2 Privacy as a legal requirement

Privacy is also a legal requirement for libraries in many jurisdictions. Libraries have to comply with various laws and regulations that govern the collection, use, disclosure, and retention of personal information. These may include federal, state, or local laws, such as the Privacy Act, the Freedom of Information Act, the Children's Online Privacy Protection Act, and the General Data Protection Regulation. A privacy policy helps libraries to comply with these legal obligations and to avoid potential liabilities or penalties. A privacy policy also informs patrons of their rights and responsibilities regarding their personal information and how they can exercise them.

3 Privacy as a best practice

Privacy is also a best practice for libraries in the digital age. Libraries face many challenges and threats to the privacy and security of their information systems, such as cyberattacks, data breaches, identity theft, unauthorized access, and third-party requests. Libraries need to adopt and implement appropriate policies, procedures, and technologies to safeguard their information systems and the information they contain. A privacy policy guides libraries to adopt and implement these measures and to monitor and evaluate their effectiveness. A privacy policy also educates patrons and staff about the privacy and security issues and how they can protect themselves and the information they access or use.

4 Elements of a privacy policy

A privacy policy should be clear, concise, comprehensive, and accessible, covering all the information systems operated or used by the library, such as the website, the integrated library system, the online catalog, databases, e-books, digital collections, social media, and public computers. It should address the types of information collected (e.g. personal information, transactional data, behavioral data, and aggregate data), the purposes for which it is collected and used (e.g. providing services or complying with legal obligations), how it is collected and shared (e.g. through cookies or third-party providers), measures taken to protect it (e.g. encryption or access control), rights and choices patrons have regarding their information (e.g. to access or delete it), and contact information for any questions related to the information. A privacy policy should be reviewed and updated regularly to reflect any changes in systems, practices or legal obligations and communicated to patrons and staff through various channels such as websites, service desks, newsletters, and training sessions.

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?