Zoia Horn’s story is one New York Public Library Director of Privacy and Compliance William Marden, CIPP/US, loves to tell. In the early 1970s, Horn, the chief reference librarian at Bucknell University, was called to testify in the conspiracy trial of the “Harrisburg Seven” anti-war activists.
In a written statement to the judge, in which she refused to testify, Horn said, the country stands on freedom of association, freedom of speech and freedom of thought, adding, “government spying in homes, in libraries and universities, inhibits and destroys this freedom.” She was jailed for 20 days.
Marden said Horn’s is the first known case of a librarian being jailed for protecting privacy principles. Those principles carry on at libraries today, he said, long-established by the American Library Association, even before the days of the internet.
“People have come to realize that libraries are a place where your information is kept more confidential than almost any other place,” Marden said. “People think of libraries as safe places. We want to make sure that they continue to think that way.”
Working in the library world early on in his career, then transitioning into compliance and regulatory work at Citi Group and JPMorgan Chase for more than 15 years, Marden, a longtime user of the NYPL, was drawn back into the field in 2015 when he found the privacy position opening posted on the library’s website.
Founded in 1895, The New York Public Library’s website says it is the nation’s largest public library system, serving more than 17 million patrons a year and holding more than 55 million items, from books and e-books to renowned research collections. NYPL includes 88 neighborhood branches in the Bronx, Manhattan and Staten Island, as well as four scholarly research centers.
Patrons range from students turning to NYPL facilities for resources, to members of the city’s immigrant communities depending on language assistance, to renowned researchers and Nobel Peace Prize winners, Marden said. And beyond the library’s print collection, its facilities are a resource for millions of New Yorkers who don’t have computer or internet access at home, and its e-reader application offers more than 300,000 e-books.
“We serve an entire spectrum of patrons and users, so that becomes part of my challenge, trying to address that very wide spectrum,” he said.
Marden, who believes he is the first full-time privacy officer at a library in the U.S., created a privacy advisory committee that is currently working on a revision of the NYPL’s privacy policy that will ultimately be approved by the organization’s board of trustees. He has worked to train front line staff on the basics of privacy principles, a collaboration with library systems in Brooklyn and Queens, and created a data inventory in which library departments input what data is collected, how, where it is stored, how long, who has access to it and more.
Most recently revised in 2016, the organization’s privacy policy “needs refreshing,” Marden said and will include updates in areas like third-party resources and network security. Part of the revision is aimed at helping patrons understand “we have their back,” Marden said. Patrons often have privacy questions, like whether the facility maintains a record of their computer activity. An FAQ that is being created alongside the new policy will address such questions in a more streamlined way, he said.
“It goes back to libraries are trusted resources,” Marden said. “That also becomes a key part of my job, making sure that those assurances remain true because we’re all aware that technology changes at the speed of light. The technology is changing so quickly that we’re always working to keep up, and I think we have, but it is a constant day-to-day effort.”
As the library relies on third-party offerings, like its circulation system, Marden said he works to ensure third-party contracts “are really buttoned up.” He instituted a full vetting of third-party contracts involving the purchasing, finance, IT, legal and risk departments. When he sees a new contract, Marden said he “digs into it,” reviewing the product in full detail and finding companies are often receptive to requested changes that may need to be made on behalf of patrons.
“It taught me that you can move the rock up the hill on some of these things,” Marden said.
The pandemic has moved the NYPL’s operations even more into the digital space, Marden said, as branches closed to the public in March and programs transitioned to remote platforms, like Zoom and Google Meets. E-books have “skyrocketed in terms of popularity,” and digital library cards enable access for anyone living in New York.
Whether it is more traditional uses of the library or these more modern offerings, Marden said his work is guided by an appreciation for patron trust and transparency around their data.
“We respect (patrons') use of the library and their trust, and we safeguard their privacy throughout the data lifecycle. Library confidentiality is important because, without that, freedom for intellectual inquiry would come to a stop. It would be a chilling effect for people’s desires to freely explore thoughts and ideas,” he said. “People will ask me, 'What do you have to protect about privacy in a library, what books people borrow?' No, but maybe what computer searches you did, what books you did look for, you’re using a certain database system that might be collecting certain information. Those are important things for people to know.”
IAPP CEO and President J. Trevor Hughes, CIPP, will host Marden during the IAPP's "Profiles in Privacy" series March 24 on LinkedIn Live.
Photo by Susan Yin on Unsplash
