LibraryLaw Blog

We're watching you closely after you leave the library...

Amanda also sent me this article saying that Arlington VA plans to use cameras to scan license plates of parked cars and compare them against unpaid fines ... "anything from late park and recreation fees to overdue library books."

Any Arlington readers who can comment on this?

Should parents be able to see children's library records?

Amanda Welsh points out an article about a bill in Maine, sponsored by Rep. Randy E. Hotham, that would require public libraries to tell parents what books their children have checked out.

The bill is definitely part of a trend ... what do librarylaw blog readers think? Should parents be able to see their children's records, and if so how should "parents", "children" and "records" be defined?

My thoughts, generally, on the topic are here.

New - Library, Bookseller, and Personal Records Privacy Act introduced by Sen. Feingold

Senator Feingold introduced the Library, Bookseller, and Personal Records Privacy Act, S. 317 last week, identical to S. 1507 from last term.

It would return a higher legal standard ("specific and articulable standard") to requests for business records (including library and bookstore records, medical records etc.) that the low "relevance" standard that the Patriot Act put in place.

S. 317 is cosponsored by Senators Akaka, Bingaman, Cantwell, Corzine, Dayton, Durbin, Jeffords, Kennedy, Leahy and Wyden.

It's so easy to send a quick email or voicemail to your Senator, so express your support (or other opinion).

Senator Feingold introduced other bills, including S. 318, the Computer Trespass Clarification Act (virtually identical to S. 2783 from last term). This would better define the computer hacker provision which was written so broadly that nonhackers could be swept in (including library patrons, according to Sen. Feingold).

See also Feb. 8 Congressional record transcript of the introduction and text of these bills. For updates see thomas.loc.gov and type in the bill number. Or read on for S. 317 text.

What do you do when the police come to your library with a missing wallet and ask for the patron's phone number? Think real hard...

Now really, it's not that difficult, though apparently a librarian at the Johnson County Central Library didn't figure it out...not when he was approached by the police, and apparently not even by the time of this newspaper interview.

According to "Librarian fired for 'good deed' that violated confidentiality, Johnson County Sun (Feb 10), when a police officer asked librarian Steve Roberts for the phone number of a library patron whose wallet had been found in a supermarket, Roberts gave it out...despite training on the library's privacy policy.

"We talked about the issues," Roberts said. "The officer and I talked at length about the right to privacy and confidentiality. The policy not to share patron information, especially with the police, is sacrosanct."

But Roberts also knew that if it was his wallet that was lost, he would want it returned as quickly as possible.

Uh, is there no other solution?  Set aside, for the moment, that  Roberts apparently did not talk to his supervisor before giving out the number...

... Yes, you got it. It's not hard to figure out a solution ...

Need for student research papers: Google library project and privacy

If you're a student looking to research an issue and want to make a difference, write about the privacy implications of the Google library research project. Send thoughtful papers backed by research in to this blog and we'll link to them. Comparisons with the Internet Archive Million Book Project would be useful.

I'm more alarmed about readers' privacy after reading Mike Mill's article in CQ than I was before, since I'm such a big fan of "don't be evil" Google.  My hope is that privacy concerns will be integral in the planning process.  I think every librarian and library student should read Mike Mills' article in CQ.  He has given permission to post his article here. 

It's great to see librarian Trina Magi take on the Patriot Act ... in the Congressional Record

Trina Magi, Past President of the Vermont Library Association, took on the Patriot Act again recently at the Vermont Law School which held a town meeting on the state of civil liberties.  It was reported in the Rutland Herald, and Rep. Bernie Sanders entered the article into the Congressional Record (Feb. 1, 2005). See also March 12, 2003 Congressional Record.

Magi said she was worried that provisions of the Patriot Act allow investigators to look at the records of any business, including libraries, without a warrant.

"As an academic librarian, it is my job to help students really dig deeper,'' she said.  "In order to do that, students must feel that the library is a safe place to seek information.''

It's inspiring to see librarians speaking out for the freedom of inquiry that so many take for granted. Magi acknowledges the legitimate fear we face in the age of terrorism, but says

"We can also be afraid of an overreaching government that stretches too far into our lives."

You know, we don't know what we've got til it's gone.  Do we really want everything we read to be trackable?  Or do we think, "oh, they won't track me, since I'm not a terrorist"?   Or "I have nothing to hide, it's okay if they watch me - that's the price of freedom" (ironic smile). 

Librarians well know that some people read books, websites, etc. on topics they wish to keep private...on abuse, disease, marital problems, and the list goes on.

To read the full report...

What me worry? Google's unhelpful reassurance about users' privacy

2/9/05 Update: Mills article is here

-------

What privacy implications does the Google/Libraries project raise?  Mike Mills, executive editor at CQ Weekly says a Google source told him:

"...libraries shouldn't worry because Google users aren't patrons in the traditional sense -- they won't be "checking out" books, they'll be visiting library Web pages. Moreover, he said, law enforcement officials are more likely to track suspects through Internet service providers than through Google; ISPs keep even more detailed data on users' names, search-histories and overall Web usage."

- Mike Mills, "Googling the Stacks: Libraries love Google's offer to scan their holdings but they also love keeping borrowers' records private."  CQ Weekly January 24, 2005  (you can get the whole issue here, then go to page 172)

Combine this with the persistent cookie (expires 2038), used to track your search history (for targeted advertising) and it looks like serious questions should be asked about privacy implications for users. 

Libraries don't just care about users privacy inside a brick building ... we care about the freedom to read without the fear that a government agent is looking over our shoulders, wherever we may be.

Lawyers for Libraries update in 2003

The State Library of Iowa offered a legal update for libraries in June 2003 (I just stumbled upon it), based on the Lawyers for Libraries training offered by the American Library Association.  It covers privacy, warrants, liability, public forum and free speech issues.  It's in outline form, and gives relevant case citations. 

Google-Watchers - want privacy guarantees before handing over library books for Google digitization

Google Watch is asking libraries to lean on Google regarding its privacy policies, as part of the Google/Library Digitization massive scanning project:

It is my feeling that those librarians who contract with Google for access to their books and documents for purposes of digitization should require that any future searches done on Google that produce this material, must respect the anonymity of the searcher. This would mean that Google cannot record the IP address or unique ID from the cookie for such searches. Short of this, another alternative would be for libraries to deny Google access to any literature that has political content or relevance.                [Emphasis is mine - Mary]

Letter to Mitch Freedman, Past President of ALA from Daniel Brandt

Does Canadian law protect library patron records?

Canadian privacy lawyer David T.S. Fraser recently spoke to public library directors in Nova Scotia on privacy law and patron records.  He posted his presentation on his blog pipeda.blogspot.com (Nov 3). 

I asked him if provincial laws protect library user records, and he replied:

"We don't have consistent protection of library patron records in Canada. Our federal system divides  jurisdiction between the federal government and the provinces. For example, the provinces have jurisdiction  over property and civil rights in a province while the feds have jurisdiction over trade and commerce. The  federal government came up with a federal privacy law in 2001, but have to rely on their trade and commerce  power to implement it. This means that the Personal Information Protection and Electronic Documents Act  (PIPEDA) only applies to "commercial activities", something that public libraries are usually not engaged  in. (If they sell their member list, it is deemed to be a commercial activity and PIPEDA applies to the  sale.)

Because the provinces have jurisdiction over civil rights, there is concurrent jurisdiction that means that  provinces can legislate in the privacy area as well, and put in place laws with wider application. Here in  Nova Scotia, the provincial government has not done so, meaning that PIPEDA applies in the province, but  again only to commercial activities.

But all provinces have public sector privacy and access laws. Nova Scotia's is called the Freedom of  Information and Protection of Privacy Act (FOIPOP), which governs records held by public bodies. I do not  believe that public libraries are public bodies under FOIPOP, so there is no privacy protection under that  law. (This may not be the case in other provinces. For example, public libraries are under the Ontario  Municipal Freedom of Information and Protection of Privacy Act and under the Alberta Freedom of Information  and Protection of Privacy Act.)

This leaves library users records unprotected in Nova Scotia, by either federal or provincial law. What I  recommend is that libraries still follow the good information practices set out in the Canadian Standards Association Model Code for the Protection of Personal Information, which is the mandatory standard under  PIPEDA. It requires (i) appointing a privacy officer, (ii) developing a privacy policy and a statement of  purposes for which personal information is collected, used and disclosed, (iii) getting consent for the use  of personal information, (iv) only using and disclosing personal info for the purposes for which it was  collected and for which consent has been obtained, (v) only retaining information for as long as is  reasonably necessary, (vi) safeguarding the info against all threats, and (vi) having a complaint mechanism.  If you have a privacy statement that becomes part of the user agreement, it should be binding upon the  library and give the users specific rights vis-à-vis their information. In my experience, users expect that  their privacy will be respected and libraries should live up to that expectation."

Minow take (added Nov 18): Thanks David. Sounds like library users in Nova Scotia have even less privacy protection than in the U.S.  It's state by state here as well, but 48 states have library privacy laws, and the other two have attorney general opinions. At least Canada has, I believe, I stronger privacy ethos. Although voluntary for noncommercial bodies, the Canadian Standards are mandatory for commercial activities and folks are thus accustomed to those privacy principles.