Privacy and Confidentiality Issues in Digital Archives

Library of Congress, "Perfect harmony. Washington, D.C., Nov. 2. Seems that Rep. James W. Wadsworth, Republican of New York, is getting a bit of confidential arms information"

On August 17, I joined the SAA pre-conference workshop on “Privacy and Confidentiality Issues in Digital Archives.” It’s a DAS course and was taught by Heather Briston from UCLA. This was one of those courses on the DAS prep sheet that had no reading list. Super frustrating if you haven’t taken the course, right? So here are some of the readings included in the course packet, with added information.

These policies will take time to read and consider. My goal is to return to this post and general topic as I work to refine institutional policies. I’m so grateful that our peers make this work available.

General Overview:

Read up on HIPPA and FERPA. Learn about why HIPPA is retroactive and how FERPA has no end date for unrestricting records. Engage in SAA discussions on these policies.

Thinking about Privacy and PII (Personally Identifiable Information):

Policies and Forms:

For Archivists:

  • Penn State – Deed of Gift Addenda for collections with electronic records
  • HIPPA, Tulane University – Business Associate Agreement
  • Missouri State Archives, Deed of Gift
    • “Materials which have been restricted from access shall be reviewed by the Missouri State Archives from time to time and any Materials which, because of the passage of time or other circumstances, no longer require such restrictions shall be opened to public access.”
  • SAA Museum Archives Section Working Group, NARA/Generic Deed –
    • “Archivist shall have the Materials reviewed and for the present shall restrict from public access the following classes of material …”
  • Minnesota Historical Society, Electronic Records Management Guidelines
  • Bentley Historical Library Web Archives: Collection Development Policy
    • “On July 1, 2010 the Bentley Historical Library initiated its subscription to the California Digital Library’s Web Archiving Service (WAS) in an effort to preserve online resources in a more efficient and cost-effective manner. This arrangement permits archivists to focus on the identification, appraisal, and description of content while the California Digital Library (CDL) supports the requisite hardware and software infrastructure”
    • Also read Appendix A, Sample Communication to University of Michigan faculty [about archiving their web pages]

For Researchers:

  • UC Irvine – Application for the Virtual Reading Room in UCIspace @ the Libraries
  • Rules of Use for the Virtual Reading Room in UCIspace @ the Libraries
  • NARA – Reconciling FOIA and the Privacy Act
  • Alaska State Archives – Researcher Agreement (on the last page) –
    • “I acknowledge individual and personal responsibility for respecting State and federal privacy laws and regulations. I will not use any privacy protected information contained in records in a manner that would tie the information to a specific individual. I will treat any confidential information I encounter with strict confidence and will take reasonable precautions to prevent disclosure, directly or indirectly, to any other parties, unless I have received written permissions to disclose from the State Archivist and/or other parties involved.”
  • New York State Archives Policy on Access to Records –
    • “For the most part records are restricted pursuant to specific state and federal statutes. Examples with specific statute restrictions are psychiatric center patient records, bank examination reports, and Moreland Act commission investigative records.” (Does a good job explaining all laws/policies to potential users)
  • Tufts University, Digital Collections and Archives, Access Policy –
    • “For university records, some restrictions are mandated by laws such as FERPA (Family Educational Rights and Privacy Act) while others are determined by the DCA in conjunction with the records creating department or office. All unprocessed records are restricted.”
  • Archives of the University of Notre Dame, Access to Records –
    • “Generally speaking, records in the University Archives will be open for use under the supervision of the University Archivist by anyone, including outside researchers, 72 years after the date of their creation, except for student records, faculty and other personnel records, personal medical records, and any other records restricted by federal or state law”
  • UPenn, Protocols for the University of Pennsylvania Archives and Records Center –
    • “The following types of records will be absolutely closed …”
  • University of Wisconsin-Milwaukee, Access Policy
    • “The Archives Department is committed to preserving university records and manuscript collections and making them available for research as soon as possible after receipt. At the same time, the department may have a legal, institutional, or other obligation to restrict access to some collections or parts of collections. The Archives will inform researchers of the conditions governing access to its collections.”
  • University of Michigan, Bentley Historical Library, Categories of Restricted Records
    • “Personnel related files, including search, review, promotion, and tenure files, are restricted for thirty years from date of creation. Student educational records are restricted for seventy-five years from date of creation. Patient/client records are restricted for one-hundred years from date of creation. Executive Officers, Deans and Directors files University records generated by the university’s Executive Officers, Deans, Directors and their support offices are restricted for a period of twenty years from their date of accession by the Bentley Historical Library. The restriction is subject to applicable law, most notably the Freedom of Information Act (FOIA).”
  • Yale University, Beinecke Rare Book & Manuscript Library, Permissions and Copyright
    • “Unlike copyright, which is subject to the federal Copyright Act of 1976, privacy and publicity rights are subject to state laws; hence, what may be permitted in one state may not be permitted in another. Although fair use is a defense to copyright infringement, it is not a defense to claims alleging violation of privacy or publicity rights … You are solely responsible for addressing issues of privacy and publicity rights relating to your use of the materials.”
  • Princeton University Library Finding Aids, American Civil Liberties Union Records, Access and Use,
    • “Some material in the ACLU Subgroup 3 must be reviewed for legal restrictions prior to research use. Please submit requests for material at least 10 business days before visiting the library to allow time for this review.”
  • American Heritage Center, Copyright Information –
    • “By use of AHC websites and content, including AHC digital collections, and any data contained therein, the user agrees that use shall conform to all applicable laws and regulations and user shall not violate the rights of any third parties. Both the laws of the State of Wyoming, U.S.A.—Title 6 of the Wyoming Statutes, Crimes and Offenses, Chapter 3, Article 5, Computer Crimes (Wyo. Stat. ‘ 6-3-501 et seq.)—and the laws of the United States—Title 17, United States Code, Copyright—govern liability for misuse of the contents of this site.”
    • “Digitized collection materials are accessible for educational and personal research purposes. If you are the copyright owner of material found on AHC websites and believe the AHC has used your work beyond fair use and without permission, we want to hear from you. If there is a problem, we will remove the material from public view while we look into it. Please contact us via this online form.”
  • Archdiocese of Atlanta, Access Policy
    • “To ensure privacy and confidentiality, access to Sacramental Records and Student Files is restricted to individuals seeking their own records, or guardians or individuals with power of attorney for the person named in the record. Exceptions must be approved by the Chancellor and are generally only granted for records dated prior to 1930.”
  • Diocese of Charleston Archives
  • The Archival Center at San Fernando Mission, Access Policy
  • Getty Research Institute, Access Policy and Researcher Privileges
  • IBM Archives: Access Terms and Conditions –
    • “By requesting material from the IBM Corporate Archives, you are indicating your awareness that you are responsible for conforming to copyright, right-to-privacy, libel, slander, and any other applicable statutes. Furthermore, you are agreeing to indemnify and hold harmless the IBM Corporation and any of its related entities, their officers, employees and agents from any and all claims resulting from the use of the materials provided to you by the IBM Corporate Archives.”


The course also included a bibliography of sources – those will be covered in another blog post.

The biggest take away from this course is MAKE POLICIES, and make your staff and users aware of them. Don’t make a decision on-the-fly about what to restrict. Consult local, state, and federal laws. Discuss institutional norms and ethics. Review SAA Ethics. And always revisit your “closed” collections – have norms shifted? Have stakeholders passed away? Open collections when you can and document all reasons why there are restrictions, and how they apply. 

Leave a comment

Your email address will not be published.