While it would be a more cut-and-dried case of patron privacy to deny wholesale snooping in your patron databases, what about when the police come to your library with a patron's wallet? If you're in Johnson County, giving the police that patron's phone number might get you fired. I know the police have shown up at our library more than once looking for patron information supposedly in the interests of returning a wallet or a PDA. I believe our policy is to offer to call the patron, but not give out that patron's personal information [without a warrant] in accordance with our privacy policy. Of course, any privacy policy is only as strong as the weakest link who has database access, right?