关键词: 图书馆, 《个人信息保护法》, 个人信息, 合规

Abstract: [Purpose/Significance] The library is an important personal information processor in the digital age, and compliance is the prerequisite for its information processing and service provison. The analysis of its compliance status, problems and causes can provide countermeasures for compliant handling of personal information of libraries in China.[Method/Process] By analyzing the privacy policies, instructions for application of certificates and other documents on the official websites of 31 provincial and municipal libraries in China, this paper found that libraries lacked notification of processing contents, the provision of obtaining consent was not consistent, the special provision for handling information of child users was lacking, and the legality of "exceptions" was questionable and the grounds for exemptions from liability might be invalid. This is because the awareness of library compliance was generally weak, the autonomous role of industry organizations was insufficient, and compliance talents were scarce.[Result/Conclusion] It is recommended that libraries adopt the model of joint governance of multiple subjects, differentiate scenarios to fulfill the obligation of notification, formulate special rules for handling child user information, reasonably limit the scope of exceptions, clarify the boundaries of exemptions from liability, and build a risk assessment mechanism to better fulfill the compliance obligations of libraries and protect the rights and interests of user information.

Key words: library, Personal Information Protection Law, personal information, compliance