A library director discovers that a staff member has been sharing patron checkout records with a local law enforcement officer without a court order.What is the most appropriate first step?