Libraries, privacy law and dealing with law enforcement requests for patron information

I was recently invited by a group of regional librarians in Nova Scotia to speak with them about libraries, privacy law and dealing with law enforcement requests for patron information.

While it's a pretty narrow niche, here's my presentation in case you're interested ...

Update (2012-10-05): In Nova Scotia, public libraries are "public bodies" governed either by the Freedom of Information and Protection of Privacy Act or Part XX of the Municipal Government Act. Both statutes permit public bodies to disclose personal information to law enforcement for law enforcement purposes without the consent of the individual. However, just because a library can make such disclosures doesn't automatically lead to the conclusion that a library should.

The Canadian Library Association has taken some strong positions on patron privacy, such as the Position Statement on Citizenship Access to Information Data Banks - Right to Privacy made in 1987 which includes:

Therefore, to protect the personal rights and privacy of users to consult and borrow library materials without prejudice, the Canadian Library Association endorses the following policy: That names of library users not be released to any person, institution, association or agency for any reasons save as may be legally required by Federal or Provincial laws.

The CLA's earlier (1976) Statement on a Code of Ethics includes general support for patron privacy:

Members of the Canadian Library Association have the individual and collective responsibility to:

1. support and implement the principles and practices embodied in the current Canadian Library Association Statement on Intellectual Freedom;
   
2. make every effort to promote and maintain the highest possible range and standards of library service to all segments of Canadian society;
   facilitate access to any or all sources of information which may be of assistance to library users;
   
3. protect the privacy and dignity of library users and staff.

Both of these policy statements support the proposition that patron information should only be disclosed where required by law, not just as permitted by law.

In my view, libraries should develop a written policy on interactions with law enforcement that are consistent with a librarian's ethical obligations to protect patrons, which would govern the exercise of discretion. One might come to the conclusion that information about a patron's use of library resources (such as books, computers, etc) would only be provided pursuant to a warrant or a production order while less sensitive information (was a person at the library at a particular time) may be provided without lawful compulsion. The policy should also say who is able to exercise discretion and make decisions on behalf of the library, with a general prohibition against all disclosures by anyone other than the sanctioned decision-makers.

In order to minimise confusion and clarify processes, such policies should be clearly communicated to local law enforcement.

Finally, I should note that the above is meant to be educational, to assist librarians in seeking proper legal advice on this sensitive topic. Above all, this should not be construed as legal advice.