Presentation from the 2014 Southeastern Chapter of the American Association of Law Libraries conference in Knoxville, TN on privacy audits in law libraries.

1. Rachel Gordon
Mercer University School of Law

2. What is Privacy?
In a library (physical or virtual), the right to
privacy is the right to open inquiry without
having the subject of one’s interest examined
or scrutinized by others.
– ALA, An Interpretation of the Library Bill of
Rights

3. Privacy and Confidentiality
Confidentiality exists when a library is in
possession of personally identifiable
information about users and keeps that
information private on their behalf.
– ALA, An Interpretation of the Library Bill of
Rights

4. Personally Identifiable
Information
Generally includes any information that can
identify a specific individual
Name Address Phone/Fax number
Social security
number
Driver’s license
number
Bar or Student ID
Number
Email address
Mother’s maiden
name
Spouse information
Financial information Medical information Education information
Birth date IP address Signature

5. What Laws Govern Library
Privacy?
 Federal
 1st Amendment
 Video Privacy Protection Act
 Freedom of Information Act (FOIA)
 Family Educational Rights and Privacy Act
(FERPA)
 State
 Library privacy statutes
 Records retention/destruction statutes

6. Georgia Library Privacy Statute

7. Georgia Business Records
Statutes
 O.C.G.A. § 10-11-2. Time period for
retention of business records
 O.C.G.A. § 10-15-2. Disposal of
business records containing personal
information

8. Privacy Audit
 What is it?
 Whose responsibility is it?
 What is the end product?

9. What is a Privacy Audit?
 Ensure goals supported by practices
 Protect from liability
 Process, not a one-time event

10. Whose Responsibility?

11. End Products
 Privacy policy
 Document retention policy
 Staff training

12. Preliminary Steps
1. Evaluate existing policies and procedures
2. Compile definitions, including what is
considered PII
3. Identify a process/department to audit

13. Data
Collected
Protected?
Secure?Test
Destroy
Privacy Audit Cycle

14. Concluding Steps
 Establish ownership
 Address issues
○ Process Improvement
○ Training
 Repeat periodically

15. Auditing for PII
 Patron records
 Transaction logs
 Notices for overdue items and fines
 ILL and document delivery records
 Visitor registers
 Reference logs
 Public terminals

16. Data Collection Considerations
 Why is data being collected?
 Who is collecting?
 Who else has access?
 How stored?
 For how long?
 How will data be destroyed?

17. Developing a Privacy Policy
 State that privacy and 1st Amendment
rights are protected
 Specifically discuss patron use info related
to books, multimedia resources, and the
internet
 State that general statistical data may be
compiled, but that PII is not included
 Offer an opt-in for contact unrelated to
library activities
 Mention vendors
 Have it reviewed by legal counsel

18. Record Retention Policies
 Is there a state statute?
 Minimum time to retain

19. Audit Results
 Existing privacy policy
 Electronic security
 Issues in practice
 Instances of borrowing history revealed
 Papers not secured/shredded
 Processes needed updating

20. Audit Results – Electronic
Info
 Patron circulation data well protected
 ILS set to only keep current check outs and
unpaid fine information
 Staff not clearing patron data from
circulation computer monitor
 Scanned files need to be manually
deleted

21. Official Requests
 Law Enforcement
 FOIA
 Open Records Act

22. Social Security Numbers
 Do not use!
 Check old records
 Redact or destroy

23. Informal Patron Requests
 Who has Weinstein
on Evidence
checked out?
 Would jury
instructions for child
molestation be civil
or criminal?

24. Reference Questions
 How do I find information on whether I
have to tell my boss that I’m HIV
positive?

25. Holds
 Balance patron privacy with need to
know who receives item
 Wrap hold items to cover titles if stored
on an open shelf

26. Routing Slips
 Routing slips reveal one or more patron
names linked to an item
 Opt in

27. Law Enforcement Requests
 Separate policy
 Easy reference
 University-wide
THERESA CHMARA, PRIVACY AND
CONFIDENTIALITY ISSUES: A GUIDE FOR
LIBRARIES AND THEIR LAWYERS (2009).

28. Audit Results – Training
 10-15 student assistants each semester
with a completely new staff every 2
years
 Students are the main circulation desk
contacts
 Training issues/reinforcement
 Reminder sign posted next to the
circulation computer

29. Audit Results – Paper Problems
 MANY issues
 Inadvertent prints from the circulation
computer
 Copies of checks
 Old student info with social security numbers
 Graded student work left by former
employees
 Staff info page on a bulletin board
 Print copies of sent overdue notices

30. Inadvertent Printing

31. Payment Records
 Copies of checks

32. Overdue and Fine Notices
Rachel Gordon
123 Some Street
Macon, GA 31204

34. Public Internet Terminals

35. Components of a Good Privacy
Policy
 Notice of rights & applicable laws
 Choice & consent
 Access & updating
 Data integrity and security
 Data aggregation
 Required disclosures

36. Related Issues
 Internet security
 Identity theft
 Social engineering