Library AI logs expose patron contact data. What external action should the IR plan require?
Select an answer to reveal the explanation.
Short Explanation
Contact data leaked—tell the people and the regulators the policy names. Quiet edits and influencer spin aren’t incident notification.
Full Explanation
When library AI logs expose patron contact data, the IR plan should require notifying affected patrons and regulators per policy. Contact exposure is a personal-data incident; municipal libraries typically owe transparency to affected individuals and, where thresholds or sector rules apply, to regulators or designated authorities. Notification is part of remedy and legal duty, not optional PR.
Quietly editing logs and avoiding external notice fails legal and ethical incident handling and can constitute concealment. Notifying only a social-media influencer for reputation spin fails as notification: influencers are not affected data subjects or regulators. Waiting one year before deciding whether notice is needed fails timeliness requirements embedded in most breach/incident regimes and worsens harm through delay.
Exam caveat: AI does not create a special exemption from breach/incident notice when personal data in AI logs is exposed. Operational check: map AI log exposure to the notification matrix (patrons, regulators, executives), preserve evidence before remediation edits, issue notices within policy timelines, and offer protective guidance appropriate to the data exposed. Coordinate with library privacy counsel on content of notices, document who was notified and when, and update the AI logging architecture so contact fields are minimized or masked to reduce recurrence risk after containment.