027: Privacy Policy Best Practices for Nonprofits

Welcome to EO Radio Show – Your Nonprofit Legal Resource. I'm happy to have my colleague Nate Garhart back for a discussion on privacy laws and how they affect website content development, as well as online activities by nonprofits. We'll start our conversation with some basic background on when a nonprofit needs a privacy policy on its website and how to think about what should be posted on the website, and where.  Resources and notes: Nate Garhart bio Farella Privacy Blog General Data Protection Regulation (GDPR) California Consumer Privacy Act (CCPA) EO Radio Show #26: Nonprofit Websites and Terms of Use - Best Practices and Common Pitfalls EO Radio Show #20: Copyright Issues for Nonprofits EO Radio Show #12: Hot Topics: Risk Management for Cybersecurity 1) Are all "nonprofits" exempt from the CCPA? The CCPA applies to any "business," which it defines as a legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners." Generally, this would seem to exclude all nonprofits, but there have been arguments trying to include mutual benefit corporations. We have not seen any attempt to enforce the CCPA against a nonprofit of any kind to date. But, as discussed in this podcast episode, that doesn't mean nonprofits should ignore the CCPA. A nonprofit could be subject to the requirements of the CCPA through contract, through receiving personal information from a for-profit subsidiary or parent of the nonprofit, or by entering into a joint venture with a for-profit company. At any rate, whether a company is subject to the CCPA is not determined by its tax status, so the fact that a company is tax-exempt is not the end of the discussion.  2) Would the trading of email lists between two nonprofits amount to the "selling" of personal information under the CCPA? The short answer is yes. "Selling" as defined by the CCPA includes any transfer of personal information to a third party for valuable consideration. The swapping of email lists would seem to qualify. But since nonprofits are generally not subject to the CCPA, it is unlikely such a trade would require the entity to employ a "Do Not Sell" button as would be required of a for-profit entity that similarly traded email lists. If you have suggestions for topics you would like us to discuss, please email us at [email protected].  Additional episodes can be found at EORadioShowByFarella.com.  DISCLAIMER: This podcast is for general informational purposes only. It is not intended to be, nor should it be interpreted as, legal advice or opinion.