SANTA CRUZ — The Santa Cruz County Grand Jury took a look at the Santa Cruz Public Library system in its latest investigation, focusing on the use of software that may have violated patron privacy policies.
Starting in 2016, the Santa Cruz Public Library (SCPL) used a data analysis tool to help administrators get a picture of patron demographics and how they use the libraries. This information was used to help with long-term strategic planning.
SCPL stopped using the software in 2018.
But the program was inconsistent with SCPL’s privacy policy, and library administrators did not inform library patrons that it was being used, and did not seek their consent, the Grand Jury report states.
In addition, SCPL officials did not consider California laws regarding privacy when they used the software.
The report also found that library administrators did not review the contract provided by the data collection company, Gale Analytics on Demand, a contract the Grand Jury called “unclear” and lacking in language that protects patrons.
According to the report, Gale Analytics on Demand is powered by Experian Mosaic, a company that provides more than 300 pieces of consumer data to companies to help them better target their customers.
Gale Analytics on Demand then blends its patron information with that of Experian Mosaic, the grand jury report said.
“As a result, the library holds significantly more household-level data in its computer system than patrons originally provided,” the report says.
The Grand Jury also found that SCPL did not describe the data returned by Gale Analytics on Demand in the “Information We keep About You” in its website.
In its list of recommended actions, the Grand Jury said that SCPL should revisit its privacy policy – which was updated June 6 – and address the use of data analytics.
The library should also create a system for obtaining and managing consent from library users when using data collection tools, the report said.
In addition, the Grand Jury said that SCPL should designate a data privacy officer to implement and enforce its privacy policy and should fully evaluate any data collection tools before using them.
SCPL Director Susan Nemitz said the software was intended to help the library system focus its programs and services.
“Because we collect so little data about our patrons it can help us better understand them,” she said. “A lot of libraries have embraced this in a big way.”
Nemitz said that the library used the program to study whether it was reaching people of color and low-income people and who was using the libraries geographically.
Since SCPL discontinued the used of Gale Analytics on Demand, it has reworked its privacy policy, which can be found at www.bit.ly/2RzAGRM.
This is important in an era when most libraries are increasingly turning digital tools for patron use.
“We care about privacy,” she said. “It’s one of the things we hold most dear. In all cases we don’t sell or give data away to private companies, and they can’t sell any information.”
SCPL officials are not considering whether to continue informing patrons about their privacy rights, or to offer the ability to opt out of similar services.
Under state law, organizations typically have 90 days to respond to grand jury reports. They are not, however, required to implement any of the suggested changes.
June 28, 2019
Register-Pajaronian
By Todd Guild (updated 4 weeks ago; posted June 28)
No comments:
Post a Comment