For an Interlibrary Loan Electronic Transmission (whether printed out and included with the item(s) or sent via electronic means) in a K-12 setting, can a student's name (the one ultimately borrowing the item) be used in the "receipt" or notification slip? Should a student's School ID number be used? Can both be used at the same time? Is it taboo to have a student's name in ANY electronic transmission?
This question comes at us from a school district public library and supporting Board of Cooperative Educational Services ("BOCES").
One thing I knew very little[1] about when I started doing "Ask the Lawyer" was school district public library systems. These are systems coordinated through a regional BOCES, creating a network of library resources, governed by their own section of the New York Education Law (and regulations, and Regents rules).
Over the years, the existence and importance of school district public library systems has grown more and more obvious to me--to the point where now, if you are so unfortunate to be trapped in an elevator with me, I might tell you all about them from ground level to the 32nd floor.[2]
One thing I would mention, around floor 15 or so, is that school district public libraries (and systems) have to balance privacy and data security obligations from a wide array of different state and federal laws. I have written on this before (see "Ask the Lawyer #67, #80, and #143), and won't re-hash that here, except to say: everything in those past answers impacts this question.
With those prior columns as background, the answers to the member's three questions are:
For an Interlibrary Loan Electronic Transmission (whether printed out and included with the item(s) or sent via electronic means) in a K-12 setting, can a student's name (the one ultimately borrowing the item) be used in the "receipt" or notification slip?
Yes, if the library's policy requires it for the "proper operation" of the library (CPLR 4509), AND if the school can assure that only those who need to see it (for the benefit of the student) will see it (FERPA) or the student has signed a FERPA waiver, AND if all the required measures for data privacy are in place (ED2-d).
Should a student's School ID number be used? Can both be used at the same time?
Yes, if the library's policy requires it for the "proper operation" of the library (CPLR 4509), AND if the school can assure that only those who need to see it (for the benefit of the student) will see it (FERPA) or the student has signed a FERPA waiver, AND if all the required measures for data privacy are in place (ED2-d).
Is it taboo to have a student's name in ANY electronic transmission?
No, but school district and BOCES systems creating and transmitting such records should always be confident that the use of the student's name is in a document generated and transmitted per applicable policy.
This is tougher than it sounds, since schools now have so many electronic systems facilitating record-making and communication--a situation compounded by online learning during the pandemic. Further, the decision to use those systems might be driven by function and cost, with only secondary attention being paid to privacy, as addressed in "Ask the Lawyer" #67, #80, and #143.
Since this question is rooted in interlibrary loan, I'll end with an example.
Below is a partial screenshot from the demo screen of OPALS, a popular ILS used by school district libraries (and other types of libraries, too).
As you'll see, OPALS enables the "viewing of all the borrowers in an attending class...."
There is nothing inherently wrong with this type of grouping of borrowers, so long as the district has addressed the various privacy obligations, and made sure the functionality and use of the system (in this example, OPALS) align with the school's approach and policies on privacy.
In other words, nothing should be left to chance.
So, with that, my ultimate answer--to all three questions-- is: any time a public school student's name is listed on a library record that leaves the bounds of the library (the "real" or virtual bounds), every unique way that happens (injury report, student discipline, interlibrary loan) should be covered by policy.
Now, let's consider how this issue looks "on the ground." I poked around a bit, and while I found many interlibrary loan policies for school district library systems/BOCES in NY, I didn't find one that went so far into the weeds as setting terms for how/when to include borrower names on the routing slips (printed or electronic).
Chances are, that's usually more of a "standard operating procedure" thing, rather than something set by formal "policy."[3]
But with increasing interconnectivity between library other school systems, it might be worth formalizing in future interlibrary loan policies. For instance, one sentence: "When effecting interlibrary loan, cooperating libraries shall mutually adhere to the other libraries' and systems' policies regarding borrower privacy"[4] is a sample of how to add a quick reminder about this critical consideration.
Because as the member's questions indicate, we can never be too "in the weeds" on privacy.
Thank you for an important array of questions.
[1] Okay, actually, nothing.
[2] In this mythical trip up 32 floors, we are visiting Buffalo City Hall, which if you have never seen, is a must-visit location.
[3] New York is a big state! I have no doubt there is a policy that does address this. If your district has one, please send a link to info@losapllc.com and reference this RAQ.
[4] This is just sample language...no matter what you select, make sure your school district's attorney or BOCES system director reviews and approves any policy before it goes into effect!
Tags: CPLR 4509, Ed Law 2-d, FERPA, Loaning programs, Privacy, School Libraries
Recently a question has come up at our academic library concerning patron privacy and the notification to a patron (usually a student) concerning excessive downloading of content from databases in our collection. Our current practice has been to receive notification from the vendor about perceived illegal downloading. We then ask a member of our library IT team to investigate the situation, based on the information from the vendor. The contact information acquired by that IT staff member is then provided to the e-resource librarian. That librarian then contacts the individual via email, explaining the situation and indicating that such behavior must cease. Once that is done, the librarian notifies the vendor that the situation has been addressed, and there is no need to withhold access to the product from the campus. No personal identification of the user or student is provided to the vendor, nor distributed to anyone else. The question now: Is this process appropriate in resolving the misuse of a database, or does it violate the user’s/student’s privacy rights?
Questions that combine higher education, data access, and "terms of use" enforcement always give me a moment of sad reflection, as I remember Internet pioneer and activist Aaron Schwartz. It was an alleged overuse of an academic database at MIT in 2012 that lead up to his demise.[1]
While the circumstances in the Schwartz tragedy are different from the situation described here, both scenarios--and the care the member has taken in framing this question--illustrate the importance of considering what's at stake when an institution balances contract compliance, digital access, and privacy.
What's "at stake" here? The member's question combines concerns about:
Let's do a quick run-down of these critical areas:
In New York, the confidentiality of library services is protected by Civil Practice Law & Rules ("CPLR") section 4509, which states that library records indicative of the identity of a library user may only be accessed with that user's permission, or per a subpoena or court order. CPLR 4509 applies to private libraries within academic institutions as much as it does public libraries or those within school districts. It works hand-in-glove with the American Library Association's and New York Library Association's recitals of patron confidentiality in their Codes of Ethics.
In New York, the commitment of a higher education institution to academic freedom is reflected in various ways. An example is the American Association of University Professors' 1940 "Statement on the Principles of Academic Freedom"[2]: "Teachers are entitled to full freedom in research..."
In New York and throughout the nation, the commitment of libraries to collaborate with others to promote intellectual freedom and access to information is reflected the ALA Library Bill of Rights: "Libraries should cooperate with all persons and groups concerned with resisting abridgment of free expression and free access to ideas."
In New York and throughout the nation, certain academic and library actions that would otherwise violate copyright are excluded from liability for infringement. This exclusion is to ensure there is a clear and well-defined legal safety net for content accessed in furtherance of certain intellectual and academic freedoms.
And throughout the USA, the privacy of education records, including library records, is assured under the Family Education Rights Privacy Act" (FERPA).
Serving as a counterweight to all of these critical factors are an educational institution's obligations under federal law and regulation with regard to alleged copyright infringement, particularly the regulations found in 34 CFR §668. If I were to delve into that and describe all of those obligations here, this answer would be 50 times longer, but a good summary of what compliance in that regard looks like can be found in this sample policy from RIT: https://www.rit.edu/its/rit-response-copyright-infringement. In short: since 2008, federal law requires higher education institutions receiving federal financial aid and other federal benefits to be express enforcers and re-enforcers of copyright.[3]
Sitting astride of all of this is whatever notification commitments (and other responses) a college or university library agreed to when it signed the license agreement with the database provider (I have reviewed many of these types of license agreements, and almost all of them have some form of notification action requirement, which can range from a warning as described by the member, to ensuring the immediate cutoff of access by an offender). This means that in addition to the ethical, legal, and regulatory factors that have to be balanced in a question like this, we also have to consider obligations that are contractual.[4]
With all of these very important considerations now laid before us, let's review what the member is doing: 1) getting a notification of a possible terms violation from the provider, and then 2) using a firewalled[5] process to identify the user and alert them of the alleged violation, and then 3) assuring the vendor they have addressed the issue. As asked by the member: Is this process appropriate in resolving the misuse of a database, or does it violate the user’s/student’s privacy rights?
Here is my short answer: since the method of response described by the member shows there is a big firewall between the vendor and the institution (meaning: the outside party never learns the actual identity of the alleged violator), I believe so. BUT: the only real way to ensure privacy is protected as it should be is to confirm that the information flowing between the library and the IT Department never goes any further...within the institution.
What do I mean by that? The information should never go to campus safety or security. Unless it is per a very clearly articulated procedure developed for the operational needs of the library, it should never go to the office responsible for student discipline. And it should certainly never go to an employer on campus, a faculty member, or an advisor.[6]
This caution is warranted because, although a library within a higher educational institution is not a separate business entity the way a chartered public library is an entity separate from the town or city that sponsors it, for purposes of an academic library's adherence to privacy ethics and laws, it should be considered a stand-alone entity. Information can flow into it, but information should not flow out, even to other departments, unless the flow serves the operational needs of the library, and verifiably goes no further.
This 'one-way flow" for user-associated academic library records is an easy goal to articulate, but in practice, it can be very difficult to assure. As systems within large and small institutions get more integrated in the interests of security and economy, so too is it more difficult to separate one type of information from another. However, when it comes to privacy and library confidentiality, because of the high stakes involving intellectual freedom, academic freedom, and student privacy, extra care and attention is warranted.
The care of the member in submitting this question and describing the careful process they are using is emblematic of the type of care that should be used at all times when safeguarding user confidentiality and privacy at a higher education academic library.
Thank you very much to the member for submitting such a careful question.
RIP, Aaron Schwartz.
[1] I say "led up to" rather than "led to" because while many believe the latter, the facts of the case clearly establish the former.
[2] Found as of November 14, 2021, here: https://www.aaup.org/report/1940-statement-principles-academic-freedom-and-tenure.
[3] I won't mince my words about that requirement: I don't like it. But I am not a member of Congress.
[4] And voluntary. This is why it is very important to read database licenses and to PUSH BACK on clauses that require draconian responses to alleged violations.
[5] By "firewalled," I mean that the vendor never knows the name or other identifying information of the alleged violator.
[6] Unless the student has signed a waiver. Then it can go to whoever has permission.
Tags: Academic Libraries, CPLR 4509, Ethics, FERPA, Privacy, Security, Students, Surveillance, Databases
My institution has a small number of documents in our archives related to previous graduate students. Some are definitely educational records (transcripts, field placement evaluations). Then there are a) letters of recommendation received by the school or written by school faculty/administrators and sent to other schools, b) some correspondence between a student and the school/administration, and other items like c) copies of images or articles from student publications.
The documents span decades. Most --- but not all--- of these former students are confirmed deceased. Most items in this small group of documents relate to alumni who were/are notable, but in widely varying degrees.
A few of these documents concern a famous alum, who passed away. An outside researcher is asking about the documents related to that alum, and unfortunately, there are no surviving institutional access policies related to student records or unpublished correspondence in our archives. We want to respect copyright, FERPA, and the alum's estate.
For the educational records, I can't find clear guidance on how long FERPA access restrictions last, but other academic collections seem to allow access 50-75 years after the former student's death.
So, a few questions:
1) When should on-site access to historical educational records be allowed (if ever), with reference to FERPA? What about providing copies of historical educational records?
2) When should on-site access to unpublished, non-educational records related to former students be allowed, in reference to state and federal copyright and privacy laws, and possibly FERPA? What about providing copies of these documents?
3) Should we take a more risk-averse approach to high-profile alumni materials, or should our policies apply equally to all alums?
I am always fascinated by the transformation documents can undergo, simply by operation of law, circumstance, or time. For instance:
And of course, documents can be "in" copyright, and "out" of copyright, or restricted due to medical content, or under terms of non-disclosure...restrictions that can shift based on any number of factors.
An educational institution considering levels of access and use of student-related documents[4] has to consider not only these legal factors, but their unique policies. Factor in fame,[5] and the stakes get even higher.
Because of that complexity, I could muse/write/talk on this topic for hours. But let's focus on the member’s specific questions:
1) When should on-site access to historical educational records be allowed (if ever), with reference to FERPA? What about providing copies of historical educational records?
If a former student is not deceased, there can be NO release of FERPA-protected education records to otherwise barred parties without written, dated consent.
If the former student is known to be deceased—or the passage of time suggests they might be deceased—then the records are no longer protected by FERPA, and that restriction no longer applies.
But as the member points out, there are other considerations.
2) When should on-site access to unpublished, non-educational records related to former students be allowed, in reference to state and federal copyright and privacy laws, and possibly FERPA? What about providing copies of these documents?
This is an interesting question because unless the records we're talking about ("related to former students") only contain "directory information,”[6] then they are by definition "education records" under FERPA.[7] That is because the FERPA is intentionally expansive. So old bills, dusty admissions files, and antiquated (but often fascinating) "administrative" records, although not "educational," per se, are still barred from release by FERPA if they relate directly to a student.[8]
BUT, as this question implies, FERPA isn't the only thing that could bar or restrict access to old records. Copyright, privacy laws, and general prudence are all good reasons to not release institutional records unless there is a policy and process for doing so (like a policy for sending transcripts to future employers), or your institution is compelled to release them (like a judicial order or subpoena).
So, while a student will always have access to their records under FERPA, both former students and third parties should by default be barred from access or obtaining copies to records they are not entitled to.
Which brings us to:
3) Should we take a more risk-averse approach to high-profile alumni materials, or should our policies apply equally to all alums?
Many, but not all, educational institutions have internal archives—not formal "Archives" they hold in trust for the public (like the W.E.B. DuBois papers at University of Massachusetts),[9] but rather, materials they regard as important pieces of their institution's history and identity, so deliberately retain.
For some, this may be a complex and far-reaching catalog of institutional history. For others, it may be simply hanging onto every program for every graduation ceremony. And of course, for many, it will be special handling of any material that is related to famous or noteworthy alumnae.
Whether formal and well-funded, or informal and not funded,[10] every educational institution's internal archive should have a policy that covers: 1) that the archive exists to transition material from "records" into "archives;" 2) how those materials are selected; 3) how those archival materials are to be preserved; 4) how the archival materials are used and accessed internally; 5) how the archival materials are used and accessed externally; 6) the ethical standards and institutional values being applied in the overall operation of the archive. [11]
If an educational institution has in-house records of such magnitude that they warrant being their own archive (for instance, the Eqbal Ahmad papers at Hampshire College), yes, the development of that archive could warrant its own separate policy. In that case, unique care would have to be taken to consider not only FERPA, but privacy laws, copyright (the author of an admissions letter is the copyright owner of that admissions letter...not the institution the letter was sent to, even if the institution retains the only physical copy).
All that said, the end result need not be "risk-averse," so much as "risk-informed:" carefully assessing all the compliance concerns and risks,[12] how does an institution create an archive that suits its stated purpose and conforms to institutional ethics? Until an institution is confident it has reached the right answer, access to third parties should not be granted, and only need-to-know access should be granted to those within the institution.
I would like to thank the member for this question, it is a good one. And I think we may have reached a new milestone at "Ask the Lawyer"—a reply where the footnotes are as long as the reply!
Thanks. I wish you a well-resourced and culturally rich archive, and continue positive alumnae relations.
[1] See letter of LeRoy Rooker, Director, Family Policy Compliance Office, U.S. Department of Education letter of Date, found at https://studentprivacy.ed.gov/sites/default/files/resource_document/file/LettertoConnecticutStateArchivistRegardingEducationRecordsMay2008.pdf as of February 10, 2021, re-affirming "that the FERPA rights of “eligible students” lapse or expire upon the death of the student based on common law of privacy rights."
[2] Text for this law can be found at: https://www.nysenate.gov/legislation/bills/2019/s5575.
[3] I am writing this on February 10, 2021.
[4] This "Ask the Lawyer" answer does not address the issue of yearbook photos and student-generated art or academic work. For that, see https://www.wnylrc.org/ask-the-lawyer/raqs/108 and https://www.wnylrc.org/ask-the-lawyer/raqs/91.
[5] What is "fame?" It's a notion that is taking odd journeys these days. As I said in footnote #3, I am writing this on February 10, 2021. Jockeying with the impeachment proceedings for "fame" on the cover of today's digital New York Times: an article about a lawyer who appeared in virtual court as a cat. I bet he can't wait for his 15 minutes to be over.
[6] "Directory information" includes, but is not limited to, the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors, and awards received; and the most recent educational agency or institution attended.
[7] Here is the actual definition: "...those records that are: (1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution."
[8] There are exceptions to this, of course...one big one being the records of campus police.
[9] I value this archive because it has letters between W.E.B. DuBois and Mary Talbert, a Buffalo resident who was a stalwart organizer for civil rights and, on the side, historic preservation (she led the effort to save the house of Frederick Douglass). I read her letters when I need a shot of pragmatic inspiration.
[10] Some "archives" exist because some wonderful employee couldn't bear to see institutional history thrown out, and they got permission to buy some boxes and put the "archives" in the storage closet.
[11] The "Ask the Lawyer" from November 4, 2020 has more about ethical considerations for archival projects: https://www.wnylrc.org/ask-the-lawyer/raqs/178.
[12] For this question, "risk" is not just legal risk, but relational and reputational risk, too. After all, it might be legal to share a harsh evaluation from a thesis committee related to the work of a long-dead student...but is there value in doing it? (Of course, there might be). Knowing why something is in the archive, and having full confidence in that reason, is just as important as preserving the record in the first place.
Tags: Academic Libraries, Archives, Copyright, Digitization and Copyright, FERPA, Privacy
Is it legal to print student photos with their names on their school library cards for circulation use?
I didn't realize it in first grade, but a school library[1] is one of the first places a person experiences "the right to privacy" unmediated by a parent or guardian.
Think about it. You go to the library and get to pick out whatever you want. You check out books, and no one can tell you what to pick. And aside from the person checking you out, no one has to see your selection; your records are private.
In the present day, this means that kids whose faces might be all over Facebook[2], who are attending school via computer, and who "turn off their screen," when they don't want people peeking into their home life during remote learning, still have a right to confidentiality when it comes to the library in their school. And one of the biggest symbols of that student-library relationship is their library card.
So, with all that hanging in the balance, what are the legal considerations of putting student pictures on school library cards?
As often happens in the highly regulated worlds of education, privacy, and information, the answer is: "It depends."
In this case, the factors "it depends" on are numerous; rather than itemize them, I'll summarize them with a few pointed questions:
Factor 1: What else is "on" the library card?
Depending what other information is on the library card, combining a student’s picture with it could increase the likelihood of a violation of FERPA[3], Ed 2-d, or school policy.[4] For instance, if the card is used for not only swipe access, but access to grades, disciplinary records, and library records, also including a picture ID on it makes it sensitive, indeed.
Factor 2: Who "owns" the library card?
Some schools, by policy, give out student identification cards, but use a school or district-wide policy to confirm that the card is simply "on loan" to the student (and must be returned at certain events, like suspension or expulsion). Other institutions issue a card, and it becomes the student's property; this means that the card is more under that student’s control.[5]
While there is no requirement to do one way over the other, the school and library should confirm the ownership of the card in a policy, as this can impact the decision to mark the card with picture ID, as well as who has control over the card in the future.
Factor 3: Why does the picture need to be on the library card?
Is the school so large that in order to ensure it provides library services to the right student, the card must have a photo ID? Is it a security measure, perhaps to deter theft (of library cards, and therefore collection assets)? Do students need to "swipe" into the library, with the library positioned to monitor that they are letting in a student who isn't supposed to be in class? Or is the library card doing double duty as the student's general student ID? Whatever the reason, it should be understood and clearly based in policy. And if the reason has to do more with security at that school than the operations of the library, it is better that the function be performed by the student ID, not the library card.[6]
Factor 4: Who will have the right or ability to view the library card?
If the library card is only required to be viewed by library staff, the inclusion of the photo is consistent with FERPA's and CPLR 4509's different but equally applicable privacy requirements. But if a security guard, teacher(s), bus driver, or others all have to see the library card for different reasons (this relates to question number 3), or could use the card to access the student's library records, that raises the possibility of concerns.
Factor 5: Is there a "stealth" reason for the use of the photo and name?
For some students, if they do not have documentation such as a birth certificate or social security card, a library card with a picture ID might be the most official "documentation" they have. If a library or school is intending that their cards perform this ancillary function, this should be done with the awareness that third parties relying on the identification function still need permission for the school or library to comment on the content of the card (for students under 18, this means a waiver by parents or guardians). However, that same student (or their parents/guardians) can choose to share their confidential education records or library records however they wish.
Okay, that's a lot of "factors," but what is the answer?
Having dragged you through all that, I will answer the member's very simple question: Is it legal to print student photos with their names on their school library cards for circulation use?
The answer is "Yes."
But! If the library card will be used for anything more than "circulation use" within the library, it is wise to assess precisely what the card will be used for, root that purpose in well-developed policy that considers the above factors, and evaluate if the picture—which in this case, will be a FERPA-protected education record[7]—is needed at all. The more the card is used for functions beyond the needs of the library, the more those functions should be achieved by a separate student ID, or in the alternative, schools should make sure that library information[8] is separate and isolated from other education records accessed by or listed on the card.
Thank you for an important question.
[1] It is important to note that a "public school library" is different than a public library, or an association library, or a college library.... but ALL are subject to CPLR 4509, the law making library records private. And while they are different, a public school library, like the college library, is subject to FERPA.
[2] I used to be such a stickler about not posting any pictures of my kids on FB. But the loving posts of other family members eventually wore me down. Sorry, kids, I really tried.
[3] Photos of students maintained by their institutions, like an ID photo, are confidential education records under FERPA. https://studentprivacy.ed.gov/faq/faqs-photos-and-videos-under-ferpa
[4] For instance, if the library card is also an all-purpose student ID that also functions as a key card or has lunch money on it, a policy should clearly separate those functions and there must be a clear protocol for voiding access when the card is reported lost.
[5] Just because the school owns the physical object doesn't mean they own the rights to the student's image.
[6] This is because, as written more thoroughly in Ask a Lawyer https://www.wnylrc.org/ask-the-lawyer/raqs/100, school library records are subject to both FERPA and 4509 rules of privacy. Combining education record with library records can make it difficult to tease out the different ways the materials may need to be handled.
[7] See footnote 3. Yes, this is a footnote to send you to a footnote.
[8] Either in hard copy, on the card, or via digital access.
Tags: CPLR 4509, FERPA, Library Card Policy, Library Cards, Privacy, School Libraries
I am wondering if sending unsealed overdue notices to students in their classrooms is a FERPA violation. The notices might appear face up on their desks or in their hands for other students to see. The prices of overdue materials are listed on our notices. Another issue - is calling a student's home and leaving a message stating that they have an overdue book and giving the price of the book a FERPA violation? Thank you.
What a difference a month makes. When this question came in, my kids were in school, my staff was at the office…and I am willing to bet at least one person in that group had an overdue library book.
Now, of course, we are all home trying to “flatten the curve” of a global pandemic. If we had overdue books before, they might be overdue for a bit longer.[1]
Despite a global shift in focus since this submission, it is still a good one, and the second question may be more urgent than ever.
The FERPA fundamentals impacting this question were addressed in an “Ask the Lawyer” last year: https://www.wnylrc.org/ask-the-lawyer/raqs/80.
With that as background,[2] here are my answers:
Is sending unsealed overdue notices to students in their classrooms a FERPA violation?
Unless there is a specific waiver or request for the information, unsealed notices distributed in classrooms risks both a FERPA violation, and a violation of CPLR 4509.
Sealing the notices so the contents can’t easily be seen by people who aren’t the students or their legal guardians is a good idea.
Is calling a student's home and leaving a message stating that they have an overdue book and giving the price of the book a FERPA violation?
Unless the student requests it, or a policy states that such a practice is for the proper operation of the library, a message reciting library records to a home phone answering machine risks a violation of CPLR 4509.[3] If the student is under 18, it is not a FERPA violation—so long as the home answering machine is that of the child’s legal guardians—but as reviewed here, FERPA is not the only privacy law a school library in New York must follow.
Lost in a sea of law and regulations? When considering the implications of FERPA and CPLR 4509 for a school library, seeking solutions that err on the side of privacy is always the safest course. While applying the letter of the law can be frustrating, a default prioritization of privacy will almost always carry the day.[4]
Thanks for a thoughtful question. At times of de-stabilization and change, focusing on the principles that guide us—like a commitment to providing access to information along with assured privacy—can bring calm.
[1] Many thanks to the Buffalo and Erie County Public Library for automatically renewing our books!
[2] Intricate, complex, and possibly unsatisfying background!
[3] I like this 2009 guidance from the New York Committee on Open Government on the nuances of CPLR 4509: https://docs.dos.ny.gov/coog/ftext/f17671.html
[4] If health and safety are in seeming conflict with privacy, that is a good time to do a quick check-in with a lawyer.
Tags: COVID-19, Emergency Response, FERPA, Privacy, Fees and Fines
My question is: do public libraries have any legal obligation to collect emergency contact information for children (age 17 and under) attending library programs without a parent or caregiver present/on the premises? Our library is located on the campus of a school district, and we have access to the school district's library automation system, in addition to our own, so we could easily and quickly locate contact information for the parents/caregivers of children who attend our programs in the event of a medical or other type of emergency situation. We already have an unattended minor policy as well. Our Library Board wants to make sure that we are in compliance with both Federal and New York State law on this issue. Thank you.
This question is rather like asking an astronautical engineer: When on a spacewalk, are there any safety procedures specifically related to securing my helmet as I exit the airlock?
Such a question could inspire an initial reaction like: Safety concerns? In SPACE??? Blazing comets,[1] the safety concerns start the moment you blast off!
But upon reflecting on the actual question, the calm, composed answer might be: “To ensure integrity of the pressure garment assembly, double-check the neck-dam’s connection to the helmet’s attaching ring.”[2]
Lawyers get this way addressing questions related to children and liability. Our first reaction is to think about everything that can go wrong. But then we calm down and focus on the specific issue at hand.
So, here is my calm, composed answer to the member’s very specific question:
There are two potential instances where a public library offering a program for unaccompanied minors might be obligated by law to collect emergency contact information.
FIRST INSTANCE
If the program the library is hosting is a camp required by law to have a “Safety Plan,” applicable regulations arguably require that the library gather the child’s emergency medical treatment and contact information.[3]
SECOND INSTANCE
If the library is paying a child performer as part of an event, the law requires that the library must collect the child performer’s parent/guardian information before the performance.[4]
Other than the above instances, while such a practice may be required by an insurance carrier,[5] a landlord, or event sponsor, there is no state law or regulation that makes collecting emergency contact information a specific requirement of a public library.
I do have two additional considerations, though.
FIRST CONSIDERATION
“Emergency contact” information provided by the parents/guardians, in a signed document drafted expressly for your library, is generally the best course of action when welcoming groups of unaccompanied minors for events not covered by your library’s usual policies.
I write this because Murphy’s Law (which is not on the bar exam, but remains a potent force in the world) will ensure the one time there is an incident at your youth program, the district’s automation system will be down.
Which brings us to the….
SECOND CONSIDERATION
Libraries and educational institutions sharing automation systems must make sure that such data exchange does not violate either FERPA (which bars educational institutions from sharing certain student information), or CPLR 4509 (which bars libraries from sharing user information).
Emergency contact information maintained by a school is potentially a FERPA-protected education record.[6] If FERPA-protected, it is illegal for any third party—such as a public library—to access it unless there is an agreement in place with certain required language AND the library’s use of the information is in the students’ “legitimate educational interests.” [7]
Of course, given the right circumstances, meeting these criteria is perfectly possible. In fact, such agreements can be a routine part of a school’s operations. But just like with a space helmet before leaving the airlock, its best to confirm that everything is in place before you take the next step.[8]
Thanks for a thought-provoking question.
[1] I imagine aeronautical engineers swear like the rest of us, but I like to image they sound like characters Golden Age comic books.
[2] Thanks, NASA.gov!
[3] I know this question isn’t really about camps, but libraries do host them. And since the NY State Health Department’s template for a licensed camp’s “Safety Plan” includes eliciting emergency contact/treatment info, I have to include this consideration. For a breakdown of what types of camps requires licenses, visit https://www.health.ny.gov/publications/3603/
[4] This is a requirement of Title 12 NYCRR § 186-4.4. Since the library would also need said child performer’s license to perform, this requirement would not likely be missed! I also appreciate that this example is on the far side of what this question is actually about.
[5] Call your carrier to check. They may even have preferred language for your library to use when crafting registration documents.
[6] The definition of “education records” under FERPA (and its many exceptions) is here: https://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=34:1.1.1.1.33#se34.1.99_13. Interestingly, a student’s name, phone number, and address—three critical components of an emergency contact form—are potentially not FERPA-protected “education records” as they may be considered “directory information” if specifically listed in a public notice from the school, as required by FERPA Section 99.37. FERPA violations can turn on these small details!
[7] What language is that? Under FERPA Section 99.31, an educational agency or institution may disclose such information to another party (like a library on its campus) if that party is: 1) performing a function for which the school would otherwise use employees; 2) the library directly controls the contractor’s use and maintenance of the records; and 3) the contractor is required to not further disclose the records. This formula can also be found in the link in footnote 4.
[8] Who says that simile can’t make a second appearance?!
Tags: FERPA, Policy, Privacy, CPLR 4509, Public Libraries
Is a parent or guardian allowed to access the titles of books that that their child(ren) have checked out from the school library?
Are school administrators allowed to access the titles of materials a student checked out?
Are school safety officers and Student Resource Officers (“SRO’s”) allowed to access the titles of materials a student checked out?
In the state of New York, library records linked to the names of users can only be disclosed:
1) upon request or consent of the user;
2) pursuant to subpoena or court order; or
3) where otherwise required by statute.
Therefore, the strong default answer to the member’s questions is “NO.”
This strong default position is based on New York Civil Procedure Rules (“CPLR”) 4509, which states:
Library records, which contain names or other personally identifying details regarding the users of public, free association, school, college and university libraries and library systems of this state, including but not limited to records related to the circulation of library materials, computer database searches, interlibrary loan transactions, reference queries, requests for photocopies of library materials, title reserve requests, or the use of audio-visual materials, films or records, shall be confidential and shall not be disclosed except that such records may be disclosed to the extent necessary for the proper operation of such library and shall be disclosed upon request or consent of the user or pursuant to subpoena, court order or where otherwise required by statute.
[emphasis added]
But when it comes to the records of minors at a school serving minors, after this omni-present strong default, there are some additional factors to consider.
FACTOR #1
Does the school condition library privileges on express parent/guardian access to library records?
Under CPLR 4509’s first prong (“consent of the user”), some libraries may condition library use by a minor on permission to share library records with parents/guardians.
This condition is not invisible or automatic; it would need to be in the cardholder agreement signed by the student, or in a written school policy passed by the school board. It must be clear, and in writing.
There is much vigorous debate about what level of parent/guardian access it is appropriate to condition library privileges on.[1] But since such conditioning is allowed by the law, setting the appropriate balance between privacy and access is the job of the library and its leadership.
The bottom line on this factor? If a school library has an express, written policy allowing it,[2] and if that policy also complies with the school’s obligation’s under FERPA (see below), a list of titles checked out may be disclosed to parents in conformity with CPLR 4509.
FACTOR #2
Does the school regard library records as “education records” under FERPA?
The member’s questions warrant three considerations vis-à-vis FERPA (“Family Education Rights Privacy Act”), a country-wide law which applies to any educational institution receiving federal aid.
First FERPA consideration: Are the school’s library records accessible as “education records” under FERPA?
Because it is famous for protecting privacy, people generally think of FERPA as a bar—not a means—to information. But FERPA expressly allows parents and guardians of students under 18 (unless the minors are attending a higher ed institution) to “inspect” “education records,” and, under the right circumstances, allows disclosure of education records to school administrators.
A list of titles borrowed from a library, if maintained in a way that meets FERPA’s definition of “education records” could be subject to such inspection and disclosure.
So let’s look at that definition:
[Information]
(1) Directly related to a student; and
(2) Maintained by an educational agency or institution or by a party acting for the agency or institution.[3]
That’s a broad definition! But several categories of information are exempted from it, including:
(i) records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are in the sole possession of the maker thereof and which are not accessible or revealed to any other person except a substitute;[4]
Under this exception, school library records, if kept in a certain way (with only the librarian, or “substitute,” having access to the records, and the information not linked to or accessible to others, including the student), are arguably exempt from FERPA.
What’s the take-away, here? It is possible—but not a uniform rule—that school library records are “education records” under FERPA. Determining if they are should be part of a school’s annual FERPA notice and policy work, and should be a consideration when a school library considers automation options.
Second FERPA Consideration: If a school determines their library records DO qualify as “education records,” does a school administrator, safety officer, or SRO[5] have a right to access them under FERPA?
Even if the library records at a specific school qualify as “education records,” when it comes to school administrators, there are only two instances where disclosure is allowed.
The first instance is created by FERPA regulation §99.3. It allows “… disclosure … to other school officials…[if the disclosure is in the student’s] legitimate educational interests.”
With regard to a request for a list of borrowed library books, this means there must be a direct, pedagogical reason to disclose that particular list to that particular administrator, safety officer, or (if their contract has the right provisions) external personnel. To determine if those individuals’ access is in the students “legitimate educational interests,” consideration of the unique circumstances is required, but it comes down to: how does this serve the student?
The second instance is created by FERPA regulation §99.36. This regulation allows an educational agency or institution to “disclose personally identifiable information from an education record to appropriate parties… in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.”
Under extraordinary circumstances, this exception could be cited to justify disclosure of education records to an administrator, safety officer or SRO addressing a concern about immediate health or safety.
But the circumstances warranting the disclosure would need to be—as I say—extraordinary. Congress and the U.S. Department of Education want this to be a very narrow exception tied to imminent threats:
The Department has consistently interpreted this provision narrowly by limiting its application to a specific situation that presents imminent danger to students or other members of the community, or that requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals. [6]
Such a “health/safety” analysis—especially if used to justify disclosure of library records—will be highly fact-specific. Whenever possible, it should be done in consultation with the school’s attorney, with careful consideration of the precise circumstances and any relevant policies (by the way, this is the kind of “now or never/critical” question school attorneys cancel meetings to research and answer promptly).
Third FERPA consideration: if a school determines their library records are “education records,” CPRL 4509 may still bar parent access under FERPA.
And finally, there is also a possibility that even if a school’s library records are “education records,” under FERPA, library records in New York schools are barred from being shared (without consent) with parents/guardians by CPLR 4509.
I base this on §99.4 of the FERPA regulations, which states:
An educational agency or institution shall give full rights under the Act to either parent, unless the agency or institution has been provided with evidence that there is a court order, State statute, or legally binding document relating to such matters as divorce, separation, or custody that specifically revokes these rights.[7]
In New York, we have just such a “State statute:” CPLR 4509. When it was adopted, its role was described as follows:
The New York State Legislature has a strong interest in protecting the right to read and think of the people of this State. The library, as the unique sanctuary of the widest possible spectrum of ideas, must protect the confidentiality of its records in order to insure its readers' right to read anything they wish, free from the fear that someone might see what they read and use this as a way to intimidate them. Records must be protected from the self-appointed guardians of public and private morality and from officials who might overreach their constitutional prerogatives. Without such protection, there would be a chilling effect on our library users as inquiring minds turn away from exploring varied avenues of thought because they fear the potentiality of others knowing their reading history.[8]
Those are some stirring words about privacy. They show what the Assembly’s intent was when CPLR 4509 was passed.
That said, this potential conflict between CPLR 4509 and FERPA has not been tested in a court of law.[9] This position is not something a school should adopt or rely on without consultation with their own attorney, as part of their annual FERPA notice and policy work.
But it is definitely something to consider.
Final FERPA Consideration: how to resolve a FERPA question when state and federal law conflict.
The good news in all this 4509/FERPA complexity is that FERPA itself anticipates this type of conflict and resulting concerns. FERPA Regulation §99.61 states:
If an educational agency or institution determines that it cannot comply with the Act or this part due to a conflict with State or local law, it shall notify the Office within 45 days, giving the text and citation of the conflicting law.
In other words, the U.S. Department of Education knows schools will be wrestling with these issues! A school that makes a good-faith determination of non-disclosure under FERPA (always with the advice of their attorney) can follow this policy for reporting a conflict. The USDOE will write you back, even if your concern is policy-driven or hypothetical.
Conclusion
Since school libraries—which are legally distinct from libraries at colleges and universities—are specifically named in CPLR 4509, there is no doubt that 4509’s strong bar on disclosure applies to schools where minors are in attendance, while the law is silent about access of guardians/parents to their children’s library records.
The best way for a school library and its leadership to handle these questions is in advance, by having a policy that respects student/family rights, and the operations of the library.
A good school library “Confidentiality of Library Records” policy will protect student privacy, educate students about their right to privacy, coordinate with the school’s position under FERPA, consider student and employee well-being, and position the library to operate properly.
Creating such a policy is an exercise in staff teamwork and aboard responsibility. Considering the complexity of the different factors at pay, I urge school librarians and their leaders to review these considerations with their own attorneys, and to work with their boards to adopt policies that reflect the legal position and the educational priorities of their institutions.
Thank you for these important questions.
[1] I am not going to provide a citation for this; the arguments are easy to find, and extensive. For the record, I’ll say: I am not a fan of any third-party access other than what is needed to ensure remuneration for lost items.
[2] Because school is a place where young people should be learning to value and protect their rights to privacy, I don’t suggest this lightly, but it is feasible.
[3] Authority: 20 U.S.C. 1232g(a)(4)
[4] 20 USCS § 1232g (a)(4)(2)(b) [NOTE: The cited law and its companion regulation vary; the regulation adds language that the records is a ‘personal memory aid.” But the law does not have this “personal memory aid” language, and laws trump regulations, so this interpretation is feasible.
[5] For those of you reading this who are not in primary or secondary education, in New York, an SRO’s are “commissioned law enforcement officers who are specially trained to work within the school community to help implement school safety initiatives as part of the school safety leadership team.” Source: New York State Education Department at http://www.p12.nysed.gov/sss/documents/FrameworkforSafeandSuccessfulSchoolEnvironments_FINAL.pdf
[7] If there is ever a case based on this line of argument, it may come down to a missing Oxford comma, since I imagine there would be a contention that the “state statute” also needs to related to “divorce, separation, or custody,” but given that there is no comma after “binding document,” that is not how it reads. Grammar, like privacy, is important.
[8] Mem. of Assemblyman Sanders, 1982 NY Legis Ann., at 25.
[9] But there is some commentary by the New York Committee on Open Government that supports this reading of the Regulation 99.4 (opinion FOIL AO 11872).
Tags: Privacy, FERPA, Academic Libraries, Policy
We received two grant applications for projects involving the digitization of high school student newspapers/magazines. The schools have given permission for these materials to be made available on a historic resource-focused, free database.
When our board was reviewing these grant applications, it was brought up that sharing student publications may not be possible under FERPA regulations. The board was concerned that these student publications might be considered educational records, which under FERPA would be subject to restricted access. If FERPA applies to these materials, they could not be uploaded and made accessible via an online database, and consequently would not be eligible for grant funding.
Does FERPA regulate student publications? Are there any other legal reasons student could not be made available freely in an online repository?
Thank you!
It took me 4 cups of coffee to figure out how to reply to this question! And it’s not because I didn’t know the answer.
FERPA is the “Family Rights Privacy Act.” It bars disclosure of students’ “education records.”
“Education records” (like grades, disciplinary reports, attendance) are defined by FERPA as records:
(1) Directly related to a student; and
(2) Maintained by an educational agency or institution or by a party acting for the agency or institution.
That is the entirety of the definition, from which many things—like names, team participation, dates of birth—are then excluded.[1]
The punishment for a FERPA violation is loss of ability to qualify for federal funds…a scary prospect for any school. A FERPA violation also comes with a heavy dose of self-correction and shame, as an institution must fix whatever caused the problem, and often, send out letters of correction/apology.
With ten years as an in-house attorney at a university under my belt (and thus, a ten years’ worth of “FERPA Fear” in my brain), the minute I read this submission, I thought: Pshaw, no student newspaper or magazine is an education record under FERPA! These grants are fine.
That was at cup #1. But as I started cup #2, I thought: But why are these grants fine? Why is no student newspaper or magazine an education record under FERPA? Technically, they could meet the definition.
And those cocky ten years in higher ed were giving me no reason for my answer.
For a lawyer, an answer without reasoning is no answer at all. So I kept sipping (and researching).
As I settled into cup #3, I reviewed some FERPA case law. But although this were fun to revisit, by the time I was brewing cup #4, I realized: This is not telling me why a student newspaper or magazine doesn’t meet the definition of “education record” under FERPA.
It was only when I re-read FERPA’s definition for “disclosure” that I could back up my instinctive answer with actual legal reasoning.
Remember, FERPA bars “disclosure” of student education records. As it says in 20 U.S.C. 1232g(b)(1) and (b)(2)):
"Disclosure" means to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record. [emphasis added]
As I sipped gratefully at cup #4, there was the answer: if any student newspaper or magazine has content in violation of FERPA, the violation happened the minute it rolled off the presses…not when the content was published to a larger audience.
It’s a bit metaphysical (or perhaps ontological) but bear with me: Re-publication in the way the member’s question describes—while arguably making an original violation bigger—cannot create a violation where there was none before. In other words, if FERPA-protected educational records were already “disclosed” via a student newspaper or magazine, allowing other people (students, parents, advertisers) unauthorized access to education records, there was already was a violation, back when the content was first published. And if protected records aren’t already disclosed, the re-publication won’t be a forbidden disclosure, now.
To illustrate this, here is a hypothetical. Let’s say that in 1991, the New Hartford High School newspaper (the Tattler!) printed all of my grades (without my permission). That would have been a FERPA violation, about which I could have complained to the U.S. Department of Education.
Fast-forward to 2019. Let’s say the Tattler ends up on New York Heritage, where everyone could then see that during the first Iraq war, I was a very strong scholar in English and History, but things were…a tad lacking in Math.
While that would be a continuation of the old FERPA violation, it would not be a new violation (even if I was just seeing it for the first time). And while I could still conceivably make a complaint to the USDOE, asking them to ask the school to work with New York Heritage to take it down, my options to do so would be limited, since there is no private cause of action or right to sue under FERPA.
So, while I cannot “clear” unseen content for FERPA violations (remember my Tattler scenario), I can say that a new FERPA violation will not be caused by posting already-published material on New York Heritage.
In that same spirit, I will now address the other question the member asks: Are there any other legal reasons student [publications] could not be made available freely in an online repository?
I wish I could just say “No,” and everyone could not worry about this at all. But we must never underestimate the creativity of lawyers and plaintiffs in finding new ways to threaten legal action! If the content of a particular student newspaper or magazine is scandalous or allegedly harmful enough, an attorney could try to frame a claim around some type of defamation or personal injury action. And of course, when publishing content, there is always a potential claim based on copyright or trademark….even if that claim turns out to be bogus.
But these cautionary words are based on highly speculative scenarios. There is no outright bar on sharing student publication content the way there is for disclosing grades, health information, and attendance-related records. And because the digitization of student publications creates a useful array of otherwise ephemeral material, and can be a valuable snapshot of a culture at a particular place in time, there are strong legal defenses for the digitization and publication of them by not-for-profit entities.[2]
To position a student publication digitization project to stand up to legal threats, a solid understanding and articulation of why the project has academic, social, and/or historic value, and a clear ability to show there is no “for-profit” motive, are fundamental. By thinking through a digitization project, establishing its social value, and documenting its adherence to professional and scholarly ethics, it is easier to defend making the material freely available—and searchable.
The good thing about grant funding is that the application and reporting process often builds these analyses right into the project.
Thanks for this stimulating question!
[1] The whole list of exclusions is in the regulations found here: https://www2.ed.gov/policy/gen/guid/fpco/pdf/ferparegs.pdf. It does not specifically exclude publications.
[2] I could write a book, or at least a very long, heavily footnoted legal brief on these defenses, but for purposes of this response, you can trust they are there.
Tags: Privacy, FERPA, Digitization and Copyright
We have a question that relates to the intersection of New York state level library privacy laws (https://www.nysenate.gov/legislation/laws/CVP/4509) and FERPA. Our campus has a newish system that is attempting to correlate student actions and activities with academic success and retention. As such, it could be helpful to include things like visits to the writing center, appointments with academic advisors, and also library activities, such as whether a class came in for a library information literacy session or whether a student made an appointment for a library one-on-one consultation. FERPA lets institutions share academically related information within certain bounds.
We are wondering what the privacy balance is here given that the information would stay in-institution, but not in-library. Here's what we are considering doing:
1) Noting in the system which classes had a library session(s). Within the system, that would identify individual students within those classes.
2) putting an opt-in statement on our one-on-one research appointment form and if the student consents, then providing to system the student name, appointment date/time, and course that the help was for (but not anything about the specific content of the appointment).
Have we crossed any lines here? Do we even need the opt-in statement? Is this something clear or fuzzy/grey? What should we be considering that we haven't thought of? Thanks.
Depression. Burn-out. Dissatisfaction. Lack of connection. Lack of money. Lack of parking.
These are just some of the reasons students give when they choose to leave—or are forced to leave—their college or university before graduating.
Many times, these reasons snuck up on them, although in hindsight, they could be seen: a pattern of missing classes, a downward trend in grades, maybe even dropping out of clubs and other campus activities. And almost always, after a student leaves (often in tears) faculty and staff, coaches and friends, are left wondering: could they have done more[1]?
No matter what events led up to it, for each such incident of student “attrition,” the stakes are high: student loans, a sense of failure, the end of a career dream, and perhaps even a medical condition that went untreated while the student struggled on their own.
But what if the clues could be seen earlier? What if the downward spiral could be stopped?
Fueled by increasing technological capabilities, many institutions of higher education are developing cross-campus, inter-sector systems to do just that: hoping to correlate the warning signs and fight student attrition through early intervention. Using a variety of commercially available and home-programmed tech, they are tracking everything from dining hall meals, to class attendance, to visits to the gym. These factors, as well as comments from concerned faculty or staff, are then routinely assessed and cross-checked for red flags.
Because libraries are increasingly hosting classes and providing adjunct space for group work, it makes sense that such a system would consider tracking library usage. After all, it can be a good sign that a student is just getting out of their dorm room!
But there is a tension within this well-meaning system. College is where young adults journey to find their independence and privacy; promoting this maturation is part of a college or university’s purpose. Further, a net of privacy laws constrains the easy sharing of certain types of information. But knowing the painful consequences of unchecked student struggles, many institutions work hard to find the right blend of metrics and policies to be able to intervene.
Part of this hard work is finding the right path through that net of privacy laws. As the member writes, the biggest privacy law of all, FERPA,[2] does allow such inter-departmental sharing,[3] and even parental notification about safety concerns, when the time is right. It does this through both application of the law, and “FERPA waivers.”
But in New York, FERPA is not the only privacy rule to apply[4] to these information-sharing systems. As the member states, New York’s Civil Practice Laws and Rules (the “CPLR”) §4509 (“4509”) also governs a student’s records—at least, their library records. And it sets the bar high.
4509 is a short law where every word matters, so it is worth quoting in full here:
Library records, which contain names or other personally identifying details regarding the users of public, free association, school, college and university libraries and library systems of this state, including but not limited to records related to the circulation of library materials, computer database searches, interlibrary loan transactions, reference queries, requests for photocopies of library materials, title reserve requests, or the use of audio-visual materials, films or records, shall be confidential and shall not be disclosed except that such records may be disclosed to the extent necessary for the proper operation of such library and shall be disclosed upon request or consent of the user or pursuant to subpoena, court order or where otherwise required by statute. [emphasis added]
As you can see, “college and university libraries,” even though they are part of larger institutions, are clearly covered by this law.
So how does 4509 impact the member’s question?
First, every library (academic or not) should have a clear sense of what it regards as “library records.” As can be seen in the statute, the term is not precisely defined (“including but not limited to” leaves a lot of room for argument!). Some of the obvious ones are listed in the law (circulation records, database searches, copy requests) but unnamed others could be just as vital to privacy (use of a 3-D printer, security footage covering the circulation desk, and in the member’s example, the use of research appointments). And still others activities that use the library may or may not apply (classes conducted in the library, but not part of library programming, are arguably excludable).
To protect the records as required by law, a library must know precisely what records it must protect. This is why, just like a public or association library, a college or university library should have a “Privacy of Library Records” policy clearly showing where it draws the line. Such a policy should also have a “subpoena response protocol,” so the library can train staff on how to receive internal and external third-party demands for information.
And in a perfect world, this college or university “Privacy of Library Records Policy” should be known and supported by the institutional officer who oversees the library (a Provost or Academic VP). This officer’s authority, from time to time, may be needed to ensure the policy is respected by campus safety officers, student disciplinary administration, and any other department that might want library records in service of another institutional purpose. Librarians should not hold the 4509 lines alone!
Now, back to the member’s scenario. Once a library knows precisely where it “draws the line” on library records, the member’s instinct is right: any access to information that falls within the institution’s definition of “library records” should be either denied, or allowed only as the law requires: via a signed consent from the user/student.
I know, just what every student wants—to fill out another form! But these 4509 consents, just like a “FERPA Waiver,” are not only mechanisms to ensure legal compliance, they are a chance to educate students about their right to privacy.
For instance, the consent form (I imagine it would be a digital click-through on a password-protected student account, but it could be a paper form) could say:
“The privacy of library records is protected by the law in New York State (CPLR 4509). Your enrollment in the [SYSTEM NAME] will ask the library to disclose certain library records that are protected by this law. As a library user at an library in New York, you have the right to keep your library records private. A list of what [LIBRARY NAME] considers to be library records is here [link to policy]. If you would like to consent to the [NAME OF LIBRARY] sharing your library records with only [SYSTEM], please check the below consent:
[ ] I am at least 18 years of age, and consent to the limited sharing of my library records for purposes of sharing the information with the [SCHOOL NAME] [SYSTEM]. This consent does not allow sharing my library records, even within the school, for any other purpose. No consent to share the records with external entities is give.
I understand I will need to renew this consent every fall semester, and that I may revoke this consent at any time.
Of course, there is no legal requirement for annual renewal, but it is worth considering. A year is a long time in the life of the typical undergraduate student, who may enter college with one set of civil rights values, and leave with another. With an annual renewal, the library not only complies with the law, but educates the student about their privacy rights on an annual basis.
So, to address the member’s final questions:
Have we crossed any lines here?
No. By thinking about this issue during the planning phase of the system, you are making sure the lines are bright and well-defined.
Do we even need the opt-in statement?
You could call it that, but I recommend calling it a “4509 Consent.” That would build awareness of this important law in our future leaders (and librarians). Of course, as a lawyer, I may be biased as to how important that is (but it’s really important!).
Is this something clear or fuzzy/grey?
Not so long as your library has a clear and routinely evaluated policy defining what it regards as “library records.” This can be tough at an integrated institution, where so much information technology crosses through different sectors. But it should be done.
What should we be considering that we haven't thought of?
I think you should consider buying yourself a nice cup of coffee or tea for doing your part to support a commitment to personal privacy in the United States of America and State of New York. Unlike in the European Union, our privacy currently risks death by a thousand cuts. Every bit of armor counts.
Thanks.
And thank you.
[1] I was a general counsel at a university for ten years…even as the in-house lawyer, I had a few of these moments.
[2] The “Family Education Rights Privacy Act,” a federal law often blamed for institutions not telling families about students’ struggles sooner.
[3] If this answer were to address those bases, it would be about ten pages longer, so we’ll just assume the system in this scenario complies with all the regulations and guidance listed here: https://studentprivacy.ed.gov/audience/school-officials-post-secondary.
[4] Neither is CPLR 4509. These systems have to navigate HIPAA, state health and mental health laws, and depending on what they do, even PCI and defamation/libel concerns.
Tags: , Policy, Privacy, FERPA, Academic Libraries
