As the guidelines state: "Information professionals collect data from their users in order to provide the most efficient and effective service. We must protect the personal data we collect and be very clear to our users why we collect the data, how we store it, how we process it and for how long we keep the data. Occasionally by law we may be required to give personal data to a third party; we need to ensure that this is justified."
Libraries hold information on their users' names, addresses, dates of birth, sex, how many books they have borrowed and what those books are, charges incurred, etc. Libraries need to take decisions, usually in the form of institutional policies, which lay out how long that data can be kept for and on what occasions it can be accessed or passed on to other organisations. Libraries should undertake data audits to ensure that they do not hold any more data than that which is necessary, and that they are complying with the law. Access to the information needs to be limited to only those staff who are authorised and need access to that data. Staff need to be trained to be aware of the issues involved. Data is a valuable resource and can be shared and re-used for other purposes, in medical research for instance, but this is problematic. There are government guidelines that cover data sharing. Personal data can be lost if memory sticks get lost. In such cases the users need to be informed. To avoid this data should not be put on memory sticks, or, if it is, the memory sticks should be encrypted. Decommissioned equipment should be wiped. Disaster plans should include a clause on how to handle personal information and Libraries should have policies on how to handle memory sticks found in the library.
Library users have a right to make 'Subject Access requests' to find out what data is being held about them, and, in exceptional circumstances police and national security staff can make requests for information relating to users. Library staff need to be trained in how to handle such requests. The law also covers the use of CCTV, photography and filming. There are other laws which also relate to these areas, such as the Human Rights act 1998, the Regulation of Investigatory Powers Act of 2006, the Terrorism Act of 2006, etc.
Fortunately the CILIP ethics committee can advise CILIP members and JISC also provides advice on these matters.
Bibliography CILIP User Privacy in Libraries: Guidelines for the Reflective practitioner
Comments