LibraryLaw Blog

Congratulations to vermont libraries on strengthened patron privacy

Congratulations and kudos to the Vermont library folks. The state governor signed a bill on May 13, 2008 that substantially strengthens library user privacy. It changes the law from permissive protection (a library MAY keep records confidential), to a mandatory protection (a library MAY NOT disclose records unless certain conditions are met. 

It seems to assume that FERPA requires disclosure of student library records to parents, though this is not known for sure.  It does allow parents of children under 16 to look at their kids' records, though IMHO it's not clear that this is always in the child's best interest.

But the best part is that it allows a private right of action. That is, a patron whose records have been wrongly disclosed may bring a civil action against the library. 

State privacy laws and libraries

Paul Neuhaus has been busy updating his great wiki of state laws on the confidentiality of library records.  Thanks, Paul.

Don't ask for social security numbers in library applications

Some libraries still ask for social security numbers on their library applications. Others have stopped that practice, but haven't purged their patron record databases of these numbers.   

Yes, collection agencies want the numbers, and perhaps having this information can increase your success rate in tracking down scofflaw patrons.   

But consider the downside.  If someone hacks your database, or if you have a bad employee, this highly sensitive information is at risk.  Once it's gone, it's gone. Patrons have little recourse once identity thieves get their hands on these numbers.

Comments, readers?

Library Elf and the UK

From Philip Jones:

I know I am coming very late into this debate, but Elf is just beginning to get publicity here in the UK, and so the issues are becoming relevant. It has also widened its coverage to library management systems (LMSs) which are mainstream over here.

An interesting slant which is emerging is around Elf's choice not to develop full working agreements with the LMS suppliers themselves. I know of one LMS company which regards with concern and suspicion any attempt by a third-party system to draw down data from its LMS installations unless there is a formal agreement in place which formalises the whole process and includes all appropriate legal protections for both parties and their customers.

I think the LMS suppliers' view is that they implicitly authorise a library service, and its registered customers, to gain access to data on its system in specific ways defined by the system. However, they argue that they do not authorise a third-party system, such as Elf, to act as an intermediary between the end user and the LMS system and to manipulate the data provided. And further that one or more end users cannot legitimately empower Elf to act on their behalf as an intermediary service simply by the process of providing their card number and PIN code to Elf for that purpose. It all seems to hinge on whom the LMS supplier believe they have authorised to gain access to their data files.

Mary: This just came in as a comment to http://blog.librarylaw.com/librarylaw/2005/11/my_library_elf_.html but I figured no one would see it there.  I think that any smart tech person could figure out how to "roll your own" RSS feeds from a library's LMS system, needing only the user's library card number and PIN (if needed to get into the records).  Why do you say end users couldn't empower Elf to act on their behalf... wouldn't that be considered consent? Is consent sufficient in the UK?

What concerns me is that the users don't need to give consent if the LMS password system is weak, as it is in so many libraries in the U.S.  Your ex-girlfriend needs only your library card number and sometimes a (weak) PIN (often the last four digits of your phone number). Do UK LMS companies offer stronger PINs than four digits?

Many have told me that that this weak security has always been the case, Elf or no Elf.  The difference that Elf or any RSS feeds (laden with personal content) makes is the convenience of daily delivery of the records from hither and yon.   

By the way, I just happened to go back to the search box in Bloglines the other day, and typed in "library elf for" and then chose [Search for Feeds] and got about 200 personal feeds  from probably unwitting library users.  Gives me their first names and one more click shows their libraries, books out/requested etc.  At least Elf got rid of their email addresses.  Still, quite disconcerting to see so much personal information floating around, free for me to capture.  I could (but won't) add a screenshot of the names with the libraries and titles.

BloglinesElfScreenshot.doc

Library patron records confidentiality? A proposed exception you could drive a truck through

The Wisconsin Library Association has a good explanation of the recent state attorney general opinion finding library surveillance tapes protected as library records under state law.   Unfortunately, in my estimation, the proposed amendment seems to be written more broadly than it need be.

5) Library records may be released for administrative library purposes, including establishment or maintenance of a system to manage the library records or to assist in the transfer of library records from one records management system to another, compilation of statistical data on library use, collection of fines and penalties, and the protection of library staff, library users, and library property.  Records released to third parties for administrative library purposes may not be used or disclosed for any other purpose.

Protection of staff, users, property? Who decides? Isn't that exactly the reason law enforcement generally ASKS for patron records?  The library shouldn't decide when patron records should be turned over, and neither should law enforcement.  A neutral, detached magistrate should decide, evaluating the context --  weighing both security and privacy. The magistrate will then issue court orders in some cases and deny them in others.

It seems that the problem could be better cured by defining library records more narrowly.

Recommended at ALA conference: Libraries, privacy and intellectual property - Friday June 22, 2007

https://www3.oclc.org/app/ala_registration/

Friday June 22, 2007 1:30 – 4:30 pm, Grand Hyatt Washington, Independence Ballroom A
OCLC Symposium: Is the Library Open?
Join your colleagues and OCLC for an interesting afternoon discussion. Hear from three experts on the issues of information property law, copyright, digital communication, intellectual property and user privacy rights in relation to library policies. They are:

• Marc Rotenberg, Executive Director of the Electronic Privacy Information Center (EPIC) and professor of privacy law at Georgetown University Law Center
• Siva Vaidhyanathan, a cultural historian, media scholar and Associate Professor of culture and communication at New York University
• Mary Minow, Library Law Consultant with LibraryLaw.com, coauthor of The Library's Legal Answer Book and a public librarian for 10 years.

Privacy and virtual reference, ask-a-librarian chats etc.

Here's a link to a paper I wrote with Paul Neuhaus on privacy and virtual reference for the American Library Association.  http://www.ala.org/ala/washoff/contactwo/oitp/MinowNeuhaus2005Sept15.pdf

Hooray - I figured out how to use tags instead of categories in this blog

As I suspected, it's much easier and more flexible.  So if any of you are looking for new posts based on categories, you may not find them. Use the technorati tags at the bottom of a post instead. If it works like I think it will, I'll probably stop using categories altogether.

Update: It looks as if users who click on a technorati tag below will get everyone in the world's posts with those tags. That's useful, but it would be nice to have an option to limit it to this blog, the way flickr does.  Well, there's always the search button in the blog...

Are spammers using public records requests to get your patrons' email addresses (off their library card registrations)?

I'm starting to hear about this trend. Is it happening to your library?  On the one hand, it sounds so far fetched that anyone would go to the trouble to get patron email addresses by making public records requests to libraries. Further, it seems so obvious that this personal information would/should be exempted, but you'd have to look at the wording of your state law to see if it is.    On the other hand, maybe its cheaper and better information than spammers could buy off other types of marketing lists.  After all, library patrons are, whatever else you can say about them, usually real people.

Library folks in Oregon recently told me that SB 950 is moving (and quite likely to pass) in their state legislature. It would exempt patrons' email addresses from public disclosure under the state public records law.

Law of Libraries and Archives

Just discovered a website on the Law of Libraries and Archives, by Bryan M. Carson. It's an adjunct to his book published in December 2006 by Scarecrow Press, which I just ordered :>