For an Interlibrary Loan Electronic Transmission (whether printed out and included with the item(s) or sent via electronic means) in a K-12 setting, can a student's name (the one ultimately borrowing the item) be used in the "receipt" or notification slip? Should a student's School ID number be used? Can both be used at the same time? Is it taboo to have a student's name in ANY electronic transmission?
This question comes at us from a school district public library and supporting Board of Cooperative Educational Services ("BOCES").
One thing I knew very little[1] about when I started doing "Ask the Lawyer" was school district public library systems. These are systems coordinated through a regional BOCES, creating a network of library resources, governed by their own section of the New York Education Law (and regulations, and Regents rules).
Over the years, the existence and importance of school district public library systems has grown more and more obvious to me--to the point where now, if you are so unfortunate to be trapped in an elevator with me, I might tell you all about them from ground level to the 32nd floor.[2]
One thing I would mention, around floor 15 or so, is that school district public libraries (and systems) have to balance privacy and data security obligations from a wide array of different state and federal laws. I have written on this before (see "Ask the Lawyer #67, #80, and #143), and won't re-hash that here, except to say: everything in those past answers impacts this question.
With those prior columns as background, the answers to the member's three questions are:
For an Interlibrary Loan Electronic Transmission (whether printed out and included with the item(s) or sent via electronic means) in a K-12 setting, can a student's name (the one ultimately borrowing the item) be used in the "receipt" or notification slip?
Yes, if the library's policy requires it for the "proper operation" of the library (CPLR 4509), AND if the school can assure that only those who need to see it (for the benefit of the student) will see it (FERPA) or the student has signed a FERPA waiver, AND if all the required measures for data privacy are in place (ED2-d).
Should a student's School ID number be used? Can both be used at the same time?
Yes, if the library's policy requires it for the "proper operation" of the library (CPLR 4509), AND if the school can assure that only those who need to see it (for the benefit of the student) will see it (FERPA) or the student has signed a FERPA waiver, AND if all the required measures for data privacy are in place (ED2-d).
Is it taboo to have a student's name in ANY electronic transmission?
No, but school district and BOCES systems creating and transmitting such records should always be confident that the use of the student's name is in a document generated and transmitted per applicable policy.
This is tougher than it sounds, since schools now have so many electronic systems facilitating record-making and communication--a situation compounded by online learning during the pandemic. Further, the decision to use those systems might be driven by function and cost, with only secondary attention being paid to privacy, as addressed in "Ask the Lawyer" #67, #80, and #143.
Since this question is rooted in interlibrary loan, I'll end with an example.
Below is a partial screenshot from the demo screen of OPALS, a popular ILS used by school district libraries (and other types of libraries, too).
As you'll see, OPALS enables the "viewing of all the borrowers in an attending class...."
There is nothing inherently wrong with this type of grouping of borrowers, so long as the district has addressed the various privacy obligations, and made sure the functionality and use of the system (in this example, OPALS) align with the school's approach and policies on privacy.
In other words, nothing should be left to chance.
So, with that, my ultimate answer--to all three questions-- is: any time a public school student's name is listed on a library record that leaves the bounds of the library (the "real" or virtual bounds), every unique way that happens (injury report, student discipline, interlibrary loan) should be covered by policy.
Now, let's consider how this issue looks "on the ground." I poked around a bit, and while I found many interlibrary loan policies for school district library systems/BOCES in NY, I didn't find one that went so far into the weeds as setting terms for how/when to include borrower names on the routing slips (printed or electronic).
Chances are, that's usually more of a "standard operating procedure" thing, rather than something set by formal "policy."[3]
But with increasing interconnectivity between library other school systems, it might be worth formalizing in future interlibrary loan policies. For instance, one sentence: "When effecting interlibrary loan, cooperating libraries shall mutually adhere to the other libraries' and systems' policies regarding borrower privacy"[4] is a sample of how to add a quick reminder about this critical consideration.
Because as the member's questions indicate, we can never be too "in the weeds" on privacy.
Thank you for an important array of questions.
[1] Okay, actually, nothing.
[2] In this mythical trip up 32 floors, we are visiting Buffalo City Hall, which if you have never seen, is a must-visit location.
[3] New York is a big state! I have no doubt there is a policy that does address this. If your district has one, please send a link to info@losapllc.com and reference this RAQ.
[4] This is just sample language...no matter what you select, make sure your school district's attorney or BOCES system director reviews and approves any policy before it goes into effect!
Tags: CPLR 4509, Ed Law 2-d, FERPA, Loaning programs, Privacy, School Libraries
Recently a question has come up at our academic library concerning patron privacy and the notification to a patron (usually a student) concerning excessive downloading of content from databases in our collection. Our current practice has been to receive notification from the vendor about perceived illegal downloading. We then ask a member of our library IT team to investigate the situation, based on the information from the vendor. The contact information acquired by that IT staff member is then provided to the e-resource librarian. That librarian then contacts the individual via email, explaining the situation and indicating that such behavior must cease. Once that is done, the librarian notifies the vendor that the situation has been addressed, and there is no need to withhold access to the product from the campus. No personal identification of the user or student is provided to the vendor, nor distributed to anyone else. The question now: Is this process appropriate in resolving the misuse of a database, or does it violate the user’s/student’s privacy rights?
Questions that combine higher education, data access, and "terms of use" enforcement always give me a moment of sad reflection, as I remember Internet pioneer and activist Aaron Schwartz. It was an alleged overuse of an academic database at MIT in 2012 that lead up to his demise.[1]
While the circumstances in the Schwartz tragedy are different from the situation described here, both scenarios--and the care the member has taken in framing this question--illustrate the importance of considering what's at stake when an institution balances contract compliance, digital access, and privacy.
What's "at stake" here? The member's question combines concerns about:
Let's do a quick run-down of these critical areas:
In New York, the confidentiality of library services is protected by Civil Practice Law & Rules ("CPLR") section 4509, which states that library records indicative of the identity of a library user may only be accessed with that user's permission, or per a subpoena or court order. CPLR 4509 applies to private libraries within academic institutions as much as it does public libraries or those within school districts. It works hand-in-glove with the American Library Association's and New York Library Association's recitals of patron confidentiality in their Codes of Ethics.
In New York, the commitment of a higher education institution to academic freedom is reflected in various ways. An example is the American Association of University Professors' 1940 "Statement on the Principles of Academic Freedom"[2]: "Teachers are entitled to full freedom in research..."
In New York and throughout the nation, the commitment of libraries to collaborate with others to promote intellectual freedom and access to information is reflected the ALA Library Bill of Rights: "Libraries should cooperate with all persons and groups concerned with resisting abridgment of free expression and free access to ideas."
In New York and throughout the nation, certain academic and library actions that would otherwise violate copyright are excluded from liability for infringement. This exclusion is to ensure there is a clear and well-defined legal safety net for content accessed in furtherance of certain intellectual and academic freedoms.
And throughout the USA, the privacy of education records, including library records, is assured under the Family Education Rights Privacy Act" (FERPA).
Serving as a counterweight to all of these critical factors are an educational institution's obligations under federal law and regulation with regard to alleged copyright infringement, particularly the regulations found in 34 CFR §668. If I were to delve into that and describe all of those obligations here, this answer would be 50 times longer, but a good summary of what compliance in that regard looks like can be found in this sample policy from RIT: https://www.rit.edu/its/rit-response-copyright-infringement. In short: since 2008, federal law requires higher education institutions receiving federal financial aid and other federal benefits to be express enforcers and re-enforcers of copyright.[3]
Sitting astride of all of this is whatever notification commitments (and other responses) a college or university library agreed to when it signed the license agreement with the database provider (I have reviewed many of these types of license agreements, and almost all of them have some form of notification action requirement, which can range from a warning as described by the member, to ensuring the immediate cutoff of access by an offender). This means that in addition to the ethical, legal, and regulatory factors that have to be balanced in a question like this, we also have to consider obligations that are contractual.[4]
With all of these very important considerations now laid before us, let's review what the member is doing: 1) getting a notification of a possible terms violation from the provider, and then 2) using a firewalled[5] process to identify the user and alert them of the alleged violation, and then 3) assuring the vendor they have addressed the issue. As asked by the member: Is this process appropriate in resolving the misuse of a database, or does it violate the user’s/student’s privacy rights?
Here is my short answer: since the method of response described by the member shows there is a big firewall between the vendor and the institution (meaning: the outside party never learns the actual identity of the alleged violator), I believe so. BUT: the only real way to ensure privacy is protected as it should be is to confirm that the information flowing between the library and the IT Department never goes any further...within the institution.
What do I mean by that? The information should never go to campus safety or security. Unless it is per a very clearly articulated procedure developed for the operational needs of the library, it should never go to the office responsible for student discipline. And it should certainly never go to an employer on campus, a faculty member, or an advisor.[6]
This caution is warranted because, although a library within a higher educational institution is not a separate business entity the way a chartered public library is an entity separate from the town or city that sponsors it, for purposes of an academic library's adherence to privacy ethics and laws, it should be considered a stand-alone entity. Information can flow into it, but information should not flow out, even to other departments, unless the flow serves the operational needs of the library, and verifiably goes no further.
This 'one-way flow" for user-associated academic library records is an easy goal to articulate, but in practice, it can be very difficult to assure. As systems within large and small institutions get more integrated in the interests of security and economy, so too is it more difficult to separate one type of information from another. However, when it comes to privacy and library confidentiality, because of the high stakes involving intellectual freedom, academic freedom, and student privacy, extra care and attention is warranted.
The care of the member in submitting this question and describing the careful process they are using is emblematic of the type of care that should be used at all times when safeguarding user confidentiality and privacy at a higher education academic library.
Thank you very much to the member for submitting such a careful question.
RIP, Aaron Schwartz.
[1] I say "led up to" rather than "led to" because while many believe the latter, the facts of the case clearly establish the former.
[2] Found as of November 14, 2021, here: https://www.aaup.org/report/1940-statement-principles-academic-freedom-and-tenure.
[3] I won't mince my words about that requirement: I don't like it. But I am not a member of Congress.
[4] And voluntary. This is why it is very important to read database licenses and to PUSH BACK on clauses that require draconian responses to alleged violations.
[5] By "firewalled," I mean that the vendor never knows the name or other identifying information of the alleged violator.
[6] Unless the student has signed a waiver. Then it can go to whoever has permission.
Tags: Academic Libraries, CPLR 4509, Ethics, FERPA, Privacy, Security, Students, Surveillance, Databases
Is it legal to print student photos with their names on their school library cards for circulation use?
I didn't realize it in first grade, but a school library[1] is one of the first places a person experiences "the right to privacy" unmediated by a parent or guardian.
Think about it. You go to the library and get to pick out whatever you want. You check out books, and no one can tell you what to pick. And aside from the person checking you out, no one has to see your selection; your records are private.
In the present day, this means that kids whose faces might be all over Facebook[2], who are attending school via computer, and who "turn off their screen," when they don't want people peeking into their home life during remote learning, still have a right to confidentiality when it comes to the library in their school. And one of the biggest symbols of that student-library relationship is their library card.
So, with all that hanging in the balance, what are the legal considerations of putting student pictures on school library cards?
As often happens in the highly regulated worlds of education, privacy, and information, the answer is: "It depends."
In this case, the factors "it depends" on are numerous; rather than itemize them, I'll summarize them with a few pointed questions:
Factor 1: What else is "on" the library card?
Depending what other information is on the library card, combining a student’s picture with it could increase the likelihood of a violation of FERPA[3], Ed 2-d, or school policy.[4] For instance, if the card is used for not only swipe access, but access to grades, disciplinary records, and library records, also including a picture ID on it makes it sensitive, indeed.
Factor 2: Who "owns" the library card?
Some schools, by policy, give out student identification cards, but use a school or district-wide policy to confirm that the card is simply "on loan" to the student (and must be returned at certain events, like suspension or expulsion). Other institutions issue a card, and it becomes the student's property; this means that the card is more under that student’s control.[5]
While there is no requirement to do one way over the other, the school and library should confirm the ownership of the card in a policy, as this can impact the decision to mark the card with picture ID, as well as who has control over the card in the future.
Factor 3: Why does the picture need to be on the library card?
Is the school so large that in order to ensure it provides library services to the right student, the card must have a photo ID? Is it a security measure, perhaps to deter theft (of library cards, and therefore collection assets)? Do students need to "swipe" into the library, with the library positioned to monitor that they are letting in a student who isn't supposed to be in class? Or is the library card doing double duty as the student's general student ID? Whatever the reason, it should be understood and clearly based in policy. And if the reason has to do more with security at that school than the operations of the library, it is better that the function be performed by the student ID, not the library card.[6]
Factor 4: Who will have the right or ability to view the library card?
If the library card is only required to be viewed by library staff, the inclusion of the photo is consistent with FERPA's and CPLR 4509's different but equally applicable privacy requirements. But if a security guard, teacher(s), bus driver, or others all have to see the library card for different reasons (this relates to question number 3), or could use the card to access the student's library records, that raises the possibility of concerns.
Factor 5: Is there a "stealth" reason for the use of the photo and name?
For some students, if they do not have documentation such as a birth certificate or social security card, a library card with a picture ID might be the most official "documentation" they have. If a library or school is intending that their cards perform this ancillary function, this should be done with the awareness that third parties relying on the identification function still need permission for the school or library to comment on the content of the card (for students under 18, this means a waiver by parents or guardians). However, that same student (or their parents/guardians) can choose to share their confidential education records or library records however they wish.
Okay, that's a lot of "factors," but what is the answer?
Having dragged you through all that, I will answer the member's very simple question: Is it legal to print student photos with their names on their school library cards for circulation use?
The answer is "Yes."
But! If the library card will be used for anything more than "circulation use" within the library, it is wise to assess precisely what the card will be used for, root that purpose in well-developed policy that considers the above factors, and evaluate if the picture—which in this case, will be a FERPA-protected education record[7]—is needed at all. The more the card is used for functions beyond the needs of the library, the more those functions should be achieved by a separate student ID, or in the alternative, schools should make sure that library information[8] is separate and isolated from other education records accessed by or listed on the card.
Thank you for an important question.
[1] It is important to note that a "public school library" is different than a public library, or an association library, or a college library.... but ALL are subject to CPLR 4509, the law making library records private. And while they are different, a public school library, like the college library, is subject to FERPA.
[2] I used to be such a stickler about not posting any pictures of my kids on FB. But the loving posts of other family members eventually wore me down. Sorry, kids, I really tried.
[3] Photos of students maintained by their institutions, like an ID photo, are confidential education records under FERPA. https://studentprivacy.ed.gov/faq/faqs-photos-and-videos-under-ferpa
[4] For instance, if the library card is also an all-purpose student ID that also functions as a key card or has lunch money on it, a policy should clearly separate those functions and there must be a clear protocol for voiding access when the card is reported lost.
[5] Just because the school owns the physical object doesn't mean they own the rights to the student's image.
[6] This is because, as written more thoroughly in Ask a Lawyer https://www.wnylrc.org/ask-the-lawyer/raqs/100, school library records are subject to both FERPA and 4509 rules of privacy. Combining education record with library records can make it difficult to tease out the different ways the materials may need to be handled.
[7] See footnote 3. Yes, this is a footnote to send you to a footnote.
[8] Either in hard copy, on the card, or via digital access.
Tags: CPLR 4509, FERPA, Library Card Policy, Library Cards, Privacy, School Libraries
Given libraries are preparing plans to reopen, I am looking for a follow up to the 3/19/2020 question posted to Ask The Lawyer pertaining to being informed that an individual who has been confirmed to have COVID visited one of our libraries. (participated in a program).
With the new tracing protocols (COVID-19) required by Re-Open New York, what, if any, impact will there be on CPLR 4509? Will libraries be required to provide information and if so, to what extent? Currently we require a judicial subpoena in order to provide any information regarding a patron - including identifying if a patron has been in the library.
Your guidance is much appreciated.
The short answer
This answer is being written on May 28th, 2020.
At this time, in addition to Executive Order 202 issued on March 7, 2020 and declaring a state of emergency in New York through September 7th, 2020, there are 30 Executive Orders.
These Executive Orders create temporary modifications to a wide and ever-increasing array of state law and regulations. They have impacted elections, public health practices, landlord tenant relations, and countless operations of the New York State justice system.
However, as of this date, there has been no modification of section 4509 of the state Civil Procedure Law and Rules (“CPLR”), which, with only very limited exceptions, bars third-party access to a user’s library records.
Therefore, at this time, any library receiving a request from a third party for confidential library records, even if in relation to contract tracing efforts, should follow the same procedure they do for all other third-party requests: require a subpoena or judicial order.
The same answer, but with more information and analysis
I am grateful to the member for posing this question, because not only is it important to have clarity on this precise issue, it is important for information management professionals across the state of New York, including some of New York's most trusted information professionals — librarians — to be thinking about the impact and finer points of contact tracing.
So what is “contact tracing”?
The Centers for Disease Control describes contract tracing this way on their current COVID-19 response page[1]:
“In contact tracing, public health staff work with a patient to help them recall everyone with whom they have had close contact during the timeframe while they may have been infectious. Public health staff then warn these exposed individuals (contacts) of their potential exposure as rapidly and sensitively as possible.”
After declaring COVID-19 a “communicable disease” as defined by the state’s Public Health Law, New York began using contact tracing to combat COVID-19.[2] Local health departments led the way, organizing information and coordinating warnings within their jurisdiction, an initiative that inspired the previous question referenced by the member.
With the adoption of “New York Forward,” 30 contact tracers for every 100,000 residents is one of the express metrics[3] being used to establish when one of the state’s ten regions is ready to begin a phased reopening. So, every region will be recruiting and deploying “tracers” to gather information and issue warnings to individuals who testing has confirmed have been exposed to COVID-19.
While emphasizing that such warnings must be issued “rapidly,” the CDC’s guidelines for contact tracing also emphasize privacy:
“To protect patient privacy, contacts are only informed that they may have been exposed to a patient with the infection. They are not told the identity of the patient who may have exposed them.”
The State of New York, however, does not require this level of confidentiality in its laws regarding quarantine, notification of infection, and contact tracing related to most communicable diseases. While the precise regulations governing the use of contact tracing to fight the spread of HIV require the consent of the patient, the regulations applying to COVID-19 do not have similar requirements.[4] Nor is such information regarded as protected health information (“PHI”) under HIPAA.
I am highlighting these considerations not to denigrate contact tracing, which has been documented as effective in combating pandemics. However, as of this writing, as reported by The New York Times, many in authority, or with credibility in the arenas of privacy and data security, have expressed serious concerns regarding the procurement and arrangement of the software and personnel that will be used in this massive public health initiative.
Caution about privacy, even during times of emergency, is a good thing.
With all that, the collaborative, community health-focused approach I outlined on March 19, 2020, in https://www.wnylrc.org/ask-the-lawyer/raqs/122 is one I continue to endorse.
In addition to that approach, here is a suggested reply in the event your library is contacted by a state-employed contact tracer, designed to work with your standard protocol for complying with 4509:
[After verifying credentials]
We know your work is critical to public health. Please send us a written list of what you need, and we will work to obtain consent from our users, as required by CPLR 4509. In the alternative, please ensure what you need is very thoroughly set forth in a duly issued subpoena or judicial order. Our library will work to expedite your request as soon as we know we are authorized to do so.
One final point
After conducting the research set forth in this answer, it is my opinion that CPLR 4509’s assurance of the confidentiality of library records is not at odds with the current emergency measures our state is taking to protect lives and get our world back on track.
First, it is critical to remember that under 4509, a person may give their written consent to disclosure. Many people, upon learning they might pose a danger, will give their express and voluntary consent, if they have the capacity at the time. That is their right, and there is no concern with your library contacting them to ask the question.
Second, if the need for confidential library records is truly critical, local board of health officials—and the tracers who will be helping their localities—can invoke the authority created by the public health law[5] to obtain duly authorized subpoenas.
Unlike many other laws and regulations, CPLR 4509 can remain as written, while New York undertakes an unprecedented, massive effort to conduct contact tracing, and protect public health.
Thank you for an important question.
[1] Found on May 28, 2020 at https://www.cdc.gov/coronavirus/2019-ncov/php/principles-contact-tracing.html.
[2] Since reporting new or unusual communicable diseases is also required, cases were probably also reported before March 7.
[3] These metrics are laid out in a graph found at https://www.governor.ny.gov/programs/new-york-forward.
[4] That section is 10 NYCRR 2.10, which states: “It shall be the duty of every physician to report to the city, county or district health officer, within whose jurisdiction such patient resides, the full name, age and address of every person with a suspected or confirmed case of a communicable disease, any outbreak of communicable disease, any unusual disease or unusual disease outbreak and as otherwise authorized in section 2.1 of this Part, together with the name of the disease if known, and any additional information requested by the health officer in the course of an investigation pursuant to this Part, within 24 hours from the time the case is first seen by him, and such report shall be by telephone, facsimile transmission or other electronic communication if indicated, and shall also be made in writing, except that the written notice may be omitted with the approval of the State Commissioner of Health.”
[5] New York Public Health Law, Section 309.
Tags: COVID-19, CPLR 4509, Emergency Response, Privacy, Contact tracing
We are seeking guidance as a result of the following:
We have been informed (by the Health Department and via news media) an individual who now has been confirmed to have COVID-19 attended a program at one of our libraries. I have been asked the following questions:
1. To what extent is it the responsibility of the library to notify participants who attended the library program the person now diagnosed with COVID-19 attended?
If the library bears no responsibility, would you recommend the library, as a courtesy, notify attendees? What of others who may have been in the library at the time of the program - in many cases, the names of these individuals are not known...are we placing the library in a liability situation if we notify some, but not others? If you suggest a courtesy call, can you please provide suggested language?
2. CPLR 4509 speaks to the confidentiality of library records. We have always employed that this further applies to the identification of anyone using the library, those participating in programs, etc. -- meaning that NO information can be provided to anyone without a proper subpoena. Given that this is a situation related to the health and well-being of our community should (they have not, but this is a question that has been asked) the Health Department request the names of program participants does CPLR apply? If so, can you recommend a response to such a question.
Thank you for your assistance.
To address this very serious array of questions, we’ll take them one at a time.
To what extent is it the responsibility of the library to notify participants who attended the library program the person now diagnosed with COVID-19 attended?
The library is not obligated to notify individual members of the public regarding possible exposure; the county health department is obligated to notify the New York State Department of Health, and will coordinate the necessary level of response.[1]
If the library bears no responsibility, would you recommend the library, as a courtesy, notify attendees?
In a time of pandemic, information is power. If the library has the capacity to notify attendees in a way that connects them to meaningful next steps, AND the County Health Department agrees that such notification will be helpful, then: yes, that would be a good thing to do.
However, because the slightest bit of mis-information in this step could potentially cause harm, such a courtesy should only be done in collaboration with the County Health Department.
What of others who may have been in the library at the time of the program - in many cases, the names of these individuals are not known...are we placing the library in a liability situation if we notify some, but not others?
An effort to empower people, through information, to take care of themselves and minimize the spread of disease will not expose the library to liability in the event only known attendees can be alerted. As stressed above, the greater risk would be mis-informing the public, which is why coordination with the county health department is key.
If you suggest a courtesy call, can you please provide suggested language?
For reasons of confidentiality and accessibility, the notice should not be a verbal phone call, but rather (and only if confirmed as helpful by the County Health Department), a written notice sent to the library’s user’s email address.
Suggested text for your library to review with the health department is:
Dear Library Member:
As you know, the [INSERT] [County Department of Health] is monitoring the development of COVID-19 in our county.
As you can see at the listing [here], the Department has determined that on DATE, a person with COVID-19 attended the [INSERT PROGRAM NAME] program at our library, which ran from TIME to TIME on DATE.
Because the [NAME] Library values every member, and because we believe knowledge is power, we are working with the county to notify individuals who we know were present at the event. As advised by the County’s guidance [here], encourage you to monitor yourself daily for symptoms of COVID-19.
Further information on what to do in the event of a health concern is on the Health Department’s website at [link].
Your library information is confidential and your participation in the [NAME] event will not be released unless upon your request.
Given that this is a situation related to the health and well-being of our community…[if] the Health Department request the names of program participants does CPLR [4509] apply? If so, can you recommend a response to such a question.
Yes, the confidentiality requirement of CPLR 4509 absolutely still applies. Here is the language of that law:
Library records, which contain names or other personally identifying details regarding the users of public, free association, school, college and university libraries and library systems of this state, including but not limited to records related to the circulation of library materials, computer database searches, interlibrary loan transactions, reference queries, requests for photocopies of library materials, title reserve requests, or the use of audio-visual materials, films or records, shall be confidential and shall not be disclosed except that such records may be disclosed to the extent necessary for the proper operation of such library and shall be disclosed upon request or consent of the user or pursuant to subpoena, court order or where otherwise required by statute.
Because CPLR 4509 is so clear in its protection of patron information, I am not comfortable concluding that disclosure to a County Health Department is allowed for the “proper operation” of the library, or even in the case of a declared emergency. Even during times of trouble, we need to follow the law.
However, if the library has the capacity to do so, upon request of the Health Department, the library can write to the impacted patron, and see if the patron will request the disclosure.
Sample outreach to see if the patron wants their information released is:
As a result of a person who visited the [NAME] library testing positive for COVID-19, the county health department has the name and contact information of other patrons who visited during the [EVENT].
By law, your library information is confidential. Therefore, the [NAME] Library will only disclose your information if you request that we do so.
Please let us know if you would like us to release your name, address, and phone number on file with the library to the [COUNTY] County Health Department.
You may also directly call the County Health Department about this at [NUMBER]; if you do, tell this it is regarding the COVID-19 case as the [NAME] Library.
In the alternative, the County Health Department may obtain the information via a subpoena or court order.
Those are my answers to the member’s questions. Here are some additional thoughts:
Legal compliance and ethics are strong supports during tough times. Thank you to the member for thinking this situation through so thoroughly.
Tags: COVID-19, CPLR 4509, Emergency Response, Library Programming and Events, Templates
My question is: do public libraries have any legal obligation to collect emergency contact information for children (age 17 and under) attending library programs without a parent or caregiver present/on the premises? Our library is located on the campus of a school district, and we have access to the school district's library automation system, in addition to our own, so we could easily and quickly locate contact information for the parents/caregivers of children who attend our programs in the event of a medical or other type of emergency situation. We already have an unattended minor policy as well. Our Library Board wants to make sure that we are in compliance with both Federal and New York State law on this issue. Thank you.
This question is rather like asking an astronautical engineer: When on a spacewalk, are there any safety procedures specifically related to securing my helmet as I exit the airlock?
Such a question could inspire an initial reaction like: Safety concerns? In SPACE??? Blazing comets,[1] the safety concerns start the moment you blast off!
But upon reflecting on the actual question, the calm, composed answer might be: “To ensure integrity of the pressure garment assembly, double-check the neck-dam’s connection to the helmet’s attaching ring.”[2]
Lawyers get this way addressing questions related to children and liability. Our first reaction is to think about everything that can go wrong. But then we calm down and focus on the specific issue at hand.
So, here is my calm, composed answer to the member’s very specific question:
There are two potential instances where a public library offering a program for unaccompanied minors might be obligated by law to collect emergency contact information.
FIRST INSTANCE
If the program the library is hosting is a camp required by law to have a “Safety Plan,” applicable regulations arguably require that the library gather the child’s emergency medical treatment and contact information.[3]
SECOND INSTANCE
If the library is paying a child performer as part of an event, the law requires that the library must collect the child performer’s parent/guardian information before the performance.[4]
Other than the above instances, while such a practice may be required by an insurance carrier,[5] a landlord, or event sponsor, there is no state law or regulation that makes collecting emergency contact information a specific requirement of a public library.
I do have two additional considerations, though.
FIRST CONSIDERATION
“Emergency contact” information provided by the parents/guardians, in a signed document drafted expressly for your library, is generally the best course of action when welcoming groups of unaccompanied minors for events not covered by your library’s usual policies.
I write this because Murphy’s Law (which is not on the bar exam, but remains a potent force in the world) will ensure the one time there is an incident at your youth program, the district’s automation system will be down.
Which brings us to the….
SECOND CONSIDERATION
Libraries and educational institutions sharing automation systems must make sure that such data exchange does not violate either FERPA (which bars educational institutions from sharing certain student information), or CPLR 4509 (which bars libraries from sharing user information).
Emergency contact information maintained by a school is potentially a FERPA-protected education record.[6] If FERPA-protected, it is illegal for any third party—such as a public library—to access it unless there is an agreement in place with certain required language AND the library’s use of the information is in the students’ “legitimate educational interests.” [7]
Of course, given the right circumstances, meeting these criteria is perfectly possible. In fact, such agreements can be a routine part of a school’s operations. But just like with a space helmet before leaving the airlock, its best to confirm that everything is in place before you take the next step.[8]
Thanks for a thought-provoking question.
[1] I imagine aeronautical engineers swear like the rest of us, but I like to image they sound like characters Golden Age comic books.
[2] Thanks, NASA.gov!
[3] I know this question isn’t really about camps, but libraries do host them. And since the NY State Health Department’s template for a licensed camp’s “Safety Plan” includes eliciting emergency contact/treatment info, I have to include this consideration. For a breakdown of what types of camps requires licenses, visit https://www.health.ny.gov/publications/3603/
[4] This is a requirement of Title 12 NYCRR § 186-4.4. Since the library would also need said child performer’s license to perform, this requirement would not likely be missed! I also appreciate that this example is on the far side of what this question is actually about.
[5] Call your carrier to check. They may even have preferred language for your library to use when crafting registration documents.
[6] The definition of “education records” under FERPA (and its many exceptions) is here: https://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=34:1.1.1.1.33#se34.1.99_13. Interestingly, a student’s name, phone number, and address—three critical components of an emergency contact form—are potentially not FERPA-protected “education records” as they may be considered “directory information” if specifically listed in a public notice from the school, as required by FERPA Section 99.37. FERPA violations can turn on these small details!
[7] What language is that? Under FERPA Section 99.31, an educational agency or institution may disclose such information to another party (like a library on its campus) if that party is: 1) performing a function for which the school would otherwise use employees; 2) the library directly controls the contractor’s use and maintenance of the records; and 3) the contractor is required to not further disclose the records. This formula can also be found in the link in footnote 4.
[8] Who says that simile can’t make a second appearance?!
Tags: FERPA, Policy, Privacy, CPLR 4509, Public Libraries
Can a library report a crime based on use of library resources while honoring CPLR 4509 (assuring the confidentiality of circulation records)?
CPLR 4509[1] is a critical caisson in a library’s foundation, protecting users from those who would draw negative inferences based on access to the library. The law sets out, in bold, simple language, that librarians shall not disclose such records to law enforcement (or others), unless there is an appropriate subpoena, court order, or disclosure is required by law.
That said, there will be instances when serious patron misconduct might require a report to law enforcement—but the mere act of reporting it will disclose a circulation record (for instance, a patron signing onto a library computer that is then used for a crime). How does a library report the criminal behavior, while honoring the letter and spirit of 4509?
The American Library Association has compiled a great array of information on balancing these priorities, and it is clear that the answer lies in the library’s policies. I will not re-create this excellent list of considerations here, but when it comes to this particular question, it is clear every library should have:
The New York Library Trustees Association has a thorough database of policies addressing, from a variety of libraries, addressing these topics. But just use these for inspiration, since policies must be crafted, evaluated, and periodically revised to serve the mission, legal requirements, and operational needs of your particular library. Ideally, your lawyer should not only review the final product, but be ready to assist with any law enforcement request, is a good idea.
A library that makes sure it has addressed the points in the above bullets, and has trained their staff on these priorities, is ready to protect circulation records, while safeguarding the “proper operation of the library!”
[1] Library records, which contain names or other personally identifying details regarding the users of public, free association, school, college and university libraries and library systems of this state, including but not limited to records related to the circulation of library materials, computer database searches, interlibrary loan transactions, reference queries, requests for photocopies of library materials, title reserve requests, or the use of audio-visual materials, films or records, shall be confidential and shall not be disclosed except that such records may be disclosed to the extent necessary for the proper operation of such library and shall be disclosed upon request or consent of the user or pursuant to subpoena, court order or where otherwise required by statute.
[2] Note the ALA guidance on steps to minimize creating/retaining circulation records.
Tags: Policy, Criminal Activity, , CPLR 4509
