4 Survey Results: Executive Summary Only eight of the respondents indicated they place restrictions on how shared data is used by other departments while institutional data shared with the library comes with greater acknowledged restrictions. Several questions focused on the perceived importance of library LA. The majority of respondents indicated that, in response to institutional LA efforts, they are collecting the same or more data with personal identifiers than they had previously. However, despite this increase, only about half felt that library data was important to campus-level initiatives. This is markedly smaller than the 80% of respondents who felt that library participation in LA was important to library administration, suggesting a greater value is being placed internally than externally on these initiatives. Data Protections (Q25–Q28) This section of the survey specifically dealt with library policies, practices, and training around data protections (e.g., handling and management). The most common data protections identified in learning analytics projects include limiting staff access to unanalyzed data, removing direct identifiers, limiting the scope of data collection, and securing storage. Few libraries reported securing data during transit, deleting data, or limiting retention. Coupled with previous results indicating long data retention periods, this suggests that libraries do not consider data deletion or limited retention as a necessary data protection strategy. Only 16 respondents answered a question about library anonymization techniques of those, several described relying on the office of institutional research to de-identify the data. Others described basic de-identification such as removing student ID numbers and names and masking identifiers, though these practices are not equivalent to full anonymization. Only two libraries have a learning analytics data management plan. A few libraries indicated that they intend to make a data management plan. When asked for plan details, several libraries linked to a webpage on data management plans for researchers with little indication as to whether these practices were used internally on library data. Privacy Policies and Practices (Q29–Q36) A particular focus for this survey is the privacy policies relevant to library learning analytics and how they are implemented by the library. While 45 respondents (90%) indicated that their institution has a privacy policy, only 31 of those have a separate library privacy policy. Most of those library policies link to the university policy, state laws on library records, and to the ALA Code of Ethics. Fewer than half point to software terms of service, the 2001 USA PATRIOT Act, the 1974 Family Educational Rights and Privacy Act (FERPA), or another document. There is a general lack of consistency regarding policy review and revision. Several respondents indicated updates happen “as needed” or “periodically” without further detail. Notably, a couple mentioned that they are currently reviewing these policies for update in 2018, with at least one mention of making changes based on the European Union’s General Data Protection Regulation (GDPR) requirements. Others are reviewed every few years, one is updated when laws change, and one was last updated nearly 15 years ago. Most respondents indicated that LA has not caused changes in their privacy policies. Only one respondent indicated that they created a “Responsible Use of Library Data” statement in alignment with their learning analytics project. Eighteen libraries (42%) inform students about library learning analytics initiatives. However, 11 of these—nearly three-quarters—indicated that there was no mechanism for students to opt out or that any kind of non-participation option was available.