For public library boards

What applies from January 1, 2027

• A written privacy impact assessment before each collection of personal information (s. 28(3)), updated before any significant change in purpose (s. 28(5)).
• Reasonable safeguards for personal information and records (s. 30(5)).
• Breach reports to the IPC and notice to the people affected when the real risk of significant harm test is met (s. 30.1).
• A record of reported breaches, and the count in the board’s annual report to the IPC, first due March 31, 2028.

The notice of collection on every form is already required (s. 29(2)). Every change, section by section.

Who signs for the board

The members of the board may designate one of themselves, or a committee, in writing to act as head (s. 3(2)). If they have not, the head is the members of the board (s. 3(3)(b)). The head may delegate duties in writing to an officer, for example the chief executive officer (s. 49(1)). A county or regional library board that serves several towns is one institution, with one head.

The town’s privacy documents do not cover the library board. A board can borrow wording from the municipality, but it needs its own assessment, protocol and register, signed by its own head.

Collections that usually need an assessment first

• Library card registration and renewal: name, address, date of birth, sometimes a parent or guardian for a child’s card.
• Borrowing and holds records, which show what a person reads and watches.
• Children’s and teen programs: registrations with ages, contacts, and sometimes health or allergy notes.
• Room bookings, exam proctoring, 3D printing and makerspace requests.
• Public computers and Wi-Fi sign-ins, and cameras in branches.
• Volunteer and job applications, and newsletter sign-ups.

Vendors and platforms

A library’s collections often run through outside services: the integrated library system, e-book and audiobook platforms, database providers, event and room booking tools, and email newsletters. The board remains responsible for information collected on its behalf. The IPC’s breach guidelines say contracts should require a contractor to report a breach to the institution immediately. Each assessment records where the vendor stores the information and what the contract says, and the inventory lists every platform in one place.

What we found on library websites

We read 150 public forms in full on 67 library websites. 93% left out at least one required part of the notice of collection, and 70% had no part at all: no authority, no purpose and no contact. Only 20% gave a legal authority and 27% a purpose. A privacy policy was visible on 58 of 74 websites (78%), a breach protocol or reporting route on 13 (18%), and a mention of privacy impact assessments on 1.

We do not name any library. All institution types compared. Your own results come with a free check.

The pack for a library board

• First assessment: usually library card registration, or a vendor-run room booking or program system.
• Inventory: every platform that holds patron information, with where it stores data and who at the library can see it.
• Breach protocol and decision guide: with examples from library work, such as a holds slip with a patron’s name left in public view or a misdirected overdue notice.
• Board briefing: one page for the board: what changed, what staff have done, and the head and delegation questions the board may need to settle.
• Staff briefing: for circulation desks and program staff.

CA$7,500, invoice after delivery, net 30. Each document in detail.