intro.tex (16190B)
1 \section{Introduction}\label{intro} 2 3 This paper presents the design and implementation of a protocol for 4 donation handling that satisfies a broad range of potential technical 5 requirements and desiderata for donation systems. The protocol 6 enables {\em donors} to make incognito donations to registered {\em 7 charities} and still receive a tax benefit for donations to 8 charities recognized by {\em tax authorities}, while at the same time 9 preventing fraud (Figure~\ref{fig:stakeholders}). 10 11 \begin{figure}[ht] 12 \begin{center} 13 \begin{tikzpicture} 14 \node (image) at (0,0) {\includegraphics[width=0.05\textwidth]{stickman}}; 15 \node at (0,-1.3) {Donor}; 16 %arrow 17 \draw (1,0) -- (5,0) node [midway,above] {donation}; 18 %charity 19 \node (image) at (5.5,0) {\includegraphics[width=0.075\textwidth]{charity}}; 20 \node at (5.5,-0.7) {Charity}; 21 %arrow 22 \draw (5,-1) -- (3.5,-2.5) node [midway, below, rotate=45] { recognition }; 23 %server 24 \node (image) at (3,-3) { 25 \includegraphics[width=0.06\textwidth]{tax-authority}}; 26 \node at (3,-3.8) {Tax Authority}; 27 %arrow 28 \draw (1,-1) -- (2.5,-2.5) node [midway, below, rotate=-45] { taxation }; 29 \end{tikzpicture} 30 \end{center} 31 \caption{Stakeholders present in the Donau system.} \label{fig:stakeholders} 32 \end{figure} 33 34 Donating is an important way for people to empower causes they believe in and 35 facilitate collective action. In many countries there is explicit state 36 recognition of the wider public benefit of enabling such generosity: a friendly 37 tax treatment of donations. This makes financial sense as well: money immediately given 38 away to a recognized, independently administered good cause is not 39 income that will be used for private consumption. So, conceptually, 40 it deserves a different tax treatment. 41 42 Today, charities issue donation receipts which generally bear the 43 name of the charity. The donor often has to include the donation 44 receipts in their tax declaration; this means the tax authority not 45 only learns the amount that the tax payer donated to charitable 46 organizations but also how much they gave to which. 47 48 %% JL: I strongly suggest completely removing this paragraph. I'm not sure we 49 %% need to be so abstractly idealistic, and even if we do, the citation is 50 %% ideologically dissonant with the text that precedes it. ALEC is a right-wing 51 %% pro-corporation model legislation factory whose goal is to eviscerate US 52 %% civil liberties, labor rights, environmental regulation, etc. It actively 53 %% fights against the civil rights mentioned just before it. 54 55 % Donations can serve many causes, but quite often they are an obvious expression 56 % of the human right towards the freedom of thought, conscience and religion. 57 % Unencumbered financial contributions to public benefit organisations as a means 58 % of collective action exhibits significant conceptual overlap with often 59 % strongly protected civil liberties like freedom of speech and freedom to 60 % assemble. The American Legislative Exchange Council, the largest voluntary 61 % membership organization of state legislators in the USA, adopted a model 62 % resolution in 2016 \cite{ALEC2016} in support of nonprofit donor privacy, 63 % stating that "nonprofit organizations are a primary mechanism by which groups 64 % of people assemble to practice free speech and express their opinions on 65 % political and nonpolitical subjects". 66 67 Individual spending quickly becomes very intimate and personal, as even 68 aggregate spending habits can reveal a great deal about people through 69 behavioral analytics and 70 psychographic profiling.~\cite{purchase2018wen,purchasepsyco2019gladstone} 71 This holds even more for 72 acts of donating, which is typically highly revealing about e.g. belief systems 73 and intersectionality of the individuals in question.~\cite{religiondonation2015deabreu} 74 75 Protecting donation confidentiality is therefore important to protect 76 those freedoms. We have to recognize that in some situations the mere 77 fact that someone has -- in private -- donated to some cause at some 78 point in their life, can later put them at risk in another context. 79 The right to privacy is thus a critical aspect of donating. 80 81 International human rights law also provides a non-ambiguous responsibility 82 to promote and protect the right to privacy: 83 Both freedom of thought and informational self-determination are 84 anchored in key international treaties and covenants such as the 85 Universal Declaration on Human Rights (Article 12)~\cite{udhr1948}, the European 86 Convention for the Protection of Human Rights and Fundamental Freedoms 87 (Article 8)\cite{ecphrff} and many more. 88 89 90 \subsection{Protection towards all sides} 91 92 Privacy protection against outside parties is not the only concern. 93 Threats to privacy may come from the recipient charity as well. 94 Even when a donor considers a 95 particular philanthropic cause to be worthwhile, the charity may use 96 information about the donor's past giving to aggressively solicit them for more 97 contributions afterward. 98 This happens in particular when such organizations 99 employ third party (often for-profit) agencies to help ``yield'' more donations 100 on a commission basis. For-profit fund 101 raising agencies often engage in privacy-invasive practices to identify and contact potential donors. 102 One common scenario is that after a first donation, such agencies % calling them "bad actors" might be unnecessarily opinionated. From a privacy perspective they are not good, but many organizations also rely on these services to not go bankrupt. -JL 103 start to aggressively pressure a particular donor for more --- with personalized 104 emails, letters, phone calls and even in-person visits. 105 They also reuse donor information between charities, 106 leading to an avalanche of donation requests from organizations that the donor might not be interested in supporting. 107 108 In the era of data-driven donations and corporate social media 109 surveillance, this kind of behavior has unfortunately become so easy 110 that there are not just pro bono but even paid services (e.g., 111 \href{https://www.donateursbelangen.nl/opzegservice}{Stichting 112 Donateursbelangen} in the Netherlands) to de-register and exercise the ``right to be 113 forgotten'' after donating. 114 115 These concerns suggest that a privacy-preserving donation system 116 should also allow donors to remain anonymous with respect to the charity itself, 117 if that is their wish. 118 119 % Commenting out, too much repetition for my taste. -CG 120 %Even without such excesses, there are many circumstances when people 121 %like to donate something to their preferred causes without revealing 122 %their identity. Some people just prefer to stay anonymous because of 123 %personal beliefs or even religious requirements, or simply do not want 124 %to have publicity which might lead to a cascade of efforts from fund 125 %raisers. 126 127 %\subsection{Donation confidentiality} 128 129 %Making a financial donation is a deeply personal choice to share part 130 %of one's wealth in order to benefit a cause one cares about. Some 131 %traditional ways of donating (for instance passing around baskets or 132 %even plates in a religious gathering) are vulnerable to group 133 %pressure, and door to door fundraising is also confrontational and 134 %puts people on the spot. 135 % 136 %Donations in their purest form should be devoid of such pressures and in cases 137 %where there is no need for, e.g., virtue signaling, donation confidentiality 138 %comes into play. Historically, people wanting to make an anonymous donation 139 %might have an envelope with cash or a box of goods delivered. Obviously, this 140 %was never compatible with providing tax benefits. Alternatively, they might 141 %arrange for an expensive intermediary like a notary (although that would not be 142 %fully anonymous and depends on the discretion of the notary). 143 % 144 %Technically guaranteed donation confidentiality is certainly 145 %non-trivial to implement in the digital payment era. What you donate to and why 146 %may be strictly personal, but along the financial pipeline there is an 147 %uncomfortable number of actors handling sensitive data that allows for 148 %profiling and targeted discrimination on grounds. And there are even more that 149 %later on may get access to it. Digital payments are logged and made accessible 150 %to many different actors, and reporting donations to tax authorities adds yet 151 %(at least) one more actor to the pipeline. 152 153 154 \subsection{Overview of the requirements analysis} 155 156 There are two types of donations. The first is {\em 157 ad hoc} or {\em informal donations}, which are made from individual 158 to individual as {\em one time gifts} typically out of spontaneous compassion 159 or in appreciation of the 160 work being done by an individual or collective. The second category is 161 {\em regulated donations} involving at least one {\em recognized} 162 philanthropic organization or charity. Both involve voluntary 163 transferal of some financial assets for which no products or services 164 are rendered in return. 165 % NOTE[oec]: what types of donations are _not_ considered, and why? 166 % TL for the first time I'd include ad-hoc donations to beggars or to some 167 % collection boxes; that doesn't fit well with the appreciateion but rather 168 % with pity or compassion 169 170 We focus on donations to charities 171 which would be eligible for claiming tax benefits as that scenario triggers the 172 most complex requirements. 173 174 As part of their regular operations as well as their recognition as 175 public benefit organizations, registered charities are already typically 176 subject to a variety of audits as well as strict regulatory and fiscal 177 scrutiny. Good causes that do not adhere to these rules are stripped from any 178 fiscal benefits. 179 From a regulatory point of view, it should be compliant to have donations to 180 recognized public benefit organizations 181 be confidential: donors should be able to freely choose whichever 182 of the approved philanthropies they donate to, without having to disclose which. 183 184 We note that in some countries there are different tiers of philanthropies. 185 Some countries like Italy and the Netherlands have for instance particular tax 186 facilities for cultural philanthropies, offering more attractive rates of tax 187 benefits than for regular philanthropies. Obviously, this needs to be taken 188 into account when designing a system, but does not take away the fundamental 189 premise that within those categories it is no concern of a government which 190 particular recognized causes are supported. 191 192 In this work we solve the issue of privacy-preserving donations with 193 tax deductions by adhering to ``privacy by design'': In cases where 194 perfect confidentiality is not (yet) feasible, we provide fallbacks 195 that best serve the interest of donors, give them choice and respect 196 their privacy as well as the current context allows. 197 198 199 \subsection{Digital Cash} 200 201 Digital cash~\cite{Chaum89} based on tokens issued using blind 202 signatures has previously been 203 suggested~\cite{donations2003blind} as a foundation for donation systems that allow 204 donors to remain anonymous but easily identify donation recipients. 205 The untraceability of the underlying payment system for purchases easily provides untraceability in the donation context as well. 206 The crucial difference is that the Donau system gives tax-deductible donation 207 receipts without revealing the charity donated to. 208 209 Our current implementation is designed to work in conjunction with the 210 GNU Taler~\cite{Taler} payment system. GNU Taler is a {\em digital 211 commons}, based on Free Software~\cite{stallman2009free} and advanced 212 cryptography. This means that -- unlike proprietary products -- anyone 213 can easily extend and customize the core system. 214 215 As the underlying acronym (``Taxable Anonymous Libre 216 Electronic Resources'') suggests, GNU Taler bridges two seemingly opposing 217 requirements: 1) providing privacy to citizens with regard to how they 218 spend their money in the digital realm, and 2) making these expenditures (on the receiving end) transparent to and auditable by appropriate financial institutions. 219 These high-level 220 objectives philosophically match nicely with our objective of 221 achieving privacy-preserving donations with tax-deductability. 222 223 224 \subsection{Approach} 225 226 At a high level, the Donau protocol consists of five steps: 227 \begin{enumerate} 228 \item Charities are recognized by the tax authority and their 229 credentials are registered at the Donau service provider. 230 \item Tax payers are assigned tax payer identification numbers. 231 \item A donor makes a donation to a charity and receives 232 blindly signed donation confirmation tokens bound to 233 their tax payer identification number in return. 234 \item After the tax period ends, each donor submits their 235 collected donation confirmation tokens to the Donau and 236 receives a summary donation statement over the total 237 amount bound to their tax payer identification number. 238 \item Donors submit the summary donation statement with 239 their tax filing to the donation authority, which validates 240 the digital signature from the Donau. 241 \end{enumerate} 242 243 The Donau protocol makes it possible for the donor to give an 244 unforgeable proof of the combined amount they donated to registered 245 charities, without the charities or the tax authorities learning who 246 donated to whom. The privacy features obviously require that there is 247 more than one charity and more than one donor. The Donau protocol 248 itself is actually oblivious to how the payment underlying the 249 donation happens. If the donor chooses to donate by credit card or 250 bank transfer, then their identity may become known to the charity 251 through the payment process. 252 % 253 However, a relevant feature of the protocol is that the charity does 254 not need to learn the identity of the donor. Hence, if payments are 255 made with GNU Taler or a similar privacy-preserving payment method, the 256 Donau protocol will preserve the privacy properties of that payment 257 system. 258 259 The design requires the creation of a Donation Authority (Donau), an 260 additional service separate from the charities and the payment system. 261 The Donau is responsible for recognizing charitable organizations and 262 tracking the total amount of donation receipts each charity is issuing 263 for the charitable contributions the charity is receiving. It is 264 typically expected that each competent tax authority would operate 265 a Donau for the taxpayers in its domain. We note that the Donau does 266 not receive sensitive private information about donors: privacy is 267 achieved using cryptography to unlink proofs of donations from the 268 actual donation process. Even the taxpayer identification number is 269 only ever disclosed with the final tax statement to the tax authority, 270 but not to the Donau service or the charity. 271 272 273 \subsection{Structure of the paper} 274 275 Section~\ref{requirements} provides some deeper analysis on the 276 various requirements that donation systems may need to satisfy. There 277 are many aspects to donations and for the technical design and 278 implementation we chose to focus on a design that provides privacy for 279 donations. Section~\ref{technical} provides technical details on the 280 core design of the Donau protocol, while ignoring some of the more 281 complex use-cases from Section~\ref{requirements}. 282 Section~\ref{implementation} gives an overview of our existing implementation of the Donau server. 283 Finally, Section~\ref{discussion} explains extensions of the core design that 284 could be used to address all of the main use-cases. Many of these 285 extensions are simply a matter of proper integration and user 286 interface design, while a few presume the existence of a widely 287 available digital identity system (such as citizen ID cards, or the European 288 Commission's \href{https://ec.europa.eu/digital-building-blocks/sites/display/EUDIGITALIDENTITYWALLET/EU+Digital+Identity+Wallet+Home}{Digital Identity Wallet}) that provides a single 289 unlinkable pseudonym for each citizen per charity. 290 291 Navigating donation regulations involves adhering to a multitude of 292 directives on transparency, anti-money laundering, tax compliance, and 293 data protection while also meeting specific requirements in individual 294 countries. Compliance ensures trust in the philanthropic sector, 295 promoting ethical giving practices within a complex regulatory 296 landscape. Cross-border donations are particularly challenging. 297 We review some of the legal and regulatory background in 298 Appendix~\ref{app-back}.