Spurred on by last fall's revelations that Adobe was spying on readers, the ALA has come up with new set of best practices for vendors and librarians to follow so they can better respect the privacy of library patrons.
The fact of the matter is, librarians have always taken patron privacy seriously. That's why librarians objected to the Patriot Act and it's why many librarians were upset when OverDrive partnered with Amazon to bring library ebooks to the Kindle, but lately it's become clear that practice isn't matching up with principle any more.
As the ALA's Office for Intellectual Freedom explained on their blog:
A gap has grown between our tradition of protecting privacy and common practices that libraries have developed as they strive to deliver digital content, embrace the modern Web, and provide personalized services to library users.
And so the ALA is releasing the new guidelines specifically to address the issues of ebook lending and digital content. You can find the new set of rules here. At twelve hundred words, it is not a long read.
The new guidelines note that contracts between "libraries and vendors should address appropriate restrictions on the use, aggregation, retention, and dissemination of patron data, particularly information about minors." The guidelines go on to add that:
The vendor should give users options as to how much personal information is collected from them and how it may be used. Users should have choices about whether or not to opt-in to features and services that require the collection of personal information. Users should also have the ability to opt-out and have their personal information erased if they later change their minds.
Later sections cover ereaders and other user devices,
There's also a long section which spells out the rules for patron data, including how vendors should protect, encrypt, and anonymize the data. The ALA also has rules on how long patron data should be retained, who it should be shared with, and how vendors should respond to govt requests for data (make the govt agency get a subpoena, search warrant, or other court order, basically).
We can also see that the ALA has been paying attention to the Radio Shack bankruptcy, in particular the way the creditors tried to sell customer data.
In the event that the vendor is sold to another company, merges with another company, or is dissolved through bankruptcy, all personally identifiable information should be securely destroyed, or libraries and their end users must be notified and given the opportunity to request that their data be securely destroyed.
The Radio Shack situation was resolved by state attorneys general blocking the sale, but clearly the ALA doesn't want to see a library vendor get into a similar situation.
You can find more details on the ALA website.
image by Thomas Leuthard