Risk-Assessment Approach to Digitization

Identifying Institutional Goals and Determining Reward

Digitizing archival and cultural heritage material and sharing it online has huge societal benefits. It makes unique resources widely available to students and scholars, helps address inequities in access to cultural resources, and makes cultural production or historically important records easily discoverable to a diverse audience including artists, genealogists, and academic researchers.

Because this work is central to the core service mission of cultural heritage organizations, it is important that a digitization project be well planned and well executed to best serve the needs of your institution and to have the maximum impact for your user communities. Before you start any digitization project, you should have a clear and well-articulated sense of the goals of the project and how the project aligns with and will advance your institution’s mission and support its values.

Assessing Your Institution’s Risk Tolerance

The level of risk your institution is willing to take on depends on a variety of factors and characteristics. An academic special collections unit with an educational mission and a business archives established to document and protect a brand and its trademarks will have very different approaches to sharing collection materials online. Similarly, private institutions may be more risk averse than state institutions. State institutions are protected by sovereign immunity, which is the legal doctrine that “a state cannot be sued in federal and state court without its consent.” Without sovereign immunity, private institutions found guilty of copyright infringement may be required to pay damages to the copyright holder as well as attorney’s fees and court costs (McCann, 2017). How do you determine the level of risk that your institution is willing to take on and make reasonable and responsible decisions and recommendations based on that known institutional risk tolerance?

Determining Institutional Risk Tolerance

General Counsel

One of the best places to begin to learn about the level of risk your institution may be willing to assume is your general counsel’s office. These offices can vary widely: Some institutions may have numerous attorneys, paralegals, and administrative staff, whereas others may be sparsely staffed. Regardless of the number of staff, your institution’s general counsel is best positioned to discuss institutional risk tolerance around copyright and other legal issues.

Sovereign Immunity

The consequences for infringing on copyright or other rights can be different and usually depend on your institution type and varying state laws. One issue to consider is whether your institution is protected by sovereign immunity, which is defined above. Some exceptions exist, including that sovereign immunity does not apply to counties and municipalities (Congressional Research Service, 2012).

This concept of sovereign immunity extends not just to state governmental entities but also to state institutions, such as state universities, state archives and libraries, and state museums. As a result, these cultural heritage institutions may have a higher risk tolerance because they cannot be sued for damages for copyright infringement. However, sovereign immunity does not completely eliminate copyright infringement liability. Individuals working at state institutions can be sued for injunctive relief (Burtle, 2021). And while the plaintiffs in these cases can’t seek damages as remedy, the cost of litigation can be punitively restrictive. Thus, even though state institutions are somewhat protected, this type of lawsuit can still be quite costly and have a chilling effect on cultural heritage institutions’ willingness to exercise their fair use rights.

Sovereign immunity applies only to state-supported and -affiliated institutions, not private ones and, as we have already mentioned, not counties or municipalities. Thus, entities such as private universities and public libraries, museums, and/or archives affiliated with cities or counties can all be sued for copyright infringement damages. Therefore, these entities tend to have lower tolerances for risk in reusing copyrighted works or engaging in other activities that might be characterized as infringing.

Understanding Potential Consequences

Consequences of copyright infringement for nonstate institutions can vary widely and are similar to the consequences that may be imposed on individuals if a judge finds that they have engaged in infringing activities. Judges may award actual damages (i.e., the amount of money the plaintiff has lost because of the infringing activities, which can be difficult to establish) or statutory damages in the amounts of $750 to $30,000 per infringement. If the judge decides that the infringement was willful (i.e., the defendant engaged in the infringing activities intentionally and deliberately), they can award damages to the plaintiff of up to $150,000 per infringement (see 17 U.S. Code § 504; Copyright Act, 1976g). In willful infringement cases, courts may also award court costs and attorneys’ fees to the prevailing party (see 17 U.S. Code § 505; Copyright Act, 1976h).

Determining Risk

What Types of Risk Might You Encounter?

Copyright

Copyright is the biggest consideration for most of us when assessing the various risks and rewards of sharing collection material online. A significant portion of 20th- and 21st-century unpublished manuscript and archival material and a fair amount of published material are still protected by copyright. The likelihood that a copyright holder would pursue a copyright claim against your institution, however, varies greatly depending on the age of the record, the record type, and the record creator. While there are certainly times when the fact that an item is in copyright will be a dealbreaker in the digitization process, there are also many instances when digitizing and disseminating copyrighted material is low risk and high reward.

There are some specific provisions and statutes of copyright law to bear in mind when considering an institution’s rights to digitize material and the associated risks:

• The Digital Millennium Copyright Act of 1998 (DMCA; U.S. Copyright Office, 1998) was passed to modernize and clarify how copyright is deployed in the internet age. Among other things, the act provides safe harbor provisions for online service providers (OSPs) in “four categories of conduct,” and each category “entails a complete bar on monetary damages, and restricts the availability of injunctive relief in various respects” (U.S. Copyright Office, 1998, pp. 8-9). In other words, as long as OSPs follow the stipulations in the DMCA, they do not have to pay money to anyone who thinks that they have allowed a user to post infringing content on their site or network. It’s important to note that in general, an OSP is defined very broadly as “a provider of online services or network access, or the operator of facilities therefor [sic],” so in lay terms, it can be thought of as any entity that has a website, which certainly includes almost all cultural heritage institutions (U.S. Copyright Office, 1998, p. 9) . The DMCA further stipulates that for an institution to qualify for the safe harbor provisions, it must have a DMCA agent (U.S. Copyright Office, 1998, p. 11). Most cultural heritage institutions designate an attorney in their general counsel’s office as their DMCA agent, and all must have the agent’s contact information on their website (see, for example, Emory University’s DMCA agent contact page).
• Fair use is a powerful provision in the Copyright Act that allows for use and reuse of copyrighted material for purposes such as criticism or commentary, teaching, scholarship and research, news reporting, and other common goods (see 17 U.S.C. § 107, Copyright Act, 1976d; see also U.S. Copyright Office, 2021). While fair use is a well-established legal doctrine, there are no hard-and-fast rules to determine whether a particular use of copyrighted material is a fair one. Instead, if a copyright infringement lawsuit is brought before a judge, that judge looks at four different factors (the purpose and character of the use, the nature of the original copyrighted work, how much of the copyrighted work was used, and the impact of the use on the market value of the original work) and makes a case-by-case determination of whether a particular use counts as a fair use or a copyright infringement. Many cultural heritage institutions make the case that, as educational institutions making material available for research and scholarship, their use is likely to be a fair one. The Association for Research Libraries’ Code of Best Practices in Fair Use for Academic and Research Libraries (2012) identifies as one of its principles that “it is fair use to create digital versions of a library’s special collections and archives to make these versions electronically accessible in appropriate contexts.” While there is support for this argument in the cultural heritage community, the only way to know for sure if a particular use is fair is to be sued and go to court for a ruling, an expensive risk that, understandably, not all institutions are interested in taking. If you are making digitized archival material accessible online because you think that the use is fair, you will need to know that your institution supports taking that stance. It is a good idea to document how you came to this decision and what considerations you weighed to show that you made the decision thoughtfully and in good faith.
• Congress acknowledged the significance of libraries and archives specifically in 17 U.S.C. 108 – Limitations on exclusive rights: Reproduction by libraries and archives (Copyright Act, 1976e). Here, Congress recognizes the limitations of copyright’s exclusive rights on the work of libraries and archives in preserving and providing appropriate levels of access to their materials. To uphold the public values of libraries, Congress put in place Section 108 to solidify the work of libraries and archives as a public good in alignment with the purpose of copyright to promote the progress of science and the useful arts. While the Section 108 exception is limited in the context of building digital collections, it does provide some brightline guidance around preservation and patron copies that can inform a risk assessment workflow. Additionally, Section 108(h) provides the structure for including cultural heritage materials in their last 20 years of copyright in digital collections.

Trademarks

Trademarks are symbols, logos, or words that represent a brand, company, or product and clearly distinguish it from other entities in the marketplace. A trademark gives the owner the exclusive right to use that trademarked word or image to distribute goods or services and helps protect against fraudulent impersonation of a brand or counterfeit products. Common examples of trademarks include corporate or brand logos such as the Nike swoosh or the Starbucks logo, product or brand names such as Tide or Doritos, words or phrases such as Super Bowl (trademarked by the NFL) or BAM! (trademarked by the chef Emeril Lagasse). Unlike copyright, which does have an expiration date, trademarks remain protected intellectual property as long as they are in active use.

Many collections contain items or documents that include trademarked brand names or logos. Sometimes these items are incidental within the collection such as when a CEO of a corporation writes a letter to a university president on company letterhead or when a grassroots LGBTQ organization has a file that includes a pamphlet published by the Human Rights Campaign that includes its distinctive equal-sign logo. In other instances, such as corporate archives, brand management and protecting and managing the use and dissemination of trademarked assets may be central to the purpose of the archive and its value to its parent institution.

While digitizing and disseminating collections that include trademarked material is not always or even often a violation of trademark law, it may still be worth considering whether the presence of trademarks in a collection could be problematic, especially if a brand is particularly protective of a trademark or regularly disseminates heritage brand content in a manner similar to a digital library-like presentation.

Right of Publicity

Right of publicity prevents an unauthorized commercial use of a person’s likeness, name, or identifying attribute (such as voice) and protects an individual’s right to have the exclusive ability to profit from their image or persona (International Trademark Association, 2022). The right of publicity is governed by state rather than federal laws, so it is explicitly protected only in some states. Others may include similar provisions in other laws related to personal privacy. It is important to note that while the right of publicity is explicitly about the commercial use of an individual’s likeness, disseminating the likeness of a highly private person or a person who is protective of their public persona even in a noncommercial context could come with heightened risk, and risk levels will vary by state.

Privacy

When considering the risk factors for sharing archival or other cultural heritage material online, there are two types of privacy considerations you need to take into consideration: statutory and ethical.

Certain state and federal laws govern what kinds of personal information about an individual other entities or institutions can or cannot share. Common examples are the Family Education Rights and Privacy Act (FERPA), which governs what information about a student educational institutions can make public, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which governs when and to whom a health care provider or insurer can release a patient’s medical records or medical information. HIPAA regulations do not apply to the majority of cultural heritage institutions, but if your institution is a HIPAA-covered entity or a hybrid entity like a healthcare center or an insurer, or you will want to confirm your status and make sure that you understand what information you can legally disclose and the legal risks associated with unauthorized disclosure of personal information. Similarly, if you work for an educational institution, you will want to be more mindful of the student records in your collections in light of FERPA. No current federal statutes afford privacy protection after death, so the age of records may be a factor in determining the risks associated with sharing the records online.

In addition to applicable laws, cultural heritage professionals have an ethical obligation to consider the privacy of the people and entities represented in our collections, and questions of personal privacy appropriately factor into decisions to digitize and make widely available documents in our collections. The Society of American Archivists in its Code of Ethics (2020) states, “Archivists recognize that privacy is an inherent fundamental right and sanctioned by law. They establish procedures and policies to protect the interests of the donors, individuals, groups, and organizations whose public and private lives and activities are documented in archival holdings.” Archivists must be mindful of third-party privacy concerns for two reasons: (1) to fulfill our ethical stewardship obligations and (2) to understand the risk of litigation or institutional reputational harm should we digitize and widely disseminate information about an entity that they could reasonably consider private or confidential.

For example, perhaps you work for a small historical society, and a respected local physician donates their papers to your organization. The papers they donate include the records of their private practice such as individuals’ medical records. Assuming that the historical society is not associated with a health-care organization and is therefore not a HIPAA-covered entity, you are not legally required to restrict or discard those records. But you may well decide that you have an ethical responsibility to protect the patients’ privacy, or you may determine that sharing patient records online in your small, close-knit community represents a violation of the community’s trust that you and your institution are unwilling to take.

Donor Relations

Cultural heritage institutions maintain personal, professional, and financial relationships with donors and other parties over time. These relationships are often of significant value to organizations. Donor relationships can be ongoing when agreements include future donation of additional material from a particular person or organization. A donor relationship can assist with collection development or help an organization establish and maintain financial and fundraising relationships. Donor relationships also inform parallel relationships within the communities we document. Digitizing and broadly disseminating records that would be embarrassing or uncomfortable for a donor or community partner carries the risk of doing damage to an important institutional relationship.

Institutional Reputation/Reputational Harm

Similarly, even when making the records in our repositories widely available poses no legal or ethical concerns, they may contain information that could do reputational harm to our archives or parent institutions either because they expose embarrassing truths about our organizations or because they could invite unwelcome scrutiny of our collaborative partners. In some types of repositories, the institutional transparency and accountability associated with disseminating records related to untoward institutional activities may be considered a positive fulfillment of the archival mission and a welcome deployment of archival values. In other organizations this exposure might be unwelcome. These factors are likely not legal risks to the organization, but the potential impact to an institution’s reputation and relationships should be considered and discussed candidly with administrators or senior decision makers when assessing a digitization proposal.

Practical Considerations

While much of the risk we have discussed so far is about legal, ethical, or reputational breaches, sometimes dealing with the fallout of a decision to digitize material simply isn’t worth the time and effort. Even if you are perfectly within your legal rights and making something available is both ethically sound and in line with your institutional mission, you may decide that engaging with challenging third parties or doing risk analysis on a particularly heterogenous or complex collection isn’t worth the risk of lost staff time or money that could occur. In the past two decades, resources for cultural heritage institutions have decreased significantly. We have fewer staff doing mission-critical work and fewer dollars to spend on things like licensing, so it is critical for us to deploy the resources we do have responsibly. If your limited staff do not have the capacity to conduct item-level rights research in high-risk collections and contact each rightsholder for permission to digitize works, it may be more strategic and a better use of resources to focus projects on low-risk collections or collections entirely in the public domain. It is always worth considering the opportunity cost of investing a significant amount of time and labor doing work on a project (whether that is doing copyright clearance or damage control) that results in other meaningful, mission-driven projects not getting done.

Identifying Risk Factors for Your Repository and Its Collections

We have just identified a number of potential factors that we may want to consider when determining how much risk our institutions may incur when making something from our collections publicly available online. But, of course, not all of these risks apply equally to all institutions, and the missions and purposes of different types of repositories will also influence a cultural heritage institution’s approach to sharing digitized material online. This section will provide some strategies for determining which of the risk factors we just identified are most likely to be present in a given type of collection or institution. By thinking categorically about record types and institutional goals, we hope to present scalable solutions for approaching risk and assessing digitization projects in a variety of organizations.

Institutional Purpose and Mission

There are many types of cultural heritage institutions, each with distinct missions, purposes, and obligations to parent institutions, boards, or community stakeholders. A repository that documents its parent institution such as a college or university archives or a corporate archives is likely managing a collection created primarily by their parent institution. These repositories will likely be less concerned about copyright risks (as their parent institution owns much of the copyright and intellectual property in a collection) and may be much more focused on matters of institutional reputation or trademark protection when considering what risks to incur when sharing digital content.

Alternatively, an archival repository with an educational or community-memory mission such as an academic library special collections department, a local historical society, or a community-based archives will likely weigh these considerations differently. These mission-driven special collections likely do not hold copyright in their collections, but they do hold material that is valuable to their users, so these institutions may spend more of their time weighing how much copyright-related risk they are willing to take on in order to advance their mission or fulfill other obligations to their communities of donors and users.

What Types of Collections Do You Hold?

Different kinds of records have varying levels of potential risk related to making them publicly available. Following is an exploration of a few examples commonly held in archives and special collections.

• Institutional records. The copyright risks associated with institutional records tend to be very low because your parent institution likely holds the copyright to the majority of the material that comprises these types of records, so the risks associated with copyright are generally negligible. However, institutional records may hold trade secrets; patent information; confidential records; or, depending on the type of institution, records that are covered by a statute such as HIPAA or FERPA.
• Records of artists, writers, or other creatives. Artists, writers, photographers, and other individuals or organizations that generate revenue by creating content are generally the donors who have the clearest interest in protecting the uses of their work. Creatives and their estates have a vested financial interest in protecting their copyrighted work; therefore, these types of collections tend to be some of the riskier collections to make available without clear licenses and permissions from the rightsholder(s).
• Business or organizational records. Many repositories hold the records of third-party businesses or community or civic organizations. Unlike artists and other content creators, most of these organizations do not profit from the ongoing use and licensing of their work and are often more interested in building awareness of their work than in protecting their intellectual property. In our experience, these types of donors often are not aware that the unpublished records they generate in the course of conducting organizational business are covered by copyright protection or that they may be copyright holders. Over time, business and organizational records have a higher likelihood than other types of records to become orphan works as the organizations that produced them go out of business or cease to exist as an incorporated entity. Additionally, the ARL Code of Best Practices in Fair Use for Academic and Research Libraries (2012) notes that it is best practice to consider digitizing and disseminating aggregations of copyrighted archival material a fair use: “Materials in special collections typically include significant amounts of primary sources and artifacts . . . whose value as historical objects for scholarly research is significantly different from their original purpose.” This highly transformative use is particularly true of organizational records where the purpose of using the records as a way to understand history is very different from the original purpose of running a business or advancing a cause. It is worth noting, however, that although copyright risk is generally lower for these records, there may be other types of risks, such as trade secrets present in the records, to be mindful of, especially if a business or organization is still active. Generally, however, making these records broadly available carries a lower risk than many other types of records.
• Collections of art. Works of art enjoy robust copyright protection; if the artwork is still in copyright, it may be riskier to make it broadly available than other types of material, especially if an original creator is still using and licensing the artwork in other ways.
• Published works. Published has a very specific meaning in copyright law: Under US copyright law, “publication is the distribution of copies or phonorecords of a work to the public by sale or other transfer of ownership, or by rental, lease, or lending. The offering to distribute copies or phonorecords to a group of persons for purposes of further distribution, public performance, or public display, constitutes publication. A public performance or display of a work does not of itself constitute publication”(17 U.S.C. § 101, Copyright Act, 1976a). The copyright to all works published in the United States more than 95 years ago has expired, and those works have entered the public domain. However, these works are not the only published works that are free of copyright protection. Current copyright law grants copyright to all published and unpublished works automatically, but for much of the 20th century, creators needed to formally assert or register copyrights or renew them after a period of time. If they did not do so, the work would enter the public domain. For example, anything published between 1927 and 1977 that doesn’t have an explicit copyright notice was never protected by copyright and is currently in the public domain. In many other cases, if a work was published with copyright notice, but that copyright wasn’t renewed, the work has entered the public domain. These facts mean that a far greater amount of material published in the 20th century in the United States is out of copyright than commonly thought. While the landscape of copyright formalities is complex, Cornell University Library (2022) maintains a helpful chart to help one determine the copyright status of a work.
• Sound or video recordings. Sound and video recordings can be tricky to assess from a copyright point of view because of the many possible layers of copyright holders in a recording. For example, in a musical recording the copyright for the musical composition is likely owned by the songwriter or the publisher of the sheet music, but the copyright in the recording is probably owned by the performer, producer, or record label. The landscape is even more complicated if the recording is unpublished. For unpublished recordings made before 1972, there are a number of possible copyright terms protecting recordings based on their date of original creation (U.S. Copyright Office, n.d.). These varying terms of protection can make it more complicated and time-consuming for a cultural heritage organization to make an accurate assessment of the risk they might be taking on by digitizing and disseminating sound and video recordings. As with any other media, if a recording is a commercial recording that someone is currently profiting from, that recording would be riskier to make available, and if a recording is noncommercial or doesn’t have anyone actively managing its rights and dissemination, it would likely be less risky.
• Government Records. The risk level associated with digitizing government records and making them available online varies depending on the government agency that created the record. Broadly speaking, in the United States, copyright protection is not available for works created by employees of an agency of the federal government, so those works are in the public domain. There are some exceptions to this rule for works created by federal contractors or for logos or trademarks used by agencies. Additionally, many (though not all) of the records created by federal legislators and judges are considered the personal papers of those individuals or offices rather than records of the federal government. The records of state and local governments are regulated by local laws and differ from state to state. Nations other than the United States, of course, have their own statutes and regulations covering the copyrightability of their state-produced records. When assessing risks related to government records one should also be mindful of whether records contain classified or potentially classified documents.

Some Key Questions to Ask Yourself

Is someone actively managing or making money from this content? This situation is most common in the collections of writers, artists, photographers, or other people working in creative fields. For artists, their heirs, or cultural organizations that make a living on the creative work that they produce, controlling and managing their intellectual property may be an important factor in their current livelihood and legacy planning. These individuals or organizations often have a high economic stake in protecting the rights they have in their work, which may make digitizing and publicly disseminating the work a riskier undertaking from both a copyright and a donor-relations perspective.

Does a known copyright holder exist? Works that are in copyright but don’t have a clear copyright holder that can be identified or their copyright holder is impossible to contact are collectively known as orphan works. Examples of orphan works may include a pamphlet that was published anonymously, a work where the original copyright holder is deceased and their heirs are not locatable, or the records of an organization that has dissolved or gone out of business. These works are generally going to carry a lower risk to reproduce or disseminate than works with active copyright managers, but the fact that they are known to be in copyright is a risk factor.

What is the age of the material? Unpublished material enjoys copyright protection for 70 years after the death of the creator. Therefore, unpublished records from individuals who died more than 70 years ago may not be as risky to digitize and disseminate as something more recent. Similarly, records created by or about deceased individuals or defunct organizations may have fewer stakeholders invested in someone’s work or reputation and therefore carry less risk of harming a relationship between a donor and a cultural heritage organization. In the context of an institutional archives, recent Board of Trustees or Board of Directors meeting minutes could contain confidential material about ongoing projects, plans, or budgets, but it is highly unlikely that the same confidentiality applies to minutes from the 1920s. There are few magic numbers in this equation, but in general older records carry less risk to digitize and disseminate than more recent records.

What kind of people are represented in the collections? Does this collection contain juicy correspondence that discloses secrets about famous people? Does the collection include material by a public figure who is very protective of their public image (or whose family and estate is)? Does the collection contain documents about a third-party private citizen who does not know a compatriot donated material to the archives that may end up online? Even if a collection of this nature is out of copyright, there may be other risks associated with digitizing and disseminating it that an institution will want to consider.

Is the majority of the material published or unpublished? Copyright terms are different for published and unpublished material. Additionally, the publication status is one to consider if your institution is making an argument that digitizing material is fair use. Again, the Cornell University Library’s Copyright and the Public Domain website (2022) is a helpful tool when assessing the copyright status of both published and unpublished works.

Does the collection contain a significant number of medical, educational, psychiatric, or attorney/client records? Some communications between professionals and their clients are considered privileged information and often contain disclosures made with the understanding that these communications are highly confidential. While in most cases it is the responsibility of the professional (e.g., the attorney, doctor, therapist, etc.) to maintain this confidentiality, making these records publicly available online would present serious ethical questions for a cultural heritage institution.

Mitigating Risk

Once you understand the level of risk tolerance at your institution, you can start thinking about ways to mitigate risk. Consider the following characteristics of a hypothetical collection at your institution:

• The donor is the copyright holder for 75% of the materials in the collection.
• The copyright holder is known to be litigious and protective of their rights.
• The copyright holder is continuing to actively license works from the collection for use in books, documentaries, and journal/magazine articles.
• The materials are clearly in copyright and will remain so for many decades.
• The items in the collection are highly creative, and some are unpublished.

Contrast the characteristics above with the following ones:

• The copyright holder is unknown for most works in the collection, so they are classified as orphan works.
• There is no licensing market for the works in the collection.
• The date of creation for the materials clearly indicates that they are no longer protected by copyright.
• The collection largely contains factual, published material.

You could consider these characteristics as opposite ends of a spectrum with many shades of gray in between. The top collection would be highly risky, and the bottom one would entail almost no risk. Your job is to determine where your collection falls on this spectrum and act accordingly.

Digitizing and Sharing Collections Online

If your institution has a goal to share its collections in an equitable fashion that allows anyone with an internet connection to access them, you can mitigate the risk of sharing in many ways. Here are some hypothetical examples: your institution could share digital images of materials from a very low-risk collection in high resolution and large format, users could be allowed to download and save the images, and the images could be available to anyone globally. For a collection that’s very high risk, you might not make it available online at all – it would only be available in your reading room. Further details on this spectrum can be found in Table 2.1.

Table 2.1. Example: Spectrum of Risk for a Hypothetical University

Criteria	Collection is very low risk	Collection is low risk	Collection is medium risk	Collection is high risk	Collection is very high risk
Resolution?	Full resolution	Full resolution	Low resolution	Low resolution	Not available online
Format?	Large format	Large format	Small format	Thumbnail only	Not available online
Availability?	Global availability	Global availability	Global availability	Available to campus only	Reading room availability only
Download?	Download allowed	No download allowed	No download allowed	No download allowed	Not available online

Disclaimer: It is critical to remember that institutional risk can vary greatly from one institution to the next. This table represents one possible method for mitigating risk and should not be applied without completing your own institutional risk assessment.

Takedown Policy

Having a takedown policy that allows creators to request removal of copyrighted material from digitized archival collections is a common practice that demonstrates that institutions are acting in good faith. Furthermore, the DMCA stipulates that to qualify for the safe harbor provisions in the law, OSPs must establish a process that allows copyright holders to register a notice with the OSP stating that they believe the OSP has infringed their copyright by sharing materials online. When the OSP receives the notice, it must remove the materials in question and determine whether the claimant has a valid complaint (see 17 U.S. Code § 512; Copyright Act, 1976i). Because of these DMCA stipulations, many cultural heritage institutions have created takedown policies that outline this process and make it clear that they are complying with the law. These actions help mitigate risk, and many examples can be found online:

• Emory Libraries’ Digital Collections Copyright and Content Policy
• NYU Libraries’ Notice and Takedown Policy
• HathiTrust Digital Library’s Take-Down Policy
• University of Wisconsin – Madison Libraries’ Take-Down Policy: Addressing Copyright Concerns
• Duke University Libraries’ Deaccession and DMCA Takedown Policy

Documentation

Cultural heritage institutions can also mitigate risk by ensuring that they have policies and workflows to determine whether they can share materials online and by documenting these policies and processes. Well-articulated policies ensure that institutions are taking an intentional, considered, and consistent approach to managing risk. Documenting these policies as well as how you have reached your decisions about copyright and other risks further strengthens an institution’s position in case there is ever a legal challenge. U.S. copyright law includes a section (see 17 U.S. Code § 504(c)(2); Copyright Act, 1976g) that reduces damages when you can prove that you thought you were acting within the confines of the law, so robust documentation is an important way to show what basis we made our decisions on, what research we undertook, and otherwise demonstrate that we were acting in good faith that our use was a legally allowable one.

Exercise: Practical Strategies for Mapping Risk Factors to Your Institution’s Collections

One tool that we developed at Emory to help us make high-level assessments about the potential risk of digitizing and making available a whole or part of a library collection was a Rights and Risk Matrix.

For the major types of collections that we tend to have in the Rose Library (personal papers, literary collections, organizational records, various types of Emory University records), the matrix identifies the most common series or record types that each kind of collection contains, identifies external risk factors that may impact our ability to make the records available publicly online, and then combines these factors to indicate the likely level of risk associated with making that category of material available. The matrix is intended to help archivists, librarians, and curators identify both potential red flags and easy paths towards digitization and dissemination of collection material.

In this exercise you will create your own risk assessment matrix for your institution based on the types of collections that you hold and your institution’s risk tolerance, or you will assign risk categories to the blank matrix we designed at Emory (see Appendix B) based on the level of risk your institution is likely willing to take on.

1. List the major types of collections your repository holds (personal papers, institutional records, etc.).
2. Then think about what major types of records you often encounter in those types of collections (personal papers may include correspondence, subject files, diaries, or journals, etc.)
3. Identify any risk modifiers that would make any given risk category either more or less risky than it might otherwise be. For example, a nonliving creator may indicate less risk, and a living, highly-litigious or very private creator may be an indicator of higher risk. Similarly, the relative age of the records may be a useful risk modifier for your institution and its collections. For organizational records the risk modifiers might be things like whether the organization still exists, or whether the organization did work that might make it higher risk (examples may be an arts organization that may be more protective of copyright, or an activist organization whose members may have engaged in protest actions that could be prosecuted or retaliated against).
4. Identify your risk categories. These are likely some combination of copyright status and additional risk considerations. Some examples may be the following:
   1. likely out of copyright, low/no risk
   2. likely out of copyright, higher risk
   3. in copyright/likely in copyright, strong fair use argument
   4. likely in copyright, low risk
   5. likely in copyright, medium risk
   6. likely in copyright, high risk
   7. Our institution owns copyright, restricted or high risk
   8. Our institution owns copyright, low risk
   9. More research required to make a responsible decision
5. Assign a color to each of your risk categories.
6. Create a matrix (a simple spreadsheet is a good tool for this) with record types (grouped by collection type) on your y-axis and risk modifiers on your x-axis.
7. Assign each cell a risk category/color (for the combination of record type and risk modifier) based on how your institution would rank the risk levels of that category.