Privacy for nonprofits: donor data protection, state law applicability and exemptions, fundraising rules and volunteer data handling.
Nonprofits are exempt from some state privacy laws and squarely covered by others, a distinction many discover only after a donor data incident. This hub covers where they land.
The HIPAA Privacy Rule lets a covered entity use six categories of patient information, or share them with a business associate or an institutionally related foundation, to raise money for itself without authorization. The entity must say so in its privacy notice, offer an opt-out with every solicitation and stop once a patient opts out.
Read more →In 2021 the Supreme Court held 6 to 3 that California's demand for every registered charity's Schedule B, the IRS form listing major donors, violated the First Amendment on its face. The Court required narrow tailoring under exacting scrutiny and found none. California's regulation now states that Schedule B is not required.
Read more →The TCPA and the FCC's rules give tax-exempt nonprofits several carve-outs: their calls are not telephone solicitations, they may place up to three prerecorded calls to a residential line in 30 days without consent, and their telemarketing to cell phones needs ordinary rather than written consent. Autodialed and prerecorded calls to wireless numbers still need consent.
Read more →