Policy takeaways:

• Libraries are defenders of free thought.
• For this reason, we keep private information about what our patrons read or consult.
• 9/11 resulted in increased federal access to certain library usage records.
• Our library workstations are configured to regularly erase search histories.
• When presented with legal reason to provide what information we have about a patron, there are specific processes in place to elicit/share that information.

Background, Philosophy, Rationale

The American Library Association, in its Code of Ethics, states that libraries in the United States are in a position to:

Influence or control the selection, organization, preservation, and dissemination of information. In a political system grounded in an informed citizenry... [librarians are] committed to intellectual freedom and the freedom of access to information.

Libraries have a responsibility to foster the free flow of ideas and information in their communities. The UVM Libraries take most seriously this responsibility to ensure intellectual freedom and recognize the critical need to protect the privacy and confidentiality of its users. This means that the UVM Libraries will not reveal, except upon receipt of a valid and enforceable judicial order or warrant, information about users--what they read from our collections, what their areas of research might be, or what resources or services they consult, use or access (hereafter "user information"). The UVM Libraries fully subscribe to the professional standard stated in the Code of Ethics of the American Library Association:

We protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted.

Support for the protection of library records is found in Vermont law, which states that "a library's patron registration records and patron transaction records shall remain confidential" and shall not be disclosed to persons outside the library "except in response to an authorized judicial order or warrant directing disclosure" (22 V.S.A. 172). Vermont law also provides that "records relating to the identity of library patrons or the identity of library patrons in regard to library patron registration records and patron transaction records" are "exempt from public inspection and copying" (1 V.S.A. 317). In recognition of public policy protecting the confidentiality of library user information, and in light of what we consider our ethical obligations as librarians, we shall not voluntarily, in the absence of written permission of the library user or an authorized judicial order or warrant, provide third parties with access to user information.

Confidential library records have long been accessible to law enforcement officials through orderly legal channels. However, passage by Congress of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act, Public Law 107-56) gives law enforcement officials freer access to library user records, and increased ability to install devices on computer workstations to monitor activity. Furthermore, it prohibits patron notification when certain types of surveillance are underway. This legislation has caused libraries, including the UVM Libraries, to review their written policies and practices regarding privacy of patron records, to rethink and codify record-keeping practices, and to ensure that staff has coherent procedures to follow should official requests for information identifying individuals come to the library.

Policy on Records Creation and Retention

We do not collect or retain user information beyond what is needed for essential library operations or to protect the library collections (e.g., information necessary for contacting someone about materials he or she currently has signed out or for which a bill might be outstanding). Only authorized staff with assigned, high-level passwords have access to personally identifiable information stored in the library's computer systems.

The library does not retain online records of Internet transactions (Website or chat room visits, or email messages). Computer workstations in the libraries are designed to protect user privacy-- regularly erasing search histories and user passwords on a cyclical basis as well as with each system restart.

Library administrators regularly review record-keeping practices, and staff in departments where patron records must be kept are trained to understand library practices regarding privacy and confidentiality.

Policy on Giving Information About Library Users

Without an authorized judicial order or warrant, and in the absence of written permission of the library patron to whom the records pertain, UVM Libraries and its faculty and staff will not provide user information requested by a third party. "User Information" includes: name, mailing address, telephone, e-mail address, social security number, and UVM barcode, personal likeness captured from a security camera, and records of resources and services used by an individual including, but not limited to, library materials borrowed or consulted, reference requests or other requests for information, database search records, interlibrary loan records, computer workstations used, and the content of computer activity.

User information will be released only pursuant to an authorized judicial order or warrant.

Certain video images from library security cameras may be covered by the Library Patron Records statute. Library personnel should handle any request for review of such images by following the procedure outlined below.

Procedures for Handling Requests for Library Records or Information About Library Users

The UVM Libraries and the UVM Office of the General Counsel have established the following protocols to deal with requests for library user information:

Faculty/staff procedure for handling requests from individuals who are not law enforcement officers

When an individual not affiliated with the library (including UVM faculty, staff, and administrators), presents himself or herself to any staff member and requests information, the staff member should inform the individual that according to UVM policy, this information cannot be provided without an authorized judicial order or warrant. If he/she has further questions, he/she should be directed to the dean's office.

Faculty/staff procedure for handling requests from law enforcement officers or other parties in possession of purportedly binding legal demands

When an individual presents himself or herself to any staff member* as a law enforcement officer or as someone bearing an authorized judicial order or warrant, and requests user information about library patrons, the staff member should

• Ask to see identification.
• Ask the officer if he or she has an authorized judicial order or warrant.
• Call the dean's office and ask to speak with the dean of libraries. Advise the dean if the individual has presented identification and a purportedly authorized judicial order or warrant to obtain user information.
• Direct the individual requesting information to speak with the dean, who will follow the procedure below.

AFTER DIRECTING THE LAW ENFORCEMENT OFFICER TO THE DEAN, THE STAFF MEMBER MUST NOT INFORM ANYONE ABOUT THE REQUEST, UNLESS/UNTIL AUTHORIZED TO DO SO BY THE DEAN.

If the dean is not in the office and cannot be reached, the staff member should contact the assistant dean and direct the individual requesting information to speak with him or her.

If the assistant dean is not in the office and cannot be reached, the staff member should contact one of the following directors and direct the individual requesting information to speak with him or her:

• Director of Access and Technology Services
• Director, Dana Health Sciences Library
• Director of Information and Instruction Services
• Director of Acquisitions and Collection Development
• Director of Special Collections
• Director of Resource Description and Analysis

During evenings and weekends, the dean should be contacted at home. If the dean cannot be reached at home, the staff member should contact one of the following at home and direct the individual requesting information to speak with him or her (phone numbers are in supervisors' manuals kept at service desks and on the Libstaff Website):

• Assistant Dean
• Director of Access and Technology Services
• Director, Dana Health Sciences Library
• Director of Information and Instruction Services
• Director of Acquisitions and Collection Development
• Director of Special Collections
• Director of Resource Description and Analysis

If the staff member cannot reach the dean, assistant dean, or any of the directors, he/she should contact a member of the university's legal staff. Assistance in this may be requested from Police Services.

Dean/department head procedure for handling requests from law enforcement officers

If the individual does not present photo identification and/or an authorized judicial order or warrant, the dean or department head should:

• Review and make a copy of whatever identification information the individual does present;
• Advise the individual that the university cannot comply without appropriate identification and authorized judicial order or warrant;
• Direct the individual to the university's Office of the General Counsel.

If the individual does present appropriate photo identification and an authorized judicial order or warrant, the dean or department head should:

Contact university counsel, who will advise the dean or department head about his/her legal responsibilities to respond to the demand, and about procedures for responding to the person seeking the user information. Counsel will also advise about any applicable restrictions concerning communications with the user or others about the legal demand and the university's response to it.

Supervisors of student assistants who work at public service desks are responsible for informing student assistants of this UVM Libraries policy. Student workers should be advised to immediately turn over any transaction of this type to a staff member. 

---

References

American Library Association. Code of Ethics. Chicago: ALA, January 22, 2008.
Accessed: June 27, 2017

Privacy & Confidentiality in Libraries. Chicago: American Library Association and the Illinois Library Association, July 2002.

Accessed: November 3, 2003.

Vermont Statutes Annotated Online. "Definitions; Public Agency; Public Records and Documents." 1.V.S.A. §317(c)19.
Accessed: June 27, 2017.

Vermont Statutes Online. "Library Patron Records." 22 V.S.A. 171-173. 
Accessed June 27, 2017.

---

Effective date: January 5, 2004
Approved by: Dean's Council, December 18, 2003, rev. 2/11/04, rev. 6/8/05, rev.10/8/09
Suggested revisions to Aaron Nichols, Interim Director, Access, Technology, and Media Services, David W. Howe Memorial Library