ULA Privacy Statement

Updated 18 August, 2008

ULA is a national borrowing scheme that allows all staff and higher education students of AVCC member universities to borrow in person from any other university in Australia. The scheme is a cooperative borrowing scheme between the libraries of member universities of the Australian Vice-Chancellors’ Committee.  At time of writing the national scheme applies to interstate registrations with intrastate registrations made under state schemes. However, NSW has proposed merging the schemes so this paper addresses privacy questions relating to a single national scheme. 

Applicants must register annually in person at the libraries they wish to use and may be required to pay a fee. Registration is personal and not transferable.  Applicants must present a photo ID and proof of current enrolment or employment at a participating Australian university.  They will be required to provide full name, addresses, telephone and email numbers and level of enrolment and student number.

Participating home libraries indemnify host libraries against the acts of their staff and students when using the host library and applicants are warned that “The lending library may also send details of overdue material or monies to your university library, which may also impose penalties.”
 

Background:  Privacy Principles
(Based on http://www.records.uts.edu.au/records.php?section=privacy&subsect=act)

All government agencies in NSW, including all universities, must comply with the twelve Information Protection Principles identified in the Privacy and Personal Information Protection Act 1998. Similar provisions are imposed by other State and Commonwealth laws.  The principles are designed to protect privacy by regulating the collection, storage and use of personal information. 

Personal information is any information that relates to an identifiable person. Information does not have to be sensitive or confidential to be classified as 'personal'.  It is not necessary that the information specifically identify a person. It is enough that identity could 'reasonably be ascertained from the information'. 

The twelve Information Protection Principles are grouped under three headings:

Collection

Personal information may be collected only:

1. for purposes directly related to a function or activity of the University
2. from the individual to whom the information relates, unless otherwise authorised
3. in circumstances where the individual from whom it is collected is made aware of the following:

• the purpose for collecting it
• the intended recipients of the information
• whether supplying the information is mandatory or voluntary
• the right to gain access to and correct the information 

• relevant
• accurate and up to date
• not excessive 
• and that collection of it does not unreasonably intrude on the individual's personal affairs.

Where the university stores personal information it must:

5. ensure that the information is:

• kept no longer than necessary
• disposed of appropriately
• protected by reasonable security safeguards
• protected from unauthorised use or disclosure when made available to a third party for provision of a service to the university 

Use and Disclosure

In proposing to use or disclose personal information, the University must:

9. take reasonable steps to ensure that the information is accurate
10. use it only for:

• the purpose for which it was collected
• a directly related purpose
• a purpose to which the individual has given consent, or
• prevention of a threat to life or health 

• directly related to the purpose of collection and where the individual is unlikely to object
• where the individual has been informed, or is likely to be aware, that the information is usually disclosed to the
• person or body in question, or where disclosure is necessary to prevent or lessen a threat to life or health 

In accordance with exemptions authorised under the Act, the university is not required to comply with:
 

• IPPs 2 or 3 if compliance would prejudice the interests of that person
• IPPs 3, 11 or 12 if the person has so consented
• IPPs 2, 3, 6, 7, 8, 10, 11 or 12 where non-compliance is required or permitted under another Act or law. 

As ULA is currently configured, no checks are undertaken with the home institution to verify that the student or staff member is still enrolled and in good standing with the Library.  It is possible that the student may have withdrawn or been excluded but still have proof of enrolment for the semester or the staff member resigned or separated but still have evidence of employment. 

This is generally of minor concern except if the applicant should have perpetrated serious acts at another institutions (eg theft, mutilation of library materials, conduct warranting exclusion or legal action).   Experiences in the USA and UK demonstrate that there is a small number of serial perpetrators who go from library to library stealing books and/or elements of library materials such as plates and maps.  It would be prudent for ULA to provide a mechanism to guard against such individuals however rare.

Checking with the home institution before registration is impracticable since it would be labour intensive and difficult to achieve promptly without authorising all loans staff at all participating university libraries to access the borrower records at all other participating libraries.  This would involve enormous training costs and raise serious privacy concerns.

An alternative would be the creation of a shared ‘black list’ of those not in good standing. This too would raise serious privacy concerns and there would be a great danger that individuals might be included on the list in error or not removed promptly.

Also, all participating universities have agreed to indemnify each other for unreturned material, after the normal methods of notification and sanctions have failed to work directly on the borrower by the host library.  In order for the home library to have some chance of contacting the borrower and imposing their own sanctions before students graduate or leave, they must be notified in a timely manner at least once per year. Therefore host libraries may send information about borrowers and relevant information about the outstanding material to their home libraries.

Proposed Action

In view of these concerns, it is recommended that applicants should be required to:

• Provide evidence of current enrolment/employment.
• State in writing (or electronic application) that they are currently enrolled/employed and have not been excluded from using their home university library or any other participating university library.
• Acknowledge in writing (or electronic application) that they will abide by the rules and conditions of the host university library.
• Sign a declaration that all the information they have provided is accurate and acknowledging that the host library may check with their home university library or any other participating university library and that their registration may be cancelled immediately if any of the information provided is found to be incorrect.  Libraries may make random or periodic checks for any discrepancies.  Should any be found, the host library will immediately cancel the registration and demand return of any library materials.
• Acknowledge in writing that they understand that information may be sent to the home library of the borrower if items are not returned to the host library, and that further sanctions may apply at their home library depending on the rules of the home library. 

Alex Byrne
University Librarian
University of Technology, Sydney

17 July 2002 / rev. 12 August 2002