NYPL privacy fail follow up