Cumberland County Library System

Confidentiality of Library Customer Records Policy

(Creation & revision: 5/23/2005; 6/20/2011; 2/27/2012; 5/21/2012; 3/19/2018)

It is the policy of the Cumberland County Library System to comply with all judicial processes while preserving customer confidentiality to the extent allowed by law.  This policy explains customer privacy and confidentiality rights, the steps the Library System takes to respect and protect customer’s privacy when using library resources, and how the Library System deals with personally identifiable information that it may collect from its users.

In accordance with the Pennsylvania Library Code, records related to the circulation of library materials which contain the names of library users or other personally identifying details shall be considered confidential in nature and will be revealed only to the library card holder or used by the library during the normal course of business. This may include:

1. Library card registration information;
2. Titles and number of items checked out;
3. Titles and number of items on hold;
4. Overdue and fine account information;
5. Interlibrary loan requests and transactions; or,
6. Public access computer activity.

These records are confidential and will not be made available to anyone other than the customer named in the record or his/her legal guardian, except by a court order in a criminal proceeding (24 P.S. §4428), or a federal investigative proceeding (USA PATRIOT Act of 2001). ). Further, the information shall only be stored and saved in the library system’s password-protected integrated library system software.  It will not be saved on transportable media such as laptops, tablets, CDs, DVDs, flash memory devices, or portable external drives.

The Library System also considers program registration and attendance lists as well as information questions asked by customers to be confidential.  The Library System will release these records only for compelling reasons as determined by library administration and legal counsel, or by appropriate court order. As for credit or debit card numbers, library system does not collect or store this information on its servers.  It contracts for third-party online payment processing services that are hosted by vendors that comply with current Payment Card Industry Data Security Standards (PCI DSS) for credit or debit card transactions.    The Library System is not responsible for any breach of security with respect to data collected or stored by these vendor-hosted sites, nor is the Library System responsible for these site’s compliance with applicable federal and state laws and regulations.

The Library System permits only authorized library employees with assigned confidential passwords to access personal data stored in the Library system’s computer system for the purpose of performing library work.

The Library System does not sell or lease users' personal information to companies, universities, or individuals.  It will not disclose any personal data it collects from customers to any other party except:

1. When required by law;
2. When requested by the account holder;
3. When requested by a minor customer’s parent or legal guardian;
4. To enforce the library’s service policies, including, but not limited to, circulation regulations and customer behavior guidelines;
5. To contact customers during the course of the library’s business including affiliated entities such as library friends or library foundation organizations; or,
6. To protect the health, welfare and safety of library customers.

Borrowers may allow a party to act on his or her behalf for checkout of materials by sending his or her library card with another party or by designating Authorized Users on their account.

Policy Notice

This policy is subject to change at any time without notice.  Updates to the policy may be obtained from the Library System.