This is probably not true at most libraries. I used to work at one of the largest library systems in the country and they had patrons' checkout logs for at least a full-decade (in a poorly designed, insecure database system, now outsourced to a managed provider at a great cost $1M+ per year). I also don't believe they had patrons' privacy or data security as their priority -- most libraries simply never had the kind of technical competence to protect such data.