Recently Asked Questions

We have a question that relates to the intersection of New York state level library privacy laws (https://www.nysenate.gov/legislation/laws/CVP/4509) and FERPA. Our campus has a newish system that is attempting to correlate student actions and activities with academic success and retention. As such, it could be helpful to include things like visits to the writing center, appointments with academic advisors, and also library activities, such as whether a class came in for a library information literacy session or whether a student made an appointment for a library one-on-one consultation. FERPA lets institutions share academically related information within certain bounds.

We are wondering what the privacy balance is here given that the information would stay in-institution, but not in-library. Here's what we are considering doing:

1) Noting in the system which classes had a library session(s). Within the system, that would identify individual students within those classes.
2) putting an opt-in statement on our one-on-one research appointment form and if the student consents, then providing to system the student name, appointment date/time, and course that the help was for (but not anything about the specific content of the appointment).

Have we crossed any lines here? Do we even need the opt-in statement? Is this something clear or fuzzy/grey? What should we be considering that we haven't thought of? Thanks.

Are libraries legally required to obtain photo releases from all patrons (children's parents, teens, adults), even if we don't name those patrons before publishing photos to our social media accounts and/or press releases?

It has come up at our Reference meetings that patrons are using our technology to alter documents such as doctor’s notes (extending days of medical excuse, for example) and our staff is increasingly uneasy about assisting patrons with this. We try our best to ignore what people have on the screen but sometimes they ask for our help with altering scanned documents, and it's impossible to pretend we don't see what they are doing. We are uncomfortable telling patrons we decline to help them based on ethical reasons, because that would show admitting we have read what is on the screen. We are somewhat concerned about liability and potential obligation to report illegal activity. What are some ways we can shield staff from having to help patrons commit fraud?