairman and I am sure that my staff, who will have been looking at the broadcast, will be very appreciative of the remarks that you have made on behalf of the Committee.

Paul Flynn

You have several times said that you were surprised because the level of complaints you have from charities is relatively low but a great deal from other areas in which there is abuse of telephone systems. Can you give some idea of the proportion of this? What proportion of complaints do you have about charities and about other organisations, because we realise The Daily Mail has its own agenda on this?

Chair

Can you pop that in your written note?

Christopher Graham

We can write to you with the statistics.

Chair

Sorry, Paul. I do apologise but we are 10 minutes behind already. Thank you very much indeed. Examination of Witnesses

Witnesses

Karen Brown, Chair, Oxfam, Daphne Harris, Chair, RSPCA, and Mark Wood, Chair, NSPCC, gave evidence.

Chair

While you are still sitting down, may I just emphasise that you are each chair of the charity that appeared before us in the guise of chief executive earlier, but missing is Save the Children Fund. I wish to emphasise that it is not their fault and we are going to subject them to the same questions, albeit in writing, and you have not been singled out unfairly. It does allow you to give fuller and franker answers with only three of you here. Thank you very much for joining us. Could I ask each of you to identify yourselves for the record?

Karen Brown

I chair Oxfam.

Daphne Harris

I chair RSPCA.

Mark Wood

I chair the NSPCC.

Chair

Thank you. Could I ask each of you to summarise the values and ethos of your charity?

Karen Brown

Our values are inclusivity, empowerment and accountability and I believe it is very important that we carry those through in every aspect of Oxfam’s work.

Daphne Harris

Ours is compassion, integrity, courage, commitment and vision, and equally I would like to believe that they are carried forward in everything we do, from our volunteers to our staff and everybody who bears our name.

Mark Wood

Putting children first and in particular a concern as to the legal state of children relative to adults. Taking a stand; running a series of campaigns particularly where we see discrepancies in the law relating to cruelty and abuse. Making an impact. It is particularly important that we calibrate the effectiveness of the activity we undertake with donors’ money. Never settling for second best, which is avoiding compromise so that when we pursue an objective we pursue that objective relentlessly. Finally, working together, and this is the element of collaboration between ourselves and other charities with similar charitable objectives and also with the Government and, most importantly, with the social services.

Chair

Could each of you summarise the values and ethos of your charity and its relationship with your donors?

Mark Wood

We have published a charter that is designed to enshrine our relationship with donors. That has specifically addressed the three areas of concern that result from the recent publicity around fundraising activities among the charities and across the charities sector. The first is that we never sell data relating to our donors. We are quite clear about that. We do not do that.

Chair

You have never done that?

Mark Wood

We have never done that, we do not do it currently and we are not considering doing it into the future. The second is that we do not breach the Telephone Preference Service unless we have specific reason to imagine that somebody has registered with the TPS but has also explicitly, unequivocally and unambiguously indicated that they would like to hear from us and continue to be updated by us. The third is that we have a very prescriptive code around the number of times that we contact our donors in a year, so there is a six-monthly interval between contacts and therefore—and this will depend on how the calendar falls—the maximum number of times an individual should expect to hear from us over 12 months is three times.

Daphne Harris

We do not cold call, because we do not think that is right. People in the past have opted out but we are looking at that with the Etherington report and welcome the review. But we believe that our donors are our life blood and we very much appreciate the way they support us. We have 55,000 and growing, so it is in our interests to find out what they want from us and I think what has happened is going to sharpen our focus a great deal.

Karen Brown

I would agree with what my colleagues have said, that our supporters are our life blood. They enable us to carry out work around the world to try to radically affect poverty. We have 400,000 supporters who give to us, of which 160,000 have been with us for more than 10 years. I believe that that is partly because we treat them fairly and we do not pester them. We, too, do not cold call. We mind a lot about consent. We have opt-in and opt-out procedures and in any communication with our supporters we always remind them that they can contact us and make it very clear how they can contact us if they wish to indicate a preference. At the current time, two-thirds of the phone numbers we have from supporters or contacts on our database are opted out from receiving phone calls from us at all. I give that as an example of the fact that we are putting into practice our values and our ethos. We, too, have a supporters’ charter and it makes absolutely clear that we do not sell any of our supporters’ data or share data with anybody else and that has been the case for as long as I can identify.

Chair

How do you see your duties and obligations as trustees in respect of your oversight of fundraising? You have answered that question to a degree, but that is now. What went wrong before The Daily Mail blew the gaff on some of what was being done in your name?

Mark Wood

I think fundamentally, and I am sure this is consistent across many charities, we are confident that we have procedures and practices that regulate the way we relate to donors in an appropriate way. However, I think what we have identified here are some breaches in terms of those suppliers who assist us with fundraising from those practices, and that is what has caused us concerns.

Daphne Harris

In addition, we have stopped exchanging data with other charities or other organisations. We have reviewed the way we work with Listen, the company we use to do our fundraising, with more focus on quality instead of quantity. I think that is very important and that is something we have decided. We are happy with the way they have dealt with the accusations by disciplinary action or further training. We have put that into train as well and we have set up a new committee on fundraising to get better oversight with a specific group of trustees monitoring the issue.

Chair

Do you have anything to add to that?

Karen Brown

A little bit. I will try to keep it brief. Ultimately trustees are responsible for what has happened and we take that responsibility very seriously. I think there are two things. We have let the general public down insofar as those who are working in our name—agents—have acted in ways that are simply not acceptable. We are very sorry that that has happened. However, we do have monitoring procedures in place. The shame of it is that our monitoring procedures were not adequate to the task. For some reason they did not spot what was going on in these agencies.

Chair

How often in your trustee body, before all this became very public, did you discuss the ethics of fundraising, the practices of fundraising and the oversight of fundraising?

Karen Brown

I have looked back at our agendas, and in our board meetings across the last five meetings fundraising has been actively discussed in at least four and in some of those board meetings it would be a specific session rather than as part of the chief executive’s report.

Chair

How much of that was about how to raise more money rather than about how the money was being raised?

Karen Brown

I think the answer is obviously we monitor the amount of money that is being raised but we do raise questions about the way in which money is being raised. What I take from this, though, is that we need to make that hardwired into our system, not just rely on the fact that our trustees are driven by an ethic and so are inclined to raise those kinds of questions. From now we have put our fundraising methods on to the same footing as we have health and safety, which means that we will have an annual check on what methods we are using and whether we are satisfied that they are within the ethos of Oxfam.

Mark Wood

We operate a fundraising committee, which is a group of trustees and co-opted members drawn from large supporters, generous supporters and large donors. That meets four times a year and is a committee of the board. It has the same status as the audit committee or the finance committee, so it has a management responsibility in terms of information flowing to that committee, and that committee has the authority of the board to make decisions on behalf of the board. The board agenda includes fundraising pretty much every meeting. To give you two examples of that, we have recently launched a new device for fundraising that involves a lottery monthly competition. That came to the board three times before being approved. Some time ago we made the decision to cease street fundraising, because of concerns that had been raised by our volunteers across the country, and that was debated at the full board three times. I am confident that we attend both to the mechanisms of fundraising and the underlying merits of those methods.

Daphne Harris

I have only been in the chair for three months but in that time I have set up a small group, an inquiries group, with the previous chair and another couple of officers, to inquire as to what has gone wrong here, how we can put it right. It is not in our interests to let this happen. Also we are setting up a new committee structure. We were doing that anyway, and fundraising, our income generation committee is going to take a much higher place. I think it is fair to say we have realised we have to do better.

Chair

Thank you for that. Of course, the Charity Commission sets out your statutory obligations. Trustees must ensure their charity complies with the law relating to fundraising and follows best practice. Why do you think trustees did not succeed in this?

Daphne Harris

With Mr Rae, I would like to apologise. What happened to Mr Rae was totally unacceptable and I apologise here unreservedly, but the truth is we did not know that this had happened. Once we knew, we took action. I think hindsight is a wonderful thing and obviously you might think we should have done, but we did not and that is the truth. But we will make sure we do better. That is our mission—to do better for the future. It is not right that a vulnerable person should have had this happen and I am very sorry about that.

Chair

But looking at your trust, and you have been a trustee for more than three months, how do you think the trustees were blind to what was happening on your watch?

Daphne Harris

I do not think we were blind as such. We had reports. The reports went to the finance committee and then recommendations would travel up to the council. I think thanks to The Daily Mail’s investigation this has opened our eyes a great deal and I can only say for the future we will do better. Obviously if we had known about Mr Rae we would have—

Chair

I appreciate what you have learnt about charitable fundraising and what was going on in charitable fundraising. What have each of you learnt about governance as operated by the trustees? What have you learnt about how you govern your charities to make sure that all that is done in your name conforms with what people expect you to believe in?

Mark Wood

May I respond to that? It seems to me it is self-evident that our routine of auditing the performance of our suppliers has not been adequate. That said—

Chair

If I may, you are answering a process question. I am asking a deeper question. It is about almost a kind of moral vigilance question.

Mark Wood

I agree, and what we have done since the revelations is to interview the management of each of the suppliers that we have worked with. So, we have added a level of examination of these organisations to the process of examination that our audits have followed. I think it is true to say that we have become concerned in some cases about the approach that these organisations take to fulfilling their duties on our behalf and we have identified two instances where we have had very explicit breaches of contract and suspended our relationship with those entities. Certainly, one of the consequences of these revelations is that we will be much more intrusive in examining the culture as well as the operation of these suppliers.

Chair

Sir Stuart Etherington said that charities’ trustees and managers have too often been absent from the discussion on fundraising practices and values. Do you think that is a fair criticism for him to make?

Mark Wood

No.

Daphne Harris

No, but I think we could do better. Can I just say briefly what we have tried to do since, or we have done? As a result of the publication of The Daily Mail article, we called an extraordinary meeting on 12 June with Listen—we do still use Listen as a company to raise funds for us—with their senior management to review the account and all processes undertaken. As a result, we have already increased our presence at Listen and ongoing staff training programmes to ensure good practice.

Chair

That is what you have done since, but beforehand?

Daphne Harris

I have personally, which I admit I have not done before, listened in to calls, randomly taking calls to assure myself of the process and any changes I feel I should report to the council that we might need to make.

Chair

How unfair is Sir Stuart Etherington’s report?

Karen Brown

I have some sympathy with his view. We have a lot on our plates as trustees, and I do not wish that to sound in any way defensive. But we have to ensure that in managing agendas, in managing the questions we ask, we do not get overcome by the business in front of us and we do really constantly remember who we stand for. There is a compact between our supporters and our beneficiaries, and in letting our supporters down we have also let our beneficiaries down and we have to win back that trust. We spent a lot of time looking at and reviewing immediately all our practices and all our relationships with the agencies involved. The specific lesson I have learnt is that we did not, as trustees, spot the extra risk that working with subcontractors presents to any organisation in any sector and we should have, as should our executive. We have highlighted that risk, but more generally I think we have to find time to think through now how we build our ethical checks into processes like audit.

Chair

My last question, which you have already answered, to the other two. What lesson do you take from your failure to embed your charity’s values in fundraising?

Daphne Harris

I think the same as has been said, we need to have our eye on the ball more. We now know what to look for, and I think lessons will be learnt.

Mark Wood

We have drawn the conclusion that we need to work with far fewer organisations, and be guided much more by the style and culture of the organisation than simply the financial bargain that we strike with those organisations. Our practice in the past has been to select agencies campaign by campaign by campaign. In the future I think what we will be doing is working much more closely to identify the individuals who act as representatives of the NSPCC and build a relationship with those people for the longer term. Fewer agencies, much deeper relationships.

Mrs Gillan

Mr Wood, you have mentioned that you have a donors’ charter. I have been on to your website and I can’t find it easily. It may be I can’t navigate it, but I would have thought it needs to be accessible and on your website. But I have read this very interesting trustee role profile, which identifies the role of a trustee, collective responsibilities and personal responsibilities. Really, the word “donor” does not feature in that set of rules and regulations for you, the trustees. Would you consider altering your collective responsibilities and your personal responsibilities to include responsibilities towards your donors?

Mark Wood

I hope it is implicit in the obligations that we have to exercise property custody and governance over the assets of the organisation.

Mrs Gillan

But if it was implicit, this set of rules was in place prior to the abuses that we are investigating.

Chair

May I simply add, the Charity Commission’s own guidance to trustees is explicit about your obligation to your donors.

Mrs Gillan

Do you not think it is time to make it explicit in your own documentation?

Mark Wood

I am grateful for you pointing out the discrepancy between the Charity Commission’s guidance and our own trustee role profile. I am satisfied, however, that all of our trustees understand that they have an absolute obligation to ensure that we look after our financial resources and the relationship with the donors to the highest standard.

Mrs Gillan

We have an expression here that if it is okay, it is good to put it on the face of the Bill. Do you not think it would be good to put it on the face of the Bill?

Mark Wood

Yes. I do not disagree with that philosophy.

Kelvin Hopkins

Just a brief question. Oxfam referred to having suspended their partnership with Listen Limited, when they are actually contractors. The use of that term “partnership” implies a different kind of relationship, but they are actually paid contractors. Would it be more appropriate to use the term “contractor” rather than “partner”?

Karen Brown

I think it would be perfectly appropriate to use the word “contractual”. Oxfam delivers its work around the world through partners, who will be smaller organisations in different parts of the world, and we do try to work in partnership. We think that that is the best way to work most effectively. But there is clearly an onus on us to supervise our subcontractors, and we fully accept that. By the way, we have subsequently ended our relationship, so that was an interim position, and we have terminated relationships with Listen, and GoGen went out of the business.

Mr Andrew Turner

Could I ask Ms Harris, it is all very well to say that this has been brought to our attention, and we have changed. What we have to do, or perhaps what you have to do, is see things that we are not seeing. Do you understand that?

Daphne Harris

Yes I do. As I have said before, I can only say that in the future I think we will be looking at things with different eyes. Hindsight, as I have said, is a wonderful thing, but all we can do is say we will do better. We owe it to our donors to do better, and vulnerable people. I mean that sincerely. We will do better. Take me at my word, see what happens, but we will do better.

Mr David Jones

When did each of you become aware of the allegations reported by The Daily Mail?

Mark Wood

On publication.

Karen Brown

Well, just prior to publication actually, when The Mail on Sunday approached Oxfam, and of course trustees were alerted to the fact that they were making enquiries.

Daphne Harris

Ours is exactly the same as has just been said.

Mr David Jones

You were all present during the evidence given by the Information Commissioner earlier, and you will recall that he said that his office approached eight separate charities last year, expressing concern about these practices. Just by way of clarification, can I assume that none of you represents one of those charities?

Karen Brown

I think that Oxfam was compliant after the letter that he referred to in 2013, as opposed to 2014, and therefore we were not in receipt of the 2014 letter, when he reminded eight—

Mr David Jones

So you were not one of those charities?

Karen Brown

No.

Daphne Harris

We do not believe we were, no.

Mr David Jones

You do not believe?

Daphne Harris

We were not, no.

Mark Wood

We were not.

Mr David Jones

You are assuring the Committee that none of you represent one of those charities. Are you all confident about that?

Mark Wood

Correct.

Mr David Jones

Thank you. What did you do when you became aware of the allegations reported in The Mail?

Karen Brown

We immediately set up a working group of the chair, vice chair, treasurer and the two trustees who over the last few years, one and then another, have taken a lead interest, as lead trustees, in the area of fundraising, to guide the management, our executive, in the handling of what was upon us. One of the issues—

Mr David Jones

Just pausing briefly, was that immediately upon discovery of these allegations? So that would actually be before publication.

Karen Brown

Immediately. In a way, there is a natural way in which that happens, because the chair, vice chair, and treasurer are already part of the honorary officers body, so we extended an invitation to two more to join the honorary officers in handling this. We then had to establish the facts, and that was what the executive set about doing. We were appalled by the headline of The Mail on Sunday, which said in big bold letters on the front page, that “Oxfam targets 98 year-old”. Oxfam absolutely, categorically, does not target 98 year-olds. Indeed, those people who are over 75 is only 5% of Oxfam’s supporter base. I can continue with the steps that we took thereafter, if you wish me to.

Mr David Jones

No, I think that that is fine for now. What about the RSPCA?

Daphne Harris

As I have said, I was not the chair then but my understanding is, and I have enquired about this, that the officers, which includes the chairman, treasurer and the vice chair, and the senior staff met and discussed it with our legal officer, and looked into the implications and set about immediately trying to put things right.

Mr David Jones

How?

Daphne Harris

I was not at the meeting, but I have said that we have had meetings with Listen, and all sorts of enquiries have taken place. We have changed the way we deal with Listen. We don’t cold call, so we were not doing that. But we have obviously had to take this very seriously. We do not want to lose our donors. We need to look after then.

Mark Wood

We had three courses of action immediately after publication. One was we reviewed the 121 complaints that we have had over the previous 12 months, which had gone through our normal complaint process but we wanted to review and understand what was behind those complaints in relation to the TPS waiver point, and we—

Mr David Jones

So those were all complaints about the TPS?

Mark Wood

We make about 350,000 telephone calls a year, and in the preceding 12 months we had received 121 complaints, which had gone through the process, where action had been taken or they had been apologised or dealt with. We re-examined those complaints, to make sure there was nothing new to learn from those complaints. Secondly, we established with our executive board—this is a group of trustees, the chairman of the fundraising board, the finance director, the head of fundraising, and four trustees—an intensive repeat review of each of our suppliers, visiting the management and relistening to calls. We have a facility whereby from our office in London we can listen to the calls made at any point without any announcement, from our suppliers. The third thing that we did was to gain the pro bono services of two senior members of a leading audit firm, who in their personal capacity reviewed the contracts that we have in place with our suppliers to make sure that they were fit for purpose and that our account management processes were appropriate.

Mr David Jones

Can each of you assure the Committee that these practices have ceased so far as your individual charities are concerned?

Karen Brown

It would depend, it is a little bit difficult; we need to understand what practices you are referring to?

Mr David Jones

The complaints that we have had catalogued today of breach of TPS, pressurising elderly people. I think that you are fully aware of the matters.

Karen Brown

I just wanted to check which aspect. As far as the TPS is concerned, we believe that we were compliant with the TPS anyway, not in breach. As far as any undue pressure that any member of the public may have experienced, we want to be able to pursue that absolutely as far as we possibly can. The Mail on Sunday has helpfully provided us with a transcript of their evidence so that we can ensure that we have indeed dealt with the problem. We have not been able to yet acquire a transcript from The Daily Mail as to the second article in July, which we would very much appreciate having in order that we can check and verify what actually took place and whether we need to take further steps.

Mr David Jones

So you are still not wholly satisfied?

Karen Brown

We can’t be because we have not got our hands on the evidence.

Mr David Jones

Ms Harris?

Daphne Harris

Yes, I think it is the same for us. All I could say is that we are not cold calling, which I think is one of the problems. We do have a system set up where words are asked and if the call gets to a point where a certain word or an indication is made, the call is wound down, because we do not want to be calling vulnerable people. As I think you would agree, people’s status can change. When you have opted in to give funds to us, you can be fit and well and then that can change. Indeed, I have heard people being talked about who are over 70. I am over 70, and I have lots of contact from charities because I want to, because I ask to hear about their work, and so I get masses of papers come through my door but I do not mind. I think it is very difficult, and one of the things we do look to the Etherington review to tell us is this vulnerable person, because I think that is key to where we went wrong and we must try to sort that out.

Mark Wood

I think I have slightly lost track of the question.

Daphne Harris

I have lost track as well.

Mark Wood

The question is, are you confident that you have—

Mr David Jones

Are you confident that these practices have ceased so far as your individual charity is concerned?

Mark Wood

We went back and looked back first and established the position as far as the complaints were concerned, as I have described. We discovered in there a breach of our ruling as far as the TPS is concerned with a single batch of individuals, 128 if I remember correctly, which we notified the Information Commissioner of immediately. That was not a process problem; it was an individual human error. Looking forward, we found, as I said at the beginning of the meeting, the three areas of concern are not areas that we participate in, in any event, and we found no exception to that, other than this human error breach that we discovered.

Mr David Jones

How often do your trustee bodies discuss complaints about fundraising? Is it a regular occurrence?

Karen Brown

Yes. For the last four years we have reviewed annually, as part of our annual report discussion, all the complaints that are made to Oxfam in all aspects of our work, including fundraising. We have a year-on-year comparison, and fundraising is broken down into the different areas of fundraising so that we can see what level of complaint it is, how it compared with the year before, and also how it benchmarks against the FRSB complaints benchmark. For instance, in the telephoning area, our complaint rate is less than a third of the average of complaints from other charities.

Daphne Harris

Our complaint rate probably was not helpful because it was one in 1,000 of fundraising calls, but what we have come to realise, and I think I said earlier, we want to look at quality in future and not quantity, and we want to make it easier for people to be able to complain. We do have a call centre that is open 24/7, so people can complain and they do, and that is recorded and passed on to us. Obviously we take that seriously. But I think this has opened our eyes to the fact that we need to be more available, and we are going to work on how that should be. But once again, we are waiting for the review to get some guidance.

Mark Wood

I personally received 15 complaints last year, which I deal with individually; I write and often speak to the complainant personally. I see all the complaints the chief executive receives and see his replies and ensure that they are resolved. At each of our trustee meetings, we have a dashboard of some 40 key performance indicators, which very much copy the pattern or reflect the pattern that Oxfam has described in relation to tracking our complaints against our targets.

Mr David Jones

May I ask, how satisfied are you that a recent Ofcom poll found that 12% of the public find calls from charities distressing and 53% find them annoying? Do you think that this method of fundraising is actually productive or counter-productive?

Karen Brown

I think that is a really helpful question. We do not want to either annoy, deeply annoy or ever distress people. One of the steps that I took after this happened was to read through the comments that supporters wrote in, in response to our director of fundraising’s e-mail telling them what had happened, and he invited comments back. We received 200, and I read through every one of those and I found it very instructive. I think the best thing that can come out of this exposure, which The Mail has enabled, is if we fully appreciate that we try to act responsibly in relation to our own charity but we have to act responsibly collectively and take responsibility for the cumulative impact on individuals. The regulation can be tightened, but that still leaves something in our cumulative approach that needs addressing as well.

Mr David Jones

Yes, because you are still making telephone calls to people who are at least irritated, but at worst distressed by it.

Karen Brown

Yes. The more that we can promote the fact that they can stop those calls from coming into their homes and the better that we can get at putting members of the public absolutely at the heart of the way we conduct our fundraising, the truer we will be to our values. Often charities are very nervous about investing money, and so we lag behind commerce in terms of the customer relations management systems that enable our supporters to have a full choice of how high the dial is turned up in terms of the way that we engage with them. We need to get better at that and make the investment and explain that it is right that we have administrative costs, in order that we can look after our supporters.

Mark Wood

I would agree. I think it is less and less effective as a technique. I am not at all surprised by the findings that you describe and I think they mirror the findings in relation to general cold calling for PPI claims, or whatever else it is. We have reduced materially the number of phone calls that we make and see it as a less and less important channel for fundraising.

Daphne Harris

One of the complaints we get is the time of day, the inconvenience that it gives to people when they are trying to prepare their meals or something. That must be taken on board; that is important. I think one of the issues is, though, we are a charity that receives no direct state aid and so we have to, day-by-day, take the requests from the public to do everything they expect us to do and we need to raise funds. But what I have learnt from all of this is that must be balanced against raising funds properly and making sure that we do not upset our donors, because without them we are nothing. That is the conclusion I have come to.

Mrs Gillan

Can I ask a question of you, Ms Harris? I was trying to get my head around the scale of this and I was very surprised from your last annual report to read that your fundraising costs for 2014 are £21 million. That is a huge amount of money to be spent on fundraising. What proportion of that is spent on telephone activity?

Daphne Harris

For every pound spent, we get £2.46 back.

Mrs Gillan

No, that was not my question. I know that, I have read the annual report. What proportion of the £21 million that you spend on fundraising is spent on telephone contact?

Daphne Harris

I wouldn’t know the answer to that.

Mrs Gillan

Could you have a look and let us know?

Daphne Harris

Yes, I certainly would.

Mrs Gillan

It is a huge sum of money and I would be very grateful. I do not know whether either NSPCC or Oxfam know what your fundraising costs are, off the top of your head, for the last financial year and what proportion was spent on telephone?