FERPA

First things first: whether a school board trustee, superintendent, principal, teacher, substitute, or volunteer, everyone must abide by the requirements of FERPA, Education Law Section 2-D, and CPLR 4509, each of which restrict access to library user records.

FERPA restricts access to education records on a “need to know” basis, even for employees.

Education Law Section 2-D restricts access to confidential student information.

CPLR 4509 restricts access to library user records, including those of minors.

Of course, knowing the law is different than following it. Plus, the scenario presented requires consideration of an additional factor: the substitute is a parent who’s looking at their child’s information.

Under the Education Law and FERPA, a parent has a right to inspect their child’s education record, and that is often interpreted to include their school library records.[1]

But! The right to inspect a record is not the same as using employee access to view a record for personal reasons. Unless district policy says otherwise,[2] a school employee taking advantage of their employee privileges to specifically access their child’s records is inappropriate.

Most people—including many teachers—are unaware of the additional layers of protection for library user records in New York State. Substitute teachers assigned to a school library might be given minimal information, and if the library is using volunteers, there may be even more reason to be cautious.[3] For this reason, a posted sign at the staff computer(s) could help emphasize the law and your library’s policy.

Here is sample language:

Use of this computer is limited to checking out and returning students’ selections and answering student questions. Accessing student library records for personal reasons is prohibited by privacy laws and district policy. Confidentiality of library services is an important part of library ethics and our school library system’s policies. If you have questions about this policy, please see [Media Specialist].

Or, if you want to have a more light-hearted approach:

Thank you for helping out today!

Just a few things we have to say:

Library user privacy

Means there are things you cannot see.

We only use the computer system

To check out items and return them.

If a student makes an inquiry

We handle it confidentially.

Borrowing records, what’s checked out

Can’t be casually talked about.

If you have a question about this list

Please ask the Media Specialist.

So welcome to our library crew!

Service with ethics is what we do.

Whenever possible, discussing policy guidance and signage like this with a supervisor and/or building principal, so they can back you up in the moment, is a wise idea.

In 2026, standing up for privacy and respect for laws governing electronic access to data grows more critical every day. Care on this topic is a sign of professionalism.[4]

Many thanks to the member for a thoughtful and important question.

[1]^ For more information, see Patron Confidentiality in School Libraries.

[2]^ I can’t imagine a district policy allowing this, but I have learned to never say never.

[3]^ For more, see Adult and Student Volunteers in School Libraries.

[4]^ Is standing up for privacy with doggerel poetry a sign of professionalism? I’ll leave that up to you.

It is hard to be a union rep. Teachers and other educators have a wide variety of regulations they must abide by. What is important to remember is that within those parameters, school libraries have even more requirements and limits.

Here are the important things for an attorney or union rep negotiating or advocating for a school librarian to know:

Public school libraries are required by law.[1]

Public school librarians (or “media specialists”) are required by law.[2]

Public school librarians must meet specific regulatory criteria.[3]

Public school library materials are NOT curricular materials.[4]

Librarianship is constantly evolving! School librarians should be provided with adequate annual professional development training.

Public school librarians have an obligation to uphold the values in the New York State Education Department “School Library Program Rubric” below.

"Intellectual freedom” includes the right of students to have access to school library materials and services.

A student’s library records are confidential under FERPA as well as under state law.[5]

If a district uses student device-monitoring software, the software must be able to omit consideration of library materials from its monitoring.

A librarian is ethically obligated to maintain the confidentiality of a student’s library records.

Every school district should have a robust and well-thought-out “school library materials policy” governing selection, procurement, cataloging, lending, concerns, re-evaluation, and removal of library materials.[6] 

A district’s policies and procedures should honor the legal obligations, professionalism, and qualifications of your school librarians and media specialists. 

A school librarian with ethical and legal compliance concerns should have, if at all possible, access to their school district’s lawyer, so they can confidentially share those concerns and work to resolve them.

Ad hoc decisions about curricular and library materials imposed without consulting policy can lead to legal claims, creating unnecessary media attention, community tension, and expense for school districts. For a good primer on this, review the NYSED Commissioner Decision 18,402.[7]

School librarians must not be required to work under these conditions:

• Library staff are directed to keep “controversial” books in the collection but move them off the shelves and into a storeroom;
• Books in the collection are stigmatized by making them available “by request only;”
• Parents and guardians with concerns are told that library material will be removed and are not referred to the relevant policy for lodging a complaint or requesting that material be re-evaluated;
• Staff are instructed that certain books may only be checked out after obtaining parent/guardian consent;
• Lists of books checked out by students are shared in excess of what professional ethics, FERPA and CPLR 4509 (regarding privacy) allow;
• Staff are directed to avoid selecting a certain “type” of material, even if that material is otherwise appropriate per the district's materials policy; or
• Library collection content is prohibited based on political or identity-based factors.

It is good for the district, its employees, and their union to build an administrative and educational team that is READY to respond to concerns about library materials.

Librarians should be assured of protection from retaliation for performing their jobs as required by law and policy and should be supported by their union through any grievance or disciplinary proceeding based on same.

Just a short list!

This is a very serious concern.

Use of such monitoring software (such as GoGuardian’s Beacon, Google’s Gaggle, and others) is growing rapidly.[1]

Each technology works differently, but the common function is constant monitoring of searches and content on student devices, to be alert for signs of potential danger.  When such potential signs are detected, both AI and real people are used to provide further assessment and intervention.

Deployed properly,[2] such software has been shown to be somewhat effective.[3]  But in New York State, as of January 22, 2025, it seems to have been deployed without much overt consideration[4] of a student’s right to confidentially use the school library.

A student’s right to privacy when using a school library is built into governing ethics, educational standards, law, and regulations.[5] It is often also assured by the policies of a particular school district.[6]

As is often the case with rapidly developing technology, it looks like the adoption of the tech may be outpacing the consideration of all relevant legal factors, including how such software will be programmed to not violate the private use of the school library for research and information access.

In the K-12 environment, this is a delicate balance.  While schools are allowed to access student education records[7] and library records[8] under particular circumstances, the wholesale monitoring of such records is a violation of the law and the ethics of library privacy. In addition, it is quite possible that students will research or access school library e-content that may “trip” the search terms, and, without a careful effort to exclude library searches and content, the software could yield a false positive… along with a privacy violation.

Where does this leave school librarians?

Since the way this plays out may change from software to software and from district to district, and different districts are in different phases of considering or using such software, it is hard to say. Below is an array of possible actions a school librarian can take to raise a concern:

This is an important—even vital—topic. While the goal of student device-monitoring software is laudable, improper deployment of such technology can be a disaster. Proper deployment should consider all privacy obligations owed to the students being monitored. While there is not one solution to such a consideration (because the technology will vary from product to product), such assurance is also vital.

Thank you for an important question. “Ask the Lawyer” will be alert for further developments on this emerging topic.

School libraries operate as part of a public school.[1] In New York’s public schools, volunteers who will work in curricular operations (classes, library, gym, etc.) need to be vetted per school district policy. These days that usually involves a background check, but it will vary from district to district.[2]

The privacy of a student’s school library records (borrowing records, library computer searches) are confidential under several laws:

• The Family Educational Rights and Privacy Act (FERPA)
• New York State’s Civil Practice Law & Rules (CPLR) Section 4509
• New York State Education Law Section 2-d

The issue has also recently become more complicated as students use school-provided technology which is not configured to abide by the confidentiality of library records.[3]

When volunteering at a school library, a parent volunteer ideally will not have access to students’ library records (just like they shouldn’t have access to grades). Instead, they should help re-shelve books, read aloud, or help minimize chaos when there is a large group in the library.

If the parent volunteer needs to help with check-outs, a statement like the one the member suggests is fine. To make things even more direct (but also upbeat), another version could be:

Thank you for volunteering at our library! As a reminder:

• Student media selections are confidential by law;
• Past borrowing is confidential by law;
• Student questions when using the library are confidential;
• If you suspect a safety risk, immediately alert the librarian or another school employee.

We appreciate your service and your respect for our students’ privacy rights!

For student volunteers, the same guidance applies; students should primarily assist with re-shelving, cleaning, and other tasks that don’t expose them to private information.

However, for students who are believed to be trustworthy, here is a notice:

Thank you for volunteering at our library!

As a student volunteer, it is important for you to know that the materials you and your classmates borrow are confidential. Please do not reveal what has been borrowed by other students; that would be against the law and against school rules, and it could require us to take disciplinary action. If you want to learn more about the privacy of student library records, please ask.

We appreciate your help in the library!

I do have to say, this overall issue throws my lawyer brain for a loop. School library records are actually confidential under more laws than other academic records, and I think it would be odd to have a student inputting grades—or helping other students see a teacher’s gradebook—on a volunteer basis.[4]

So, to make frequent use of either parent or student volunteers to check out books, a school library should also have a relevant policy, such as:

School Library Volunteer Policy

Adult Volunteers

To involve parents and community members in the operations of the school library, the library makes use of adult volunteers.

Adult volunteers are evaluated and confirmed as follows [insert school policy on volunteers].

Adult library volunteers must demonstrate the ability to understand that school library records are confidential and must be trained in the law and ethics that require confidentiality of school library records.

Adult library volunteers are distinguished by a badge worn during their service.

Student Volunteers

To familiarize students with the ethics, laws, and policies governing school library services, and to involve students in the operations of the library, the school library makes use of student library volunteers.

Student library volunteers must demonstrate the ability to understand that school library records are confidential and must be trained in the law and ethics that require confidentiality of school library records.

Student library volunteers are designated by a badge worn during their service.

Whenever possible, such a policy should be reviewed by a school district’s lawyer.[5]

Thank you for an important question!

This is a timely and important question.

Regarding the ability of law enforcement (including ICE, FBI, ATF, etc.) to enter a college or university campus: the administration will make that determination, and it will be based on many factors.

That said, by both state and federal law (Education Law 6434, and the Clery Act [20 U.S.C. 1092]), college and university campuses are supposed to have a relationship with local law enforcement, so some degree of cooperation with local police, a county sheriff, and the state troopers should already be in place. Many institutions, especially those close to borders or with particular security priorities, have established working relationships with the FBI.

Against that variable background, what happens within an academic library on campus (and in virtual spaces) is subject to further control.

To describe that and provide guidance, I have developed the below “GUIDE” that can be posted in academic libraries in New York State. The sections in yellow can be modified to fit your institution’s unique information. Feel free to use your own font (I am into Century Schoolbook these days, but Avenir Next has a quiet authority). You can also add additional protections and procedures; I have put in the bare minimum required by law and ethics.

NOTE: As will ALL templates, have your higher-ed institution’s lawyer review it first, whenever possible. They may have a few more considerations to add.

In addition to having clarity about the steps needed to demand student-related information, I want to encourage all academic librarians to stay calm. In the event you are asked for information about a student or colleague, follow policy and guidance (including what is below, if your institution decides to use it) and refer all inquiries to senior administration.

In the event of an enforcement action, one of the best things you can do is provide witness, and help that person get to a good lawyer. So, if you have extra adrenaline on this right now, using your librarian skills to assemble lists of legal aid and private attorneys with the right experience to help can be vital.

In summary: librarians at higher-ed institutions can’t control what campus policy is overall, but they can have clarity about the policy in the library. In addition, by attesting to what you see, and providing timely information to those who could be impacted, you are using your profession to ensure accurate information is timely applied. As of this writing (January 29th, 2025), helping your colleagues track accurate information about funded research and programs will help, too.

Thank you for thinking of your students and your ethical obligations as an academic librarian.

The Higher Ed Librarians’ of New York

GUIDE

To Responding to Law Enforcement & Others’

Requests for Library User Information

[INSERT YOUR LIBRARY LOGO HERE!]

FACT 1: “Library Records” in New York, including those held by higher education libraries, may not be disclosed to third parties without a duly executed subpoena, court order, or waiver signed by the library user, unless such disclosure is required for library operations (for example, reporting destruction of library property). [NY CPLR 4509]

FACT 2: “Library Records” in New York, including those held by higher education libraries, may not be shared with law enforcement (local, state, or federal) without a warrant, unless the library is the party filing the report (for example, reporting theft of library property).

FACT 3: At this library, a student’s Library Records are also confidential “Education Records” per the Family Education Rights Privacy Act (FERPA). While some records can be shared under FERPA, Library Records have an added layer of restriction (see FACT 1 and FACT 2).

FACT 4: The American Library Association’s Code of Ethics requires librarians to “protect each library user’s right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted.”

BECAUSE OF THESE LEGAL AND ETHICAL OBLIGATIONS:

1. Law Enforcement (local, state and federal): All requests for library user information will be referred to Campus [Safety/Security] or the [University/College’s] lawyer. Search warrants, subpoenas and court orders should be submitted directly to [position] for assessment, so prompt responses can be issued. Library workers are, by law and policy, barred from providing such information.

2. Attorneys: All requests for library user information will be referred to Campus [Safety/Security] or the [University/College’s] lawyer. Subpoenas and discovery demands should be submitted directly to [position] for assessment, so prompt responses can be issued. Library workers are, by law and policy, barred from providing such information.

3. Private Investigators: All requests for library user information will be referred to Campus [Safety/Security]. Library workers are, by law and policy, barred from providing such information.

4. Faculty, Staff, Coaches, Advisors: All requests for library user information will be referred to the Library Director, who will assess the degree to which such information may be shared under FERPA and CPLR 4509. If a student has signed a FERPA waiver that includes disclosure of Library Records, please alert the Library Director, so the information that the student has agreed can be shared can be promptly provided. Library workers are, by policy, barred from providing such information.

5. Information Technology (“IT”): All requests for library user information should be referred to the Library Director, including requests that could be fulfilled by IT. IT workers are, by law, barred from providing access to Education Records and Library Records without a FERPA waiver authorizing such access.

IN THE EVENT LIBRARY RECORDS OR INFORMATION RELATED TO LIBRARY USE IS DEMANDED DUE TO AN IMMEDIATE RISK TO HUMAN HEALTH (student or other), THE DIRECTOR OR LIBRARIAN IN CHARGE WILL WORK WITH OTHER [COLLEGE/UNIVERSITY] PERSONNEL TO MAKE A TIMELY DECISION BASED ON APPLICABLE LAW.

This Guide is posted and promulgated in the [NAME] Library to protect important privacy rights while promoting the orderly and safe operation of the campus.

The day this story really broke (August 7, 2023, a day that will live in minor infamy), Nathan in my office pointed this issue out to me.

"Did you see that Zoom is going to use customer content to train AI?" he asked (this is what passes for casual morning conversation in my office).

My eyebrows went up, mostly because Zoom was being upfront about it, rather than because it was being done at all (because yes, this is the way of the world now).  That said, there are some tricks libraries and educators—and any business that cares about use of personal data—can employ to resist it.

Not surprisingly, this comes down to two simple things: awareness, and language.

We'll use the recent Zoom scenario to illustrate:

I am not sure how awareness of the new clause first broke (I am going outsource that research to Nathan, and if he finds out, he'll put it in a footnote, here[1]).  But it is clear that fairly soon, consumers were unambiguously aware of the privacy and use concerns posed by the "we'll suck you into our AI" Terms of Use.

Here is the language Zoom used[2] (and has since retracted) to announce it would use our conferences, etc. to train AI:

"[You agree Zoom can use your Content] ... for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom's other products, services, and software, or any combination thereof..."

This is where language comes in.

As the world soon knew, this "old" language listed "artificial intelligence", as well as "training", (although the Terms' dubious use of commas suggests to me that Zoom could use our Content for not just "training" AI, but humans, too... actually an even more terrifying prospect, from some perspectives).[3]  So yes, lots to be concerned about when it comes to "Customer Content" (which is Zoom’s term for the recordings/data/analytics that come from "Customer Input", which is the raw content you put into Zoom[4]).

 Now let's use our awareness of the current Term of Use (current as of August 24, 2023, at least), and see what the language says:

"10.2 Permitted Uses and Customer License Grant. Zoom will only access, process or use Customer Content for the following reasons (the “Permitted Uses”): (i) consistent with this Agreement and as required to perform our obligations and provide the Services; (ii) in accordance with our Privacy Statement; (iii) as authorized or instructed by you; (iv) as required by Law; or (v) for legal, safety or security purposes, including enforcing our Acceptable Use Guidelines. You grant Zoom a perpetual, worldwide, non-exclusive, royalty-free, sublicensable, and transferable license and all other rights required or necessary for the Permitted Uses."

Although not as stark as the old language, there is still a lot of wiggle room to squeeze a blending of Customer Content with AI there.  What if Zoom is "obligated" to provide a service, and decides to use AI to do it?  What if Zoom decides AI is needed for "enforcing Acceptable Use Guidelines?"  What if Zoom decides that AI is needed for your safety, and that, also for your safety, Customer Content must be used to train that AI?

Of course, right now, the Terms also say (in bold, so you know they mean it[5]):

"Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content (such as poll results, whiteboard and reactions) to train Zoom or third-party artificial intelligence models".

So can this assurance be trusted?  This brings us back to language.

Back in the day, of course, computer systems were not "trained" (as one would train a dog, or a small child to use the toilet) but rather, "programmed."

However, even in the (relatively) slow-moving world of the law, this is no longer the case.

Here is an excerpt from a recent case[6] where lawyers were squabbling over how to gather "Electronically Stored Evidence" ("ESI"):

Defendants propose the following method for searching and producing relevant ESI:

1) Narrow the existing universe of approximately 27,000 documents...

2) Undersigned counsel reviews a statistically significant sample of the remaining e-mails at issue and marks them relevant/irrelevant to create a "training set;"

 3) That training set is then used to "train" the eDiscovery vendor's artificial intelligence/predictive coding tool, which "reviews" the remaining e-mails and assigns each a percentage-based score that measures likelihood to be responsive...

So even in the law, computer systems are being "trained", and there is a precise meaning to the term (which in plain[7] terms is "repeatedly using data and parameters to create patterns desired by the user").

So, with all that said, let's look at the member's questions:

Question 1: I am wondering if there are any privacy or FERPA concerns that librarians and educators need to be worried about since Zoom is still used heavily in both library and school worlds.

The short answer is: yes.

Question 2: Should we be looking for alternatives or is this just the way of the world now?

The short answer is: yes.

Here is the reason for my first short answer:  Many contracts have what I call a "we were just kidding" clause that allows the contractor to change their terms at will, and without notice.  Here is the one in the current version of Zoom:

15.2 Other Changes. You agree that Zoom may modify, delete, and make additions to its guides, statements, policies, and notices, with or without notice to you, and for similar guides, statements, policies, and notices applicable to your use of the Services by posting an updated version on the applicable webpage. In most instances, you may subscribe to these webpages using an authorized email in order to receive certain updates to policies and notices.

What does this mean?  Even though they are in bold, Zoom can change its assurance on AI at any time.

The reason for my second short answer is this: Libraries and education institutions have incredible commercial leverage when they work together.  For this reason, libraries and educational institutions should always be using their awareness of data, ethics, use, and privacy issues to demand contract language that meets their expectations.

Those expectations will change from product to product. With a product like Zoom, which can generate audio/video/text/analytics/+, including content that later may be part of a student file (FERPA) or a library record (various) the assurances should be:

• All content entered is property of the customer (library or school);
• At all times, all content entered into the service, or content generated with the use of customer-supplied content, may only be used to provide the current service(s) specifically authorized by the customer;
• Any other use of data (for product improvement, for marketing) must be via a specific opt-in;
• Terms cannot change without notice and terms in effect at the time content was generated will govern such content, regardless of future changes;
• Customers can receive assurance that all data is purged upon request.
• Customers can verify that they can enforce and comply with all their own internal policies and obligations regarding data creation, use, and storage.

In addition, libraries and educational institutions should have a clear set of policies for how they, as the potential owners of recordings and other data associated with the use, will use their ownership and control of the content.  It would be unfortunate, to say the least, for a student to find that their college disciplinary hearing for underage drinking is now available on YouTube.[8]

Many public library groups and academic consortia are already working to develop this type of criteria[9] (which should focus more on isolating aspirations and expectations than on legal wording, since legal wording will vary from state to state). And some institutions are designing their own services[10] in order to avoid contract terms that don't meet their criteria.

At the individual institutional level, this means building assessment of such services, and bargaining time, into the procurement process.  It also means thinking through that institution's own particular ethics and responsibilities and developing internal policies to promote them.

So, while this is the world we live in, libraries and educational institutions are well-situated to make a better one. 

Thanks for an important question.

This question comes at us from a school district public library and supporting Board of Cooperative Educational Services ("BOCES").

One thing I knew very little[1] about when I started doing "Ask the Lawyer" was school district public library systems.  These are systems coordinated through a regional BOCES, creating a network of library resources, governed by their own section of the New York Education Law (and regulations, and Regents rules).

Over the years, the existence and importance of school district public library systems has grown more and more obvious to me--to the point where now, if you are so unfortunate to be trapped in an elevator with me, I might tell you all about them from ground level to the 32nd floor.[2]

One thing I would mention, around floor 15 or so, is that school district public libraries (and systems) have to balance privacy and data security obligations from a wide array of different state and federal laws.  I have written on this before (see "Ask the Lawyer #67, #80, and #143), and won't re-hash that here, except to say: everything in those past answers impacts this question.

With those prior columns as background, the answers to the member's three questions are:

For an Interlibrary Loan Electronic Transmission (whether printed out and included with the item(s) or sent via electronic means) in a K-12 setting, can a student's name (the one ultimately borrowing the item) be used in the "receipt" or notification slip?

Yes, if the library's policy requires it for the "proper operation" of the library (CPLR 4509), AND if the school can assure that only those who need to see it (for the benefit of the student) will see it (FERPA) or the student has signed a FERPA waiver, AND if all the required measures for data privacy are in place (ED2-d).

Should a student's School ID number be used? Can both be used at the same time?

Yes, if the library's policy requires it for the "proper operation" of the library (CPLR 4509), AND if the school can assure that only those who need to see it (for the benefit of the student) will see it (FERPA) or the student has signed a FERPA waiver, AND if all the required measures for data privacy are in place (ED2-d).

Is it taboo to have a student's name in ANY electronic transmission?

No, but school district and BOCES systems creating and transmitting such records should always be confident that the use of the student's name is in a document generated and transmitted per applicable policy.

This is tougher than it sounds, since schools now have so many electronic systems facilitating record-making and communication--a situation compounded by online learning during the pandemic.  Further, the decision to use those systems might be driven by function and cost, with only secondary attention being paid to privacy, as addressed in "Ask the Lawyer" #67, #80, and #143.

Since this question is rooted in interlibrary loan, I'll end with an example.

Below is a partial screenshot from the demo screen of OPALS, a popular ILS used by school district libraries (and other types of libraries, too).

As you'll see, OPALS enables the "viewing of all the borrowers in an attending class...."

There is nothing inherently wrong with this type of grouping of borrowers, so long as the district has addressed the various privacy obligations, and made sure the functionality and use of the system (in this example, OPALS) align with the school's approach and policies on privacy.

In other words, nothing should be left to chance.

So, with that, my ultimate answer--to all three questions-- is: any time a public school student's name is listed on a library record that leaves the bounds of the library (the "real" or virtual bounds), every unique way that happens (injury report, student discipline, interlibrary loan) should be covered by policy.

Now, let's consider how this issue looks "on the ground."  I poked around a bit, and while I found many interlibrary loan policies for school district library systems/BOCES in NY, I didn't find one that went so far into the weeds as setting terms for how/when to include borrower names on the routing slips (printed or electronic).

Chances are, that's usually more of a "standard operating procedure" thing, rather than something set by formal "policy."[3]

But with increasing interconnectivity between library other school systems, it might be worth formalizing in future interlibrary loan policies.  For instance, one sentence: "When effecting interlibrary loan, cooperating libraries shall mutually adhere to the other libraries' and systems' policies regarding borrower privacy"[4]  is a sample of how to add a quick reminder about this critical consideration.

Because as the member's questions indicate, we can never be too "in the weeds" on privacy.

Thank you for an important array of questions.

[1] Okay, actually, nothing.

[2] In this mythical trip up 32 floors, we are visiting Buffalo City Hall, which if you have never seen, is a must-visit location.

[3] New York is a big state!  I have no doubt there is a policy that does address this.  If your district has one, please send a link to info@losapllc.com and reference this RAQ.

[4] This is just sample language...no matter what you select, make sure your school district's attorney or BOCES system director reviews and approves any policy before it goes into effect!

Questions that combine higher education, data access, and "terms of use" enforcement always give me a moment of sad reflection, as I remember Internet pioneer and activist Aaron Schwartz. It was an alleged overuse of an academic database at MIT in 2012 that lead up to his demise.[1]

While the circumstances in the Schwartz tragedy are different from the situation described here, both scenarios--and the care the member has taken in framing this question--illustrate the importance of considering what's at stake when an institution balances contract compliance, digital access, and privacy.

What's "at stake" here? The member's question combines concerns about:

• Confidential use of library resources
• Academic freedom
• Intellectual freedom
• Honoring the exclusion of certain academic and library actions from liability for copyright infringement
• FERPA

Let's do a quick run-down of these critical areas:

In New York, the confidentiality of library services is protected by Civil Practice Law & Rules ("CPLR") section 4509, which states that library records indicative of the identity of a library user may only be accessed with that user's permission, or per a subpoena or court order. CPLR 4509 applies to private libraries within academic institutions as much as it does public libraries or those within school districts. It works hand-in-glove with the American Library Association's and New York Library Association's recitals of patron confidentiality in their Codes of Ethics.

In New York, the commitment of a higher education institution to academic freedom is reflected in various ways. An example is the American Association of University Professors' 1940 "Statement on the Principles of Academic Freedom"[2]: "Teachers are entitled to full freedom in research..."

In New York and throughout the nation, the commitment of libraries to collaborate with others to promote intellectual freedom and access to information is reflected the ALA Library Bill of Rights: "Libraries should cooperate with all persons and groups concerned with resisting abridgment of free expression and free access to ideas."

In New York and throughout the nation, certain academic and library actions that would otherwise violate copyright are excluded from liability for infringement. This exclusion is to ensure there is a clear and well-defined legal safety net for content accessed in furtherance of certain intellectual and academic freedoms.

And throughout the USA, the privacy of education records, including library records, is assured under the Family Education Rights Privacy Act" (FERPA).

Serving as a counterweight to all of these critical factors are an educational institution's obligations under federal law and regulation with regard to alleged copyright infringement, particularly the regulations found in 34 CFR §668. If I were to delve into that and describe all of those obligations here, this answer would be 50 times longer, but a good summary of what compliance in that regard looks like can be found in this sample policy from RIT: https://www.rit.edu/its/rit-response-copyright-infringement.  In short:  since 2008, federal law requires higher education institutions receiving federal financial aid and other federal benefits to be express enforcers and re-enforcers of copyright.[3]

Sitting astride of all of this is whatever notification commitments (and other responses)  a college or university library agreed to when it signed the license agreement with the database provider (I have reviewed many of these types of license agreements, and almost all of them have some form of notification action requirement, which can range from a warning as described by the member, to ensuring the immediate cutoff of access by an offender).  This means that in addition to the ethical, legal, and regulatory factors that have to be balanced in a question like this, we also have to consider obligations that are contractual.[4]

With all of these very important considerations now laid before us, let's review what the member is doing:  1) getting a notification of a possible terms violation from the provider, and then 2) using a firewalled[5] process to identify the user and alert them of the alleged violation, and then 3) assuring the vendor they have addressed the issue.  As asked by the member:  Is this process appropriate in resolving the misuse of a database, or does it violate the user’s/student’s privacy rights?

Here is my short answer: since the method of response described by the member shows there is a big firewall between the vendor and the institution (meaning: the outside party never learns the actual identity of the alleged violator), I believe so.  BUT: the only real way to ensure privacy is protected as it should be is to confirm that the information flowing between the library and the IT Department never goes any further...within the institution.

What do I mean by that? The information should never go to campus safety or security. Unless it is per a very clearly articulated procedure developed for the operational needs of the library, it should never go to the office responsible for student discipline. And it should certainly never go to an employer on campus, a faculty member, or an advisor.[6]

This caution is warranted because, although a library within a higher educational institution is not a separate business entity the way a chartered public library is an entity separate from the town or city that sponsors it, for purposes of an academic library's adherence to privacy ethics and laws, it should be considered a stand-alone entity. Information can flow into it, but information should not flow out, even to other departments, unless the flow serves the operational needs of the library, and verifiably goes no further.

This 'one-way flow" for user-associated academic library records is an easy goal to articulate, but in practice, it can be very difficult to assure. As systems within large and small institutions get more integrated in the interests of security and economy, so too is it more difficult to separate one type of information from another. However, when it comes to privacy and library confidentiality, because of the high stakes involving intellectual freedom, academic freedom, and student privacy, extra care and attention is warranted.

The care of the member in submitting this question and describing the careful process they are using is emblematic of the type of care that should be used at all times when safeguarding user confidentiality and privacy at a higher education academic library.

Thank you very much to the member for submitting such a careful question.

RIP, Aaron Schwartz.

[1] I say "led up to" rather than "led to" because while many believe the latter, the facts of the case clearly establish the former.

[2] Found as of November 14, 2021, here: https://www.aaup.org/report/1940-statement-principles-academic-freedom-and-tenure.

[3] I won't mince my words about that requirement: I don't like it. But I am not a member of Congress.

[4] And voluntary. This is why it is very important to read database licenses and to PUSH BACK on clauses that require draconian responses to alleged violations.

[5] By "firewalled," I mean that the vendor never knows the name or other identifying information of the alleged violator.

[6] Unless the student has signed a waiver. Then it can go to whoever has permission.

I am always fascinated by the transformation documents can undergo, simply by operation of law, circumstance, or time.  For instance:

• Documents that are "education records" under FERPA can become simply "records," or "nothing" once the person to whom they pertain has died.[1]
• Documents that are "private information" under New York's new(ish) SHIELD Act[2] are no longer controlled by the Act if the digital copy is swapped for a copy on paper.
• Documents that use the "name and likeness" of a deceased performer, currently allowed, will be far more restricted when New York's new Civil Rights Law 50-f, which requires written permission for certain commercial uses, goes into effect on May 29th, 2021.[3]

And of course, documents can be "in" copyright, and "out" of copyright, or restricted due to medical content, or under terms of non-disclosure...restrictions that can shift based on any number of factors. 

An educational institution considering levels of access and use of student-related documents[4] has to consider not only these legal factors, but their unique policies.  Factor in fame,[5] and the stakes get even higher. 

Because of that complexity, I could muse/write/talk on this topic for hours.  But let's focus on the member’s specific questions:

1) When should on-site access to historical educational records be allowed (if ever), with reference to FERPA? What about providing copies of historical educational records?

If a former student is not deceased, there can be NO release of FERPA-protected education records to otherwise barred parties without written, dated consent.

If the former student is known to be deceased—or the passage of time suggests they might be deceased—then the records are no longer protected by FERPA, and that restriction no longer applies.

But as the member points out, there are other considerations.

2) When should on-site access to unpublished, non-educational records related to former students be allowed, in reference to state and federal copyright and privacy laws, and possibly FERPA? What about providing copies of these documents?
 

This is an interesting question because unless the records we're talking about ("related to former students") only contain "directory information,”[6] then they are by definition "education records" under FERPA.[7]  That is because the FERPA is intentionally expansive.  So old bills, dusty admissions files, and antiquated (but often fascinating) "administrative" records, although not "educational," per se, are still barred from release by FERPA if they relate directly to a student.[8]

BUT, as this question implies, FERPA isn't the only thing that could bar or restrict access to old records.  Copyright, privacy laws, and general prudence are all good reasons to not release institutional records unless there is a policy and process for doing so (like a policy for sending transcripts to future employers), or your institution is compelled to release them (like a judicial order or subpoena).

So, while a student will always have access to their records under FERPA, both former students and third parties should by default be barred from access or obtaining copies to records they are not entitled to.

Which brings us to:

3) Should we take a more risk-averse approach to high-profile alumni materials, or should our policies apply equally to all alums?

Many, but not all, educational institutions have internal archives—not formal "Archives" they hold in trust for the public (like the W.E.B. DuBois papers at University of Massachusetts),[9] but rather, materials they regard as important pieces of their institution's history and identity, so deliberately retain.

For some, this may be a complex and far-reaching catalog of institutional history.  For others, it may be simply hanging onto every program for every graduation ceremony.  And of course, for many, it will be special handling of any material that is related to famous or noteworthy alumnae.

Whether formal and well-funded, or informal and not funded,[10] every educational institution's internal archive should have a policy that covers: 1) that the archive exists to transition material from "records" into "archives;" 2) how those materials are selected; 3) how those archival materials are to be preserved; 4) how the archival materials are used and accessed internally; 5) how the archival materials are used and accessed externally; 6) the ethical standards and institutional values being applied in the overall operation of the archive. [11]

If an educational institution has in-house records of such magnitude that they warrant being their own archive (for instance, the Eqbal Ahmad papers at Hampshire College), yes, the development of that archive could warrant its own separate policy.  In that case, unique care would have to be taken to consider not only FERPA, but privacy laws, copyright (the author of an admissions letter is the copyright owner of that admissions letter...not the institution the letter was sent to, even if the institution retains the only physical copy).  

All that said, the end result need not be "risk-averse," so much as "risk-informed:" carefully assessing all the compliance concerns and risks,[12] how does an institution create an archive that suits its stated purpose and conforms to institutional ethics?  Until an institution is confident it has reached the right answer, access to third parties should not be granted, and only need-to-know access should be granted to those within the institution. 

I would like to thank the member for this question, it is a good one.  And I think we may have reached a new milestone at "Ask the Lawyer"—a reply where the footnotes are as long as the reply!

Thanks.  I wish you a well-resourced and culturally rich archive, and continue positive alumnae relations.

[1] See letter of LeRoy Rooker, Director, Family Policy Compliance Office, U.S. Department of Education letter of Date, found at https://studentprivacy.ed.gov/sites/default/files/resource_document/file/LettertoConnecticutStateArchivistRegardingEducationRecordsMay2008.pdf as of February 10, 2021, re-affirming "that the FERPA rights of “eligible students” lapse or expire upon the death of the student based on common law of privacy rights." [NOTE: This link was confirmed as no longer active and removed on 02/25/2022  as part of the routine review of "Ask the Lawyer" materials.]

[2] Text for this law can be found at: https://www.nysenate.gov/legislation/bills/2019/s5575.

[3] I am writing this on February 10, 2021. 

[4] This "Ask the Lawyer" answer does not address the issue of yearbook photos and student-generated art or academic work.  For that, see RAQ #108 and RAQ #91.

[5] What is "fame?"  It's a notion that is taking odd journeys these days.  As I said in footnote #3, I am writing this on February 10, 2021.  Jockeying with the impeachment proceedings for "fame" on the cover of today's digital New York Times: an article about a lawyer who appeared in virtual court as a cat.  I bet he can't wait for his 15 minutes to be over.

[6] "Directory information" includes, but is not limited to, the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors, and awards received; and the most recent educational agency or institution attended.

[7] Here is the actual definition: "...those records that are: (1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution."

[8] There are exceptions to this, of course...one big one being the records of campus police.

[9] I value this archive because it has letters between W.E.B. DuBois and Mary Talbert, a Buffalo resident who was a stalwart organizer for civil rights and, on the side, historic preservation (she led the effort to save the house of Frederick Douglass).  I read her letters when I need a shot of pragmatic inspiration.

[10] Some "archives" exist because some wonderful employee couldn't bear to see institutional history thrown out, and they got permission to buy some boxes and put the "archives" in the storage closet. 

[11] The "Ask the Lawyer" from November 4, 2020 has more about ethical considerations for archival projects: RAQ #178.

[12] For this question, "risk" is not just legal risk, but relational and reputational risk, too.  After all, it might be legal to share a harsh evaluation from a thesis committee related to the work of a long-dead student...but is there value in doing it?  (Of course, there might be).  Knowing why something is in the archive, and having full confidence in that reason, is just as important as preserving the record in the first place.

I didn't realize it in first grade, but a school library[1] is one of the first places a person experiences "the right to privacy" unmediated by a parent or guardian.

Think about it.  You go to the library and get to pick out whatever you want.  You check out books, and no one can tell you what to pick.  And aside from the person checking you out, no one has to see your selection; your records are private.

In the present day, this means that kids whose faces might be all over Facebook[2], who are attending school via computer, and who "turn off their screen," when they don't want people peeking into their home life during remote learning, still have a right to confidentiality when it comes to the library in their school. And one of the biggest symbols of that student-library relationship is their library card.

So, with all that hanging in the balance, what are the legal considerations of putting student pictures on school library cards?

As often happens in the highly regulated worlds of education, privacy, and information, the answer is: "It depends."

In this case, the factors "it depends" on are numerous; rather than itemize them, I'll summarize them with a few pointed questions:

Factor 1: What else is "on" the library card?

Depending what other information is on the library card, combining a student’s picture with it could increase the likelihood of a violation of FERPA[3], Ed 2-d, or school policy.[4]  For instance, if the card is used for not only swipe access, but access to grades, disciplinary records, and library records, also including a picture ID on it makes it sensitive, indeed.

Factor 2:  Who "owns" the library card?

Some schools, by policy, give out student identification cards, but use a school or district-wide policy to confirm that the card is simply "on loan" to the student (and must be returned at certain events, like suspension or expulsion).  Other institutions issue a card, and it becomes the student's property; this means that the card is more under that student’s control.[5]

While there is no requirement to do one way over the other, the school and library should confirm the ownership of the card in a policy, as this can impact the decision to mark the card with picture ID, as well as who has control over the card in the future.

Factor 3:  Why does the picture need to be on the library card?

Is the school so large that in order to ensure it provides library services to the right student, the card must have a photo ID?  Is it a security measure, perhaps to deter theft (of library cards, and therefore collection assets)?  Do students need to "swipe" into the library, with the library positioned to monitor that they are letting in a student who isn't supposed to be in class?  Or is the library card doing double duty as the student's general student ID?  Whatever the reason, it should be understood and clearly based in policy.  And if the reason has to do more with security at that school than the operations of the library, it is better that the function be performed by the student ID, not the library card.[6]

Factor 4:  Who will have the right or ability to view the library card?

If the library card is only required to be viewed by library staff, the inclusion of the photo is consistent with FERPA's and CPLR 4509's different but equally applicable privacy requirements.  But if a security guard, teacher(s), bus driver, or others all have to see the library card for different reasons (this relates to question number 3), or could use the card to access the student's library records, that raises the possibility of concerns.

Factor 5:  Is there a "stealth" reason for the use of the photo and name?

For some students, if they do not have documentation such as a birth certificate or social security card, a library card with a picture ID might be the most official "documentation" they have.  If a library or school is intending that their cards perform this ancillary function, this should be done with the awareness that third parties relying on the identification function still need permission for the school or library to comment on the content of the card (for students under 18, this means a waiver by parents or guardians).  However, that same student (or their parents/guardians) can choose to share their confidential education records or library records however they wish.

Okay, that's a lot of "factors," but what is the answer?

Having dragged you through all that, I will answer the member's very simple question:  Is it legal to print student photos with their names on their school library cards for circulation use?

The answer is "Yes."

But!  If the library card will be used for anything more than "circulation use" within the library, it is wise to assess precisely what the card will be used for, root that purpose in well-developed policy that considers the above factors, and evaluate if the picture—which in this case, will be a FERPA-protected education record[7]—is needed at all.  The more the card is used for functions beyond the needs of the library, the more those functions should be achieved by a separate student ID, or in the alternative, schools should make sure that library information[8] is separate and isolated from other education records accessed by or listed on the card.

Thank you for an important question.

[1] It is important to note that a "public school library" is different than a public library, or an association library, or a college library.... but ALL are subject to CPLR 4509, the law making library records private.  And while they are different, a public school library, like the college library, is subject to FERPA.

[2] I used to be such a stickler about not posting any pictures of my kids on FB.  But the loving posts of other family members eventually wore me down.  Sorry, kids, I really tried.

[3] Photos of students maintained by their institutions, like an ID photo, are confidential education records under FERPA.  https://studentprivacy.ed.gov/faq/faqs-photos-and-videos-under-ferpa

[4] For instance, if the library card is also an all-purpose student ID that also functions as a key card or has lunch money on it, a policy should clearly separate those functions and there must be a clear protocol for voiding access when the card is reported lost.

[5] Just because the school owns the physical object doesn't mean they own the rights to the student's image.

[6] This is because, as written more thoroughly in Ask a Lawyer RAQ #100, school library records are subject to both FERPA and 4509 rules of privacy.  Combining education record with library records can make it difficult to tease out the different ways the materials may need to be handled. 

[7] See footnote 3.  Yes, this is a footnote to send you to a footnote.

[8] Either in hard copy, on the card, or via digital access.