Recording devices

Before we dive into this, a word of caution: sometimes “law firms” are not always what they seem.

Because I am writing this in 2025, you might assume I am starting with the caution because “deep fakes” are out there pretending to be lawyers, politicians, and your grandchildren stranded on the road in Arkansas.[1]

But actually, this has been a problem for a long time, even before someone could use PageMaker[2] to cobble up a fake law firm letterhead.

So, before a library (or any cultural institution) leaps into response mode on a “lawyer letter,” it is wise to do what the member is doing: exercise a little healthy skepticism.

In this case, it is good to verify that the firm and lawyer are real, and that the firm you’ve verified actually sent this.

Now, if there is any chance that the legal matter in question could involve a claim against your institution, it is wise for your lawyer to do this. I am not saying that to drum up work for my siblings at the bar,[3] but because the initial outreach to the requesting firm could result in providing information they are not entitled to, and it could put your institution at risk. Using your attorney to make the contact will reduce this risk.

The attorney can, at the same time, assess if the demand has teeth (as in, can the requirement to preserve the footage be enforced?), and advise on next steps. As part of that exercise, the attorney will evaluate this from the perspective requested by the member: patron privacy.

The first part of that evaluation is standing under the transparent elephant in the room: FOIL.[4] If a record is available under FOIL, a person doesn’t have to get a subpoena to demand a copy; they can just request the record, and the library has 5 business days to get them an initial response to the request.

Of course, FOIL is not a magic wand that brings immediate access to all records; there are all sorts of exceptions to what must be disclosed under it, and those exceptions include library user records.

This brings us to the next consideration: what your library has defined as “library user records.” While the law in New York governing the confidentiality of library user records[5] does not mention security footage, it allows libraries to include such records in their own definition. If a library’s “Confidentiality of Library User Records Policy”[6] lists security footage—or security footage in certain areas—as a “user record,” the content cannot be disclosed without a written release from the relevant patron(s), a court order, or a subpoena.

The next thing to consider is your library’s practice of retaining security footage. In New York, security footage can be FOILed, but there is no obligation for an agency to retain such footage unless there is a “potential legal use.” This “0 after no longer needed” retention period is set by the LGS-1, which is the master list of record retention terms for government agencies in New York.

Here is the LGS-1’s listing for security footage:

When developing a security footage/library user record policy, it is important to keep this non-existent retention period for boring footage in mind.[7]

Why is that important? If a request has been received for footage that is already deleted (because your library did not identify a need to retain it), the library has no ability to fulfill the request and has no culpability for not having the footage.

If the library retains the footage for a set time (for instance, 30 days) and then routinely deletes it, but a legitimate demand to retain the footage is received prior to the footage being deleted, the footage must be retained as having a “potential legal use.”

For this reason, it is important for public libraries with security systems to set a retention period for security camera footage and to ensure they are deleting the recordings exactly as required by the policy. This is because if a public library gets a request for the footage, and the library has the footage, it must be preserved, even if it is past its retention period… and even if it is regarded as a library user record.

Note that I say it must be “preserved,” not that it must be “disclosed.” Disclosure is only required after a library user grants their written permission or the library receives a subpoena or court order. Assessing when the library is compelled to provide the record is another job for the library’s attorney.[8]

Returning to the member’s question (“I would like to know what limitations and obligations we have in this civil matter with regard to patron privacy”), the answer is: the library cannot go wrong by assuming that the record cannot be disclosed without a subpoena or court order and not releasing it until the library’s attorney has assessed the matter and provided written advice.

Here are just a few of the variables that make caution and taking your time wise: 

• The “litigation hold” demand might not be legitimate;[9]
• The case could be settled in between the time the library gets the request and is ready to fill it;[10]
• The person the footage pertains to could attempt to “quash” the subpoena;
• A party could try to appeal the court order directing that the record be provided;
• If the footage is needed by the library user it pertains to, that person could sign a release, but there is no obligation on the part of the library to provide the record;
• The library may need to address footage that shows one or more other person(s) in the same frame as the person(s) to whom a subpoena pertains.

When a library director (or another lucky employee) receives a request like this, the best response is to draw a deep breath, call your board leadership and/or library system to develop a response plan,[11] or reach out to the library’s attorney.[12] If the footage that was requested still exists but is scheduled for deletion, it should be preserved immediately.[13] Other than that, nothing should happen quickly.

The good thing to remember is that no matter what, libraries in New York[14] are well-positioned to go to the mat for library user privacy—a notion that in 2025 may seem quaint but grows more important with every passing day.

Thank you for a great question. 

Before I dive right into the answers (we are going to address every question), let me say what a lot of readers are probably thinking: most tech-savvy people know how to modify their phone so a recording they made doesn’t show up in their files. So, this answer will not only review the questions about sensitivity and liability but also discuss the practical concerns of enforcing a Code of Conduct when a decision turns on dubious evidence.

First, let’s talk about a policy on recording.

Any public library should feel confident adopting a policy limiting use of recording devices in areas where privacy of library users is assured.

For some libraries, this rule may be limited to the service desks and common rooms where people are reading, using computers, and accessing other specific library services and programs. For others, this rule may apply to the entire interior of the library.

Some libraries may even want to bar recording in their parking lot and grounds (a factor relevant to the member’s questions), but this may be harder to justify on the basis of privacy, as there is no guarantee of privacy when walking out in the open.

So, for argument’s sake, let’s say the member’s library does have a policy, but it doesn’t extend to the outside. What else could help with the situation presented here?

In addition to a policy on recording in the library,[1] any library can use its code of conduct to prohibit the deliberate antagonism[2] of one person by another on library property.

Once a person reports such a violation, it is up to the director of the library (or librarian in charge) to ensure the policy for evaluating a code of conduct violation is followed.

Library codes of conduct vary from place to place, but a good policy will always follow this pattern: notify the person of the accusation in writing, let them know the penalty that could be imposed, and provide a reasonable opportunity for the person to respond prior to that penalty starting. If the matter involves a very clear risk to safety or compliance (a physical threat, sexual harassment, etc.), the person can also be temporarily barred from the library while the matter is pending, if the policy allows it. After a decision is made, there should be one level of appeal (usually to the board of trustees after a decision by the library director, but in a larger organization, the final appeal can be to the director after a decision by another employee).

If the matter is being handled by law enforcement, the library should still follow its own policy before removing library access and privileges (this is true even if there is an order or protection put in place).

When the accused person is a minor, that person’s parent or guardian should be notified to the degree consented to by the minor (possibly as part of getting a library card) or as stated by the policy.

If, after being accused in writing, a person volunteers to “prove” their innocence by showing their phone, the library should consider if the risk of intrusiveness[3] is worth it; likely it is not. Far better is to hear from the complaining person and the accused person a recital of what happened, decide what is most likely to have happened, and if a violation did occur, decide what penalty will help create assurance of respect and safety going forward.

This is particularly true in a case like this, where unless some other aspect makes the recording harmful (Has it been shared on social media?[4] Was the person being bullied at the time?), the consequences for doing what the youth was accused of will likely be a warning.

How would this “due process” roll out? After getting the complaint, it would start with a letter stating:

On DATE, a library user reported that she was concerned that you were recording her on library property (outside, at TIME), after she requested not to be recorded. If this happened, this is against the Library’s Code of Conduct, which prohibits INSERT.

The Library will be reviewing this report, and we invite you and your parent/guardian to provide a statement in response. You may also come in at DATE/TIME to discuss this with me.

Because it is important for library users to feel safe and respected at the library, if this did occur, it may result in a warning, or a temporary loss of library privileges. If we impose a temporary loss of privileges, you will be able to appeal it before it goes into effect.

Although the situation in the member’s question does not require it, if a reported violation is more serious (a threat, an injury, property damage, etc.), here is the language for a temporary bar on access to the premises:

Because this report relates to [a threat to safety, serious injury, etc.], until this is resolved, you are barred from library premises. You may still use library services remotely. If you need assistance to arrange services remotely, please call NUMBER to work with POSITION[5] or e-mail PERSON.

Taking this careful, deliberate approach does more than assure due process; it also slows things down and gives an accused person and their accuser time to think. It makes sure both parties can be heard. If the people involved are minors, it provides adequate notice and opportunity for parents and guardians to be involved.

Just as important: it is gentler on library workers, who should not have to serve as the sudden judge and jury of disputes between patrons (but of course, often do).

This brings things full circle to the original question: Is the library at risk if a teen patron volunteers to share contents of a cell phone?

The answer to that is YES. That risk includes everything from the simple optics of invading the privacy of a minor to compromising their rights without their parent or guardian present. It is a situation that begs for a formal complaint to a board and/or for public relations fallout. When you consider that the evidence to be provided is probably of dubious value, these risks completely undermine the worth of such access.[6]

While it can take more time, addressing things in a calm, formal manner can teach people (particularly young people) that they have rights. For certain disputes,[7] if the library identifies a way to mediate the issue[8] and help the young library users reconcile their differences, that is fine, too.

Thank you for a thoughtful array of questions.