• member databases (e.g. Church Community Builder, Elvanto, FellowshipOne)
• rostering applications (e.g. Planning Center Online)
• email and calendars (e.g. Gmail/Google Apps)
• notetaking and organisation (e.g. Evernote)
• email newsletters (e.g. MailChimp)
• form building (e.g. Wufoo)
• …and the list goes on!

These services provide tremendous benefit to churches – I’ve written about these on more than a few occasions.

However, when I wrote the article “3 excellent church database solutions“, a concern was raised with me as to the potential privacy issues that exist with these cloud-based services, and whether these issues preclude churches from using them. It’s a good question, and I decided this was a topic worth exploring further, given the relevance to Australian churches.

At the heart of the matter is the fact that many of the cloud-based services used by churches (and other organisations, for that matter) store data (including personal information) on servers outside Australia (often in the United States). Where the information is hosted matters, because privacy legislation differs in different countries.

In Australia, the Privacy Act (1988) contains 10 National Privacy Principles (the NPPs) which specify how organisations should handle personal information. NPP 9 specifically enables the transfer of personal information from Australian boundaries if certain conditions are met, such as

• if the individual who’s personal information is collected consents, or
• if the organisation collecting the personal information ‘reasonably believes’ that the recipient or transferee falls under ‘a law, binding scheme or contract that upholds the principles for fair handling of the information that are substantially similar to the National Privacy Principles’, or
• ‘if the organisation has taken reasonable steps to ensure that the information which it has transferred will not be held, used or disclosed by the recipient of the information inconsistently with the National Privacy Principles’.

Does this legislation apply to churches?

While this legislation only applies (with some exceptions) to organisations with an annual turnover of $3 million or more (unless the organisation is related to another business with an annual turnover of more than $3 million), as this document by the Sydney Anglican Diocese (I think rightly) explains:

“If a person has a genuine grievance about the way in which a parish has handled his or her personal information, it is unlikely that the grievance will be satisfactorily resolved by relying on an exemption from the legislation. While reliance on an exemption may mean the parish avoids the risk of a financial penalty for a breach of privacy under the legislation, a grievance which is not satisfactorily resolved may lead to damaged relationships which, in serious cases, may affect the mission of the parish.”

Therefore the privacy legislation is relevant for Australian churches and the question then needs to be asked:

“What are the privacy implications for Australian churches using cloud-based services and what standards should be observed if they are to be used?”

1. The relevance of the USA PATRIOT Act

You’ve probably never heard of the USA PATRIOT Act (signed into law in the U.S. in 2001), but it is a relevant concern. Why?

The Act “dramatically reduced restrictions on law enforcement agencies’ ability to search telephone, e-mail communications, medical, financial, and other records; eased restrictions on foreign intelligence gathering within the United States”, and more. This means that data housed on servers in the U.S. could be accessed by the U.S. government without the user knowing. This has caused major concerns in Europe and Canada, both of which have legal regimes to manage the use of personal information, like Australia. As of December 2011, a bill awaits U.S. Congress that:

“would include a provision that would prevent any service provider from disclosing a customer’s personal data with any agency, even under government order, without notification and consent of the customer.”

The existence of this Act creates some uncertainty for information managers in Australia, given that some organisations may be required to ask some complex questions:

1. Does the existence of the PATRIOT Act mean that information located in the U.S falls under a regime that is not ‘substantially similar’ to the NPPs? or
2. Have we taken ‘reasonable steps’ to ensure that the information is not ‘held, used or disclosed’ by the recipient ‘inconsistently’ with the NPPs?

There is a lot of debate around how the PATRIOT Act relates to the NPPs, and similar legislation in other countries. The debate is complicated because of at least three other reasons:

1. Some European and Australian-based web hosts and service providers have a vested interest in scaring people away from U.S. based companies, and the existence of the PATRIOT Act is one way to further this goal, and
2. The mutual assistance treaties that Australia has with other nations could potentially mean that Australian data could be accessed by foreign governments even if it’s hosted on Australian soil, and
3. Although Australia does not have a PATRIOT Act, various Australian legislation exists permitting Australian law enforcement and security agencies to demand personal information from certain organisations.

From the extensive reading that I’ve done (and I’m not a lawyer – see disclaimer below), it seems that the PATRIOT Act adds complexity to the issue (and many are arguing that this be resolved ASAP), but the existence of the PATRIOT Act doesn’t in and of itself mean that Australian organisations hosting data in the U.S. are breaching the NPPs. I’m yet to read anything that would suggest otherwise – apart from those who have a vested interest in the PATRIOT Act resulting in these restrictions.

I found it interesting that the PATRIOT Act isn’t mentioned at all on the website for the Office of the Australian Information Commissioner,  nor in a 2010 speech on the topic of cloud computing and privacy by a representative of the Office.

2. Requirements for transferring and hosting information offshore

I believe that the NPPs provide requirements for dealing with organisations that host data offshore, rather than ruling this activity out all together. Indeed, the title for NPP9 ‘Transborder data flows’ appears to envisaged that this will and may occur. Practically,  this trend will continue to increase, as organisations rely on cloud-based services to efficiently handle their information needs and systems.

The NPPs require that if personal information is transferred to someone in a foreign country (other than the organisation or the individual), that the organisation transferring the information satisfy a number of conditions. As one expert explains:

“Moving this data overseas isn’t arbitrarily banned…provisions of the Privacy Act 1988 National Privacy Principles 9 (Transborder Data Flows) allow for movement of personal information offshore as long as the destination jurisdiction adheres to similar privacy principles; the individual involved has consented to the transfer, usually as part of service terms and conditions; and the transfer is necessary to benefit the individual.”

I think it’s beneficial to refer to a speech in September 2010 by Andrew Solomom who was at the time, Acting Assistant Commissioner, Operations, Office of the Australian Information Commissioner, to the Cloud Computing Conference and Expo. He said this:

“Cloud service providers are frequently based outside Australia and thus may not be subject to Australian legislation or it may be difficult for a regulator to enforce action against the organisation if something goes wrong. This means that it is very important that Australian organisations ensure, when they enter into a contract with a cloud service provider, that the terms of the contract enable them to continue to meet their obligations under the Privacy Act and that there is minimal risk in relation to the protection of personal information.”

Mr Solomon does not discourage let alone state the view that the NPPs prohibit Australian organisations from using cloud-based service providers. Rather, his discussion centres on using them with caution and employing risk minimisation when engaging their services. Besides, cloud-based data storage can be much safer than storing data on a local network:

“Stories about security breaches due to lost or stolen laptops and USB devices, or inappropriately secured enterprise computing systems abound. Storing data in the cloud, rather than on these devices or on an inadequately secured in-house system, if done well, may reduce these risks.”

The challenge, in order to take advantage of these new opportunities, is to ensure that personal information can be moved to a third-party service provider’s facilities securely and that those facilities are also appropriately secure.”

Let me share with you a couple of snippets from the speech that are relevant to Australian churches. You can read the whole speech for yourself here.

“It is important, therefore, that individuals are informed given appropriate notice that their information will be stored in facilities provided by a third party.”

“Organisations should ensure that cloud service providers they intend to use offer personal information security measures that are at least equal to their own and will enable them to continue to meet their obligations under the Privacy Act.”

“Organisations should question the permanence of data they move to a cloud service provider and ensure that they are able to continue to meet their obligations concerning the disposal of personal information that is no longer required.”

Based on my reading of the NPPs and the commentary on these laws contained in Mr Solomon’s speech, it seems to me (and again, this isn’t legal advice) that Australian churches can host data offshore and adhere to the NPPs as long as they:

• Obtain consent – as one legal author states: “consent is the miracle cure that cures virtually any abuse possible under the NPPs”.
• Confirm some key security details with their cloud service provider or through due diligence enquiries, such that the Church is able to form a reasonable belief that the recipient falls under substantially similar privacy protections as the NPPs.
• Take appropriate steps to ensure that the information will be maintained by the cloud service provider in a way that is consistent with the NPPs. For example, if entering a contract with a cloud service provider, and personal information will be transferred, it may be possible to negotiate a clause within the contract ensuring that the provider maintains information in a way that is not inconsistent with the NPPs (obviously, this will not always be possible due to the relative strength of the bargaining positions of each party).

In addition, it would also be prudent to advise members of where their personal information may be stored through a privacy policy or statement.

It is clear that as the world is changing fast and more services are being provided online, there is some clarity lacking in how aspects of Australian privacy legislation applies to Australian businesses, including churches. Ultimately, this is something that churches need to consider for themselves as their particular circumstances demand.

I will be asking the Sydney Diocese (of which my church is a part) to produce a formal legal statement explaining how the Privacy Act applies to local congregations, to provide greater clarity for Anglican churches.

I’m confident (and this SMH article agrees) that as cloud computing develops and becomes even more popular and beneficial, that the law will become clearer and improve the legal controls for the transfer of data in a way which does not stymy the use of cloud based technologies, yet which appropriately safeguards a person’s personal information. This will enable churches to continue to use these tools – in an appropriately managed way that balances the competing tension between organisational management and efficiency and a person’s privacy interests - for the advancement of the gospel and the glory of God.

I found a couple of articles helpful in the preparation of this article:

• Is it legal to send your data overseas?
• Protecting Privacy on the ‘Borderless’ Internet – Some Thoughts on Extraterritoriality and Transborder Data Flow
• Cloud computing and privacy FAQ (this was written for a Canadian audience, but is relevant in many ways to Australia)
• Canadian privacy law [similar to Australia], cloud computing and how it applies to nonprofits
• A collection of articles relating to cloud privacy in Australia
• Patriot Act clouds picture for tech
• Anglican Church Diocese of Sydney – Privacy Legislation, managing its impact on parishes

A big thank you to Todd, for his help in thinking this complex topic through.

Disclaimer: The material contained on this article is by way of general commentary only. It is not legal advice, nor should the reader rely on it without seeking legal advice. Communicate Jesus and the author excludes all liability or any loss suffered in connection with any reliance on the information contained in this article.

Advertise here with Beacon Ads

These codes can be generated online and placed on just about any product that can be printed. What’s the point?

Using a free app for your mobile phone, passers-by can scan the code and be taken straight to a link – a website, a song on iTunes, or other destinations:

Here’s an example from Wufoo:

There’s lots of creative ways of using QR codes:

JC Penny has some up with an interesting approach that ”allows the gift giver to scan and record a personalised voice message for the recipient… Once they are done, just stick the QR code Santa Tag on the present!”.

QR codes have even made appearances on wine bottles and buildings! You can learn more about QR codes in the ‘Ultimate Beginners Guide to QR Codes‘.

In the next post, I’ll explain how my church is using QR codes in our Christmas promotion.

Advertise here with Beacon Ads

Thanks for attending this morning’s seminar. Here’s some resources I mentioned (including the article mentioned in the intro – ‘12 reasons to thank the porn industry?’ and ‘8 systems for a healthy church‘).

If you’ve got any questions, feel free to contact me.

Get updates to your inbox here.

Social Media

• 4 staggering Facebook statistics
• 15 ways for churches to use Twitter
• John Piper shares how he uses Twitter
• Harness Twitter for post-Sunday communication
• Finding faith on Facebook
• How Facebook killed the church

Church Website

• How the gospel should shape your web strategy
• Your church needs a good website
• 25 inspiring church websites
• Clover Sites
• Church Themes
• Church Media
• Church Themer
• Read this book before creating a website – ‘Don’t make me think‘ by Steve Krug.

Member Database

• 3 excellent church database solutions
• 6 reasons my church uses the Jethro member database
• 32 church database solutions
• Search for the ideal church database

Technology and the Christian Life

• Beware – the Bible is about to threaten your smartphone focus
• Click in remembrance of me (how not to do communion!)
• Churches need to catch up
• Is it too late to catch up?
• 5 principles for selecting technology for your church
• 5 dangers of using technology in the Christian life
• The dangers of dehumanizing our communication
• A letter I wrote to my church about why we use technology
• 7 articles on using technology to advance the gospel
• The implementation of technology and its dangers for our soul
• For more on technology and productivity, I recommend Matt Perman’s blog – ‘What’s Best Next‘

Top 10 Tech Tools

Here they are – in no particular order:

• Elvanto
• Evernote
• Wufoo
• Planning Center Online
• Google Apps
• Mailchimp
• Logos Bible Software
• Google Reader
• OmniFocus or GQueues
• Kindle (see below)

At the most basic end of the spectrum there’s Wi-Fi (I’ve got this version) and Wi-Fi + 3G.

Wi-Fi means you need to be connected to a network to sync your Kindle. The 3G version allows you to do this wherever you are. Personally, I like to be distraction-free, and it’s great to take my Kindle to a cafe, without the temptation of being able to browse the internet.

New versions of the Kindle were recently released including the Fire and the Kindle Touch. Call me old fashioned, but I prefer the earlier version – it’s simple, and what it does it does well – allows me to read books.

Books

• ‘The Next Story: Life and Faith after the Digital Explosion‘ by Tim Challies.
• ‘Sticky Teams: Keeping Your Leadership Team and Staff on the Same Page‘ by Larry Osborne
• ‘Switch: How to Change Things When Change Is Hard‘ by Chip Heath
• ‘Axiom: Powerful Leadership Proverbs‘ by Bill Hybels
• ‘Don’t Make Me Think‘ by Steve Krug.

Disclosure: this post contains some affiliate links. This means that if you click on the link, and purchase the product, I will receive a small percentage of the total amount. I only link to products I recommend, and income from affiliate links is used to maintain and improve Communicate Jesus.

Advertise here with Beacon Ads

It was a great night discussing how we can most effectively welcome the people God brings to our churches. I learnt a lot from other churches, got a stack of ideas, and was encouraged meeting with Christians who I’d never met before. I thought it was well worthwhile – welcoming is a very important activity, that rarely gets much thought or discussion.

Proposal: Welcoming Roundtable in Melbourne

In November I’ll be in Melbourne speaking at the ‘In The Chute’ conference, and thought I’d run the night again with churches there. I’m proposing an evening during the week commencing 28 November.

You can read more about the background to the Welcoming Roundtable here.

I have fewer church connections in Melbourne, but I thought I’d make the suggestion and see if there’s any interest.

Interested?

So, if you’re interested, please let me know via this online form. It’s just an expression of interest – no need to commit at this stage.

Advertise here with Beacon Ads

Advertise here with Beacon Ads

The purpose

To assist discussion amongst Christians as to how to most effectively welcome the people who God brings to our churches. You can download a short background paper I’ve written on this topic: ‘Welcoming people to church‘ (PDF).

The essentials

• Who: Christians who are interested in discussing how to most effectively welcome the people who God brings to our churches.
• When: 19 September from 6.30-8.30pm. We may finish a little earlier, we won’t finish any later.
• Where: Naremburn Camerray Anglian Church.
• Cost: your time, but not your wallet.
• RSVP: Please let me know if you are coming via this form. It is important that I know in advance (by 12 September) who is coming, so that I can confirm the room that we will be using.

I’ll also order some pizzas if you’d like some food and conversation before we start. You can indicate if you’d like to be there at 6pm for pizza on the sign-up form.

The format

The format is still being finalised but will most likely involve:

• Brainstorming the obstacles newcomers face in coming to, and being at church.
• People from different churches sharing their approaches to welcoming.
• Time to ask questions of these people as to how and why they approach welcoming as they do.
• Exploring the challenges and opportunities of the key periods of welcoming (before the service, during the service, after the service).
• Time for people to share what’s worked particularly well for their church, and what’s not worked at all!
• A discussion on how to train welcoming teams, and the church as a whole to welcome newcomers.
• Useful resources for thinking about this topic further.

We’ll close the night in prayer. I’ll aim to document the discussion in a series of follow-up posts on Communicate Jesus.

To get prepared

No preparation beforehand is required. However, if you’re interested, here are some resources to consider:

• You can download a short background paper I’ve written on this topic here.
• One book that I’ve found particularly helpful is Fusion: Turning first-time guests into fully engaged members of your church by Nelson Searcy. There’s a lot of great advice in this book that I’ve been thinking through how to apply.

I’ve also written a number of posts recently on this topic:

1. It’s time to stop assuming people know
2. If you don’t know, it’s not obvious
3. A first impressions survey of newcomers to church
4. A visit to the philosophy seminar: a lesson for churches
5. What questions might people have before visiting church for the first time?
6. 8 posters to engage with people new to church
7. Video: 10 top tips for welcoming
8. Hillsong provides two lessons for welcoming visitors to church

Questions?

If you have any questions, please contact me via email: steve at communicatejesus.com.

I look forward to seeing you there.

Advertise here with Beacon Ads

One book that I’ve found particularly helpful is Fusion: Turning first-time guests into fully engaged members of your church by Nelson Searcy. There’s a lot of great advice in this book that I’ve been thinking through how to apply.

One of the suggested applications is a survey of newcomers, sent out in the days after their first visit. Searcy suggests the following questions:

• What did you notice first?
• What did you like best?
• What was your overall impression?
• How can we pray with you?
• Name
• Email Address

I also noticed The Village Church running a similar survey on their website.

I decided to launch this at Church by the Bridge – below is a snapshot, and you can view online here. We received our first entry last week!

There are numerous benefits to this survey. Here’s five:

1. Show people that you care about the experience that they have.
2. See how church is perceived through the eyes of someone who is new.
3. Learn what your church is doing well – how the church and welcome teams can be encouraged.
4. Discover what obstacles exist to new people feeling welcomed.
5. Understand (over time) whether your church is welcoming or not (don’t just rely on gut feel!).

Advertise here with Beacon Ads

1. Chat to your friends, family and colleagues and ask them the question – “why aren’t you a Christian?”. You could also phrase it in other ways – e.g. “what are your objections to Christianity?”.
2. Once you’ve spoken with these people and heard their response, submit the details via the online form [see a sample form here, or below] by 30 March.
3. We’ll then announce the topic for the sermon, and you can invite your friends, family and colleagues to church to hear a response.

It’s a great opportunity to reach those we know – and this is the focus for the year at Church by the Bridge.

Advertise here with Beacon Ads

At the end of last year I received a Wufoo-themed balloon and card in the mail.

Here’s what the hand-written card said:

It was a small, low-cost gesture, but it meant a lot. Why? Because it was intentional and personal.

The internet is growing fast – there are now five-times as many internet users as there were just 11 years ago.

Regardless of how much of the world is online, hand-written cards will never go out of fashion.

Advertise here with Beacon Ads

See also:

• Wufoo offers churches a 50% discount
• Examples of Wufoo forms in action
• Use Wufoo to encourage church members to share
• 10 reasons why Wufoo is better than Google Docs
• Simplifying Bible study sign-up

FormStack

Advertise here with Beacon Ads