{"id":2098,"date":"2018-04-04T14:27:43","date_gmt":"2018-04-04T14:27:43","guid":{"rendered":"https:\/\/blog.oclc.org\/next\/?p=2098"},"modified":"2019-05-29T17:38:33","modified_gmt":"2019-05-29T17:38:33","slug":"gdpr-what-does-it-mean-for-oclc-and-your-library","status":"publish","type":"post","link":"https:\/\/blog.oclc.org\/next\/gdpr-what-does-it-mean-for-oclc-and-your-library\/","title":{"rendered":"GDPR: What does it mean for OCLC and your library?"},"content":{"rendered":"

\"gdpr\"<\/p>\n

Have you heard of the General Data Protection Regulation?<\/h2>\n

If you\u2019re living in Europe, chances are you have. GDPR imposes a series of changes to the personal data privacy laws in the European Union and will go into effect on 25 May 2018. The new regulation will replace the current Data Protection Directive 95\/46\/EC. It is meant to harmonize data privacy laws across Europe and to give individuals more transparency and control with respect to how their personal data is processed. While GDPR does impose requirements that, in some instances, are more stringent than current EU law, regulators have stated that the new regulation should be viewed as an incremental change for organizations that are already complying with existing data protection laws, noting that the regulation is \u201can evolution, not a revolution<\/a>.\u201d<\/p>\n

<\/p>\n

GDPR and libraries<\/h2>\n

The widespread use of data has improved our lives in many ways. And libraries were among the first to embrace computerization of records and connected, online workflows. But that legacy also comes with a downside. New regulations will require us to reconsider business practices that, in many instances, may have been in place for decades. OCLC and our members, however, understand that in the case of promoting and maintaining data privacy and security, doing the right thing isn\u2019t just a responsibility\u2014it\u2019s part of the benefit of doing business with libraries.<\/p>\n

In another sense, OCLC and our members are already ahead-of-the-curve in terms of data privacy. Unlike other industries\u2014advertising, for example\u2014we do not sell personal data or aggregate it from multiple sources, and most in the industry are not using behavioral tracking or automated decision making. We (both OCLC and libraries) generally anonymize or pseudo-anonymize our data as part of our standard data handling processes. And, unlike many industries, personal privacy has been a consideration for libraries for a long time, not simply a regulatory burden.<\/p>\n

The possible impacts<\/a> of GDPR on any one institution will depend greatly on how personal data is currently used, and what processes are already in place. For some, GDPR may require only minor tweaks to current procedures. For others, it will mean major changes and even a rethinking of how personal data fits into business plans.<\/p>\n

If your library is in the EU\u2014or if you collect personal data about individuals in the EU\u2014you may already have a GDPR plan in place. If not, we suggest some of the resources listed below to get started in understanding your obligations and putting together a compliance plan:<\/p>\n