Policy takeaways:
- Libraries are defenders of free thought.
- For this reason, we keep private information about what our patrons read or consult.
- 9/11 resulted in increased federal access to certain library usage records.
- Our library workstations are configured to regularly erase search histories.
- When presented with legal reason to provide what information we have about a patron, there are specific processes in place to elicit/share that information.
The American Library Association, in its Code of Ethics, states that libraries in the United States are in a position to:
Influence or control the selection, organization, preservation, and dissemination of information. In a political system grounded in an informed citizenry... [librarians are] committed to intellectual freedom and the freedom of access to information.
Libraries have a responsibility to foster the free flow of ideas and information in their communities. The UVM Libraries take most seriously this responsibility to ensure intellectual freedom and recognize the critical need to protect the privacy and confidentiality of its users. This means that the UVM Libraries will not reveal, except upon receipt of a valid and enforceable judicial order or warrant, information about users--what they read from our collections, what their areas of research might be, or what resources or services they consult, use or access (hereafter "user information"). The UVM Libraries fully subscribe to the professional standard stated in the Code of Ethics of the American Library Association:
We protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted.
Support for the protection of library records is found in Vermont law, which states that "a library's patron registration records and patron transaction records shall remain confidential" and shall not be disclosed to persons outside the library "except in response to an authorized judicial order or warrant directing disclosure" (22 V.S.A. 172). Vermont law also provides that "records relating to the identity of library patrons or the identity of library patrons in regard to library patron registration records and patron transaction records" are "exempt from public inspection and copying" (1 V.S.A. 317). In recognition of public policy protecting the confidentiality of library user information, and in light of what we consider our ethical obligations as librarians, we shall not voluntarily, in the absence of written permission of the library user or an authorized judicial order or warrant, provide third parties with access to user information.
Confidential library records have long been accessible to law enforcement officials through orderly legal channels. However, passage by Congress of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act, Public Law 107-56) gives law enforcement officials freer access to library user records, and increased ability to install devices on computer workstations to monitor activity. Furthermore, it prohibits patron notification when certain types of surveillance are underway. This legislation has caused libraries, including the UVM Libraries, to review their written policies and practices regarding privacy of patron records, to rethink and codify record-keeping practices, and to ensure that staff has coherent procedures to follow should official requests for information identifying individuals come to the library.
We do not collect or retain user information beyond what is needed for essential library operations or to protect the library collections (e.g., information necessary for contacting someone about materials he or she currently has signed out or for which a bill might be outstanding). Only authorized staff with assigned, high-level passwords have access to personally identifiable information stored in the library's computer systems.
The library does not retain online records of Internet transactions (Website or chat room visits, or email messages). Computer workstations in the libraries are designed to protect user privacy-- regularly erasing search histories and user passwords on a cyclical basis as well as with each system restart.
Library administrators regularly review record-keeping practices, and staff in departments where patron records must be kept are trained to understand library practices regarding privacy and confidentiality.
Without an authorized judicial order or warrant, and in the absence of written permission of the library patron to whom the records pertain, UVM Libraries and its faculty and staff will not provide user information requested by a third party. "User Information" includes: name, mailing address, telephone, e-mail address, social security number, and UVM barcode, personal likeness captured from a security camera, and records of resources and services used by an individual including, but not limited to, library materials borrowed or consulted, reference requests or other requests for information, database search records, interlibrary loan records, computer workstations used, and the content of computer activity.
User information will be released only pursuant to an authorized judicial order or warrant.
Certain video images from library security cameras may be covered by the Library Patron Records statute. Library personnel should handle any request for review of such images by following the procedure outlined below.
The UVM Libraries and the UVM Office of the General Counsel have established the following protocols to deal with requests for library user information:
When an individual not affiliated with the library (including UVM faculty, staff, and administrators), presents himself or herself to any staff member and requests information, the staff member should inform the individual that according to UVM policy, this information cannot be provided without an authorized judicial order or warrant. If he/she has further questions, he/she should be directed to the dean's office.
When an individual presents himself or herself to any staff member* as a law enforcement officer or as someone bearing an authorized judicial order or warrant, and requests user information about library patrons, the staff member should
AFTER DIRECTING THE LAW ENFORCEMENT OFFICER TO THE DEAN, THE STAFF MEMBER MUST NOT INFORM ANYONE ABOUT THE REQUEST, UNLESS/UNTIL AUTHORIZED TO DO SO BY THE DEAN.
If the dean is not in the office and cannot be reached, the staff member should contact the assistant dean and direct the individual requesting information to speak with him or her.
If the assistant dean is not in the office and cannot be reached, the staff member should contact one of the following directors and direct the individual requesting information to speak with him or her:
During evenings and weekends, the dean should be contacted at home. If the dean cannot be reached at home, the staff member should contact one of the following at home and direct the individual requesting information to speak with him or her (phone numbers are in supervisors' manuals kept at service desks and on the Libstaff Website):
If the staff member cannot reach the dean, assistant dean, or any of the directors, he/she should contact a member of the university's legal staff. Assistance in this may be requested from Police Services.
If the individual does not present photo identification and/or an authorized judicial order or warrant, the dean or department head should:
If the individual does present appropriate photo identification and an authorized judicial order or warrant, the dean or department head should:
Contact university counsel, who will advise the dean or department head about his/her legal responsibilities to respond to the demand, and about procedures for responding to the person seeking the user information. Counsel will also advise about any applicable restrictions concerning communications with the user or others about the legal demand and the university's response to it.
Supervisors of student assistants who work at public service desks are responsible for informing student assistants of this UVM Libraries policy. Student workers should be advised to immediately turn over any transaction of this type to a staff member.
American Library Association. Code of Ethics. Chicago: ALA, January 22, 2008.
Accessed: June 27, 2017
Privacy & Confidentiality in Libraries. Chicago: American Library Association and the Illinois Library Association, July 2002.
Accessed: November 3, 2003.
Vermont Statutes Annotated Online. "Definitions; Public Agency; Public Records and Documents." 1.V.S.A. §317(c)19.
Accessed: June 27, 2017.
Vermont Statutes Online. "Library Patron Records." 22 V.S.A. 171-173.
Accessed June 27, 2017.
Effective date: January 5, 2004
Approved by: Dean's Council, December 18, 2003, rev. 2/11/04, rev. 6/8/05, rev.10/8/09
Suggested revisions to Aaron Nichols, Interim Director, Access, Technology, and Media Services, David W. Howe Memorial Library