Background, Philosophy, Rationale
The American Library Association, in its Code of Ethics, states that libraries in the United States are in a position to
Influence or control the selection, organization, preservation, and dissemination of information. In a political system grounded in an informed citizenry, [librarians are] committed to intellectual freedom and the freedom of access to information.
Libraries have a responsibility to foster the free flow of ideas and information in their communities. The UVM Libraries take most seriously this responsibility to ensure intellectual freedom, and recognize the critical need to protect the privacy and confidentiality of its users. This means that the UVM Libraries will not reveal, except upon receipt of a valid and enforceable court order, subpoena or other binding legal demand (hereafter "binding legal demand") information about users - what they read from our collections, what their areas of research might be, or what resources or services they consult, use or access (hereafter "user information"). The UVM Libraries fully subscribe to the professional standard stated in the Code of Ethics of the American Library Association:
We protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted.
Support for the protection of library records is found in the Vermont Public Records Act (1 V.S.A. ?317), which provides that "records relating to the identity of library patrons or the identity of library patrons in regard to the circulation of library materials" are "exempt from public inspection and copying." In recognition of that public policy against open public access to library patron records, and in light of what we consider our ethical obligations as librarians, we shall not voluntarily, in the absence of legal compulsion or extraordinary and emergent health or safety threats, provide third parties with access to user information.
Confidential library records have long been accessible to law enforcement officials through orderly legal channels. However, passage by Congress of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act, Public Law 107-56) gives law enforcement officials freer access to library user records, and increased ability to install devices on computer workstations to monitor activity. Furthermore, it prohibits patron notification when certain types of surveillance are underway. This legislation has caused libraries, including the UVM Libraries, to review their written policies and practices regarding confidentiality of patron records, to rethink and codify record-keeping practices, and to ensure that staff have coherent procedures to follow should official requests for information identifying individuals come to the library.
Policy on Records Creation and Retention
We do not collect or retain user information beyond what is needed for essential library operations or to protect the library collections (e.g., information necessary for contacting someone about materials he or she currently has signed out or for which a bill might be outstanding). Only authorized staff with assigned, high-level passwords have access to personally identifiable information stored in the library's computer systems.
The library does not retain online records of Internet transactions (Web site or chat room visits, or email messages). Computer workstations in the libraries are designed to protect user confidentiality - regularly erasing search histories and user passwords on a cyclical basis as well as with each system restart.
Library administrators regularly review record-keeping practices, and staff in departments where patron records must be kept are trained to understand library practices regarding privacy and confidentiality.
Policy on Giving Information About Library Users
Without a binding legal demand, and in the absence of extraordinary and emergent health or safety threats that merit disclosure in the judgment of the dean or his/her designee, UVM Libraries and its faculty and staff will not provide user information requested by a third party. "User Information" includes: name, mailing address, telephone, e-mail address, social security number, and UVM barcode, personal likeness captured from a security camera, and records of resources and services used by an individual including, but not limited to: library materials borrowed or consulted, reference requests or other requests for information, database search records, interlibrary loan records, computer workstations used, and the content of computer activity.
User information will be released only pursuant to a proper court order, subpoena, search warrant or other valid and binding legal demand (collectively "a binding legal demand") or in the event of extraordinary and emergent health or safety threats, as determined by the dean or his/her designee.
Certain records, including video images from library security cameras, may be shared at the library's initiative in matters relating to the safety and security of library facilities, collections, personnel and patrons.
Procedures for Handling Requests for Library Records or Information About Library Users
The UVM Libraries and the UVM Office of the General Counsel have established the following protocols to deal with requests for library user information:
Faculty/staff procedure for handling requests from individuals who are not law enforcement officers
When any individual not affiliated with the library (including UVM faculty, staff, and administrators), presents himself or herself to any staff member and requests information, the staff member should inform the individual that according to UVM policy, this information cannot be provided without a binding legal demand. If he/she has further questions, he/she should be directed to the dean's office.
Faculty/staff procedure for handling requests from law enforcement officers or other parties in possession of purportedly binding legal demands
When an individual presents himself or herself to any staff member* as a law enforcement officer or as someone bearing a binding legal demand, and requests user information about library patrons, the staff member should
- Ask to see identification.
- Ask the officer if he or she has binding legal demand.
- Call the dean's office and ask to speak with the dean of libraries. Advise the dean if the individual has presented identification and a purportedly binding legal demand to obtain user information.
- Direct the individual requesting information to speak with the dean, who will follow the procedure below.
AFTER DIRECTING THE LAW ENFORCEMENT OFFICER TO THE DEAN, THE STAFF MEMBER MUST NOT INFORM ANYONE ABOUT THE REQUEST, UNLESS/UNTIL AUTHORIZED TO DO SO BY THE DEAN.
If the dean is not in the office and cannot be reached, the staff member should contact one of the following department heads and direct the individual requesting information to speak with him or her:
- Head of Access and Technology Services
- Director, Dana Medical Library
- Head of Instruction and Information Services
- Head of Collection Management Services
- Head of Research Collections
During evenings and weekends, the dean should be contacted at home. If the dean cannot be reached at home, the staff member should contact one of the following department heads at home and direct the individual requesting information to speak with him or her (phone numbers are in supervisors' manuals kept at service desks):
- Head of Access and Technology Services
- Director, Dana Medical Library
- Head of Instruction and Information Services
- Head of Collection Management Services
- Head of Research Collections
If the staff member cannot reach the dean or any of the department heads, he/she should contact a member of the university's legal staff. Assistance in this may be requested from Police Services.
*Supervisors of student assistants who work at public service desks are responsible for informing student assistants of this UVM Libraries policy. Student workers should be advised to immediately turn over any transaction of this type to a staff member.
Dean/department head procedure for handling requests from law enforcement officers
If the individual does not present photo identification and/or a binding legal demand, the dean or department head should:
- Review and make a copy of whatever identification information the individual does present;
- Advise the individual that the university cannot comply without appropriate identification and documented legal authorization;
- Direct the individual to the university's Office of the General Counsel.
If the individual does present appropriate photo identification and a binding legal demand, the dean or department head should:
Contact university counsel, who will advise the dean or department head about his/her legal responsibilities to respond to the demand, and about procedures for responding to the person seeking the user information. Counsel will also advise about any applicable restrictions concerning communications with the user or others about the legal demand and the university's response to it.
References
American Library Association. Code of Ethics. Chicago: ALA, June 28, 1997, amended January 22, 2008.
http://www.ala.org/ala/aboutala/offices/oif/statementspols/codeofethics/codeethics.cfm
Accessed: November 3, 2008.
Privacy & Confidentiality in Libraries. Chicago: American Library Association and the Illinois Library Association, July 2002.
http://www.ila.org/pdf/privacy.pdf
Accessed: November 3, 2003.
Vermont Statutes Annotated Online. "Definitions; Public Agency; Public Records and Documents." 1.V.S.A. ยง317(c)19. Last update, March 15, 2002.
https://legislature.vermont.gov/statutes/section/01/005/00317
Accessed: March 15, 2018.
Effective date: January 5, 2004
Approved by: Dean's Council, December 18, 2003, rev. 2/11/04, rev. 6/8/05
Suggested revisions to: Paul Philbin, Head Access and Technology Services, Howe Library ([email protected])