03-19082. Family Educational Rights and Privacy Act

AGENCY:

Department of Education.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Secretary proposes to amend 34 CFR part 99 to implement the Department's interpretation of the Family Educational Rights and Privacy Act (FERPA) identified through administrative experience as necessary for proper program operation. These regulations would provide general guidelines for accepting “signed and dated written consent” under FERPA in electronic format.

DATES:

We must receive your comments on or before September 26, 2003.

ADDRESSES:

Address all comments about these proposed regulations to LeRoy Rooker, U.S. Department of Education, 400 Maryland Avenue, SW., room 2W119, Washington, DC 20202-4605. If you prefer to send your comments through the Internet, use the following address: [e-mail].

FOR FURTHER INFORMATION CONTACT:

Kathleen Wolan, U.S. Department of Education, 400 Maryland Avenue, SW., room 2W115, Washington, DC 20202-4605. Telephone: [phone].

If you use a telecommunications device for the deaf (TDD), you may call the Federal Information Relay Service (FIRS) at 1-800-877-8339.

Individuals with disabilities may obtain this document in an alternative format (e.g., Braille, large print, audiotape, or computer diskette) on request to the contact person listed under FOR FURTHER INFORMATION CONTACT.

SUPPLEMENTARY INFORMATION:

Invitation To Comment

We invite you to submit comments regarding these proposed regulations. We also invite you to assist us in complying with the specific requirements of Executive Order 12866 and its overall requirement of reducing regulatory burden that might result from these proposed regulations. Please let us know of any further opportunities we should take to reduce potential costs or increase potential benefits while preserving the effective and efficient administration of the program.

During and after the comment period, you may inspect all public comments about these proposed regulations in room 2W115, 400 Maryland Avenue, SW., Washington, DC, between the hours of 8:30 a.m. and 4 p.m., Eastern time, Monday through Friday of each week except Federal holidays.

Assistance to Individuals With Disabilities in Reviewing the Rulemaking Record

On request, we will supply an appropriate aid, such as a reader or print magnifier, to an individual with a disability who needs assistance to review the comments or other documents in the public rulemaking record for these proposed regulations. If you want to schedule an appointment for this type of aid, please contact the person listed under FOR FURTHER INFORMATION CONTACT.

Background

The Department has developed these proposed regulations in accordance with its “Principles for Regulating,” which are intended to ensure that the Department regulates in the most flexible, equitable, and least burdensome way possible. The Secretary proposes these regulations and believes they are necessary to implement the law and give the greatest flexibility to local governments and schools. In addition, these regulations minimize burden while protecting the rights of parents and students.

Significant Proposed Regulations

The following is a summary of the regulatory provisions the Secretary proposes. These provisions interpret statutory text. The Secretary is not authorized to change statutory requirements. Commenters are asked to direct their comments to the regulatory provisions that would implement or interpret the statute.

Statute: FERPA provides that an agency or institution may not have a policy or practice of disclosing personally identifiable information from education records without the “written consent” of the parent or eligible student, subject to specified exceptions. 20 U.S.C. 1232g(b)(1).

Current Regulations: Regulations codified at 34 CFR 99.30 provide that written consent must be “signed and dated” and must specify the records to be disclosed, the purpose of the disclosure, and the party or class of parties to whom the disclosure may be made.

Proposed Regulations: Proposed § 99.30(d) provides general guidelines for educational agencies and institutions that choose to meet the requirements of § 99.30 with records and signatures in electronic format.

Reasons: The Department has received numerous inquiries whether some form of electronic consent and signature, including e-mail, satisfies FERPS's written consent requirement.

The requirements of a valid signature, including various forms of electronic signature, are generally established under State rather than Federal law. However, Congress has enacted at least two Federal statutes to encourage the use of electronic signatures and records. The Government Paperwork Elimination Act (GPEA), Pub. L. 105-277 (effective October 21, 1998) applies to filing forms electronically with Federal agencies. The Electronic Signatures in Global and National Commerce Act (E-Sign), Pub. L. 106-229 (effective October 1, 2000) validates and establishes general standards for use of electronic signatures and records in interstate commerce that remain in place pending a State's adoption of some form of the Uniform Electronic Transactions Act (UETA).

E-Sign, UETA (where enacted in State law), and the GPEA validate the use of electronic records and signatures in contracts and other legal transactions. The Department concludes that educational agencies and institutions may use electronic records and signatures for written consents governed by FERPA to the extent that the procedures used for creating and storing the electronic records and signatures comply with these proposed regulations.

This discussion, as well as the proposed amendment to § 99.30, constitutes general guidance for the use of electronic communications in meeting certain FERPA requirements. The proposed amendment does not specify desired methods but instead contains general guidelines, adapted from concepts contained in E-Sign, GPEA, and UETA, to help ensure that FERPA's privacy protections are not compromised when records are disclosed pursuant to electronic communications. The Family Policy Compliance Office may issue further guidance concerning electronic records and signatures.

FERPA is technology-neutral with respect to how to meet disclosure and signature requirements. In cases where FERPA requires a signed and dated written consent under § 99.30 for a disclosure, such as issuance of a transcript to an employer, there proposed regulations specify that an agency or institution may accept electronic consents and signatures when reasonable security is provided for the process. In particular, the process must:

• Establish a reasonable way to identify the individual and authenticate the identity of the particular eligible student or parent as the source of the electronic message or record requesting access or consenting to the disclosure of education records (authentication);
• Attribute the electronic signature to the unaltered message or document to prevent repudiation by the sender (attribution);
• Verify the integrity of the signed message or document in transmission and upon receipt (integrity or security of transmission); and
• Document the requester's approval of the text contained in the electronic message.

While agencies and institutions are not limited to any particular technology or method, the Department considers electronic signature standards established under the Federal student loan programs to satisfy the written consent requirement in FERPA. You may view those standards on the Internet at the following Web site: http://www.ifap.ed.gov/​dpcletters/​gen0106.html

Executive Order 12866

1. Potential Costs and Benefits

Under Executive Order 12866, we have assessed the potential costs and benefits of these regulatory actions.

The potential costs associated with these proposed regulations are those resulting from statutory requirements and those we have determined to be necessary for administering this program effectively and efficiently.

In assessing the potential costs and benefits—both quantitative and qualitative—of these regulatory actions, we have determined that the benefits would justify the costs.

Summary of Potential Costs and Benefits

FERPA requires an educational agency or institution to obtain “written and signed” consent from a parent or eligible student before the educational agency or institution discloses education records. These proposed regulations would provide additional flexibility for educational institutions and agencies in meeting the existing consent requirement. These proposed regulations would not require that an educational institution or agency participate in the electronic format option.

2. Clarity of the Regulations

Executive Order 12866 and the Presidential Memorandum on “Plain Language in Government Writing” require each agency to write regulations that are easy to understand.

The Secretary invites comments on how to make these proposed regulations easier to understand, including answers to questions such as the following:

• Are the requirements in these proposed regulations clearly stated?
• Do these proposed regulations contain technical terms or other wording that interferes with their clarity?
• Does the format of these proposed regulations (grouping and order of sections, use of headings, paragraphing, etc.) aid or reduce their clarity?
• Would these proposed regulations be easier to understand if we divided them into more (but shorter) sections? (A “section” is preceded by the symbol “ § ” and a numbered heading; for example, § 99.30 Under what conditions is prior consent required to disclose information?)
• Could the description of these proposed regulations in the SUPPLEMENTARY INFORMATION section of this preamble be more helpful in making these proposed regulations easier to understand? If so, how?
• What else could we do to make these proposed regulations easier to understand?

Send any comments that concern how the Department could make these proposed regulations easier to understand to the person listed in the ADDRESSES section of the preamble.

Regulatory Flexibility Act Certification

The Secretary certifies that these proposed regulations would not have a significant economic impact on a substantial number of small entities.

The small entities that would be affected by these proposed regulations are small local educational agencies (LEAs) receiving Federal funds from the Department and certain 4- and 2-year colleges and for-profit postsecondary trade and technical schools with small enrollments that receive Federal funds, such as student aid programs under Title IV of the Higher Education Act of 1965. However, these regulations would not have a significant economic impact on the small LEAs affected because these regulations would not impose excessive regulatory burdens or require unnecessary Federal supervision. These regulations would provide an electronic format option for records and signatures and impose minimal requirements to ensure that LEAs comply with the educational privacy protection requirements in FERPA.

Paperwork Reduction Act of 1995

These proposed regulations do not contain any information collection requirements.

Intergovernmental Review

These proposed regulations are not subject to Executive Order 12372 and the regulations in 34 CFR part 79.

Assessment of Educational Impact

The Secretary particularly requests comments on whether these proposed regulations would require transmission of information that any other agency or authority of the United States gathers or makes available.

Electronic Access to This Document

You may view this document, as well as all other Department of Education documents published in the Federal Register, in text or Adobe Portable Document Format (PDF) on the Internet at the following site: http://www.ed.gov/​legislation/​FedRegister

To use PDF you must have Adobe Acrobat Reader, which is available free at this site. If you have questions about using PDF, call the U.S. Government Printing Office (GPO), toll free, at 1-888-293-6498; or in the Washington, DC, area at [phone].

Note:

The official version of this document is the document published in the Federal Register. Free Internet access to the official edition of the Federal Register and the Code of Federal Regulations is available on GPO Access at: http://www.access.gpo/​gov/​nara/​index.html.

(Catalog of Federal Domestic Assistance Number does not apply.)

List of Subjects in 34 CFR Part 99

• Administrative practice and procedure
• Education
• Information
• Parents
• Privacy
• Records
• Reporting and recordkeeping requirements
• Students

Dated: June 9, 2003.

Rod Paige,

Secretary of Education.

For the reasons discussed in the preamble, the Secretary proposes to amend part 99 of title 34 of the Code of Federal Regulations as follows:

1. The authority citation for part 99 continues to read as follows:

Authority: 20 U.S.C. 1232g, unless otherwise noted.

PART 99—[AMENDED]

2. Section 99.30 is amended by adding a new paragraph (d) to read as follows:

§ 99.30

Under what conditions is prior consent required to disclose information?

* * * * *

(d) “Signed and dated written consent” under this part may include a record and signature in electronic form provided the educational agency or institution follows a process to—

(1) Identify the individual and authenticate the identity of the individual requesting disclosure of education records;

(2) Attribute the signature to the consent;

(3) Secure and verify the integrity of the consent in transmission and upon receipt; and

(4) Document and record the signed message.