APLA2018

Libraries historically hold a great deal of personal data about their patrons - names, emails, birth dates, gender, phone numbers, addresses, student numbers, driver’s licenses and surprisingly even comments about the patron - sometimes for decades. In the current climate of data breaches and privacy concerns, are you doing enough to secure that information from unauthorized access and even authorized access? Are you unnecessarily maintaining data that your modern workflows no longer depend upon and just keeping the information out of habit? Inaction and indecision are not options.

Many libraries have focused energies on access to patron borrowing history and ensuring those systems were out of reach of the Patriot Act, but many have neglected the raw personal data often sitting in plain text on their servers.

We found current ALA guidelines particularly instructive:
"Libraries should limit the amount of personal information collected by the LMS about patrons.  In general, the library should collect the minimum amount of personal information required to provide a service or meet a specific operational need.”

UNB Libraries recently went through exercises to determine exactly what data we were keeping on our patrons and why. We determined that much of the data no longer had any real merit and was simply reflexive. This was seen as an unnecessary risk and liability that we were no longer willing take. We decided to take action before something catastrophic happened. We took steps to unravel the processes that were harvesting, much of it dynamically, and storing the data. Retention periods and anonymizing data were also reviewed. Deleting the obsolete data proved to be as challenging as deciding what to keep. Staff expectations, especially those with a long history of access to the data, also had to be adjusted.

We’ll share our experiences.