Administrative Law

Has anyone evaluated the privacy policies offered by cloud computing services used by libraries? What kinds of data are libraries sharing in the cloud?  If patron records, does disclosure comport with state law? Some states, like California allow disclosure "by a person acting within the scope of his or her duties within the administration of the library."   This is used as the justification sometimes for disclosing overdue records to collection agencies. A big difference there, however, is that the law in California (and some other states) excludes records of fines collected by the library from privacy protections.