On 9 December 2016, the ICO issued two Civil Monetary Penalty Notices ('CMP Notices') against the British Heart Foundation ('BHF') and the RSPCA, each being fined £18,000 and £25,000 respectively for alleged breaches of the DPA. This decision by the ICO came as a surprise to many charities, particularly as the issue of wealth profiling or screening in connection with fundraising was not mentioned in any detail at the outset of the ICO's investigations. For instance, if you look at the ICO Direct Marketing Guidance published in 2016, the word 'profiling' is mentioned only once and that is in relation to use of website cookies. The published CMP Notices are similar in many respects so the main findings are summarised together below. Many in the sector are concerned about the way that the ICO have come to its conclusions. We share those concerns as the ICO's reasoning and legal basis for its decision to impose fines on the charities involved, does not appear to be particularly clear.