gdt on Nostr: I've been unclear on the statutory basis for patron privacy (MA, Federal?). I see the ...

I've been unclear on the statutory basis for patron privacy (MA, Federal?). I see the carve-out from public records in MA, but use of gmail to communicate with patrons seems improper. Do you have a statute/regulation pointer?