Will the Donors Be Told?

The university incidents exposed donor records — contact details, giving history, event attendance and biographical information. Whether affected donors receive individual notification is a question the reporting raised and did not resolve.

State breach notification statutes generally require notice when defined categories are exposed: name combined with a national identifier, financial account number, driver’s licence, or in some states medical or biometric data.

A donor record of name, address, telephone number, giving history and event attendance may contain none of those. The exposure can be substantial and fall below every statutory trigger.

That is the structure this desk filed at 25-0916 for law firms and 25-1204 for manufacturing intellectual property: real harm, no notifiable field, no public record.

What a person donates, to which cause, and at what level, is a financial disclosure and frequently a political or religious one. Many donors give on the explicit understanding that the amount is not public.

A wealth capacity assessment written by a staff member is more sensitive still — an estimate of what somebody could afford, recorded about them, which they have never seen.

This desk does not allege that any institution suppressed anything. It records that the incentive structure is worth naming: a development office exists to maintain donor relationships, and telling a major donor that their capacity assessment may have been taken is a difficult conversation with a person the institution needs.

Where notification is discretionary rather than mandatory, that pressure operates. Graded medium: whether notifications were issued is not established in the material we reviewed.