Helmet libraries visitor tracking updated
Helsinki Metropolitan Area Libraries (Helmet) have improved website users’ data security by replacing the site’s analytics tool in September 2022. However, in December, the Helmet library received a reprimand from the Deputy Data Protection Ombudsman about the previous use of Google Analytics on the site and the failure to adequately inform the clients regarding the site’s cookie policies.
The Helmet.fi online service used Google Analytics for visitor tracking for website development, such as for statistics on the number of visitors and the most popular pages, starting from 2012. Google Analytics is still the most used website analytics tool in Finland and globally. Though previously a widely accepted visitor tracking tool, current stricter interpretations of data protection legislation mean that it can no longer be used.
The Deputy Data Protection Ombudsman’s reprimand on the processing of personal data concerns in the first place the IP addresses of devices, i.e. the network IDs consisting of a series of numbers, and their possible transfer to Google and, thus, outside the EU/EEA. Data protection legislation considers IP addresses to be personal data.
The Helmet.fi service website (news, info, etc.) has been using Google Analytics cookies. Although Google Analytics cookies have not been used when searching for library materials, Google may have received data about searches made by users. If a library user searched for a book and returned to the Helmet homepage immediately after that, Google was informed of the material search address from which the user came to the Helmet homepage. This address revealed what material the user had just searched for. Google may have combined the data collected.
The information in the customer data file, such as names, addresses, library card numbers or information on loans, has not been tracked by Helmet or Google. Therefore, such data has not been transferred to Google.
The removal of Google Analytics was planned and scheduled for the end of 2022 already before the Deputy Data Protection Ombudsman’s contact. The schedule was accelerated, and Google Analytics was removed from the site in September 2022. The Helmet web service currently uses Matomo software, which also anonymises IP addresses. All data collected and stored through Matomo is processed only in Finland.
The cookies used on the online service are categorised into necessary cookies, preferences and analytical cookies. The cookies necessary for the operation of the Helmet online service enable, for example, the reservation of materials, the renewal of loans and the maintenance of user sessions. Analytical (statistical) cookies are used to develop the website.
The proper functioning of the cookie tool was verified in autumn 2022, and the website’s data protection statement will be specified accordingly in January 2023.
Link to the press release by the Deputy Data Protection Ombudsman
More information: Katri Vänttinen, Library Director, Helsinki City Library, katri.vanttinen@hel.fi, tel. +358 40 554 8861
News item updated on 10 February 2023: Further specified the text regarding the material search and added information about the cookies used in the Helmet online service.