Help Me With Sign Nevada Banking Form

Help me with industry sign banking nevada form secure

all right ryan clay i got two o'clock eastern is okay if i go ahead and get this party started let's do it let's get it going all right austin well welcome everybody uh happy tuesday if you're watching live if you're watching the recording i hope you're having a good day no matter where you are we are here to talk about donor data privacy and security specifically doing what is right you want to do what's right for sure i'm stephen i'm over here at boomerang and i'm going to be moderating today's discussion as always and just a couple of quick housekeeping items just want to let you all know that we are recording this session and i'll be sending out the recording as well as the slides later on this afternoon so if you have to leave early maybe you missed something or just want to review the content later on don't worry i'll send you that recording later on today by email but most importantly please feel free to ask any questions you have throughout the hour there's a q a box there's a chat box you can use either of those we'll keep an eye on them but we'd love to hear from you don't be shy don't sit on those hands we're going to save some time at the end for q a so don't be shy at all you can also send us a tweet i'll keep an eye on the twitter feed as well but we'd love to hear from you invite is open introduce yourself in the chat if you haven't already because we'd love to know who we're talking to as well and if this is your first bloomerang webinar just want to say an extra special welcome to you folks we do these webinars a couple times a week now we love doing them we bring on great guests today is no exception uh today might be a little more silly than normal but that's okay we love these webinars um my favorite thing we do but if you've never heard of bloomerang just for context we are a provider of donor management software so check that out if you're interested maybe you're going shopping before the end of the year visit our website there's all kinds of videos on there you can watch you can check us out but don't do that right now because you are in for a real treat over the next hour or so uh i don't know who allowed uh the three of us to to get together on a webinar this seems like it should be against the rules it's never been allowed at a conference but that's okay it's my webinar series my good friends and i sincerely mean that these are my buddies uh for sure uh clay and ryan joining uh us clay you are in las vegas you are a lost vegan i just learned minutes ago yeah i'm brian from the uh baltimore dc area you doing okay how's it going are you guys doing good everything's good i ran out of coffee so i don't know it might get kind of rough that's not good i i can't help you but you should have planned better i guess i should say ryan but let me let me brag on these guys uh here real quick if you don't know clay one of my good buddies i mean what can i say about clay he's he's the first person i look for to give a hug at a conference whenever we are traveling which we're not doing now check him out he's over at tactical fundraising solutions one of the smartest working fundraisers right now honestly has been doing this many years he just taught the cfre class over the weekend i mean what more do you need to know and that that's that's hardcore uh follow him on twitter he's a master trainer he's a cfre uh and he's on the uh rogare board which is also a very big deal i won't go into the details there but take my word for it um ryan from donor search what can i say about ryan other than the fact that he's a bills fan which i have some problems with he is he's my go-to for for all things wealth screening uh donor data research and and these two they got together and put together this awesome presentation they've been given uh all over the place and we're graciously uh gracious enough to to do it for us here over at bloomerang it's a cool one it's timely and i don't want to take any more time away so i'm going to stop sharing my screen i think ryan you're you're going to bring up the slides i think you're going to be the driver here let's see if we can click that magical green button that lets you share the fun transition looks like it's working and i'm gonna pipe down uh so the floor is yours my friend uh take it away thanks steven uh thanks so much um clay and i'm really excited to be here clay we've been we've been giving this session for steven was talking i think it's a year and a half now yeah yeah yeah yeah and oh go ahead no you i mean dude this is in folks as steven said it'll be a little silly but this is this is how we do right um what if you look back at the first time we did this to what it is today uh it's it's kind of why we love the presentation because it keeps evolving and the the conversation keeps happening so yeah yeah and and for those of you watching please please please drop stuff into the chat if we were in person we would be pausing and looking at you and calling on people a little tougher uh here virtually so drop things into the chat and this way we can keep it light and uh keep you engaged i've already got a few folks that are that are piping in saying you know they're looking at their crm and thinking about how they manage security so yay like we're set up for the right the right conversation yeah yeah so so we ready ryan oh yeah we're ready so um when ryan and i started this conversation it actually began with a tweet on prospect development and what you would share with the donor and the ethics of including information and it has again it just evolved since that conversation because this conversation on data and privacy and how we manage data keeps evolving and growing and i i for one really believe this from seth godin and if you're not familiar with seth's work it's a definite must for your fundraising library a complete inspiration um from his perspective if anybody was at the afp icons two three or four years ago he was the keynote speaker um and does a fair you can find his work on fundraising and cut in talking about fundraising online but he says we're leaving the industrial economy and entering the connection economy and if we look at the proliferation of data and social and everything that's online and even now more so i mean we're all on zoom i've been on zoom i feel like for a month solid so right we are the way we connect with each other and what we do is very very different than it was you know 10 years ago 15 years ago 26 years ago when i started my career and we were still using carbon paper and um three by five cards you know how we approach it is is very differently so what does um what do we mean let's just take a quick look to set us up here what do we mean by the connection economy ryan i just tried to move the slides because you know if i'm a control freak and i can't help it forgetting that you had the thing so um right i really like this definition from this this website payout.com the connection of economy rewards value created by building relationships and fostering connections rather than assets and stuff like the industrial economy the industrial economy values more better faster whereas the connection economy and here's the thing builds on who you know what you know and how that knowledge influences your connections and quick side note the last before i go too much further um the last time i did this presentation one of the comments back was um why does clay read the slides we can read the slides um i'm reading the slides for anybody that might have any accessibility issues or concerns in reading so i want to be sure that i read out the words that are on it in case anybody uh is here uh focusing uh on hearing things so um we'll read and comment both as we go but this concept of the connection economy where really the value is far more on who we know and how we're connecting to each other than on a specific commodity or a specific thing or as this definition says stuff think about again think about social media think about digital platforms think about zoom how we are building those connections and interrelationships with each other digitally ryan if you would please sir before i do really quickly we can't we can't skip one of the most important parts of this webinar it's the legos which is right which is the lego so yeah the legos if you think about it if assuming i hope you everybody watching played with legos at some point in their life if not at kids maybe at n10 when they hand out the legos but the whole thought is a few legos on their own really aren't anything special but being able to connect them and layer them on top of them that's what makes the cool thing um and so you'll see throughout we we leave legos in as a light fun and exciting way to keep the dialogue going exactly exactly so in in then if if we agree and let's agree that we are living and working on fundraising in a connection economy that data really is the most value and coveted asset there are some analogies out there that talk about data as the new oil um right if in an industrial economy the fuel right the oil that drove that economy was the most valued asset um there's an interesting counter to that argument with it that that says in that analogy it's actually data is the new land and how important land is because you can't access oil if you don't have land rights so an interesting way of looking at it and framing how we think about what donors are entrusting us with when they sign up for our newsletter or make a donation or enter however they come to us however we connect with them what they're entrusting with us is it's not just information it is an asset that we need and that other people want so i think ryan's going to give us a little historical perspective on what we've seen in recent years yeah so so talking about what some people have and what other people want it's that data so there's a lot of different things here that we're looking at um mostly it's logos of companies and the one of the things that they all have in common is they've been involved in where they've had a data breach that that has impacted consumers donors individuals in all likelihood most of you um if you look on the left hand side there's that thing that says equifax so back in 2017 equifax they let a few of their security licenses and a few other security measures just kind of lapsed they weren't paying close attention and i think it was the somebody from a government entity who basically said that it was child's play to go in there and access the data that they had pretty much anybody could have gone in and grabbed all the data which if you think about it equifax what do they do they're a credit company so they have your name they have your date of birth they have your social security number so that was one of the really big wake up calls that security is no joke it's it's really important and for us in the nonprofit sector fairly recently we've all had this come to the forefront in light of the data breach that uh occurred at blackbaud and that's kind of an ongoing evolving issue that we're learning more of but but the important things here are not that these companies had data breaches but it's that it could happen to anyone and it's the way in which these companies react hopefully ethically transparently and quickly that could allow them to retain your trust or could kind of start to alienate you and again what happens to them is no different than what could happen to you if it is your donors right think of anybody impacted by the blackbaud breach um they should have been commuting that communicating that information with their donors the quicker they did it the more directly they did it the better off they will be because ethically that's that's the better thing to do now looking at all of those different breaches if you look at this quote here by some estimates cybercrime is expected to globally cost up to 6 trillion dollars annually losses of this scale put the incentives for innovation and investment at risk and will be more profitable than the global trade of all major illegal drugs combined so if you've ever thought wow there's a whole bunch of people that die because of drug cartels that's because it's profitable and this is more profitable than an industry that is that violent uh so there's a lot that you just want to consider to put it in perspective each day the amount of money uh works out to about 16.4 billion dollars and each hour we're talking about 685 000 that's what it costs because of people's data being stolen and and the takeaway on this again is you should value your data your donor data your volunteer data that much um because it's it's that important to you um so to kind of walk through a little bit more hey what what exactly are we talking about we didn't see an agenda slide what so now that you've scared the heck out of us ryan now that we're all quaking right that's right there there are solutions now that you're awake the the goal is we want you to be aware of the things that you can do so that that stuff won't happen to you um but you'll see over here we've got our jedi uh saving us and protecting us um so we're going to talk a little bit more about donors our data and we have to make sure that they trust us we're going to talk about the legal and ethical approach they're two different things what is legally required of you is not necessarily what is ethically correct um and then we'll start talking about the different steps that you can take in order to make sure that you have trust from your donors uh which will mean ethically you're doing the right things um and also from a legal perspective make sure that you're secure so uh for those of you that can't see the bullets at the bottom we'll highlight change the culture data is an asset be aware of the laws so many laws so many changes policies and procedures which ones should you have which ones do you have and then leadership and governance right because the policies that you have it's important that they make it all the way to the top of the organization um one of the last things here um and this is great because it's so easy to find a whole bunch of white people legos but this is a nice diverse group uh where they're all playing well together you can see uh that they trust one another right the lady who's up on the ladder she's being supported by somebody down at the bottom for those of you that like to do housework alone on the second story you really should always have somebody holding the ladder down below and if you think about it you're not going to choose somebody that you don't trust to hold that ladder um really no different than a donor isn't going to choose an organization to invest in that they don't think would do a good job of stewarding their funds to to achieve their philanthropic goals so the value of trust transparency and ethical relationship management it's more critical than ever before right if we're thinking about what we just highlighted with all the data breaches that that trust is so important um and and so talking about who americans trust right now you'll see this is specific to the us there are other studies for other countries so for those of you in canada and elsewhere we're not ignoring you it's just that this was the most readily available um we're looking at an image that was referenced in a chronicle of philanthropy article and the link is down at the bottom for those of you that get the slides and and it's essentially you survey hypothetically 100 americans out of those 54 said yeah we trust businesses 52 said yeah we we trust nonprofits 48 said yeah we trust the media and 40 said yeah we trust the government now it's it's kind of sad that the numbers are that low and there really isn't that much trust but one of the really scary things here folks is that people trust businesses more than non-profits right we all know that yeah okay nonprofits are technically businesses but there's a very different mission statement right i mean the mission of a business is essentially to make money but regardless of all of the other things that it does whereas the mission of a non-profit is we're just in it for the social good and the way things stand in the us now is that people are more likely to trust patagonia as a com any than they are a random non-profit just by a little bit which is really kind of sad so again the important part is make sure that you're communicating with them well and and steering them along so that you garner their trust with that we're gonna pass this off to clay just like the stormtroopers passing this egg off yeah and nancy just asked a great question and we are going to talk about it a little further down the line right on on on actual implementation of of how and who should have access to data and security protocols and all of that which is a major step in building building the trust and the transparency the more savvy donors get and the more they pay attention to this the more it's going to be absolutely critical for us that that our policies and procedures and knowing how we manage data and who has access to it and being able to articulate that is really really clear to our donors so yeah we're going to talk about it in a little more specifics but both the process of building trust and the higher level uh of how ethics and trust tie together and repeat each other it's it's interesting there's a number of academic studies and other studies on ethics and and you know when we're talking about ethics you can go back for thousands of years to the earliest writings so we've been trying to figure out what ethics means since then right um so definitions and how we define and how we look at ethics uh are open to as many interpretations as there are people but in essence at least for me in defining what ethics means and how we approach it this is the higher level um uh data management along with the specific protocols that yeah again we will we'll talk about here in a little in a little bit right but setting the groundwork of understanding what ethics is so a couple of definitions here ethics is based on well-founded standards of right and wrong that prescribe what humans ought to do usually in terms of rights obligations benefits to society fairness or specific values okay um the bbc center for ethics defines it as edit simplest ethics is a system of moral principles they affect how people make decisions and leave their lives ethics is concerned with what is good for individuals and society and is also described as moral philosophy in a fundraising context we look at ethics in that context of what should we do and what is the right thing to do here ryan kind of already addressed it a little bit and you know the right thing to do is communicate open transparently honestly with our donors the right thing to do is have policies and procedures that clearly define how data is managed and how assets are managed particularly in light of the connection economy and where we live and people want your data it's just as simple as that if there is personal information attached name address phone number is incredibly valuable to any marketer let alone social security information credit card information payment information all of that regardless of your size regardless of what you think of the quality of your data there's somebody out there that wants it because they can sell it and make a book if you're on twitter ryan i spend a little too much time on twitter uh but if you're on twitter this twitter account is life-giving um it's uh we saw it and fell in love with it and it ties right into what we're talking about but the actual account is ethic ethics in bricks and every day they post some sort of philosophical or um ethical conundrum told in lego um the other day was the myth of sisyphus in lego and it was brilliant and they played into the whole uh how it started and where it's at now and it was just if it's rolling up the rocks staying in the place but i digress a great count account to follow so defining ethics but then how do we implement ethics and what what are the implica why right why in fundraising why in nonprofit management is ethics uh important to us and it is again because of that accountability because it helps us i mean we are required in the nonprofit sector to be transparent that is part of the mandate that is part of the responsibility of carrying a 501 certification is we are required to be transparent so there's the legal requirement but off of the also the ethical requirement of taking it that step further to do what's right and be as fully and openly transparent as we can transparency leads to the leads to public trust so ryan referenced that slide where 52 of americans say that they do trust uh nonprofits flip that script and look at it from 48 nearly half of americans do not trust the non-profit sector that's kind of scary especially if we if what we're doing is out there for the common good changing the world this life-changing work that we all spend so much time and energy and passion around and nearly half of the country doesn't trust us to do it well let's building that trust and the reason why this section is is is titled the way it is is again there are multiple studies from psychologists and sociologists looking at um the analysis of when somebody says they trust something they like it more and when somebody says they like something they trust it more so like and trust connection and trust build on each other and and keep building each other so i trust you which means i like you more i like you more which means i trust you more and those just keep compounding and growing there is also an ethical responsibility to the organization right we we are if we are a paid fundraiser we have a responsibility to the organization to the mission of that organization in in to the budget it's we we we are the revenue generating arm of the for good sector so we have a responsibility to to hit those goals to make the mission happen we have a responsibility to our donors absolutely and we we can't talk about those two prongs of our responsibilities without bringing an equal representation to the beneficiaries to the recipients of our mission so our duty if you will to all three of those in equal measure from an ethical standpoint of doing what's right by all of those three priorities really sets a mandate for us of more than just what's required of us but what is the right thing to do uh if you will stephen in in his intro and i appreciate him mentioning it uh uh mentioned that i was a a member of the rogari advisory board um rogari is a fundraising think tank based out of the uk uh headed by ian mcquillen and a number of other great thought leaders and researchers in um fundraising if you haven't uh if if you're not familiar with regarding encourage you to look up some of the work that we've done in some of the white papers and a whole bunch of there's a whole lot of studies and uh academic research into the work of fundraising taking that critical uh thinking approach to it and how do we really think about and look at what we do um but this this is a wonderful white paper on ethics and ethics in play in fundraising um regarding.net fundraising fundraising hyphen ethics you can download it totally free rogari by the way is latin for to ask which is why it's name so why ethics this definition fundraising is ethical when it balances the duty of fundraisers to ask for support on behalf of their beneficiaries with the right of the donor not to be subject to undue pressure to donate such that a mutually beneficial outcome is achieved and neither stakeholder meaning beneficiary or donor is significantly harmed so ethics driving how we look at our work and how we approach our work and how we manage things like data ryan and i were asked at one point in doing this to look at the ethical statements of the different professional associations which sent us down this long wonderful several month long kind of rabbit trail of reading every professional association that we could find uh that and i actually found a new one yesterday ryan i didn't after we talked and updated the slides i didn't have a chance to pop it in but i found a new one last night um so any professional association that deals with the non-profit sector and with fundraisers specifically has a code of ethics so yay like hooray it's out there if you're a member of any of these afp case apra adrp grant professionals association ahp any of those membership orgs have some form of an ethical statement of how we should do our work and in many cases they are actually enforceable um i know for certain with afp if you know of a member who is violating ethical standards there is a committee to whom you can report that anonymously they will research it look into it and take action if action is needed so there is a high level of importance to this the really interesting thing is they all kind of say the same thing it's fascinating it's a great study in communications if you ever get the chance um you never really want to read them all because some of them take like five pages to say the same thing that the others say in a paragraph but it's still great right um they they all very similarly talk about the same things and address many of the same issues in how we deal with how we deal with donors and how we approach our ethic our work ethically and responsibly um afp is the one that i am most familiar with uh just because it's the association i've spent the most time with so we wanted to highlight a couple of points at least from again the association of fundraising professionals code of ethical standards that really highlight data and we just highlighted these year one value the privacy freedom of choice and interests of all those affected by their actions i think we can underscore triple underscore privacy there and then adhere to the spirit as well as the letter of all applicable laws and regulations ryan's going to take us through a fun little study here in a second on the applicable laws and regulations the question is from an ethical viewpoint right where ethics is separated from law from an ethical viewpoint not just do the laws exist but are we adhering to them are we following them and are we being ethical in our approach to them because laws laws set the minimum standards of behavior if you will the law requires us to do things that's on the next slide sir um the law sets the minimum standards for us while the ethics set a maximum higher or moral standard again the right thing to do so we know we are legally required for example in some states to register and disclose that we are soliciting in those states that's that is a requirement of the law nevada and california nevada is a registration and disclosure state to solicit donors in the state of nevada you must register your nonprofit and you must disclose that on all solicitations okay that's a pretty basic pretty standard easily followable law but how do we take it to that ethically respond ethically responsible to that next level higher moral standard of we're doing it not just because it's the law but because it's the right thing to do for our donors it's the right thing to do for our organization and it's the right thing to do for the beneficiaries who are who are that's who we're raising money for yeah so high-level kind of overview of of ethics and uh the fundraising non-profit look at it let's dig into uh some of the laws and the legalities of it and the caveat being neither ryan nor i are attorneys we are just guys with a google account who um find this fascinating and spend a lot of time digging into it so so treat this as very surface level it is not legal advice hopefully you have access to lawyers who can give you that because if you're relying on us it could get scary almost as scary as having some little man pull your keys apart at night and you come back to a blank keyboard um so we're going to start with something called gdpr and a little bit of the history on data laws in europe so the eu when it was formed there's this really cool thing uh called the maastricht treaty where everybody got together in a uh i guess a smaller town in the grand scheme of things in the netherlands called maastricht and they ironed out all the different rules that they would have as they started get going to get going one of the center pieces of that they decided was data protection because they knew that this was going to be such an important part of the global economy which is what the eu was designed to feed into when they got started so the the basis was they had a in 1995 they created the eu data protection directive and what that essentially meant was there's certain ways that you have to hold data if you have information on a bank account there's certain security measures that you as an organization would have to take so you're a bank or you store a credit card stuff has to be encrypted as a really easy example um fast forward to 2014 they came up with something that had always been ethically correct but it never been legally it had never been a legal measure and that's the right to be forgotten so that is if you say hey facebook i've decided i'm done with you i want you to delete all the information you have on me well prior to 2014 if you were a citizen in the eu which is not all of europe but many countries then you you could ask facebook and they could laugh at you there was no law that said they had to delete your information even though you wanted them to delete it even though ethically that would have been the right thing to do so that set the groundwork for similar right to be forgotten laws elsewhere in the world and then in 2018 is when they rolled out gdpr uh now gdpr again this is specific to eu residents so if if all of your residents are in the united states or in other countries then this may not be that important to you but if you do have european donors this is important to you and we'll talk about that in a little bit but at the end of 18 the beginning of 19 they basically said that if you're going to collect data on anybody they have to opt in so it can't simply be hey by virtue of you having a facebook account we're going to collect all of this information on you it was actually no but by virtue of you saying yes it's okay for you to collect my information it's fine otherwise i'm still legally allowed to use your offering um but you can't collect my data and you can't resell it without my consent okay now here in the united states that's very different we'll talk about the ways that that's changing but there's a really interesting book that recently came out by a cambridge analytica insider named brittany kaiser books called targeted and she goes really in depth on on all of these things if you've got i don't know 12 hours it's well worth the read but now so if you think beginning of 2019 you probably got emails from say a marriott or a hertz or any large international company where they said all of these things are changing and we're asking you to opt in and the reason they did that is because it's easier to have the same policies for citizens in different countries as opposed to trying to create various policies and various platforms for each separate country so uh many international nonprofits like a heifer international they did the same exact thing now now let's let's talk about you if if you have european residents and you're tracking their information because they're donors or volunteers or patients um these are a few different bullet items that you really ought to be on top of again the part where hey we're not lawyers but this is a good baseline level so you should have high data protection standards if you click that link when you get this it goes in depth but a very simple way to think about that is there should be one username and password combo per person per login so if there's eight of you that share a crm login that's a really big no-no that's a violation of gdpr it's also not safe i mean if you think about it going back to ethics and trust right you're doing the right thing ethically you will gain trust from your donors um if one person leaves out of the eight and it's a really ugly exit the the the smallest of your problems will be seven people are going to have to figure out a new username and password and memorize it the biggest of your problems is you don't shut it down because everyone else needs access and in the time that you don't shut it down the person that left has done something nefarious mayb pulled out the database and who knows what they're going to do with those donors so that's the first thing to think of second thing is again move from opt out to opt-in think of communications right do you want this newsletter well if you do you should opt in instead of saying we're going to give it to you regardless again ethically that's that's the right thing to do even though it might not be the way we practice here in the u.s the second the third rather is allow people to request all the information you have on them or the deletion of data one one thing to consider there that means when you're taking notes and entering uh call reports in make sure you're putting stuff in there that you would be okay showing the donor um don't add your opinion about things unnecessarily or things you heard about members of their family if it's irrelevant to your organization's relationship with the donor and and lastly here's a big one and here's something that really whether or not you have european donors you should start doing as well as assign a data protection officer give somebody the responsibility at the organization to make sure that there are a list of policies that everyone should be following to ensure that the data is secure right those policies it's essentially a playbook so that if there is some sort of weird data breach the very least you can show your donors hey look we had these things in place and stephen shattuck here was the one that set this really good list of things to do and not to do to make sure that that your data was secure um so that's that's gdpr now i mentioned uh cambridge analytica so when everyone found out about cambridge analytica and the whole getting information on your friends through facebook california was the first state to react with legislation and they passed a law and the law said within the next 12 months we will define this law which is kind of scary they basically said look we need data security we don't know what it's going to look like yet but we all agree that it's going to be something and over the next 12 months before this this bill goes into effect we'll figure out what it is now the the bullet points down here they explain what that is so anybody in the state of california has the right to access data um anybody has the right to delete their data anybody has the right to know um the collection processes that company uses and anybody is the right to opt out now there's some really important information about this in its current state this does not impact nonprofits right so this means the way you interact with your organizations or with your donors rather you you don't have to follow these rules however it does impact you indirectly because right i work at donor search wealth screening prospect research firm uh stephen who who was here earlier and he'll show up again at the end he works at bloomerang well both of our companies need to adhere to these laws because we're for-profits that have clients and have information on residents of california so that was the the biggest first change that happened right after that there was a slew of other legislative changes so you're looking at one map now we're going to look at another map in a minute that shows hey where is consumer privacy in the house in the senate at these different states so you'll see right next to california uh our friends in nevada which that might include clay um they saw what california did and they said hey that's a great idea we're going to do it we're going to do it better and we're going to do it quicker so there's some and we did we did we got it in place first before california did that's right it's a thing for us nevada won zero um that the laws are are virtually the same but but declay's point yeah it went into effect a few months earlier um you'll see not shown here is vermont vermont had one of the first consumer privacy laws that went into effect it actually went into effect before california and a lot of that had to do with the security standards if you're holding somebody's social security number so if you look this is one really well known source iapp they're they're on top of these different privacy laws but here's a map from a different source and if you'll notice in this map vermont's filled in wisconsin has nothing going on so that whoops the different states are moving so quickly that it's very difficult to catch up and it's difficult to stay on top of which state is doing what which ultimately means if you really think about it and you want to be safe if you adhere to what gdpr has in place since what california created tried to design that that's the safest way to make sure that you're a doing the ethical thing but b you're also going to be on top of the the legal uh ramifications there's another law that you might want to look into called the new york shield act and the new york shield act applies to anybody with a new york resident and it applies to non-profits um so it really it has to do with with transparency if there's a breach you have to respond quickly nothing crazy but again the thing is um if you don't know that and you're just assumed well i'm gonna follow what my state's laws are and you have donors in new york it's not just an ethical issue if you're not doing the right things but legally it can come back to bite you and with that i'm going to kick it over to clay and we'll stop talking about the the quilt that is u.s state laws and we're going to talk about federal legislation yeah i'm keeping an eye on the clock too ryan i want to be sure that we leave plenty of open time at the end for um q a but that patchwork of data privacy laws in different states that some may or may not affect non-profits in different ways which also ties to the patchwork of different registration and disclosure requirements in different states it's a lot to stay on top of and it's a lot to be aware of but again from an ethical perspective how much do we and what are the policies and procedures and really having those high-level discussions of okay what exactly are we going to do here and how are we going to take not only the required steps but the ethical steps in in protecting and dealing with this information because there are currently i don't i honestly don't know i told ryan we did a little prep last night i don't know that this is correct today um i could have changed because it's changing that quickly but there are currently several different legislation uh uh proposals on the floor of the house um going through and the prediction is that one of them is going to pass and some permutation of one or all of these is more than likely going to pass and that in the not too distant future we will have federal legislation on data privacy standards across the united states um and ryan i'll talk a little bit about this in just a second but um uh our friends in canada have different privacy laws than than we do so any of us that are working in both canada and the united states have to be aware of those certainly for donor search and any wealth intelligence firm or public data firm is aware of the different rules and restrictions just across the border um and then if you as ryan already mentioned if you bring in the eu right so then we're going to add on this very likely federal legislation um it is it is something that i would encourage all of you particularly encouraging your boards and your governance to pay attention to keep an eye on this and if you have legal counsel if you have um any sort of of government relations activity going on either at your non-profit or in your community or through community foundation keeping a very close eye on this because as we learned from from uh gdpr the ones that weren't prepping for it in advance were the ones that really got hurt on the back end um and really had struggles so starting now in the midst of everything else going on right it's starting to pay attention to this federal legislation um you know ryan and i are very conscious and we all are though you know you don't want to single blame here or point anyone out but the the we also have to learn in 2020 that the nonprofit sector is not immune to data privacy hacks we know this very clearly unequivocally now that as a sector our data has value and the bad actors if you will um want it so ryan if you flip one more for me please sir right so um on september 15th the chronicle of philanthropy reported that donors had filed five class action lawsuits against blackbaud okay so that was that kind of lit lit everybody up and i think we need to not panic um but we do need to watch carefully because it's it's pretty clear that um our data is vulnerable that people want our data and they can get it and donors are aware of it so these are class action suits started by donors against the software firm all right now flip over one more just one week later the number increased and they started targeting nonprofits directly so it went from something like five class action suits to nine or ten i don't know the exact number uh but the number of lawsuits increased and then the last two lawsuits started targeting non-profits so again something we need to keep our eye on very very carefully in context of that public trust and in context of that transparency that this is really going to change the dialogue for us um again we don't the point here isn't to be scared the point is to take logical good steps that we can to do everything that we can to protect it and now we're going to talk about that but first a little visit to canada yay so we've got our mountie friend um and he's here to talk about some of the canadian privacy laws so there's there's two that we're going to talk about um the first one is pipita generally speaking it doesn't apply to nonprofits but a lot of what it says has to do with data security and data privacy and making sure that you're taking appropriate measures to safeguard the data that your organization has now the one that does apply to nonprofits is is castle and that applies nonprofits or that applies essentially individuals to opt-in for solicitation emails so stephanie asked a question earlier about whether or not any of the u.s state level legislation impacted email solicitations and i think currently the answer is no but as soon as next week it could so you should just keep that in mind that uh it's kind of a gray area now when it comes to canadian donors it's not a gray area it's not a gray area at all uh if you are let's say an arts organization um not only can you not solicit donors without their opt-in for gifts but you can't solicit them for tickets so um there is one uh canadian organization that did something really cutting edge um and if you're an arts org or you're any kind of organization that has insider info or or insider opportunities i recommend you take note they created a special group for individuals that were willing to donate one dollar and opt-in you would be able to get the the schedule or the program two weeks early so if you donate a dollar right that's a small gift and you say yeah i want the information um and yes i want your solicitations you're suddenly able to see okay well this is when the nutcracker is going to air and i want to buy my tickets two weeks early so yeah why wouldn't i do that what they were able to do by creating that one dollar membership is they picked up somewhere between 20 to 30 000 dollars in donations but they also had a small group of people who not only legally had said yeah it's okay to send me these messages and solicitations but more importantly it was hey uh i actually want you to communicate with me which is really brilliant because those are the people that are turned on to the org you've built trust you're doing the right thing so let's talk a little bit more about data governance so what do you need in the database what is it used for and can it be stored elsewhere do you need to track an individual's gender do you need to track their ethnicity do you need to track their age maybe maybe not um maybe if you're thinking about gender there could be really important reasons to track it hypothetically if you're a hospital and you need to know their current biological gender but but more importantly if you're an org you probably don't you just need to know the title that they prefer when you communicate with them maybe you want 80 points of wealth screening data in there but maybe you just want one so the thought is make really intentional decisions about what you're storing and how you store it number two is update agreements to ensure institutional safety what does your volunteer agreement look like when's the last time you updated that does that include the kind of information that you're collecting on these volunteers and what you're going to do with that data and then review information requests strongly don't give info to scammers so on a regular basis you might have people reaching out and asking for their data right because let's say you're trying to be ethical and you're trying to adhere to the uh 19 well i guess the 2014 eu directive where people can find out their own information and delete it if they want well that's great you definitely want to do that but you also want to make sure that you're not dealing with clay pretending to be me trying to get my info so that he can i don't know let's say send me some strange emails at three in the morning about legos and maybe sign me up for uh the lego um regular email blast so that i could buy the latest set even though i might want to do that you shouldn't facilitate it that'd be a big no-no so again pay attention look out for scammers uh when you're trying to field those requests um basic security practices so we touched on this a little bit right but there should be separate passwords for every employee and every volunteer if somebody has a login it shouldn't be a shared login it should be their own the next one is just so important uh don't email donor information i can't say it anywhere clearly than that if you ever get a request from a vendor to email you uh names and addresses and gift dates say you're you're doing a conversion to a new database say that you you just signed on with bloomerang you're gonna start using them as a crm they're gonna send you an sftp or an easy way to securely share that information with them they're not going to ask you to email it if you email that stuff it's not secure someone can grab it and that's how a bad actor ends up with donor data and you end up in a dicey situation the number three really easy one use up-to-date antivirus software there's tons of stuff out there mcafee is a really good one norton is another good one and they're affordable um don't share passwords especially via email so again right everyone's supposed to have their own username and password but what if i i need to log in and i need clay to share a password with me temporarily and he's gonna change it in an hour okay well let's just say hypothetically that has to happen for whatever reason which it shouldn't but if it does don't email it again because email is is not really secure um one of the last ones probably a little less relevant now since many of us are working from home but be careful on public wi-fi when you're on a public wi-fi everyone can see what you're doing it's not difficult to hop in take a look at somebody's email history or pull files down off of their computer or watch when they logged in and grab their username and password so be careful on public wi-fi don't do anything that's you wouldn't want anyone else to see and again stop emailing datalists so now clay we're going to kick it over to you for some more advanced security practices and um while you were talking i'm going to ask you to poke into the q a ryan the questions in the q a and in the chat are phenomenal um and i'm thinking back to like i wish doing it live when we can do it right in engaged but take a look at some of the questions and type in your thoughts too because there's just phenomenal important questions going on um as we look at kind of the things that ryan already referenced as we're here barreling into the top of the my clock is over there that's why i keep looking that way sorry um as we barrel into the top of the h ur one of the best things that you can do to protect yourself is have a written policy and um procedure manual i know for a fact stephen i don't know if i can do this but i'm going to do it anyway i know for a fact somewhere on the bloomerang blog is a data entry policy and procedure manual that the brilliant robin cabral wrote with bloomerang and published on the blog and it is just a phenomenal resource um it's actually so good that you can just take it and like replace your name into it and use it as long as you agree with everything so um that and a data security and maintenance policy that defines very clearly what what you will protect how you will do things how you will enter things and who will have access to it you have noticed on websites all over the data privacy policy when we accept cookies when we sign up for lists that we have to accept that data privacy policy so ensuring that you have one um and that you know what it means and that it is publicly disclosed and serves as a great donor stewardship document to be able to say hey donor i get it it's legalese and it is required but i want you to know that we take this very seriously and when you entrust your name to us this is this is what we're doing with it and this is how seriously we're taking it uh gift entry data entry policy procedure so who knows what um you know operate under the what if you win the lottery tomorrow and i get it not all of us have the luxury of having a full-time database admin but that person who enters the data what if they what if what if they win the lottery tomorrow and they don't come back to work um who's going to pick that up and how do we know who how it was done and how are they securing and protecting um data and including this in human resources and onboarding because everybody that comes on board at your non-profit could have access to private information is that included in your hr policies and in onboarding and signing that document that says i understand that i may come in contact with personal protected information and by signing this document i acknowledge that i will keep it private and as long as i'm an employee and blah blah blah is there a whistleblower policy in place if you paid any attention to some of the scandals last year in terms of organizations that accepted donations from jeffrey epstein sorry it's tough situation but name it um right is there a whistleblower policy in place that rises to the level of governance so that an employee even if that employee is you know way down in the hierarchy knows that they can go to somebody at the governance level and be heard and protected when they see violations of these things does this rise to the level of governance and this is where i'm going to say pretty much emphatically yes that we now that you know all this now that you've seen all this we are all somewhat accountable to start bringing this up to our boards and our leadership and saying we've got to be looking at this data as an asset and protecting it as such some real um clever fun ways to do this ryan we got two minutes left so we'll flip through that and then hit hit the last step yeah so these are from our friends at the university of chicago university of chicago gigantic gigantic non-profit right they make more money than probably many of those that are attending today combined so they have really good people that work in security and privacy and back when everyone was going to the office they made these index cards that they called flip for a tip so you turn it over and you see this cute little puppy sticking his nose through a fence uh and but next to it it says hey turn off public wi-fi and don't use public networks use a vpn which is a virtual protected network connection that's more secure it's a lot safer we're block nosy neighbors we like the dog we don't necessarily want the dog to come in this time um there's a few more uh oh did you leave your computer unattended lock your computer every time you leave your desk and you don't want to see this sad polar bear i mean think about it even working from home you want to lock the computer if you've got kids at home and you walk away to go to the bathroom who knows what they're going to do um and then we've got this little uh rack nosy raccoon going through the trash um you want to make sure you shred confidential documents and now probably less important but again you don't want to leave a written down username and password at home when in doubt shred it so kind of circling back we're going to finish on time recommendations make sure you've got a really clear and precise gift acceptance policy and stakeholder buy-in right going back to jeffrey epstein thing make sure you know here's when we accept gifts and here's when we don't and here's why so you can say i'm really sorry donor of the unfortunate situation occurs but this is why we cannot accept this gift um data usage manual who gets access to what what are they supposed to do with it and it's part of onboarding training right when a new employee comes on here's how you use each system and make sure that permissions are set right so that a volunteer because they're checking in to spend time with the kid that doesn't give them permission to look at the entire donor database um clay you want to take the rest of these um yeah we've already talked a lot about them uh assigning that data protection person hey here's the thing um it doesn't have to be senior leadership it doesn't have to be leadership at all if your receptionist is the person who does the data entry and you make the the person in charge of that your data protection person then then then give that person a leadership role and when they talk about data everybody's got to listen so it's it again rises to the level of priority which makes data a huge institutional priority for the organization at the same level as we're talking about goal setting and um budget setting so yeah that's that is the high level stuff ryan i don't know if you have time stephen i don't know if this is allowable but i know there's still a few questions running around so i'm happy to keep going to linger on uh and answer some of these because some of them were lingered we can take five minutes i mean geez this is good stuff yeah looking cool cool um ryan i mean donor search is really spearheading this it just it lives on my website for whatever reason i forget why we decided to do it that way but it's all good if um we would love your opinion your voice your input we're trying to take a measurement on the sector on how data management is done and get some actual data behind the data see what i did there um so uh tcb fundraising.com data hyphen survey uh if you can type in an answer of three or four questions for us that would be super helpful do not hesitate to reach out to either one of us if we can be helpful or answer questions um steven can knows how to reach us too so feel free to come to us through through bloomerang but um clearly it's a topic we love and i'll tell you honestly for me the reason i love it um because well the reason i love it is it sets us in such a great way to be donor centered and to really make that statement to the donor hey what you've entrusted to us we're protecting not just your gift it's not just your money it's it's you and your identity and your your important information and we are taking good care of everything you have entrusted to us this is awesome wow good stuff i love the last the last few slides it seems like the things we can be proactive about ourselves solve i don't know 90 wouldn't you say i know there's a lot of vendors and bad actors but a lot of it's on us too right well and and stephen if you're going to say that i mean i'm going to say to you in in all love and respect and you know how much i love bloomerang um but you know we do kind of need to lean on our vendors a little bit yeah and help guide us and provide resources i love what you guys do with the blog and stuff like that right but uh there's there's all of us together making it oh my gosh it just turned into a commercial all of us together making it safer for donors one point on that too if you think about it a lot of a lot of these scammers know that non-profits have smaller budgets and might not be paying attention to this so they're quick to go out and see what easy things they can get away with so you know that the comment was made look you do these things that covers 90 of it you don't email donor data that's a really really great way to make sure it's not going to get taken because that's one of the ways that scammers might try to grab it it doesn't take a lot of effort for them to do it so it's a quick check so by not doing that it says okay well i'm gonna i'm gonna move on to the next non-profit or next company that i wanna hack whatever hey stephen sorry logistics one of the questions in the q a is will the q and a's be shared after the meeting some great questions or responses i don't know how that works like the ones that were written um do you share a transcript or yeah we will uh when we post the recording on our blog probably about a week yeah we'll get all that good stuff in there yeah absolutely cool cool and ryan actually that was a point to me something you and i can do we could write a joint blog with some of the questions that we see the most frequently i love it yeah okay done yeah we'll keep talking about that yeah we'll get uh we'll try to get that done about the same time that you publish this and then i'll hold you thinking right yeah do it do it do it do it do it i never know the answer is is is the google unsafe i never know how to answer that i'm not a google guy i would ask google yeah i would ask google probably safer than an excel spreadsheet on your computer on public wi-fi right i mean yeah that's kind of worth talking about you know if it's yeah hosted somewhere securely that's always better than the local machine i feel like um and super fast one of the most common questions today if i could sorry was donor recognition right and publishing the donor's name with the level i mean interesting that is not something we really ever talked about as as an industry before could it be it maybe could i hadn't really thought about it because you're actually publishing their name with so it could which is the starting point to go down that reads it is and there's a lot of discussions in you know building equity and representation and giving that maybe maybe we need to rethink how we do recognition maybe we need to rethink that whole thing so you know i kind of put a pin in that one and go for continued discussion well get to work on that presentation and we'll have you back and you can you can do that part excellent that's that's really interesting that touches so many things donor centricity equity that's yeah wow and we have a couple people saying their orgs have already decided not to publish donor recognition i kind of you know that kind of makes sense to me i you know i've only been thinking about it for 10 seconds but right well there was a question earlier see i could go all day i'm sorry right there's a question earlier um you know what if we accidentally publish somebody who wants to remain anonymous well ethically tell them before it hits the press tell them that you did it and you made a mistake and you're sorry but tell them before they find out and yeah anyway right the moment you realize it is the time to tell people just like if there is a data breach and obviously make sure you fix the breach before you tell the world that there was a breach because otherwise somebody might be able to come in and grab more data but you know you gotta be on top of it we need to find a lego whale slide right because whales breach anyway yeah that's that's a that's a point against you guys you didn't have that i mean come on that was i think at this point i'm getting punchy so we might yeah i know you got a couple dogs outside the office that need some attention from you and someone with the leaf blower just showed up in my house i don't know why but we're a little over time but hey this was awesome i knew this would be a fun one and informative so thank you both for for ta you're both real busy you have your own jobs i mean you got day jobs you're doing this for fun so thank you thank you for doing thank you it was fun always good to see you and and everybody on here and the the whole bloomerang folks it's great and reach out to them follow us on twitter the three of us a little bit of shenanigans but you may you may pick up a nugget here and there go sports ball it's sports ball and um yeah good luck ryan tonight i guess with your bills clay good luck with um whatever whatever whatever is going on in las vegas like everything and nothing yeah indeed and for me i'll get working on the uh the recording and the slides we'll get that out to you later on today and we've got another webinar coming up this week uh two days from now on thursday afternoon another free webinar i lost my slides but i'll email you guys i'll email you that one it's gonna be on cultural competency uh jessica from from mockingbird analytics uh you'd see information here if i had my act together this will be a really cool one so we're going to touch on dei issues give me a fun session definitely a timely and important topic so look for an invite to that from me with a recording in the slides and hopefully we'll see you again on another session if not we got lots of other webinars coming up you follow bloomerang you know we've got some good ones all the time so we'll call it a day there uh like i said look for an email from me with all the goodies and uh hopefully we'll talk to you again on another webinar so have a good rest of your tuesday have a good week stay safe stay healthy we need you out there and we'll talk to you again soon bye