It depends. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to non-profits. It excludes contact information from the definition of personal information. However, the privacy policy should ensure that members, clients or others are aware of this practice and provide the reasons.   Best practice is to exercise caution before sharing.