New survey confirms librarians’ commitment to protecting privacy rights

For Immediate Release
Tue, 05/01/2012 – 15:55

Contact: Jennifer Petersen
Office for Intellectual Freedom (OIF)

CHICAGO – In conjunction with Choose Privacy Week, the American Library Association’s (ALA) Office for Intellectual Freedom (OIF) released preliminary findings from a new survey measuring librarians’ views on privacy rights and protecting library users’ privacy.

The survey, which builds on an earlier 2008 survey assessing librarians’ attitudes about privacy, provides important data that will help ALA evaluate the state of privacy in the United States and libraries’ role in protecting library users’ privacy. The data will help guide ongoing planning for Choose Privacy Week and similar initiatives aimed at engaging librarians in public education and advocacy to advance privacy rights.

Some of the highlights from the 2012 survey include:

• Librarians remain concerned about privacy and individuals’ desire to control access and use of personal information. Ninety-five percent agree or strongly agree that individuals should be able to control who sees their personal information, and more than 95 percent of respondents feel government agencies and businesses shouldn’t share personal information with third parties without authorization and should only be used for a specific purpose.
• Librarians affirmed their commitment to the profession’s long-standing ethic of protecting library users’ privacy. Nearly 100 percent of respondents agreed that “Libraries should never share personal information, circulation records or Internet use records with third parties unless it has been authorized by the individual or by a court of law,” and 76 percent feel libraries are doing all they can to prevent unauthorized access to individual’s personal information and circulation records.  Overall, nearly 80 percent feel libraries should play a role in educating the general public about privacy issues.
• When compared to the 2008 survey, the results showed that the responses given by the 2012 respondents generally mirrored those of the 2008 respondents, with data showing a slight decline in the level of concern over privacy. For example, in both surveys, the vast majority (95 percent in 2008, 90 percent in 2012) of respondents expressed concern that “companies are collecting too much personal information about me and other individuals.”  However those who “strongly” agreed dropped from 70 percent in 2008 to only 54 percent in 2012.

The 2012 survey also revealed some limitations in libraries’ handling of privacy issues.  While nearly 80 percent of the responding librarians said libraries should play a role in educating the general public about privacy, only 13 percent said their library had hosted a privacy information session, lecture, seminar or other event addressing privacy and surveillance. Similarly, while 100 percent agree that libraries should not release library records without a court order, only 51 percent indicate that their libraries offer training on handling requests for user records and only 57 percent indicate that their libraries effectively communicate the library’s privacy policies to their patrons.

The 2012 study is funded by a generous grant from the Open Society Foundations and is managed by Dr. Michael Zimmer, an assistant professor at the University of Wisconsin-Milwaukee’s School of Information Studies, and co-director of its Center for Information Policy Research.

The survey is part of ALA’s Choose Privacy Week and “Privacy for All” initiative, which conducted with the generous support of the Open Society Foundations.  Its website, www.privacyrevolution.org, provides access to privacy-related news, information and programming resources.

The American Library Association’s (ALA) Office for Intellectual Freedom established Choose Privacy Week in 2010 to help libraries work with their communities in navigating these complicated but vital issues.  It is a national public awareness campaign that aims to educate the public about their privacy rights and to deepen public awareness about the serious issue of government surveillance. The theme for Choose Privacy Week 2012 is “Freedom from Surveillance.”

For more information on Choose Privacy Week, visit www.privacyrevolution.org or contact Jennifer Petersen, ALA PR coordinator at (312) 280-5043, jpetersen@ala.org.

Zimmer, M. (2012). The ethical (re)design of the Google Books project. In iConference ’12 Proceedings of the 2012 iConference, 363-369. DOI: 10.1145/2132176.2132223

Today, the Google Books project is at a relative standstill — lawsuits against the project remain outstanding as the courts rejected a proposed settlement agreement. The failure of the original vision for the Google Books project to become fully realized presents us with a unique opportunity to ensure that whatever final form Google Books will take in the future, it is designed to support the values respected within the domain of information ethics. This paper will proposed an ethical re-design of the Google Books project, focusing on three core ethical values of primary interest to librarian and information professionals: privacy, intellectual freedom, and public access to information. Advocating for these values in the next iteration of the mass digitization service can help ensure that the informational norms of the library are embraced and upheld.

ALA conducting new survey about librarians and privacy

For Immediate Release
Tue, 12/13/2011 – 15:50

Contact: Barbara Jones
Office for Intellectual Freedom (OIF)

CHICAGO – The American Library Association’s (ALA) Office for Intellectual Freedom (OIF) is inviting librarians and library workers across the country to participate in a survey that will measure librarians’ attitudes about privacy rights and protecting library users’ privacy.

The survey is available online, and takes only 15 minutes to complete. All responses are anonymous and confidential:

http://tinyurl.com/ALAprivacysurvey

The survey, which builds on an earlier 2008 survey assessing librarians’ attitudes about privacy both within and outside of the library, will provide important data that will help ALA assess the state of privacy in the United States and help guide OIF’s planning for “Privacy for All,” ALA’s ongoing campaign to engage librarians in public education and advocacy to advance privacy rights.  The survey will be available until March 1, 2012.

The study is funded by a generous grant from the Open Society Institute and is managed by Dr. Michael Zimmer, an assistant professor at the University of Wisconsin-Milwaukee’s School of Information Studies and co-director of its Center for Information Policy Research.

Barbara Jones, director of the Office for Intellectual Freedom, encouraged all librarians and library workers to take the survey.  “After three successful years working on Choose Privacy Week and related educational programs, it is essential that we test our assumptions for the remaining years of the grant,” she said.  “We want ‘Privacy for All’ to create models for programming and services that librarians can use for various constituencies and community groups.  We can’t do that without your opinions.”

The “Privacy for All” initiative features Choose Privacy Week, an annual event that encourages libraries and librarians to engage library users in a conversation about privacy; and a website, privacyrevolution.org, that provides access to privacy-related news, information and programming resources.  In 2011 – 2012, “Privacy for All” and Choose Privacy Week will be focused on the topic of government surveillance, with an emphasis on immigrant and refugee communities’ use of libraries and youth attitudes about privacy.

Visit www.privacyrevolution.org to learn more about Choose Privacy Week and the resources available to help libraries engage their users in a conversation on privacy.

• Angela Maycock, assistant director, ALA Office for Intellectual Freedom
• Deborah Caldwell-Stone, deputy director, ALA Office for Intellectual Freedom
• Michael Zimmer, PhD, assistant professor, School of Information Studies at the University of Wisconsin-Milwaukee and co-director of the Center for Information Policy Research
• Ginger McCall, assistant director, Electronic Privacy Information Center’s (EPIC) Open Government Project

The webinar was recorded, and is available here.

My particular slides can be viewed below, and here are some of the resources I mentioned in my presentation:

• Pew Internet & American Life Project – Teen studies
• Youth, Privacy and Reputation (Literature Review)
• How Different are Young Adults from Older Adults When it Comes to Information Privacy Attitudes and Policies?
• Publications & presentations by danah boyd (Microsoft Research)

Emerging Privacy and Ethical Challenges for Libraries in the 2.0 Era

Tuesday, May 4, 2010
3:00pm – 4:30pm
Golda Meir Library, West Wing, 4th Floor Conference Center
University of Wisconsin-Milwaukee
Free and open to the public

Topics to be discussed include:

• What innovative online tools and services are libraries bringing to users, and what are the potential impacts on patron privacy?
• Are there privacy considerations for providing or controlling access to digital collections?
• How do current laws & policies protect patron privacy, and are any changes coming?
• What are the broader ethical responsibilities for librarians and information professions in the libraries of the future?

Featured panelists:

• Liza Barry-Kessler : privacy lawyer and co-author Privacy in the 21st Century: Issues for Public, School, and Academic Libraries
• Kristin Eschenfelder : associate professor, School of Library and Information Studies, UW-Madison
• Peter Lor : visiting professor, School of Information Studies, UW-Milwaukee, Past Secretary General, International Federation of Library Associations (IFLA)
• Michael Zimmer : assistant professor, School of Information Studies, UW-Milwaukee

The panel discussion is free and open to the public.

To complement the panel discussion, the UWM Libraries is also holding two days of hands-on workshops to help students learn about their privacy options on Facebook and related social media platforms.

[Facebook event page] [Promotional flier]

UPDATE: Video of the event can be viewed here.

In July 2009, Google posted a brief FAQ regarding privacy and Book Search, promising that the services provided under the Settlement will be bound by its general Privacy Policy, that it will only share aggregate usage data with the Book Rights Registry, that Google Accounts will not be required to access the services (although there will be some access limits for those who don’t login).

To most, including myself, this FAQ failed to sufficiently quell concerns over GBS’s impact on intellectual privacy and the freedom to read anonymously.

At the “Google Books Settlement and the Future of Information Access” conference organized by the UC-Berkeley Information School, I joined other advocates in calling on Google to be more forthright about the privacy concerns — and need for more specific protections — related to the GBS settlement and proposed infrastructure for accessing digital books. Google has insisted, however, than a more detailed privacy policy was impossible to construct since the actual technology has not yet been developed. Google’s Privacy Counsel, Jane Horvath, noted this apparent obstacle in an August 31, 2009 letter to the FTC:

Because the settlement agreement has not yet been approved by the court, and the services authorized by the agreement have not been built or even designed yet, it is not possible to draft a final privacy policy that covers details of the settlement’s anticipated services and features.

Sharing the concern of privacy advocates, the FTC refused to fully accept Google’s deferment, and urged Google to publish a privacy policy outlining Google’s specific privacy commitments for the Book Search product:

[I]t is important for Google to develop a new privacy policy, specific to Google Books, that will apply to the current product, set forth commitments for future related services and features, and preserve commitments made in the existing privacy policy.

As Google develops its new privacy policy, we urge Google to focus in particular on appropriately limiting secondary uses of data collected through Google Books, including uses that would be contrary to reasonable consumer expectations.

So, upon receiving this demand from the FTC, Google did what it has previously said was impossible: it published a Privacy Policy for Google Books.

:::

In announcing the publication of this privacy policy, Google notes that “Google Books has always been covered by the general Privacy Policy for all of Google’s services”, and in the policy itself it is stated that “Any publicly available product authorized by the settlement will have a privacy policy comparable to policies you can see in our Privacy Center today for other Google products.” While this sounds comforting, it is the very fact that Google intends to treat Book Search records with the same (and in many ways, limited) privacy protections as its other products that causes much of the concern.

As I noted in my remarks at the Berkeley event, there are particular expectations of privacy when it comes to seeking information in a library setting. The context of the library brings with it specific norms of information flow regarding patron activity, including a professional commitment to patron privacy. But the insertion of Google into this context raises an alarm, and merely promising that the same privacy standards of Web searching will apply is insufficient. Here’s why:

Searching for information on the World Wide Web was a new experience for most everyone. It was a new frontier of information-seeking, which developed its own business model, its own technical infrastructure, and its own technical standards and best practices, ones that rely heavily on the tracking and capturing of user data. Google has gone to some lengths to explain how & why it must track and collect user data for Web searches. Many people accept this as the norm for Web searchers: in order to benefit from what companies like Google have created, we need to acquiesce to this kind of tracking of our search activity. Yes, Google promises not to give to other people except in specific circumstances, but in general, people know and accept that Google can see what they’re searching for, and they keep and use that data for a variety of purposes. For most, that’s just the way the Web works.

But the context of the library is altogether different. In the library, users intellectual activities are protected by decades of established norms and practices intended to preserve patron privacy and confidentiality, most stemming from the ALA’s Library Bill of Rights and related interpretations. As a matter of professional ethics, most libraries protect patron privacy by engaging in limited tracking of user activities, having short-term data retention policies (many libraries actually delete the record that you ever borrowed a book once it is returned), and generally enable the anonymous browsing of materials (you can walk into a public library, read all day, and walk out, and there is no systematic method of tracking who you are or what you’ve read). These are the norms of the library.

With the proposed GBS settlement, we are talking about the de facto transfer of library practices (reading a book) to a Web-based infrastructure powered by Google (searching the Web). It will be reasonable to expect the same informational norms that exist in the library settings – limited tracking, short-term data retention, possibilities of anonymous browsing – to translate into the proposed digital system for browsing books. If these are the expected norms of information flow, we must ensure they are respected by any system designed for browsing digitized books. In short, the system must be conceived as an extension of the library – with its informational norms in tow – and not an extension of Google, burdened with its standard practice of gathering user information.

Unfortunately, the fact that Google repeats that Google Books will follow the same privacy policy of general Web searching means the norms of data collection of the Web will likely prevail over the norms of the library. All the reasons we are concerned about the privacy of our Web searches are now amplified with the possible emergence of a large-scale infrastructure to track and monitor book searches. This is part of why most advocates where disappointed with the privacy policy released by Google.

:::

That said, there is one hopeful difference in the privacy commitment laid out by Google. Google notes the existence of special protections, in some jurisdictions, protecting the the privacy of people’s activities in libraries:

Special legal privacy protections for users may apply in cases where law enforcement or civil litigants ask Google for information about what books an individual user has looked at. Some jurisdictions have special “books laws” saying that this information is not available unless the person asking for it meets a special, high standard – such as proving to a court that there is a compelling need for the information, and that this need outweighs the reader’s interest in reading anonymously under the United States First Amendment or other applicable laws.

This is an important recognition of how people’s actions in the library setting often deserve special protections (something I wish Google would recognize with all information-seeking activities). In response Google promises that (emphasis added): “Where these “books laws” exist and apply to Google Books, we will raise them.” Quite honestly, I don’t know what Google means by stating it will “raise them”. The most basic reading of this statement means that if the law exists, then Google will bring that law to the Court’s attention (as if the Court wouldn’t have already addressed it?). That’s not the same as a promise to require warrants, challenge subpoenas, or otherwise require compliance with these laws.

Perhaps I’m wordsmithing, but this is such an important issue, Google should be more precise in their intentions (which was the whole point of demanding this policy in the first place). Further, this seems to be yet another case where Google is thinking like lawyers about privacy, suggesting that “there are some laws that might protect readers’ privacy, and we’ll “raise them” when appropriate.” But it seems to be only the existence of such laws that prompts Google’s additional attention to the uniqueness of intellectual privacy.

What Google needs to do is think like a librarian, and do whatever it takes to ensure readers’ privacy and confidentiality is protected, regardless of what the law requires.

I speak last on a panel of esteemed experts, including Angela Maycock, Office for Intellectual Freedom, American Library Association; Tom Leonard, University Librarian, UC Berkeley; and Jason Schultz, Associate Director of the Samuelson Law, Technology & Public Policy Clinic at U.C. Berkeley School of Law; fellow, Electronic Frontier Foundation.

They will certainly cover all the important terrain, so my remarks will focus on my desire to trust Google when they say they’re “thinking hard” about these issues and promise to “protect readers’ privacy rights”, while noting their track record is reason enough to cause us some pause, and is why we’re pushing so hard as advocates on these vital concerns.

I will also suggest a few tactics they can take to engage in the ethical-design of the proposed service, and will close with a call for coders to help develop a version of TrackMeNot for Book Search, thereby giving some power back to the users to obfuscate their book search activities.

A rough draft of my remarks are here, and a pdf of my slides are here.

You can follow the tweet stream for the conference at #gbsfia.

UPDATE: PCWorld has some coverage of our panel discussion: “Privacy Missing From Google Books Settlement”, which was also picked up by the New York Times.

YouTube video of the panel presentation is here.

Notably, the Electronic Frontier Foundation and the ACLU have called on consumers to pressure Google to build significant privacy protections into its Book Search service, demanding Google provide protection against disclosure of the books one reads, engage in limited tracking of user activities, provide users control over the data Google collects, and ensure transparency and enforceability of all privacy-related policies and procedures. The Center for Democracy & Technology followed with their own analysis and set of recommendations.

In response (and actually before CDT was able to get their document out the door), Google posted a quick FAQ regarding privacy and Book Search. Google insists that the services provided under the Settlement will be bound by its general Privacy Policy, that it will only share aggregate usage data with the Book Rights Registry, that Google Accounts will not be required to access the services (although there will be some access limits for those who don’t login). Google also defends the absence of privacy provisions in the Settlement Agreement because that was a document stemming from a legal dispute over copyright.

While Google has tried to appease the critics, it seems there are still many unanswered questions regarding ensuring reader privacy if the settlement gets approved, both in principle and practice. I’ll be working through these issues as I prepare a talk for the “Google Books Settlement and the Future of Information Access” conference organized by the UC-Berkeley Information School, and I welcome any suggestions or insights readers might have.

For thousands of users, a book they thought they had properly purchased suddenly disappeared. This, unsurprisingly, caused considerable grief and consternation, arguing that “it‘s like Barnes & Noble sneaking into our homes in the middle of the night, taking some books that we’ve been reading off our nightstands, and leaving us a check on the coffee table.”

As reasonable as this user reaction sounds, a perusal of the Kindle’s terms of service reveals that users aren’t actually buying a book, but merely a license to utilize digital content on their device. While the TOS doesn’t directly state the license is revocable, it does indicate that the license is conditional on Amazon’s authorization, likely giving them the legal authority to remove books from a Kindle whenever they de-authorize its use.

So, yes, while it feels as if Barnes & Noble broke into your house to take back the book you purchased last week, the reality of licensing digital content is different than with brick and mortar. Clearly, we all need to do a better job educating consumers about content licenses, DRMs, and the nature of our digital tools.

But there is a much larger issue here that is being overlooked by many commentators: how simple it is for Amazon to simply take back what they sold you.

More than just an eBook reader, the Kindle is Amazon’s latest cog in its large-scale infrastructure of intellectual surveillance. Moving beyond its (now famous) ability to track one’s book purchases, wish lists, and clickstream activities on Amazon.com, Kindle gives Amazon the power to monitor and collect what you actually do with the books you buy license.

Ted Striphas describes this well in his discussion on “Kindle & the Labor of Reading” (emphasis added):

Much has been made about Kindle’s downstream capabilities—the fact that you can acquire the complete contents of any Kindle-formatted book in under a minute, provided you’re within range of a cell tower. But what about the data it transmits upstream, back to Amazon.com? The Kindle license agreement and terms of use are instructive in this regard. In the subsection entitled “Information Received,” the agreement states: “The Device Software will provide Amazon with data about your Device and its interaction with the Service (such as available memory, up-time, log files and signal strength) and information related to content on your Device and your use of it (such as automatic bookmarking of the last page read and content deletions from the Device).” Here’s the especially intriguing part: “Annotations, bookmarks, notes, highlights, or similar markings you make on your Device are backed up through the service and subject to the Amazon.com privacy notice.” And there, it’s worth mentioning, all of the data you generate while reading on your Kindle falls within the purview of “the information we [Amazon.com] collect and analyze” for marketing and related purposes.

This “snoop-friendly” nature of the Kindle is what made it effortless for Amazon to be able to reach in and take back Orwell’s words. The fact that Kindles users went to bed reading Orwell, and woke up the next morning with it suddenly stripped from their Kindles’ memory should be reminder to us all of the power Amazon maintains over readers. The ability to read freely and anonymously continues to be eroded before our (digital) eyes.

UPDATE: Please also read Jack Balkin’s post, where he comes to similar conclusions:

For centuries, we have understood, or rather believed, that owning books came with certain rights, including the right to keep what we purchase and to use it, mark it up, and sell it in any way we like. We were free to purchase books and keep them in our homes, without telling anybody what we were reading, or indeed, what page we had last looked at. Amazon’s Kindle system upends all of these expectations. Amazon knows what books you have on your Kindle, and, in theory, it can even know the book you are currently reading, and even the last page you’ve read on each of the books you own. It can delete books, add books, or modify books, all without your permission. It can change features of the Kindle at will. In upending our assumptions about our freedoms to read books in private and use them as we see fit, Amazon threatens many of the basic freedoms to read we have come to expect in a physical world. If we want to preserve these freedoms, we will have to reform copyright law and privacy law to control the new intermediaries who can control us at a distance.

Today, Fred Stutzman revealed a particularly troublesome example of how relying on the “My Library” feature of Google Book Search might mean you have even less privacy with regard to your online intellectual endeavors:

I was shocked to find out that saving a book to your library requires that the book be added to your “shared library”, a public listing tied to your Google account.

There is no way to save a book privately in Google Booksearch.  As Google writes in their FAQ, “When you add reviews, ratings, notes, or labels to a book—or when you add a book to your my Library page—that information will be publicly displayed on Google Book Search.”  They go on to write that “No matter where you use these features, the information you submit will be displayed publicly.”

I couldn’t believe it either.  If you want to set up a Google Library, even if it is just for convenience sake, you have to show the world what you’ve been reading.  As far as I can tell, there’s no good technical or legal reason why one can’t save a book privately, or limit their book-sharing to a group of friends.  This decision seems arbitrary and downright scary (or at least terribly ill-advised).

Stutzman points out the incongruence between Google’s policy and the American Library Association’s longstanding code of ethics, bill of rights, and core values, including their commitment to protecting patron privacy:

I must wonder why Google is not adhering to ALA policy, and the broader cultural norm of protecting library patron privacy.  As Google partners with large institutions and attempts to monetize Booksearch, failing to respect patron privacy seems foolish and potentially dangerous.  A patron researching a sensitive topic, or a topic that reveals information about the patron (for example, books about a health condition) will have their information revealed publicly if they add such a book to their library.

I also suggest a read of the comment thread on Stutzman’s post, where a suggestion has been made (channelling Zuckerberg) that all your favorited books should be public in an ideal world. Stutzman aptly counters such a proposition.

This is a serious design flaw (or a seriously flawed design decision). Google must act quickly to give users control over which books in their library are publicly viewable.