[Federal Register: July 28, 2003 (Volume 68, Number 144)]
[Proposed Rules]               
[Page 44419-44422]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[[Page 44419]]Download: PDF Version


Part IV

Department of Education


34 CFR Part 99

Family Educational Rights and Privacy Act; Proposed Rule

[[Page 44420]]



34 CFR Part 99

RIN 1855-AA00

Family Educational Rights and Privacy Act

AGENCY: Department of Education.

ACTION: Notice of proposed rulemaking.


SUMMARY: The Secretary proposes to amend 34 CFR part 99 to implement 
the Department's interpretation of the Family Educational Rights and 
Privacy Act (FERPA) identified through administrative experience as 
necessary for proper program operation. These regulations would provide 
general guidelines for accepting ``signed and dated written consent'' 
under FERPA in electronic format.

DATES: We must receive your comments on or before September 26, 2003.

ADDRESSES: Address all comments about these proposed regulations to 
LeRoy Rooker, U.S. Department of Education, 400 Maryland Avenue, SW., 
room 2W119, Washington, DC 20202-4605. If you prefer to send your 
comments through the Internet, use the following address: 
FOR FURTHER INFORMATION CONTACT: Kathleen Wolan, U.S. Department of 
Education, 400 Maryland Avenue, SW., room 2W115, Washington, DC 20202-
4605. Telephone: (202) 260-3887.
    If you use a telecommunications device for the deaf (TDD), you may 
call the Federal Information Relay Service (FIRS) at 1-800-877-8339.
    Individuals with disabilities may obtain this document in an 
alternative format (e.g., Braille, large print, audiotape, or computer 
diskette) on request to the contact person listed under FOR FURTHER 


Invitation To Comment

    We invite you to submit comments regarding these proposed 
regulations. We also invite you to assist us in complying with the 
specific requirements of Executive Order 12866 and its overall 
requirement of reducing regulatory burden that might result from these 
proposed regulations. Please let us know of any further opportunities 
we should take to reduce potential costs or increase potential benefits 
while preserving the effective and efficient administration of the 
    During and after the comment period, you may inspect all public 
comments about these proposed regulations in room 2W115, 400 Maryland 
Avenue, SW., Washington, DC, between the hours of 8:30 a.m. and 4 p.m., 
Eastern time, Monday through Friday of each week except Federal 

Assistance to Individuals With Disabilities in Reviewing the Rulemaking 

    On request, we will supply an appropriate aid, such as a reader or 
print magnifier, to an individual with a disability who needs 
assistance to review the comments or other documents in the public 
rulemaking record for these proposed regulations. If you want to 
schedule an appointment for this type of aid, please contact the person 


    The Department has developed these proposed regulations in 
accordance with its ``Principles for Regulating,'' which are intended 
to ensure that the Department regulates in the most flexible, 
equitable, and least burdensome way possible. The Secretary proposes 
these regulations and believes they are necessary to implement the law 
and give the greatest flexibility to local governments and schools. In 
addition, these regulations minimize burden while protecting the rights 
of parents and students.

Significant Proposed Regulations

    The following is a summary of the regulatory provisions the 
Secretary proposes. These provisions interpret statutory text. The 
Secretary is not authorized to change statutory requirements. 
Commenters are asked to direct their comments to the regulatory 
provisions that would implement or interpret the statute.
    Statute: FERPA provides that an agency or institution may not have 
a policy or practice of disclosing personally identifiable information 
from education records without the ``written consent'' of the parent or 
eligible student, subject to specified exceptions. 20 U.S.C. 
    Current Regulations: Regulations codified at 34 CFR 99.30 provide 
that written consent must be ``signed and dated'' and must specify the 
records to be disclosed, the purpose of the disclosure, and the party 
or class of parties to whom the disclosure may be made.
    Proposed Regulations: Proposed Sec.  99.30(d) provides general 
guidelines for educational agencies and institutions that choose to 
meet the requirements of Sec.  99.30 with records and signatures in 
electronic format.
    Reasons: The Department has received numerous inquiries whether 
some form of electronic consent and signature, including e-mail, 
satisfies FERPS's written consent requirement.
    The requirements of a valid signature, including various forms of 
electronic signature, are generally established under State rather than 
Federal law. However, Congress has enacted at least two Federal 
statutes to encourage the use of electronic signatures and records. The 
Government Paperwork Elimination Act (GPEA), Pub. L. 105-277 (effective 
October 21, 1998) applies to filing forms electronically with Federal 
agencies. The Electronic Signatures in Global and National Commerce Act 
(E-Sign), Pub. L. 106-229 (effective October 1, 2000) validates and 
establishes general standards for use of electronic signatures and 
records in interstate commerce that remain in place pending a State's 
adoption of some form of the Uniform Electronic Transactions Act 
    E-Sign, UETA (where enacted in State law), and the GPEA validate 
the use of electronic records and signatures in contracts and other 
legal transactions. The Department concludes that educational agencies 
and institutions may use electronic records and signatures for written 
consents governed by FERPA to the extent that the procedures used for 
creating and storing the electronic records and signatures comply with 
these proposed regulations.
    This discussion, as well as the proposed amendment to Sec.  99.30, 
constitutes general guidance for the use of electronic communications 
in meeting certain FERPA requirements. The proposed amendment does not 
specify desired methods but instead contains general guidelines, 
adapted from concepts contained in E-Sign, GPEA, and UETA, to help 
ensure that FERPA's privacy protections are not compromised when 
records are disclosed pursuant to electronic communications. The Family 
Policy Compliance Office may issue further guidance concerning 
electronic records and signatures.
    FERPA is technology-neutral with respect to how to meet disclosure 
and signature requirements. In cases where FERPA requires a signed and 
dated written consent under Sec.  99.30 for a disclosure, such as 
issuance of a transcript to an employer, there proposed regulations 
specify that an agency or institution may accept electronic consents 
and signatures when reasonable security is provided for the process. In 
particular, the process must:

[[Page 44421]]

    [sbull] Establish a reasonable way to identify the individual and 
authenticate the identity of the particular eligible student or parent 
as the source of the electronic message or record requesting access or 
consenting to the disclosure of education records (authentication);
    [sbull] Attribute the electronic signature to the unaltered message 
or document to prevent repudiation by the sender (attribution);
    [sbull] Verify the integrity of the signed message or document in 
transmission and upon receipt (integrity or security of transmission); 
    [sbull] Document the requester's approval of the text contained in 
the electronic message.
    While agencies and institutions are not limited to any particular 
technology or method, the Department considers electronic signature 
standards established under the Federal student loan programs to 
satisfy the written consent requirement in FERPA. You may view those 
standards on the Internet at the following Web site: http://www.ifap.ed.gov/dpcletters/gen0106.html

Executive Order 12866

1. Potential Costs and Benefits
    Under Executive Order 12866, we have assessed the potential costs 
and benefits of these regulatory actions.
    The potential costs associated with these proposed regulations are 
those resulting from statutory requirements and those we have 
determined to be necessary for administering this program effectively 
and efficiently.
    In assessing the potential costs and benefits--both quantitative 
and qualitative--of these regulatory actions, we have determined that 
the benefits would justify the costs.

Summary of Potential Costs and Benefits

    FERPA requires an educational agency or institution to obtain 
``written and signed'' consent from a parent or eligible student before 
the educational agency or institution discloses education records. 
These proposed regulations would provide additional flexibility for 
educational institutions and agencies in meeting the existing consent 
requirement. These proposed regulations would not require that an 
educational institution or agency participate in the electronic format 
2. Clarity of the Regulations
    Executive Order 12866 and the Presidential Memorandum on ``Plain 
Language in Government Writing'' require each agency to write 
regulations that are easy to understand.
    The Secretary invites comments on how to make these proposed 
regulations easier to understand, including answers to questions such 
as the following:
    [sbull] Are the requirements in these proposed regulations clearly 
    [sbull] Do these proposed regulations contain technical terms or 
other wording that interferes with their clarity?
    [sbull] Does the format of these proposed regulations (grouping and 
order of sections, use of headings, paragraphing, etc.) aid or reduce 
their clarity?
    [sbull] Would these proposed regulations be easier to understand if 
we divided them into more (but shorter) sections? (A ``section'' is 
preceded by the symbol `` Sec.  '' and a numbered heading; for example, 
Sec.  99.30 Under what conditions is prior consent required to disclose 
    [sbull] Could the description of these proposed regulations in the 
SUPPLEMENTARY INFORMATION section of this preamble be more helpful in 
making these proposed regulations easier to understand? If so, how?
    [sbull] What else could we do to make these proposed regulations 
easier to understand?
    Send any comments that concern how the Department could make these 
proposed regulations easier to understand to the person listed in the 
ADDRESSES section of the preamble.

Regulatory Flexibility Act Certification

    The Secretary certifies that these proposed regulations would not 
have a significant economic impact on a substantial number of small 
    The small entities that would be affected by these proposed 
regulations are small local educational agencies (LEAs) receiving 
Federal funds from the Department and certain 4- and 2-year colleges 
and for-profit postsecondary trade and technical schools with small 
enrollments that receive Federal funds, such as student aid programs 
under Title IV of the Higher Education Act of 1965. However, these 
regulations would not have a significant economic impact on the small 
LEAs affected because these regulations would not impose excessive 
regulatory burdens or require unnecessary Federal supervision. These 
regulations would provide an electronic format option for records and 
signatures and impose minimal requirements to ensure that LEAs comply 
with the educational privacy protection requirements in FERPA.

Paperwork Reduction Act of 1995

    These proposed regulations do not contain any information 
collection requirements.

Intergovernmental Review

    These proposed regulations are not subject to Executive Order 12372 
and the regulations in 34 CFR part 79.

Assessment of Educational Impact

    The Secretary particularly requests comments on whether these 
proposed regulations would require transmission of information that any 
other agency or authority of the United States gathers or makes 

Electronic Access to This Document

    You may view this document, as well as all other Department of 
Education documents published in the Federal Register, in text or Adobe 
Portable Document Format (PDF) on the Internet at the following site: 
    To use PDF you must have Adobe Acrobat Reader, which is available 
free at this site. If you have questions about using PDF, call the U.S. 
Government Printing Office (GPO), toll free, at 1-888-293-6498; or in 
the Washington, DC, area at (202) 512-1530.

    Note: The official version of this document is the document 
published in the Federal Register. Free Internet access to the 
official edition of the Federal Register and the Code of Federal 
Regulations is available on GPO Access at: http://www.access.gpo/gov/nara/index.html.

(Catalog of Federal Domestic Assistance Number does not apply.)

List of Subjects in 34 CFR Part 99

    Administrative practice and procedure, Education, Information, 
Parents, Privacy, Records, Reporting and recordkeeping requirements, 

    Dated: June 9, 2003.
Rod Paige,
Secretary of Education.

    For the reasons discussed in the preamble, the Secretary proposes 
to amend part 99 of title 34 of the Code of Federal Regulations as 
    1. The authority citation for part 99 continues to read as follows:

    Authority: 20 U.S.C. 1232g, unless otherwise noted.


    2. Section 99.30 is amended by adding a new paragraph (d) to read 
as follows:

Sec.  99.30  Under what conditions is prior consent required to 
disclose information?

* * * * *

[[Page 44422]]

    (d) ``Signed and dated written consent'' under this part may 
include a record and signature in electronic form provided the 
educational agency or institution follows a process to--
    (1) Identify the individual and authenticate the identity of the 
individual requesting disclosure of education records;
    (2) Attribute the signature to the consent;
    (3) Secure and verify the integrity of the consent in transmission 
and upon receipt; and
    (4) Document and record the signed message.

[FR Doc. 03-19082 Filed 7-25-03; 8:45 am]