As stated in our policy on Privacy and Confidentiality at Cornell University Library, we protect the privacy of all who use our services, in person and online. We will deny all requests for patron information, with limited exceptions. The sections below detail what constitutes protected patron information, and the procedure for library staff for handling requests for patron information. Patron Information That Is Protected Pursuant to NY CPLR § 4509 the following is protected patron information: Library records, which contain names or other personally identifying details regarding the users of public, free association, school, college and university libraries and library systems of this state, including but not limited to records related to the circulation of library materials, computer database searches, interlibrary loan transactions, reference queries, requests for photocopies of library materials, title reserve requests, or the use of audio-visual materials, films or records. Library Procedure for Handling Requests for Patron Information If a request for patron information is made, regardless of who is making the request and for what purpose, the request must be denied unless it falls under one of the following exceptions, stated in NY CPLR § 4509: Disclosure to the extent necessary for the proper operation of library activities. Procedure note: An example of where disclosure would be allowed under this exception is information sharing necessary for staff to determine library routing of patron-requested materials. An example of where disclosure is not allowed under this exception would be a faculty member or student patron request for identifying information of another patron who is in possession of library material that the requesting faculty member or student patron wishes to obtain. Disclosure upon written consent of the user whose information is to be disclosed. Procedure note: If user is a minor or ward, the user’s parents or guardians must give written consent. Written consents must be collected by library staff prior to disclosure, and kept for review and record keeping by the administration in each library unit. Disclosure upon court order or subpoena. Procedure note: University Policy 4.13 Acceptance of Legal Papers (PDF) requires all university employees, including library staff, to direct anyone attempting to serve legal papers pertaining to the university to the Office of University Counsel. If approached by a law enforcement official who requests protected patron information from library records, or requests library cooperation to obtain protected patron information, library staff must inform the law enforcement officer that they are not authorized to accept legal papers on behalf of the university, and refer the individual to the Office of University Counsel. Staff should request the individual’s name and agency and then report this information to their immediate supervisor, who will in turn advise Library Administration. The University Librarian or any available AUL will communicate immediately with the Office of University Counsel that they should expect legal papers to be served upon them. If the law enforcement officer insists on leaving papers with library staff, they must immediately refer the officer to the staff member’s immediate supervisor. If the immediate supervisor is unavailable, staff will refer the law enforcement official to the Library Administration Office in Olin Library, Room 201 (607.255.3393). The University Librarian or any available AUL will respond to the request and immediately contact the Office of University Counsel. Special Notice for EEA Residents If you are located within the European Economic Area (European Union, Norway, Liechtenstein, and Iceland), we acknowledge the rights granted to you under the General Data Protection Regulation (GDPR). These rights may include the right to: access your information held by us; correct inaccurate or incorrect information about you; the erasure of your information when it is no longer necessary for us to retain it; restrict processing of your personal information in specific situations; object to processing your information, including sending you communications that may be considered direct-marketing materials; object to automated decision-making and profiling, where applicable; and/or complain to a supervisory authority in your jurisdiction within the EU. Please contact us with any questions, concerns, or if you wish to exercise any of these rights. Effective Date of Privacy Notice This privacy notice was last revised on February 12, 2020.