Skip to content

Latest commit

 

History

History
87 lines (69 loc) · 4.51 KB

PERSONAL_DATA_DISCLOSURE.md

File metadata and controls

87 lines (69 loc) · 4.51 KB
Raw

Last Updated: Mon, 28 Nov 2022 UTC Last Reviewed: Mon, 28 Nov 2022 UTC

Overview

The purpose of this form is to disclose the types of personal data1 (PD) stored by each module. This information enables those hosting FOLIO to better manage and comply with various privacy laws and restrictions, e.g. GDPR.

It's important to note that PD is not limited to that which can be used to identify a person on it's own (e.g. Social security number), but also data used in conjunction with other data to identify a person (e.g. date of birth + city + gender, or dynamic IP address + date + time), and any information about such a person (e.g. has loaned 5 items, 2 of which are overdue).

For the purposes of this form, "store" includes the following:

  • Persisting to storage - Either internal (e.g. Postgres) or external (e.g. S3, etc.) to FOLIO
  • Caching - In-memory, etc.
  • Logging
  • Sending to an external piece of infrastructure such as a queue (e.g. Kafka), database (e.g. Elasticsearch, Library Data Platform), distributed table, etc.

Personal Data processed by this Module

  • This module does not store any PD.
  • This module does not process any PD.
  • This module provides custom fields.
  • This module stores fields with free-form text (tags, notes, descriptions, etc.)
  • This module caches PD
  • This module logs PD
    • Log level ERROR includes PD
    • Log level WARNING includes PD
    • Log level INFO includes PD
    • Log level DEBUG includes PD
  • This module transmits PD (including queues, additional databases, etc.)

Identifiable information

  • Passport number / National identification numbers
  • Driver’s license number
  • Social security number
  • Financial account information
  • System Password

Identifiable information if linked

Information can be combined with others to form a person’s identity.

  • First name
  • Last name
  • Gender
  • Date of birth
  • Place of birth
  • Racial or ethnic origin
  • Address
  • Location information
  • Geolocation data
  • Phone number(s)
  • Pseudonym / Alias / Nickname
  • Username / User Identifier (UUID)
  • Proxies
  • Groups
  • Email address
  • Financial information / Fees or Fines
  • Circulation transaction(s)
  • Web cookies
  • IP address / MAC address
  • Photographs of users (profile picture)

NOTE This is not intended to be a comprehensive list, but instead provides a starting point for module developers/maintainers to use. If needed, append additional lines and check those accordingly.

Privacy Laws, Regulations, and Policies

Numerous laws and policies were considered when creating the list of personal data fields above. For additional information, please refer to the following:

v1.1

Footnotes

  1. Personal data is "any information relating to an identified or identifiable natural person". GDPR Article 4 ↩