91´«Ã½

Introduction

Libraries face a number of challenges in protecting the privacy of users, especially students in elementary, middle, and high schools. School libraries offer print, media, and online content to meet students’ educational and research needs as well as to nurture their intellectual curiosity and development. Students’ use of library resources is also incorporated into classroom activities, learning outcomes, and assessment. School libraries are typically integrated into their district's administrative and technology infrastructures. Depending on district administration and outside cooperative technology or vendor agreements, school libraries have greater or lesser degrees of autonomy. A lack of autonomy may make it difficult for librarians to implement policies and procedures to protect student privacy in regard to the use of library systems, applications, and collections. In addition, state and federal laws regarding library records, educational records (e.g., the - FERPA), and the online activities of minors (e.g., the - COPPA) have both positive and negative impacts on the privacy rights of students. For example, FERPA establishes explicit rights to privacy for students’ and minors’ educational records but at the same time grants school officials with “legitimate educational interest” and parents access to, and oversight over, student records that weakens these privacy rights. The 91´«Ã½ (91´«Ã½) issues these guidelines to provide school libraries with information about appropriate data management and security practices in respect to student use of library collections and resources in order to strengthen student privacy protections.

Why Privacy Is Important

Protecting user privacy and confidentiality has long been an integral part of the intellectual freedom mission of libraries. The right to free inquiry as assured by the First Amendment depends upon the ability to read and access information free from scrutiny by the government or other third parties. In their provision of services to library users, librarians have an ethical obligation, expressed in the , to preserve users' right to privacy. The also states that all users, regardless of age, “possess a right to privacy and confidentiality in their library use.” Librarians and libraries may also have a statutory or regulatory obligation to protect library users' personally identifiable information and data from unauthorized disclosure and use. Students' and minors' First Amendment rights to free inquiry and privacy must be balanced against both the educational needs of the school and the rights of the parents. As students and minors mature, it is increasingly important that they are provided with opportunities to exercise their curiosity and develop their intellect free from the chilling effects of surveillance by educators, peers, parents, or commercial interests. As students begin to participate more fully in the online world, they must develop an appreciation for their own privacy and a corresponding respect for the privacy of others.

Clear Privacy Policies

It is important for libraries to develop privacy policies for student use of library resources that are adopted by both the library and the school’s policy-making body. Students should be notified about library privacy policies when borrowing materials or accessing resources for the first time and as appropriate when there is a change in services, policies, or access. Library privacy policies should be made easily available and understandable to students in an age-appropriate manner. Safeguarding user privacy requires that staff keep all in-library use and reference questions confidential and assure that there is no monitoring by staff or peers of what students are reading, viewing, or researching while in the library. The same confidentiality should be extended when students are using eBooks and online subscription resources. Clear privacy policies should also be factored into vendor negotiations.

Audit

School librarians should conduct regular privacy audits to determine the current threats to student privacy and what protections are already in place. The audit should cover any areas that handles student data, such as the library management system, computer and network use in the library, eBooks and other online content, online software, apps, social media, and other technologies such as scanners/photocopiers and surveillance cameras. The results of the audit can be used to help create or revise privacy policies.

Collection and Retention of User Data

Libraries should limit the amount of personal information collected about students. Libraries should collect the minimum amount of personal information required to provide a service or meet a specific operational need. Libraries should not build services or resources using sensitive personally identifiable information that, if leaked or accessed by an unauthorized party, could prove detrimental to the user's privacy. Personally identifiable information should not be retained in perpetuity. The library should establish record retention policies specifying how long to retain different types of data and specifying methods for securely destroying data that is no longer needed. Retention policies should also cover archival copies and backups.

Encryption

The use of data encryption helps enhance privacy protection. All online transactions between client applications (staff desktop clients, web browsers, mobile apps, etc.) and server applications should be encrypted. Client applications that do not support encryption (such as staff desktop clients) should employ virtual private network (VPN) technologies. In addition, any personally identifiable information and student data housed by the library or school off-site (cloud-based storage, tape backups, etc.) should use encrypted storage.

Data Sharing

Library privacy policies should define the conditions under which school library records can be shared with parents or guardians, school staff and teachers, and third-parties, such as service providers. Federal laws such as FERPA and COPPA, as well as state laws concerning the confidentiality of library and student records, may impact if and how data is shared. Because of the broad leeway FERPA gives schools in using student data for internal educational purposes, librarians need to clearly distinguish among library records, educational records, and administrative records in order to provide explicit privacy rights in accordance with professional ethical obligations. Agreements between school libraries and online service providers should address appropriate restrictions on the use, aggregation, retention, and dissemination of students' personally identifiable information. Agreements between libraries and service providers should also specify that libraries retain ownership of all data and that the service providers agree to observe the library's privacy policies, data retention policy, and security policies. In the event of a data breach, the following people should be informed promptly: parents or guardians of minor children, users over the ages of 18, and any emancipated minors. Many service providers have signed the which indicates a commitment to work in an ongoing fashion to meet and exceed all federal requirements to protect student data. Librarians should make participation in the Student Privacy Pledge a criterion when making purchasing decisions. In addition, many states are passing legislation that restricts the collection and use of students' data by service providers (e.g. California’s – SOPIPA). Librarians should only contract with service providers that comply with applicable state laws.

Educational Technology Systems

Primary and secondary schools are adopting learning management systems and other technologies that enable educators to monitor student reading habits (e.g. Did the student access/read the assigned eBook or online text?). Librarians need to advocate for protecting student intellectual freedom and privacy in an age of ubiquitous data logging and surveillance technologies, including learning management systems.

Digital Literacy & Advocacy

School librarians have a responsibility to teach students about their privacy rights, practices they can use to protect themselves, ethical behavior online, and respect for the privacy of others. In addition to educating students, school librarians should become advocates for protecting student privacy and intellectual freedom in the larger school environment. Often school librarians are focused only on user privacy within the library to the detriment of broader privacy issues in their school and district context. Because of their professional training and ethical commitment, librarians are well-equipped to be privacy advocates outside of the school library.

The "" is intended to help library staff take practical steps to implement the principles that are laid out in this guideline. Additional resources can be found on the .

Approved April 2, 2016 by the Intellectual Freedom Committee of the 91´«Ã½; revised December 11, 2020.