Indiana Statutes: http://www.in.gov/legislative/ic/code/
State Library Association: Indiana Library Federation
Security Breach Notification Law : Ind. Code §§ 24-4.9 et seq., 4-1-11 et seq.
Data Disposal Law: Ind. Code §§ 24-4-14-8, 24-4.9-3-3.5(c)
Library Records Privacy:
TITLE 5. STATE AND LOCAL ADMINISTRATION ARTICLE 14. PUBLIC PROCEEDINGS CHAPTER 3. ACCESS TO PUBLIC RECORDS
Burns Ind. Code Ann. § 5-14-3-4
§ 5-14-3-4. Exceptions to IC 5-14-3-3 — Time limitation on confidentiality of records — Destruction of public records [as amended by P.L.201-2001]
(a) The following public records are excepted from section 3 [IC 5-14-3-3] of this chapter and may not be disclosed by a public agency, unless access to the records is specifically required by a state or federal statute or is ordered by a court under the rules of discovery <….>
(1) Those declared confidential by state statute.
(2) Those declared confidential by rule adopted by a public agency under specific authority to classify public records as confidential granted to the public agency by statute.
(b) Except as otherwise provided by subsection (a), the following public records shall be excepted from section 3 of this chapter at the discretion of a public agency: <…>
(16) Library or archival records:
(A) which can be used to identify any library patron; or
(B) deposited with or acquired by a library upon a condition that the records be disclosed only:
(i) to qualified researchers;
(ii) after the passing of a period of years that is specified in the documents under which the deposit or acquisition is made; or
(iii) after the death of persons specified at the time of the acquisition or deposit.
However, nothing in this subdivision shall limit or affect contracts entered into by the Indiana state library pursant to IC 4-1-6-8.
(c) Notwithstanding section 3 of this chapter, a public agency is not required to create or provide copies of lists of names and addresses, unless the public agency is required to publish such lists and disseminate them to the public pursuant to statute. However, if a public agency has created a list of names and addresses, it must permit a person to inspect and make memoranda abstracts from the lists unless access to the lists is prohibited by law. The following lists of names and addresses may not be disclosed by public agencies to commercial entities for commercial purposes and may not be used by commercial entities for commercial purposes:
(1) A list of employees of a public agency.
(2) A list of persons attending conferences or meetings at a state institution of higher education or of persons involved in programs or activities conducted or supervised by the state institution of higher education.
(3) A list of students who are enrolled in a public school corporation if the governing body of the public school corporation adopts a policy:
(A) prohibiting the disclosure of the list to commercial entities for commercial purposes; or
(B) specifying the classes or categories of commercial entities to which the list may not be disclosed or by which the list may not be used for commercial purposes.
A policy adopted under subdivision (3) must be uniform and may not discriminate among similarly situated commercial entities.
(d) Nothing contained in subsection (b) shall limit or affect the right of a person to inspect and copy a public record required or directed to be made by any statute or by any rule of a public agency.
(e) Notwithstanding any other law, a public record that is classified as confidential, other than a record concerning an adoption, shall be made available for inspection and copying seventy-five (75) years after the creation of that record.
(f) Notwithstanding subsection (e) and section 7 [IC 5-14-3-7] of this chapter:
(1) public records subject to IC 5-15 may be destroyed only in accordance with record retention schedules under IC 5-15; or
(2) public records not subject to IC 5-15 may be destroyed in the ordinary course of business.