The 2018–2019 Santa Cruz County Civil Grand Jury Requires that the Director, Santa Cruz Public Libraries

The use of Gale Analytics on Demand by Santa Cruz Public Libraries was inconsistent with the library’s long-standing policy on Confidentiality of Library Records (policy 303, adopted February 2006; revised November 2010) and companion document, “Information We Keep About You.” AGREE PARTIALLY DISAGREE – explain the disputed portion x DISAGREE – explain why Response explanation (required for a response other than Agree): Libraries take patron privacy very seriously, and most adhere to the American Library Association’s “Library Bill of Rights” (http://www.ala.org/advocacy/intfreedom/librarybill) which includes VII. All people, regardless of origin, age, background, or views, possess a right to privacy and confidentiality in their library use. Libraries should advocate for, educate about, and protect people’s privacy, safeguarding all library use data, including personally identifiable information. It is with this lens that libraries constantly think about how much data they want to retain in their ILS, and how much they want to share with trusted vendors. SCPL’s former policy stated: The Santa Cruz City County Library System complies with all sections of the State of California Public Records Act (Protection of Library Circulation and Registration Records, Government Code Title 1, Division 7, Chapter 3.5). That is, all registration and circulation records of library users shall remain confidential and shall not be disclosed to any person, local, state, or federal agency except by order of the appropriate superior or federal court. The Library also treats patron requests for reference information and records of patron Internet use as confidential. Further, the Library Joint Powers Authority Board regards any inquiry about library use as an invasion of patron privacy. It prohibits staff from giving information about any library use absent a valid order from a superior or federal court or at the discretion of the Library Director. The common sense exception to this rule is when a law enforcement officer describes a situation involving immediate danger. It is not clear how the use of AOD is inconsistent with the Library’s longstanding policy on Confidentiality. The Companion document, “Information We Keep About You” is actually a web page. It will be updated. The Grand Jury concluded that AOD’s use is “permitted under the 2011–2012 version of California law, provided that the third-party vendors working in service of the library.” (p. 7) Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

The use of Gale Analytics on Demand, or any other data analytics tool, by Santa Cruz Public Libraries is not clearly addressed in the Library’s newly revised policy, Confidentiality of Library Records & Patron Data Privacy Policy (policy 303, adopted June 6, 2019). AGREE x PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): The Library is on the record for discontinuing its use of Gale Analytics on Demand in January 2019. All other third party software products are listed on the Library’s data privacy website. Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

Santa Cruz Public Libraries did not adequately inform its patrons about the Library’s use of Gale Analytics on Demand or obtain their consent for this use. AGREE x PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): “The Grand Jury initiated its investigation amid concern that SCPL may have violated State law by uploading patron data to the AoD cloud. As explained below, recent changes to the California Government Code should put this concern to rest.” (p. 6) The Grand Jury found, “California laws and regulations are silent on the need for libraries to obtain patron consent when engaging third parties.” (p. 5) They also concluded that AOD’s use is “permitted under the 2011–2012 version of the law, provided that the third-party vendors working in service of the library.” (p. 7) Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

Santa Cruz Public Libraries used Gale Analytics on Demand without adequately considering the patron privacy aspects of current California law. AGREE x PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): “The Grand Jury initiated its investigation amid concern that SCPL may have violated State law by uploading patron data to the AoD cloud. As explained below, recent changes to the California Government Code should put this concern to rest.” (p. 6) The Grand Jury found, “California laws and regulations are silent on the need for libraries to obtain patron consent when engaging third parties.” (p. 5) Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

Santa Cruz Public Libraries used Gale Analytics on Demand without examining the contract for this service, thus raising potential liability issues related to data ownership, data breaches, and patron privacy. x AGREE PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): The Library relied upon the Pacific Library Partnership, a consortium of 42 Bay area libraries, to negotiate the contract. SCPL will not do this in the future. Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

The contract is unclear and does not contain language that protects the interests of the Pacific Library Partnership, its member libraries, and their patrons. AGREE x PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): The SCPL no longer uses this product and will forward this report to the Pacific Library Partnership for their edification. Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

The use of Gale Analytics on Demand by Santa Cruz Public Libraries is inconsistent with best practices in the library community regarding patron privacy. AGREE x PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): There are major disagreements within the public library community about the use of big data to improve programs and services. Large libraries systems around the country buy and use AoD and other products like CommunityConnect by CIVICTechnologies. In the Bay area, Sacramento Public used and Oakland Public uses AoD to plan and market programming by branch. Like most government entities, SCPL is faced with a tension between providing relevant and convenient access to its services and the need to ensure the data security and privacy of its users. Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

Santa Cruz Public Libraries used Gale Analytics on Demand without adequately evaluating the effectiveness of the tool. AGREE x PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): SCPL staff experimented with the product to evaluate its effectiveness, primarily in 2017. Staff looked at the income distribution and diversity of our users, mapped the usage of the Capitola branch library, and experimented with marketing a program to long term residents. Staff had mixed reactions as to its efficacy. After staff concerns were expressed, SCPL put a moratorium on any additional use of AoD in 2018. Library leadership voted to end use of the product and delete all files in January 2019. Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries

The use of Gale Analytics on Demand by Santa Cruz Public Libraries has created disagreement among Library staff concerning the traditional responsibility of libraries to protect patron privacy, the validity of data analytics as a planning tool, and potential security vulnerabilities of the system. x AGREE PARTIALLY DISAGREE – explain the disputed portion DISAGREE – explain why Response explanation (required for a response other than Agree): Respond by September 23, 2019 Patron Privacy at Santa Cruz Public Libraries Director, Santa Cruz Public Libraries