The Future of Data Privacy

ProQuest director of security and privacy information Dan Ayala briefed attendees on two European Union (EU) privacy laws.

The ProQuest breakfast on Saturday morning featured the information-content company’s director of security and privacy information, Dan Ayala, who briefed attendees on two European Union (EU) privacy laws that will take effect on May 25: the General Data Protection Regulation (GDPR) and the ePrivacy Directive. Any American firm doing business in Europe will be affected by this legislation, Ayala said, and they are already “forcing US companies to look at data privacy in completely different ways.”

Some corporations, Ayala said, are laboriously setting up two different privacy systems, one for Europe and another for the US. However, the major players are unifying their rules to comply with the GDPR, “which is an indicator that European trends are starting to become global trends. Facebook and Google just rolled out new privacy centers that are in effect throughout the world, not just Europe.”

Dan Ayala, ProQuest director of security and privacy information

The GDPR requires companies conducting business in the EU, including the many businesses providing services to US libraries, to ensure the following protections:

Increased territorial scope. Companies must comply if data is collected in the EU, even if it is processed elsewhere.
Explicit consent. Users must explicitly agree to privacy terms and conditions (including accepting cookies) before they can access a service or product.
Breach notification. Companies must let users know there has been a data breach within 72 hours of its discovery. (Compare the Equifax breach, which took the consumer-credit agency 70 days to notify the public about the massive amount of personal data that was compromised.)
Right to access. Users have the right to request any personal information that has been collected from them.
Right to be forgotten. Users may request that their data be erased.
Data portability. Users have the right to request personal information from other companies that have received it second- or third-hand.
Privacy by design. Companies should build their business processes with data privacy in mind from the beginning, not as an afterthought.
Data protection officers. Companies must have a readily identified person, detached from operations, who is responsible for data and privacy protection.

The ePrivacy Directive includes these provisions:

Users must be provided with clear and precise information on what data the cookies are collecting and must give their consent.
Personal data on users collected as part of normal business interactions (phone numbers, billing, IP addresses) should be stored for only a limited time.
Use of any data for marketing purposes must be agreed to by the user after accurate and full information is given by the provider.
The types of cookies used for site or product analytics (number of hits, delivered anonymously) do not require as close scrutiny as those used for marketing purposes.

Ayala said that as more information-related companies come into compliance with the new European regulations, libraries and their users will reap some benefits. “GDPR will change the data economy,” he said. “The old models will no longer be viable.” Companies will introduce more granular controls over how personal data is used, and librarians can train their users to be aware of the differences in transparency between various products and services. “Of course, US companies whose sole business is advertising,” Ayala said, “will not be giving up their control.”

Librarians should also feel free to contact the data security officer of any company that provides them with a service and express any concerns they have over data privacy. “More data transparency and openness will build a greater amount of trust among a company’s clients,” Ayala said. The data security officer is there to show that “user privacy is handled effectively and appropriately.”

Ayala admits that enacting any privacy laws in the US similar to those in the EU is extremely unlikely, given the political landscape and the problem of state versus federal jurisdiction. Thus data privacy will rely on voluntary compliance by American companies.

“Data will always be collected,” Ayala said, “but data collection does not necessarily mean there is a privacy violation. Companies must learn to serve the user and clearly state their principles on data use and sharing. If you collect it, use it wisely.”

Latest Library Links

3h

Skylar Laird writes: “Seven books must be removed from the library shelves and classrooms of South Carolina’s public schools, while three classics can stay, the state Board of Education decided Nov. 5. The decision was the first time the board considered whether to remove or keep books under a new regulation banning books that contain ‘sexual conduct.’ Instead of waiting for parents to challenge the books locally and appeal districts’ decisions, committee members asked department staff to review books that had already faced local opposition or came up during public hearings for the regulation.”

South Carolina Daily Gazette, Nov. 5; The Post and Courier (Charleston, S.C.), June 25
22h

Amy Bushatz writes: “The Matanuska-Susitna Borough (Alaska) School District has agreed to pay $89,000 in legal fees to settle a lawsuit alleging it violated students’ constitutional rights by removing 56 books from library shelves early last year, district officials said November 1. Under the settlement, seven books will remain permanently off district library shelves, officials said. The remaining titles were returned to shelves late this summer at nine high schools, four middle schools, and a correspondence homeschool program. The settlement does not include an admission of guilt.”

Mat-Su Sentinel (Palmer, Alaska), Nov. 1
1d

“Kerri Price is no stranger to ALA. In early September, Price returned to the Association to direct the Office for Accreditation, which promotes and advances education in library and information studies, after five years at the nonprofit Accreditation Council for Graduate Medical Education in Chicago. During her previous tenure at ALA, Price spent 12 years working in the Office for Accreditation and the Governance Office. She answered our 11 Questions to introduce herself to ALA members.

AL: The Scoop, Nov. 5
2d

Renaud Foucart writes: “The US Department of Justice may be on the verge of seeking a breakup of Google in a bid to make it less dominant. While this is still a distant prospect, it is being considered in the wake of a series of rulings in the US and the European Union which suggest that regulators are becoming increasingly frustrated by the power of big tech. But what would a breakup of these tech giants achieve for consumers?”

LLRX, Oct. 29
2d

Steven Mintz writes: “For decades, a college or university’s quality was measured by the size of its library collection. The library was the campus’s crown jewel, a towering building at the institution’s center, symbolizing academic prestige. But as collections shift online and physical books move into remote storage, the library’s purpose is now in question. For libraries to maintain their central place within the intellectual life of universities, they must become dynamic, multipurpose hubs that not only provide access to a vast array of digital and physical resources but also actively engage in the broader educational and cultural missions of their institutions.”

Inside Higher Ed: Higher Ed Gamma, Oct. 28
2d

On November 6, ALA issued a statement following the results of the 2024 US election. The full statement reads as follows: “In response to results of the 2024 US election, ALA vowed to continue its defense of the core values of librarianship in the face of political threats. ‘We know that many of our members are concerned that the election results portend attacks on libraries, library workers, and readers,’ said ALA President Cindy Hohl. ‘Whatever happens, ALA will stand up for all Americans’ freedom to read—and we will need everyone who loves libraries to stand with us.’”

AL: The Scoop, Nov. 6
3d

“Over 1.2 million school-aged children were identified as experiencing homelessness during the 2021–2022 school year. Kids who are experiencing homelessness and their caregivers can benefit greatly from the services libraries offer, including computer and printing access, programs and classes, books and other materials, and a place to spend time when their housing situation may not be safe or comfortable. Every school district in the US is required by federal law to have a homeless student liaison, usually called a McKinney-Vento liaison. The good news is that it’s usually pretty easy to find your McKinney-Vento liaison.”

ALSC Blog, Nov. 2