|
Like many Australians, my first instinct after hearing about the Qantas data breach last year was to check my Frequent Flyer account. And then I had a moment that felt oddly relevant to the work we do in prospect research.
I am a heavy Qantas user — Frequent Flyer member, multiple bookings a year, Qantas credit cards, the works. My husband and daughter rarely fly with Qantas. When the breach affected 5.7 million customers, Qantas communicated directly with each of us regarding the data that they held. The data Qantas held on me was considerably richer than what they held on either of them. That difference isn’t random. It’s proportional to the depth and frequency of our respective relationships with the brand. Which got me thinking: isn’t that exactly how prospect research should work? The principle of proportionality In privacy law, proportionality refers to the idea that the data an organisation collects and holds on an individual should be proportionate to the nature of the relationship. It’s a cornerstone of the Australian Privacy Act — and it’s also, or at least it should be, a cornerstone of good prospect research practice. In a fundraising context, this means the depth of research we conduct on a prospect or donor should reflect where they are in their relationship with our organisation. A lapsed annual donor who gave twice five years ago warrants a very different level of research than a mid-level donor who has been consistently engaged for a decade and is showing signals of major gift capacity. We wouldn’t expect Qantas to hold the same depth of data on an occasional flyer as they do on a Platinum member — and the same logic applies to us. But here’s where it gets complicated The tension, of course, is that richer data on engaged donors genuinely does lead to better fundraising strategy — and better donor experiences. And when we look at the ATO’s charitable giving statistics, the case for investing in understanding your major donor base becomes pretty hard to argue with. The potential for growth is real — but realising it requires genuine, thoughtful donor understanding, not a superficial skim. So the argument for deep research on engaged, high-capacity donors is a strong one. When we understand a donor’s philanthropic history, their capacity, their connections, and their giving priorities, we are better placed to have the right conversation at the right time. That’s not voyeurism; that’s good stewardship. What about AI? Doesn’t that change the equation? It’s a question we’re hearing more and more. If AI can aggregate large amounts of data on prospects quickly and at scale, doesn’t that make the proportionality conversation moot? Why not just collect everything on everyone and let the algorithm sort it out? The short answer is: because volume is not the same as value — and because AI doesn’t get you off the hook on proportionality, it makes the stakes higher. AI-generated prospect profiles can appear comprehensive. But the data they draw on is frequently wrong, misrepresented, and incomplete. There are key pieces of information that Prospect Researchers look at that aren’t accessible by AI. What is presented in AI generated profiles is often questionable - philanthropic histories that conflate two people with the same name, misinterpreted data, business interests attributed to the wrong person, missing data because AI wasn’t able to work out who the person was, Anyone who has fact-checked an AI-generated profile will have their own version of this list. When that data is wrong and it sits in your CRM unchecked, it doesn’t just create an embarrassing moment in a donor meeting — it creates a compliance risk. You are holding inaccurate personal information on individuals, potentially at a scale and depth that is not proportionate to your relationship with them. That’s not a minor administrative issue; under a strengthening privacy framework in Australia, it’s increasingly a liability. The proportionality test applies to AI-assisted research just as it does to any other method. If anything, because AI makes it easier to collect more data on more people more quickly, the discipline of asking “should we be collecting this, on this person, at this depth?” becomes more important, not less. The ease of collection is not the same as the right to collect. Used well, AI can be a genuinely useful tool in prospect research — for synthesising information on highly engaged prospects where deep research is warranted, for flagging signals that merit a closer look. But it needs a human hand on the wheel, checking accuracy and asking the proportionality question at every step. So where does that leave us?The Qantas breach is a useful prompt to ask ourselves a few honest questions. What data are we holding, on whom, and why? Is the depth of our research genuinely proportional to the relationship — or are we profiling people with minimal engagement with our organisation, perhaps with the help of tools that make it feel frictionless? And critically, if our data were exposed tomorrow, would we be comfortable explaining to our donors what we hold and why? What the ATO data also tells us is that there is a lot of work still to do to normalise philanthropy among Australia’s wealthiest cohort. With the government’s goal of doubling philanthropic giving by 2030, building donor trust has to be part of the equation. And trust, in part, is built on people knowing that we hold their data with care — that we know more about them because we’ve invested in the relationship, not simply because we can, or because a tool made it easy. The principle of proportionality isn’t a constraint on good prospect research. Used well, it’s actually a framework for doing it better.
0 Comments
This article reflects governance observations only. It is not legal advice.
In many organisations, privacy policies are treated as compliance documents. They’re drafted, reviewed when legislation changes, and otherwise left alone. But privacy policies do more than meet regulatory requirements. They say something about how well an organisation understands — and stands behind — its data practices. Prospect research and wealth screening sit squarely in that space. In Australia, references to prospect research and screening activities are often folded into broad statements about “publicly available information” or “third-party service providers.” Technically, that may meet minimum disclosure standards. Operationally, it can leave things vague. That vagueness may feel comfortable in the short term. I’m not convinced it will age well. Other jurisdictions provide useful context. When the General Data Protection Regulation (GDPR) came into force in the European Union, organisations had to be much clearer about how personal data was collected and used. Fundraising activities — including prospect research, profiling and wealth screening — were required to be explicitly described. Lawful basis had to be articulated. Profiling had to be acknowledged where it occurred. That transparency didn’t eliminate prospect research. It professionalised it. Organisations were required to clarify purpose, document governance controls, assess proportionality and strengthen oversight. In practice, many emerged with stronger internal processes and clearer board engagement. Importantly, greater transparency did not trigger widespread donor backlash. Where organisations explained that screening supported appropriate fundraising, stewardship and due diligence, it was broadly understood as part of responsible institutional management. Australia’s privacy framework is structured differently. The Australian Privacy Principles do not adopt GDPR’s lawful basis model. But the direction of reform is increasingly clear: strengthened individual rights, higher penalties, greater regulatory enforcement and rising expectations of organisational accountability. At the same time, public sensitivity to data use — particularly where analysis, profiling or automation is involved — continues to increase. In that environment, ambiguity becomes a risk factor. APP 1 and APP 5 require organisations to describe the kinds of personal information they collect and the purposes for which it is used. APP 6 limits use to the primary purpose of collection, or a related secondary purpose that would be reasonably expected by the individual. Where prospect research relies on publicly available information and reputable research providers to support fundraising strategy, stewardship and due diligence, transparent disclosure is not a concession. It is consistent with those principles. It also anticipates the growing regulatory emphasis on transparency, proportionality and reasonable expectations. Privacy policies are not marketing documents. They do not need to detail every operational step. But they should reflect reality. Organisations that articulate their prospect research practices clearly now will be better positioned if reform narrows interpretations of “reasonably expected” use or strengthens notification obligations. And in the current climate, that is simply prudent risk management. In major gift fundraising, a key to planning and strategy is understanding the wealth and giving of major donors and prospects. We think about how much we believe people can give, but what do we know about how much people do give? |
We try to keep up to date with news on developments in and reports on philanthropy in Australia and post it here: if you have something to share, please send it to us! Archives
February 2026
Categories |
RSS Feed