Date
Attendees
...
https://dukeuniversity.webex.com/join/jcc81
Goals
- Decide on Updates and discuss next steps for our group; what do we take to the Reporting SIG, and is there anything further that our group can do at this time?
Discussion items
| Time | Item | Who | Notes |
|---|---|---|---|
Updates from Joyce on LDP reports containing personal attributes that she sent to the Reporting SIGreport owners, to determine whether the reports can remain functional if personal data are removed Updates from Ingolf about staff data privacy (audit trails) |
Meeting Notes
...
- Joyce went through all the LDP reports and flagged those containing personal data, which she then sent out to report owners. Of the 36 reports that Joyce flagged, report owners identified 24 that need to retain these data in order to be functional. These will now be shared with the Reporting SIG to determine whether all 24 reports can be made in-app, or whether some have to remain LDP reports, and if so, how do we handle the issue of data privacy? Link to her sheet: https://docs.google.com/spreadsheets/d/1nR9frGMUgWq6TNKJFhY84FJx2Cwnlndnd2iq6p0wDx4/edit#gid=0
- Ingolf 's conversation with a data privacy officer , we formulated a list of attributes considered personal data, which should not be included in the LDP. A few attributes were flagged as unnecessary for reporting purposes, and should also be excluded (see Table 1 below).
- As well, we flagged several attributes that can only be included if they are formulated in a specific way (see Table 1A below).
- Tables 1 and 1A should be shared with the Reporting SIG.
- We all agreed that it would be very time-consuming for this small group to look through all the reports and flag them. As well, as the reports are often described at a higher level, without an actual list of attributes included. Each report needs to be understood in depth, to determine whether it contains personal data attributes or not. We need to crowd-source the process of flagging reports.
- Update on 7/8/19: Joyce Chapmanlooked through the reports and found that "There are 32 that I found that could have personal data. Some I don't have enough info about, others it's very clear. Basically every single report on the user mgmt tab of the reporting master spreadsheet is for sure personal data -- these are all reports that call up different types of lists of patrons. 18 of the 32 I marked as "definitely" including personal data, and 11 of those are the "user mgmt" tab of reports." These are at https://docs.google.com/spreadsheets/d/1nR9frGMUgWq6TNKJFhY84FJx2Cwnlndnd2iq6p0wDx4/edit#gid=0
- Before taking on the issue of staff data privacy, we want to ascertain whether any reports of audits will ever need to be run from the LDP, instead of in-app. This may not be an LDP problem at all.makes it clear that there is a marked difference between European and U.S. Universities in the matter of staff data privacy (audit trails). In Germany (and probably most of Europe), staff data can be stored only is there is a valid reason for this. It must be either a legal reason (required by law), or part of a contract that has been made between the workers' council and the employer and that is valid for all employees. Such contracts are always vetted by Employee Councils, which are part of each organization 1, and Employee Councils would not agree to staff data being stored for reasons such as running reports on, for example, how many items one individual has catalogued. We discussed how in the U.S., library management systems often have 'notes' fields, and staff members may identify themselves when entering specific notes, so that others may contact them for further information. As well, there is no equivalent of an Employee Council that has a say in staff audit trails. Such trails are used in many different ways in the U.S., and it is unlikely that U.S. universities will be able to do without them. Thus, there will have to be a dual system in FOLIO (it might be done only in-app and then falls in the purview of some other working group; this working group is only about data in the LDP). Conerning the question whether GDPR applies to staff audit data, the answer is, that GDPR only applies if there is no other regulation. If there is a company deal (between workers' council and management) this deal will be applicable and refine GDPR. In particular, if there is the company agreement that some operational data about employees are necessarily to be recorded in order to avert damage to the company (or for some other sufficient reason), then the individual employee forfeits her right of erasure of the data (which she would have if only plain GDPR applied), as long as she is an employee of that company. But, as mentioned above, an audit trail "how many catalogue records did employee X create in the last 7 days", would never pass the consent of a workers' council in Germany. In other words, measuring the performance of individual emplyoees is considered not a sufficient reason. There always has to be a sufficient reason to record personally related data.
- Both issues now need to be handed over to the larger FOLIO community, as we may have come to an end of our fact-finding mission.
Action items
Present the above discussion to the Reporting SIG on Monday, July 22nd.
1 The organization has to exceed a ceratin size, which is 5 employees (in Germany). There is no obligating to the employer to establish a workers' council. But the employees have the right to elect a workers' council, they have to take action. Once a workers' council has been elected, though, the employer is legally obliged to inform the workers' council (or call it employee's council, as you like) about all affairs which concern the staff / employees. The employer is also supposed to reach consent with the emplyoee's council. If the employer refuses to do so, the council can go as far as to take legal actions against the employer.
...