You’ve likely already heard that OCLC has released a new report on library advocacy. But today, I’m wishing that the previous one had gotten more attention from the library community. Sharing, Privacy and Trust in Our Networked World got some serious attention from the social networking cliques, but I was really hoping that it would open the dialog about privacy expectations some more.
I attended a lecture on privacy at NCSU once where the speaker mentioned that we are living in a climate where most undergraduates would trade a DNA sample for an Extra Value Meal. A nice throw-away line, but one that sets up a value proposition for libraries. We could certainly ask for less than DNA and offer more than a Big Mac and fries.
I started wondering why library software applications and services don’t work more like the privacy settings in a web browser. By default, even Microsoft wants to be diligent in protecting my privacy, but the software gives my organization the ability to adjust the level to its liking. In turn, my organization can decide to extend that benefit to me as much as it sees fit, making determinations about how much it needs to protect itself and how much I can be trusted to protect myself.
Picture options like this:
I remain baffled as to why most libraries will only let patrons share their library data outside of libraries. I’m equally baffled as to why patrons don’t demand that they be allowed to do so.
I know we’d love to give patrons more options when it comes to storing their information (to give recommendations, for example).
However, in our jurisdiction it is actually illegal for us to store patron information in this way except in very specific circumstances. So… patrons can demand all they want – but the law is the law (and we do point this out to all who ask about our privacy policies).
I’m baffled as well, and I think a lot of folks have forgotten the days when there were cards in the book that listed everyone who had checked the book out. Where was privacy then? At least now we can allow users to either have privacy, or not, their choice. And I’m convinced most would be happy to give it up to get the benefits that come from doing so.
Because our software doesn’t support it, naturally. Most of us probably don’t even _know_ for certain what kinds of logging are being done by our various software systems involved in the library environment. I personally probably am as concerned about this as any systems librarian, and am perhaps even more technically capable of figuring it out (if I had time) then many systems librarians—and I still couldn’t tell you with certainty what kinds of user-identifyable information are being kept for how long in exactly what locations by each of the half dozen or more diversely-sourced pieces of software involved in the user’s digital library experience. Let alone be able to _change_ that logging in each of these software packages–let alone get the software to log differently for different patrons!
I have long thought that it should be standard library IT practice to conduct a regular “privacy audit” by which they identify exactly what user-identifyable information is being kept by what software for how long and where. But this would require a non-trivial resource investment by a library to conduct. And non-trivial participation from vendors probably even to do an audit like this, let alone to change software behavior in response, or allow user-configurable privacy options.