It depends. The Personal Information Protection Act that applies to non-profits excludes contact information from the definition of personal information. However, the privacy policy should ensure that members, clients or others are aware of this practice and provide the reasons.   Best practice is to exercise caution before sharing.