Read on Twitter
After a night's sleep and a few conversations on Twitter stemming from the contact tracing/health screening and patron privacy thread yesterday, it might be worthwhile to dive into some specifics about how contact tracing could possibly look like in the library. A privacy 
.
.
Thread parameters:
- Some libraries will be asked by the gov to do contact tracing when they reopen.
- Contact tracing is an effective way to mitigate infection rates.
- Contact tracing is not health screening. Library workers should not collect health data.
- Some libraries will be asked by the gov to do contact tracing when they reopen.
- Contact tracing is an effective way to mitigate infection rates.
- Contact tracing is not health screening. Library workers should not collect health data.
Reports of contact tracing requirements include logging the name, email, and phone number of the person visiting the business. That is enough information to contact someone.
Libraries, then, should consider collecting the absolute minimum data needed for contact tracing.
Libraries, then, should consider collecting the absolute minimum data needed for contact tracing.
Some places are putting out a sheet of paper and having visitors sign in and out.
Outside of health concerns (multiple ppl using the same pen, touching the same surfaces), libraries have additional privacy considerations wrt self logging.
Outside of health concerns (multiple ppl using the same pen, touching the same surfaces), libraries have additional privacy considerations wrt self logging.
The main consideration is that the log is visible for everyone to see. A patron can come into the library and look who else has visited the library that day.
Another scenario - what would stop an ICE agent from visiting the library & looking at the log sitting on the circ desk?
Another scenario - what would stop an ICE agent from visiting the library & looking at the log sitting on the circ desk?
To mitigate the privacy risk of patrons and others finding out who is in the building or visited the library that day, libraries should explore having staff log patrons in and out using a paper log that is only accessible by staff.
Why a paper log? A paper log is much easier to control in terms of staff access. You can lock up the paper log in a secured desk and office.
A paper log is also much easier to dispose. If you don't make any copies of the paper log, the data is long gone once you shred the log.
A paper log is also much easier to dispose. If you don't make any copies of the paper log, the data is long gone once you shred the log.
This would mean that staff would need to be proactive in ensuring that the log does not sit on the desk as well as that the log is securely stored when no longer needed.
Yes, paper is inefficient, but do you want a contact log floating around in your network storage drive?
Yes, paper is inefficient, but do you want a contact log floating around in your network storage drive?
Our next consideration comes from @kidsilkhaze - what happens when patrons don't give this information over, or don't have this information?
Local govs might have some guidance on this, particularly since this will not be a library-only issue. https://twitter.com/kidsilkhaze/status/1260597486579781642
Local govs might have some guidance on this, particularly since this will not be a library-only issue. https://twitter.com/kidsilkhaze/status/1260597486579781642
With any type of self-reporting, you will get folks that don't have this info, or give you false names and contact info. That's a weakness in the contact tracing method that's not easily solved, so again, it's up to the local gov who is mandating tracing to come up with options.
Libraries need to provide equitable service to all patrons, so if the local gov options make it impossible to do this, libraries should consider working with their gov officials in finding ways so that the library doesn't have to turn away patrons.
Another privacy consideration - retention. How long do you keep the contact tracing logs? Again, your local gov or health officials will most likely have guidelines. If they do not, ask them.
Do not keep logs longer than the required retention period.
Do not keep logs longer than the required retention period.
The longer you keep data, the more toxic it becomes.
Getting rid of this toxic data will be easier if you are able to keep the contact tracing logs in paper form and only have one copy to shred.
If you stored your logs in electronic format, you have your work cut out for you.
Getting rid of this toxic data will be easier if you are able to keep the contact tracing logs in paper form and only have one copy to shred.
If you stored your logs in electronic format, you have your work cut out for you.
