GO AHEAD, MAKE MY DATA!
This week’s The Provocateur welcomes guest blogger and colleague, Vincent Duckworth, CFRE of ViTreo Group Inc. Vincent writes a timely piece on why crowdfunding platforms such as GoFundMe have the authority to remove fundraising campaigns for unexplained reasons. He is one of ViTreo’s 'nerdiest' team members and succinctly explains the issues surrounding fundraising and data security so that even the most luddite of us can understand.
GO AHEAD, MAKE MY DATA!
What do you mean, you cancelled my crowdfunding campaign?
Vincent Duckworth, CFRE, ViTreo Group Inc.
February 18th 2020
The Iran air crash of January 8, 2020 was one of the worst air disasters in history involving Canadians. All 176 people on board were killed, including 57 Canadians (Global News Canada, Iran Plane Crash: Here’s What We Know About The Victims Who Lived In Canada, Racheal D’Amore, Andrew Russell, and David Lao, January 13 2020).
In the days and weeks following this tragedy, a number of GoFundMe crowdfunding campaigns were established to help the victims’ families. At least two of these campaigns, both based in Edmonton, were pulled offline without explanation (CBC News Calgary, Iran Plane Crash Fundraisers Shut Down By GoFundMe Without Explanation, Anis Heydari, January 14 2020).
One of the GoFundMe campaigns which was temporarily pulled offline by GoFundMe.
It was suspected that these campaigns ran afoul of GoFundMe’s terms of service around not allowing fundraising campaigns related to States and groups on the United States’ terrorism watchlists. GoFundMe and its data servers are located in the United States.
The idea that an organization located outside of Canada could shut down a legitimate and legal (by Canadian law) Canadian fundraising campaign got me thinking (Actually, at first it really ticked me off but then I started to do some research).
The answers to my questions have everything to do with data. Most specifically, data and the law. Even more specifically, data and the “law of the land”.
And, no surprise, it goes beyond fundraising. Way beyond fundraising. But, for this post, I want to keep us focused on data held by nonprofits which also includes fundraising data (prospective donor, donor information and gift details, etc.).
Data And The Law
Photo Credit: The Philanthropist
To begin to understand why another State (in this case, the United States) was able to impose its laws on a Canadian-based Iranian air crash GoFundMe campaign, we need to look a little more deeply at how data and the law intersect. Two of the most important legal concepts are data sovereignty and data residency (or data localization).
Data sovereignty
“Data sovereignty is the idea that data are subject to the laws and governance structures within the nation it is collected. The concept of data sovereignty is closely linked with data security, cloud computing and technological sovereignty. Unlike technological sovereignty, which is vaguely defined and can be used as an umbrella term in policy making, data sovereignty is specifically concerned with questions surrounding the data itself…. With the rise of cloud computing, many countries have passed various laws around control and storage of data, which all reflects measures of data sovereignty.” (Wikipedia, Data Sovereignty, As of February 15 2020)
Data residency
“Data localization or data residency law requires data about a nations’ citizens or residents be collected, processed, and/or stored inside the country, often before being transferred internationally, and usually transferred only after meeting local privacy or data protection laws, such as giving the user notice of how the information will be used and obtaining their consent…. While data sovereignty may require that records about a nation’s citizens or residents follow its personal or financial data processing laws, data localization goes a step further in requiring that initial collection, processing, and storage occur first within the national boundaries.” (Wikipedia, Data Localization, As of February 15 2020)
Data and Canadian Nonprofits
There are only nine countries that have national laws stating personal, health, and financial records (to name a few) on their citizens must be housed on servers within their national borders. They include: Australia, China, Germany, India, Indonesia, Kazakhstan, Russia, South Korea and Vietnam.
Canada does not have a federal law on data residency, however, there are provincial laws in force in British Columbia and Nova Scotia that require public service providers (hospitals, universities, etc.) to keep all personal data within Canada’s national borders. And while there are no comprehensive laws in place in other Canadian provinces, public service providers in these provinces are increasingly requiring that personal data be housed on and shared only within Canada.
So What?
This post began with me being upset that an extra-national organization like GoFundMe could pull down a legitimate Canadian fundraising campaign. After researching the concepts of data sovereignty and data residency, I now understand why this likely occurred. In the United States, companies are prohibited from doing business with or in support of States who are under embargo or are on a terrorism watch list (Iran is both) [1] [2] [3]. Turns out, given that the fundraising data for these campaigns did cross borders, GoFundMe was legally obligated to do what it did. Note: it did eventually re-instate these campaigns.
Thousands of nonprofits (and for profits) do business with public service providers in Canada. These public service providers require that their partners abide by data security, housing, transfer, and residency laws. In short, if you want to do business with a hospital, or a university or college (or any number of other agencies who qualify as public service providers), Google Drive and Dropbox are just not going to cut it.
Now What?
What are your options if you want to ensure that your data and the data of your Canadian partners retains its sovereignty and that it remains resident in Canada?
Stored in Canada data solutions
So…you want to do the right thing with data and you want your crowdfunding campaign to be successful. What are some made-in-Canada solutions? Turns out, for cloud data storage, there are quite a few. At ViTreo, we have had success with Sync.com.
There are many others including:
and Bell (to name just a few.)
Canadian crowdfunding options
As you did with your data storage needs, you are now bound and determined that your crowdfunding campaign will not be interrupted because it might run afoul of extra-jurisdictional laws (my fancy way of saying laws outside of Canada). Unlike the relatively long list of stored-in-Canada cloud data solutions, there are very few (two actually) crowdfunding platforms that allow for legal but relatively free-form fundraising campaigns. If the ultimate destination for the funds you are raising is a Canadian charity and your donors want a Canadian charitable tax receipt, CanadaHelps is an excellent solution.
If, however, like the recent campaigns to help the families of the Iran air crash victims, your campaign is not specific to a single charity or even to a charity at all, there appears to only be one clear option. FundRazr is a Canadian company founded in 2009 and based in Vancouver. FundRazr operates much like GoFundMe in that you can set up a campaign that has funds flowing to individuals versus a charity (if you are looking for a charitable receipt, this is not the solution for you).
And Now, For The Rest Of Your Data…
More than 50% of all Canadian data is stored on servers located in the United States [5]. Companies like Google, Amazon, and Microsoft all offer very compelling and useful services. It would be almost impossible (not to mention very inconvenient) to not use these services for most of our data needs. But, when it comes to personal and giving data on our donors, a made-in-Canada solution is not only the right choice, in most instances, it is the required choice.
Footnotes:
[1] Iran is one of four countries currently listed on the U.S. list of State Sponsors of Terrorism (Wikipedia, State Sponsors of Terrorism (U.S. list), As of February 15 2020)
[2] “The United States has imposed an arms ban and an almost total economic embargo on Iran, which includes sanctions on companies doing business with Iran, a ban on all Iranian-origin imports, sanctions on Iranian financial institutions, and an almost total ban on selling aircraft or repair parts to Iranian aviation companies. A license from the Treasury Department is required to do business with Iran.” (Wikipedia, Sanctions Against Iran, As of February 15 2020)
[3] Not to mention the U.S. Patriot Act which still allows for the U.S. to ask for and receive “business information” on the customers of any U.S. company (think Google, Apple, Microsoft, Amazon, Facebook…). Business information in this case means emails stored on Google servers, purchase histories from Amazon or Friend lists from Facebook, to name a few. (Vox Media, Everyone's Heard Of The Patriot Act. Here's What It Actually Does., Dara Lind, June 02 2015)
[4] “[Statements] seem to back up IDC research, which found that despite not having local data centres, Amazon and Microsoft hold over 50 per cent of Canadian market share.” (Channel Daily News, Top 10 Canadian Cloud Providers Revealed: IDC Canada, Dave Yin, February 20 2015)
Vincent is the host of our popular BrainTrust Philanthropy podcast. Check out the latest episode on Philanthropic Naming and Sponsorship Rights with Susan Storey and Suzanne Duncan as expert guests.
ABOUT THE AUTHOR
Vincent Duckworth, CFRE, Partner
ViTreo Group Inc
Vincent is internationally recognized as a leading expert on campaign design, strategy and major gift performance. He is Canada’s authority on philanthropic naming. Vincent has been a leader in the nonprofit sector for more than two decades. He is a founding partner of ViTreo and he also serves as its chief marketing officer. Vincent hosts ViTreo’s popular monthly podcast, Braintrust Philanthropy and he curates a widely read weekly recap of sector news.