Welcome to this week’s Tip of the Hat!
To build or to outsource?
Building an application or creating a process in a library takes time and resources. A major benefit of keeping it local, though, is that libraries have the greatest control over the data collected, stored, and processed by that application or system. Conversely, a major drawback of keeping it local is the sheer number of moving parts to keep track of in the building process. Some libraries have the technical know-how to build their own applications or have the resources to keep a process in house. Keeping track of privacy risks is another matter. Risk assessment and management must be addressed in any system or process that touches patron data, so how can libraries with limited privacy risk assessment or management experience make sure that their local systems and processes mitigate patron privacy risks?
Libraries have a new resource to help with privacy risk management! The Digital Library Federation’s Privacy and Ethics in Technology Working Group (formerly known as the Technologies of Surveillance Working Group) published “A Practical Guide to Performing a Library User Data Risk Assessment in Library-Built Systems“. This 28-page guide provides best practices and practical strategies in conducting a data risk assessment, including:
- Classifications of library user data and privacy risk
- A table of common risk areas, including probability, severity, and mitigation strategies
- Practical steps to mitigate data privacy risks in the library, ranging from policy to data minimization
- A template for readers to conduct their own user data inventory and risk assessment
This guide joins the other valuable resources produced by the DLF Privacy and Ethics in Technology Working Group:
- Advocacy Action Plan
- Digital Privacy Instruction Curriculum
- Ethics in Research Use of Library Patron Data: Glossary and Explainer
The group also plans to publish a set of guidelines around vendor privacy in the coming months, so be sure to bookmark https://wiki.diglib.org/Privacy_and_Ethics_in_Technology and check back for any updates!