|
|
Privacy
Guidelines for
British Columbia Public Libraries
4. On-line Services
Libraries should develop
privacy policies for their websites that relate directly to personal
information collected that is used, retained and/or disclosed in the
course of visiting and/or navigating through the site. These policies must
be made readily available to the public (Act, s. 70).
See "Policies &
procedures" and "Appendix IV: Sample General Privacy Policy" for more
information.
a) Registration on-line
|
Registration on-line
should be over a secure connection (e.g.
using 128-bit encryption). If not, a notice should clearly state to anyone
using the service that any information they send is not secure and may be
accessed by others. Individuals should also be informed that other more
secure methods of registration are also available (such as registering in
person). Libraries assigning personal identification numbers (PINs) should
use random numbers (not non-random numbers, such as the last 4 digits of a
phone number).
Also see "Registration:
Collecting personal information: On-line registration".
|
b) On-line reference questions
|
Reference questions
are sometimes emailed to a
library. Some libraries may provide a chat-like system on-line to answer
reference questions. In either case, if personal information is collected (such as IP address, email
address, or name), the individual must be informed of the purpose for
collecting the information, the library’s legal authority for collecting
it, and information about how to contact the library’s FOI/Privacy
Officer (Act, s. 27).
See "Reference
Questions: Electronically" for more information.
|
c) Outside databases
|
Libraries often provide
access to services offered by other organizations and hosted on the
organizations’ own websites (e.g. EBSCO). When a link takes a visitor from
the library’s website to that of another organization, clear notice should
be provided beside the link that lets the individual know she is about to
leave the library’s website and visit the site of another organization. It
should also recommend that she check their privacy policies.
Box 4.1
|
|
Going
the extra mile:
When considering whether to offer a link from your site to
that of another organization:
-
Check the
organization’s privacy policies to see if they comply with
FOIPPA.
-
If they do not, try to
negotiate for an increase to their privacy policies to comply with
FOIPPA.
-
At minimum, try to
negotiate for their privacy policies to disclose specifically the
purpose of collecting personal information, how it is used, to whom it
is disclosed, and the contact information for someone who can provide
more information about their personal information protection
practices.
|
|
