Administrative Law

(posted by Peter Hirtle)

So Google, perhaps in response to Mary Minow's post, has issued a new privacy policy for Google Books.  To no one's great surprise, EFF finds it a good start but insufficient.

I would point out that Google's statement is entirely compatible with current library standards for confidentiality in licensed resources.  Specifically, it begins by stating that "We do not share your personal information with third parties, except in the narrow circumstances described in the Privacy Policy, such as emergencies or in response to valid legal process."  The CLIR/DLF Model License has this to say about confidentiality:

Licensor and Licensee agree to maintain the confidentiality of any data relating to the usage of the Licensed Materials by Licensee and its Authorized Users. Such data may be used solely for purposes directly related to the Licensed Materials and may only be provided to third parties in aggregate form. Raw usage data, including but not limited to information relating to the identity of specific users and/or uses, shall not be provided to any third party.

Similarly, SERU, Shared E-Resource Understanding, has this to say on confidentiality of user data:

The subscribing institution and the publisher respect the privacy of the users of the content and will not disclose or distribute personal information about the user to any third party without the user?s consent unless required to do so by law. The publisher should develop and post its privacy policy on its website.

And the International Coalition of Library Consortia's statement on "Privacy Guidelines for Electronic Resources Vendors" gives two primary requirements: that publishers do not share information with 3rd parties and that they have a published privacy policy. 

The bottom line: Google is more than compliant with current library standards for 3rd-party privacy protection.  EFF argues that "Given the important free expression interests at stake and the long history of protecting reader privacy by libraries and bookstores, readers need a durable guarantee of protection enforceable by a court."  No library has been demanding such a guarantee before now.  One has to wonder if the current criticism of Google wouldn't be better directed at libraries and their privacy requirements when working with outside vendors.