Email this Document!

M-00-15

MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES

From:  Jacob J. Lew
Director

Subject: OMB Guidance on Implementing the Electronic Signatures in Global and National Commerce Act

This document transmits OMB guidance to Executive Agencies regarding the interpretation and implementation of the Electronic Signatures in Global and National Commerce Act (“E-SIGN”) (Public Law 106-229) enacted on June 30, 2000.  E-SIGN eliminates legal barriers to the use of electronic technology to form and sign contracts, collect and store documents, and send and receive notices and disclosures.

Under E-SIGN, companies can contract online to buy and sell a broad array of products and services.  Businesses can use servers the size of a laptop to collect and store transaction records that once filled up vast warehouses.  Consumers can buy insurance, get a mortgage, or open a brokerage account on-line, without waiting for physical documents to be mailed back and forth.  E-SIGN will offer improved efficiencies in U.S. markets; this historic legislation will help to bring the full benefits of electronic commerce to our economy.  The government will do its part to implement E-SIGN in a manner that best achieves the legislation’s goals.

E-SIGN eliminates barriers to electronic commerce, while also providing consumers with protections equivalent to those available in the world of paper-based transactions.  The Act makes clear that no person is required to use electronic records, signatures, or contracts.  Indeed, E-SIGN requires that a consumer affirmatively consent to the use of electronic notices and records.  Prior to consenting, the consumer must receive notice of his or her rights.  Moreover, the consumer must provide the affirmative consent electronically, in a manner that reasonably demonstrates that the consumer can access the electronic records that are the subject of the consent.

E-SIGN applies broadly to Federal and state statutes and regulations governing private sector (including business-to-business and business-to-consumer) activities.  The Act generally covers legal requirements that information be disclosed in private transactions.  It also requires that agencies generally permit private parties to retain records electronically.  The government may establish appropriate performance standards for the accuracy, integrity, and accessibility of records retained electronically, to ensure compliance with applicable laws and to guard against fraud.
Agency activities and requirements that involve information, but do not relate to business, commercial, or consumer transactions, are not within the scope of this legislation.  Instead they are addressed by the Government Paperwork Elimination Act (GPEA).  Certain laws and regulations involve both GPEA and E-SIGN, especially with respect to record retention requirements in agency regulations that relate to business, consumer and commercial transactions.  The attached guidance discusses this interaction

A general summary of the dates when E-SIGN provisions become effective:

• Most of E-SIGN is effective as of October 1, 2000.
• Certain provisions relating to government record retention requirements become effective on March 1, 2001, unless an agency by that date has otherwise announced or initiated a rulemaking on a record retention requirement.  In the latter case, the law is effective for that record retention requirement on June 1, 2001.
• For loan guarantees, mortgage insurance, or commitments for such transactions, E-SIGN applies only to transactions entered into on or after June 30, 2001, and to loans or mortgages made, insured, or guaranteed by the United States Government on or after June 30, 2001.
• E-SIGN establishes specific effective dates for consumer provisions as they relate to the student loan programs of the Education Department.

         The attached OMB guidance was developed with substantial input from the agencies most involved in the enactment of E-SIGN: the Departments of Commerce, Treasury, and Justice, working with the National Economic Council.  This guidance is designed to aid in Federal agency implementation of E-SIGN.   The guidance contains three parts: (1) a short summary of the law; (2) a description of specific steps agencies should take to comply with the law; and (3) a detailed description of the law’s requirements, including illustrative examples.

         E-SIGN is complex and has wide-ranging implications.  Accordingly, the guidance covers many areas.  It is essential that agencies become familiar with the Act and determine how it will affect activities within their domain.

         Should you need additional information or have general questions about this guidance, please contact Jonathan Womer in the Office of Management and Budget at 395-3785 or jwomer@omb.eop.gov.  Any questions related to specific legal issues regarding this guidance may be referred to the Justice Department at ESIGN@usdoj.gov; specific questions about the legislative history of E-SIGN may be referred to the Commerce Department at ESIGN@doc.gov.
 

Attachment

PART I:  General Overview and Explanation of E-SIGN Act Public Law No. 106-229 (As it Relates to Federal Agencies)
           A. Basic Areas Covered by E-SIGN
           B. Governmental Activities
           C. Preservation of Agency Authority
PART II:  Suggested Steps for Agencies’ Implementation of E-SIGN
           A.  Special Rules for Specific Areas of Regulation
PART III: Ensuring Agency Compliance with the Statutory Requirements of E-SIGN
           A.  Regulation of Transactions Between Private Parties (Contract Formation, Notices, and Disclosures)
           B. Record Retention Requirements
           C. Filing requirements
           D. Government Guaranteed Loans and Mortgage Insurance
           E.  Government as Market Participant
           F.  Effective Dates

          OMB developed this document with substantial help from the Departments of Commerce, Justice, and Treasury.  This document is intended only for the internal management of the federal government, and does not establish legally binding interpretations, rules or standards. Agencies should exercise their own judgment and discretion in determining how to address the issues discussed in this document in the context of their particular programs.  To the extent that agencies are seeking legal advice on specific concerns, they should contact their general counsel, the appropriate component of the Department of Justice, or, for binding legal opinions, the Department of Justice’s Office of Legal Counsel. Nothing in this document is intended to confer any right on any person or group.

         On June 30, 2000, the President signed into law the Electronic Signatures in Global and National Commerce Act (“E-SIGN”). This version explains E-SIGN as it relates to federal agencies, to assist them in becoming familiar with these new requirements.

A.  Basic Areas Covered by E-SIGN

         E-SIGN promotes the use of electronic contract formation, signatures, and recordkeeping in private commerce by establishing legal equivalence between:
 

• contracts written on paper and contracts in electronic form;
• pen-and-ink signatures and electronic signatures; and
• other legally-required written documents (termed “records”) and the same information in electronic form.

         E-SIGN applies broadly to commercial, consumer, and business transactions affecting interstate or foreign commerce, and to transactions regulated by both Federal and state government. If there is no writing required by another law, E-SIGN does not apply.  In general, subject to the limits discussed in B. below, E-SIGN applies to the following areas.

         1.  Regulation of Private Parties’ Contract Formation

         If all parties to a contract choose to use electronic signatures and records, E-SIGN generally grants legal recognition to those methods.  E-SIGN provides that no contract, signature, or record shall be denied legal effect solely because it is in electronic form.  Nor may a contract relating to a transaction be denied legal effect solely because an electronic signature or record was used in its formation (Section 101(a)).  Beginning October1, 2000, E-SIGN will supersede all statutes or agency rules containing paper-based requirements that might otherwise deny effect to electronic signatures and records in consumer, commercial or business transactions between two or more private parties, providing that all the contracting parties agree to the use of electronic methods.  E-SIGN preserves agencies’ existing authority, however, to set standards for the integrity, accuracy, and accessibility of electronic records and the authentication of electronic signatures.  Such standards must be consistent with E-SIGN and substantially justified.  They must also satisfy other statutory criteria (as described in detail in Part III).

         2.  Legally Required Notices and Disclosures in Private Transactions

         Many Federal, State, and local laws or rules require that parties receive notices and disclosures in connection with private transactions (for example real estate purchases and settlements).  To the extent these laws or rules require paper notices, E-SIGN largely supersedes them.  Effective October 1, 2000, the notices may be in electronic form, provided that all involved parties agree. E-SIGN establishes special requirements for the use of electronic notices and disclosures in consumer transactions.  A consumer must specifically “opt-in” to receiving electronic notification according to requirements spelled out in detail in the statute (Section 101(c)).   Please note that E-SIGN does not give legal effect to the use of electronic notices of home mortgage foreclosures, evictions, repossessions, termination of utility services, cancellation of health or life insurance, and product recalls (Section 103(b)(2)).  Also, E-SIGN does not affect the proximity requirements of any other law with respect to any warning, notice, disclosure, or other record required to be posted or displayed.

         3.  Record Retention Requirements

         If a Federal law or regulation requires that a document (or particular information) be retained by an individual or company, E-SIGN adds an electronic option.  Effective March 1 (if no new regulation is in process), or June 1, 2001 (if a regulation is being revised), retention may be  electronic so long as the electronic record accurately reflects the information set forth in the record, and remains accessible in a form that can be accurately reproduced for later reference (Section 101(d)).  As noted below, agencies also may promulgate performance standards to ensure the accuracy, integrity and accessibility of electronic records (Section 104(b)(3)).

         4.  Filings

         E-SIGN generally preserves an agency’s existing authority to specify standards and formats for records filed with the agency (Section 104(a)).  Federal agencies have separate obligations, however, under the Government Paperwork Elimination Act (“GPEA”)(Title XVII of Pub. L. No. 105-277) to accept most electronic records submitted by the public (See Section 104(c)(2)). ¹ Under  GPEA, agencies must generally provide for the optional use and acceptance of electronic documents, signatures, and recordkeeping, when practicable, by October 2003.  GPEA seeks to increase the ability of citizens to interact with the Federal government electronically.

         5. Federal Agency Contracts

         E-SIGN does not force contracting parties (whether the government or the private sector) to use or accept electronic signatures and records.   If agencies and the parties with whom they contract choose to use electronic methods, E-SIGN gives legal effect to those methods.  Moreover, E-SIGN expressly permits agencies to require the use of specific technologies (such as specific authentication methods) in connection with Federal procurement contracts (Section 104(b)(4)).  It is important to distinguish these points from other, non-procurement electronic transactions provided for under GPEA, where Federal agencies are compelled (when practicable) to accept electronic forms with electronic signatures by October 2003.

B.  Governmental Activities

         Congress specifically rejected the inclusion of the term A “governmental transactions” in the definition of transactions subject to E-SIGN, although that term did appear in earlier versions of the bill.  See Section 106(13) (defining covered transactions).  E-SIGN does not prescribe requirements pertaining to activities that are governmental (as opposed to business, consumer, or commercial) in nature, including activities conducted by private parties principally for governmental purposes.  One example of an activity that is governmental is census reporting and related requirements.   When government agencies choose to engage in commercial transactions, E-SIGN does apply, permitting (but not required) the use of electronic methods.  See above (“Federal Agency Contracts”).

         Note that if a transaction is not within the scope of E-SIGN because it is governmental, rather than commercial, consumer, or business in nature, agencies must still pursue options for electronic collection, maintenance, and disclosure of information, as well as electronic signatures, under GPEA.  The latter statute generally requires agencies to recognize the validity of electronic submissions in their programs by October 2003 (when practicable), in accordance with guidance issued by the Office of Management and Budget.

C.   Preservation of Agency Authority

         If an agency is responsible for issuing rules under a statute (pursuant to rulemaking authority granted by that statute or some other statute), E-SIGN preserves that agency’s authority to issue a rule, order or other guidance of general applicability interpreting the impact of E-SIGN on that statute (Section 104(b)).  These rules must be:

• consistent with Section 101 of E-SIGN and not add to its requirements;
• supported by a substantial justification;
• substantially equivalent to similar requirements imposed with respect to non-electronic contracts, notices, and retained records;
• reasonable in the costs they impose;  and
• technology neutral (Section 104(b)(2)).

• issue rules requiring the use of an authentication technology providing a particular level of security (but generally not the use of one specific technology, unless certain requirements are met) for contract formation or for signing of notices or disclosures;
• issue interpretive rules or other guidance regarding the application of the consumer consent provisions to the particular notices or disclosures within the agency’s jurisdiction;
• issue interpretive rules or other guidance regarding the agency’s record retention rules, including the specification of performance standards required to assure accuracy, record integrity, and accessibility of the records that are required to be retained (Section 104(b)(3)).

         Beginning on October 1, 2000, E-SIGN will supersede many provisions in Federal and State statutes and agency regulations requiring the use of paper records and ink signatures in commercial, consumer, and business transactions.

         The statutes and regulations affected by E-SIGN include those that impose requirements for contract formation, record retention, and notices and disclosures by private parties (that relate to business, consumer, or commercial, rather than governmental, activities).  E-SIGN also provides special rules and effective dates for government and government-guaranteed loans.

         Agencies should immediately begin to identify which of their regulations or other requirements may be subject to E-SIGN.  They should decide whether they need to revise any of their regulations or requirements in light of the legal status accorded to electronic records and signatures under E-SIGN.  They should work with their customers and regulated communities in this process to help ensure that they understand the scope of E-SIGN.  They should issue a general notice or group of notices for comment as to what guidance or regulations should be amended.

         We recommend that agencies follow these steps:

Step One:  Identify Affected Agency Regulations, Policies, and Procedures.

         E-SIGN could potentially affect any statute or agency regulation, policy, or procedure that requires private parties to conduct transactions using paper records and ink signatures.  As a first step, you should review your statutes, regulations, policies, and procedures to determine whether they come within the scope of E-SIGN. You should specifically examine those relating to transactions between private parties (for example, contract formation, notices, disclosures), record retention, filings, government guaranteed loans and mortgage insurance, as well as those governing situations in which the government is a market participant.  Part III of this Guidance contains a detailed discussion of the scope of E-SIGN and how it may apply to these specific areas.

Step Two:  Determine Whether it is Necessary to Issue Guidance or Regulations Concerning the Use of Electronic Records or Signatures in Particular Transactions

         Consistent with the intent of E-SIGN, you generally should not restrict whether and how private parties use electronic records and signatures in their dealings.  You may need to provide guidance or standards for the use of electronic records or signatures in some contexts in order to implement statutory requirements that you administer.  Part III discusses the types of situations in which there may be substantial justification for you to issue guidance or set standards on the use of electronic records and signatures.

Step Three:  Determine the Extent to Which You Have Authority to Issue Guidance or Regulations Concerning the Use of Electronic Records or Signatures in Particular Transactions

         E-SIGN generally allows you to interpret how its requirements apply to your statutes and regulations.  You have varying levels of discretion to issue guidance or regulations for different types of transactions.  You have more discretion to establish standards in connection with record retention requirements than in connection with the formation of contracts between private parties.  Part III discusses the scope of discretion with respect to the use of electronic records and signatures in various types of transactions affected by E-SIGN.

Step Four:  Adopt Guidance or Regulations for the Use of Electronic Records and Signatures, Where Necessary

         If you determine that it is necessary to issue new or amended regulations, policies, or procedures to establish standards for electronic records or signatures, you should ensure that you do so in compliance with the requirements of E-SIGN as well as other applicable laws, such as GPEA.  If your regulation contains information collections under the Paperwork Reduction Act (“PRA”), and thus is subject to GPEA, you should address options for automating these collections as part of your planning for GPEA implementation.²

         You should initiate any needed changes to your regulations that affect contract formation, notices, or disclosures between private parties involving business, consumer, or commercial transactions -- or draft new regulations if necessary -- by October 1, 2000, the general effective date for E-SIGN, or as soon as possible thereafter.  In light of the close proximity of E-SIGN’s effective date, you may wish to consider whether interim final or direct final regulations are appropriate.  You should not wait to complete your GPEA plans that are due October 31, 2000 to pursue such regulatory actions.

A. Special Rules for Specific Types of Regulations

         1.  Record Retention Requirements

         Once E-SIGN becomes effective, private parties may keep electronic records instead of paper records of covered transactions provided the electronic records meet certain accuracy and accessibility requirements in the E-SIGN statute.  Agencies should review their record retention regulations to determine whether changes are needed for mission performance or for future audit or law enforcement purposes.  An agency may need to update requirements for paper records or adopt performance standards for accuracy, integrity, and accessibility of electronic records in order to maintain the effectiveness of record retention requirements.  Part III discusses an agency’s authority to issue performance standards for the use of electronic records.

         Record retention requirements imposed by Federal laws and by State laws administered by a State agency will be subject to E-SIGN beginning on March 1, 2001.  (Record retention requirements imposed by State laws that are not administered by a State agency are subject to E-SIGN beginning October 1, 2000.)  If on March 1, 2001, an agency has announced, proposed or initiated (but not completed) a rulemaking to prescribe performance standards for electronic records used to meet a record retention requirement, the effective date of E-SIGN as to that requirement will be June 1, 2001.  Accordingly, agencies should commence any rulemaking as soon as possible but no later than March 1, 2001, in order to complete the rulemaking by June 1, 2001.  Agencies may wish to combine proposed changes relating to record retention in a single proposed rule for administrative ease.

         The PRA covers many regulatory record retention requirements for business, consumer, or commercial transactions.  When these regulations are information collections under the PRA, and thus subject to GPEA (see discussion under Step Four above), agencies should address options for automating these collections as part of their GPEA planning.  Given the considerably earlier effective dates for E-SIGN than for GPEA, changes in record retention regulations should be given high priority in the GPEA plans that are due by October 31, 2000.

         2.  Filing Requirements

         Under E-SIGN, agencies generally can specify standards and formats for records.  They must adapt standards for the filing of electronic filings for most of their processes, consistent with the standards and timetables in GPEA.  Agencies should review their regulations that relate to filings to determine whether changes are needed.  They should decide any on such changes by October 31, 2000, the deadline for GPEA plans.  Agencies should refer to OMB Memorandum M-00-10, “Implementation of the GPEA,” for general guidance in this area, and to OMB’s procedural guidance on developing GPEA plans, issued July 25, 2000, for specific instructions.

         3.  Federal Loan Guarantees and Mortgage Insurance

         Agencies should also examine their regulations governing transactions related to federal loan guarantees, mortgage insurance, and commitments for these obligations. Some agency regulations set rules for communication between lenders (for example, financial institutions) and borrowers (for example, homeowners or students) in such transactions. Due to the importance of preserving loan documentation, an agency should carefully examine the extent to which it needs to specify standards for the accuracy, integrity, and accessibility of electronic loan documentation methods.

         E-SIGN applies to transactions involving mortgage insurance, loan guarantees, loan guarantee commitments, and other programs listed in the Federal Credit Supplement, Budget of the United States (FY 2001). E-SIGN applies to such transactions and to any loan or mortgage which is made, insured, or guaranteed by the United States under this supplement on or after June 30, 2001 (one year after E-SIGN became law).  If agency regulations related to these loan transactions contain information collections under the PRA, they are subject to GPEA, and agencies should address options for automating these collections as part of their GPEA planning.

         The following discussion seeks to explain E-SIGN’s specific requirements.  Agencies may also benefit from the discussion of E-SIGN’s legislative history in Appendix A.³

A.   Regulating Transactions Between Private Parties (Contract Formation, Notices, and Disclosures)

         1. When Does E-Sign Apply?

         a. Contract formation.  Regulations that directly regulate the form or content of legal agreements in commercial, consumer or business transactions between private parties are generally within the scope of E-SIGN.  They must allow the parties to use electronic contracts.

Illustration 1: Person A is selling substance S to person B in a commercial transaction.  Agency ABC currently requires that all private contracts for the sale of substance S be recorded on blue paper.  E-SIGN applies to this requirement, so assuming A and B agree to use an electronic record to evidence their contract, they do not need to use paper of any type.

Illustration 2:  Person A is selling substance S to person B in a commercial transaction.  Agency ABC has adopted a regulation requiring that all electronic contracts for the sale of substance S be electronically signed with a particular signature method. E-SIGN applies, and the regulation must meet the standards set forth in Section 104 governing the use of agency interpretive authority (see Section III(A)(3) below).

         b. Notice and disclosure requirements.  E-SIGN generally applies to all requirements that private parties undertake such activities as signing documents or exchanging disclosures during the course of commercial, consumer or business transactions.

Illustration 1: Person A is selling substance S to person B in a commercial transaction.  Agency ABC requires that when substance S is sold, a separate disclosure form must be provided.  E-SIGN applies to the disclosure form, so (assuming the parties agree) the disclosure may be in electronic form.

         c. Additional requirements for consumer transactions. Section 101(c) requires that for transactions that involve a consumer,⁵ electronic records may be substituted for paper versions only if the consumer affirmatively consents to receive the documents in electronic form and several other requirements are met. These include, among other things, that the consumer receive a clear and conspicuous statement of: (1) the consumer’s right to receive paper records; (2) the consequences of later withdrawing consent to receive electronic records; and (3) the hardware and software requirements for access to and retention of electronic records. This provision is especially significant, since many laws require that individuals receive information in paper form in connection with private transactions, including extensions of credit by financial institutions and the sale of real estate.

         The consumer must provide the affirmative consent electronically in a manner that reasonably demonstrates that the consumer is able to access the electronic records that are the subject of the consent.  Section 101(c) seeks to ensure that existing consumer protections based on paper disclosures to consumers are not undermined by the use of electronic disclosures in cases where consumers do not have the capability to receive such disclosures or may not be fully aware of the consequences of agreeing to receive such disclosures electronically.

         Agencies should review the extensive consumer disclosure provisions contained in Section 101(c) of E-SIGN, which are not reviewed in full here.

         2. Should Agencies Issue Guidance or Regulations on How Parties May Contract or Provide Notices
         Electronically?

         When agencies assess their regulations affecting private-party transactions, they should first consider two things:
 

• what the regulated persons might do on their own (that is, forms they might choose to use in their transactions), and
• whether there are any substantial policy reasons to issue guidance or regulations with respect to the parties’ choice of method

         a. What would regulated parties do in the absence of rule revision?  In general, starting on October 1, 2000, those who formerly had to use paper-and-ink contracts, notices, and disclosures need no longer do so. At least in the short run, however, most contracting parties will continue to use paper B perhaps out of habit, or due to unfamiliarity with new methods, or for other purposes. Other parties will begin immediately to use electronic formats for their contracts.  Agencies should ensure that they are aware of what approach regulated parties are taking to electronic transactions.
 

Illustration.  Person A is contracting with person B to sell product M in a commercial transaction.  Agency ABC requires  that contracts for the sale of product M be in writing.  (They need not, however, be filed or retained.)   Agency ABC elects not to issue a new regulation in response to E-SIGN.  Starting on October 1, 2000, A and B may use any electronic form they agree on for their contracts.  E-SIGN ensures that Agency ABC’s regulation will not deny the contracts legal effect solely because they are in electronic form.

         b.  Is there a substantial policy reason to issue guidance or regulations concerning the parties’ choice of contracting or disclosure method?  As a rule, parties should be left to choose the electronic contracting method they will use. There may be some circumstances, however, in which substantial policy reasons require that agencies issue guidance or regulations concerning this issue.  For example, the agency may want to ensure that consumers or businesses have accessible copies of electronic contracts or disclosures relating to certain types of transactions.  An agency may wish to solicit comments from regulated entities, consumers, and the public at large as to whether issuance of guidance or regulations is appropriate to address substantial policy concerns.  These comments could help the agency identify issues that should be addressed in any guidance or regulation.
 

Illustration. Product M is often counterfeited.  Agency ABC has issued a regulation requiring that all contracts for the sale of Product M be in writing and contain certain terms, for the protection of consumers who later discover that they have purchased a counterfeit product.  Agency ABC is concerned that, if product M is sold electronically in a way that leaves many consumers with poor records of the transaction, those who buy counterfeits may be unable to obtain relief.  Agency ABC may conclude that it is appropriate to issue regulations interpreting the provisions of E-SIGN to address this risk.

         3.  What is an Agency’s Interpretive Authority?
 

         If E-SIGN applies (section (1) above) and it is necessary to interpret E-SIGN (section (2) above), agencies should consider issuing rules or guidance to do so, as discussed in part I.C., above. Section 104(b)(1) of E-SIGN provides that only agencies with statutory authority to issue rules may do so.  Agencies with authority to issue guidance and orders as well as rules may elect to issue guidance or orders.  An agency’s rules should interpret one of the provisions in Section 101. A regulation or guidance could specify standards for signatures or records used in meeting a particular statutory requirement.  Agencies whose regulations implement consumer disclosure requirements may consider the need to interpret various terms used in Section 101(c) as they apply to the disclosure requirements the agency administers.  For example, an agency may consider the need to interpret the “clear and conspicuous” requirement (Section 101(c)(1)(B)) or how a consumer “reasonably demonstrates” the ability to access electronic records (Section 101(c)(1)(C)(2)).

         Of course, agencies need not promulgate rules unless there are substantial reasons for doing so.  When agencies choose to do so, E-SIGN contains a number of specific restrictions on agency rulemaking authority.  While E-SIGN may help grant legal recognition to electronic signatures and records, agencies still have the authority to impose some rules to ensure the reliability, availability and integrity of contracts and records or when necessary for other agency purposes.

         a.  Rules must be consistent with and not add to Section 101. (Section 104(b)(2)(A), (B)).  These provisions require that regulations, orders, or guidance be “consistent with” Section 101 and “not add to” the requirements of that Section.  Agency interpretations of these provisions are subject to the usual test for judicial review of an agency’s interpretation of a statute that it is charged with administering.  The agency may not deviate from the clear language of a statute but may construe a statute where Congress’ intent is not clear.⁶

         b.  Rules must be substantially justified. (Section 104(b)(2)(C)(i)).  This provision requires that the agency find that there is a “substantial justification” for the regulation, order, or guidance.  Agencies should not promulgate regulations unless substantial policy reasons justify that they do so.  If such policy reasons exist, regulation may be appropriate.⁷

         c.  Rules must be substantially equivalent to those for paper records. (Section 104(b)(2)(C)(ii)(I)). This provision requires that “the methods selected to carry out” the agency’s purpose must be “substantially equivalent to the requirements imposed on records that are not electronic records.”  In some circumstances, it may be appropriate to assess “substantial equivalence” by considering general features of a process (such as security, proof of identity, and the like), since electronic and paper systems often operate by means that are not directly analogous.  Systems may be substantially equivalent at this higher level of generality even though their details are quite dissimilar.

         d.  Rules may not impose unreasonable costs. (Section 104(b)(2)(C)(ii)(II)).  This provision requires that “the methods selected to carry out” the agency’s purpose must “not impose unreasonable costs on the acceptance and use of electronic records.” One factor in the reasonableness determination may be a comparison of the cost and benefits of the proposed regulation.  This comparison will presumably resemble other analysis of regulatory costs and benefits.
 

         e.   Rules must be technology-neutral. (Section 104(b)(2)(C)(iii)). This provision requires that “the methods selected to carry out” the agency’s purpose must not “require, or accord greater legal status or effect to, the implementation or application of a specific technology or technical specification for performing the functions of creating, storing, generating, receiving, communicating, or authenticating electronic records or electronic signatures.”  Although this provision bars agencies from prescribing specific technologies, it does not bar an agency from adopting a performance standard for a particular technology.  Such standards could address such issues as security, record integrity, record or identity authentication, or interoperability of systems.  In some instances, agencies may be able to require the use of a specific technology or technical specification.  See Section 104(b)(3)(A), discussed in section III(B)(3), below.

         f.  Rules may not require the use of paper. (Section 104(c)(1)). This provision states that agencies may not use their interpretive authority to “impose or reimpose any requirement that a record be in a tangible printed or paper form.”  But see the exception in Section 104(b)(3)(B), discussed in section III(B)(3), below.

B.   Record Retention Requirements

         E-SIGN does not define “record retention” requirements.  In its usual sense, however, the term refers to requirements that a private party retain certain records so they will be available for audit or law enforcement purposes.

         Section 101 of E-SIGN contains specific provisions permitting the use of electronic records to comply with record retention requirements if the record “accurately reflects the information set forth in the contract or record,” (Section 101(d)(1)(A)), and “remains accessible to all persons who are entitled to access by statute, regulation, or rule of law, for the period required by such statute, regulation, or rule of law, in a form that is capable of being accurately reproduced for later reference, whether by transmission, printing, or otherwise,” (Section 101(d)(1)(B)).

         1.  When Does E-SIGN Apply?

         Record retention requirements for records generated in a commercial, consumer, or business transaction are subject to E-SIGN.
 

Illustration 1.  Person A is selling substance S to person B in a commercial transaction.  Agency ABC requires that, when substance S is sold, a copy of the contract of sale be retained for future audit or law enforcement purposes.  E-SIGN applies to this requirement, so the contract may be retained in electronic form.

         Records generated solely to comply with regulations (see illustration 2), rather than records generated as part of a preexisting commercial transaction, are generally not subject to E-SIGN.   Record retention requirements of the former type are subject to GPEA, however, and should be reviewed and addressed under the processes set forth in that Act.
 

Illustration 2.  Agency ABC requires that certain categories of businesses periodically commission audits of their consumption of substance S.  The audits are self-contained documents, created to government specifications, and do not contain records of the underlying transactions.  Agency ABC requires that the businesses retain a copy of the audit, but does not require that the audits be reported.  E-SIGN does not apply.  The requirement is not “related to” a commercial transaction.  The contract between the audited and auditing entity is a commercial transaction, but one that occurs only to comply with this governmental requirement.

         2. Should the Agency Allow the Parties to Choose any Method for Retaining Records Electronically?

         As with regulation of private-party transactions, agencies should consider two things regarding their record retention requirements.  First, they should consider what the regulated persons might do on their own (that is, what forms might they choose for retention absent regulation).  Second, agencies should consider whether there are any substantial policy reasons to regulate the parties’ choice of method.

         a. What would regulated parties do in the absence of a rule revision?  In general, starting on March 1, 2001, regulated parties need no longer retain records in paper form (so long as they keep them in an acceptable electronic form). Many parties may continue to keep their records on paper, others may prefer that electronic forms of record retention.  This is especially true for transactions that were originally undertaken in electronic, rather than written form.
 

Illustration: Agency ABC regulates the sale of a commodity that raises significant regulatory concerns.  Agency ABC requires suppliers of the commodity to keep written records of all sales, so that, if necessary, it can track and trace major purchasers and uses of the commodity.  Starting on March 1, 2001, Corporation C and others begin to sell the commodity over the Internet.  C’s computers keep an electronic copy of certain key information on each purchase.  Now that this information is stored electronically, C and other distributors who use similar systems no longer keep paper records of the transactions. Agency ABC should review its record keeping regulations to insure that they are consistent with the practices permitted by E-SIGN.

         b.  Is there a substantial policy reason to issue guidance or regulations with respect to the parties’ choice of record retention methods?  Parties should be left to select an electronic storage form of their own choosing where appropriate.  There may be some circumstances, however, in which substantial policy reasons require that agencies regulate the parties’ choice.  For example, the agency may want to ensure that the record has not been tampered with, that it is safe from inadvertent loss or destruction, that the agency can read and access it, or that it contains all the necessary information.  We believe that many agencies will wish to issue guidance or regulations addressing these issues.
 

Illustration 1: The information about the regulated commodity transactions stored on C’s system is kept in a database that is updated every minute. Any of C’s employees have access to the database and can change any of the data in it.  Agency ABC may wish to update its regulations to require that the commodity sale records be maintained in a secure format if C’s current database management substantially impedes audits or enforcement.

Illustration 2: Agency ABC is also concerned about its ability to identify purchasers of the commodity through the sales records.  Agency ABC has concluded that regulated entities do not always preserve this information adequately in their electronic systems.  The agency may also wish to issue an updated regulation requiring that records be maintained in a format that accurately and reliably reflects the identity of the purchaser.

Illustration 3: In some cases, Agency ABC has a need to refer to the commodity sales records for several years after a sale occurs.  Realizing that computer systems and database software used in the industry change frequently as technology advances, Agency ABC may want to issue an updated regulation requiring that records be maintained over time in a format that is reasonably accessible to government investigators.

         3.  What is an Agency’s Interpretive Authority?
 

         If E-SIGN applies (section 1 above) and it is necessary to interpret E-SIGN (section 2 above), agencies may wish to issue rules or guidance to do so.  E-SIGN provides, in Section 104(b)(1), that only agencies with preexisting statutory authority to issue rules may do so.  Agencies with authority to issue guidance and orders as well as rules may elect to issue guidance or orders.  These rules or guidance would interpret the provisions of Section 101(d).  For example, agencies having the requisite rulemaking authority might interpret the following aspects of Section 101(d)’s provisions with regard to their programs:
 
 

• What types of records will be deemed to “accurately reflect the information” (Section 101(d)(1)(A)) in a contract or record?  Must the record be of a type that is read-only or otherwise is non-alterable?
• What particular information “in the contract or record” (Section 101(d)(1)(A)) must be reflected?
• What does it mean to “remain accessible” (Section 101(d)(1)(B))?  Does that mean that the hardware and software necessary to read the record must be kept available too?  If so, where must those materials be kept?  To whom must they be available?  Who pays for that?
• Who are the persons “entitled to access” (Section 101(d)(1)(B))?
• What is the applicable period of time (Section 101(d)(1)(B)) for which the records must be accessible?
• Regarding checks, what comprises the “information on the front and the back of the check” (Section 101(d)(4))? Is this requirement satisfied by merely typing into a database the handwritten name(s) that appears on the signature line and the endorsement, or does it require scanning the signature and maintaining the image of it in the database?

         The general limitations on agency rulemaking authority discussed in part A.3. (See p. 12) also apply here in the case of agency interpretations related to record retention requirements.  E-SIGN also contains specific provisions in Section 101 addressing record retention, and provisions providing agencies with additional authority to regulate record retention, including authority to adopt performance standards, and to require the use of specific technologies or of paper in certain circumstances.

         a.  Requiring specific technologies. (Section 104(b)(3)(A)).  As explained above, E-SIGN generally permits agencies to adopt performance standards in regulations interpreting Section 101.  With respect to record retention requirements, E-SIGN provides agencies with additional authority, stating that agencies may “specify performance standards to assure accuracy, record integrity, and accessibility of records that are required to be retained.”  Such standards would be interpretations of the general provisions of Section 101(d).

         E-SIGN permits agencies to adopt standards that are “specified in a manner that imposes a requirement in violation of paragraph (2)(C)(iii),”  -- that is, that require the use of a specific technology or technical specification -- if the agency finds that the requirement serves an importantgovernment objective and is substantially related to the achievement of that objective.

         Agencies may not “require use of a particular type of software or hardware in order to comply with Section 101(d).”  This provision is probably best read to mean that agencies may not require use of the hardware or software of a specific manufacturer, not that they may not set performance standards for hardware and software.  The statute permits agencies to require the use of a particular technology or technical specification if the required findings are made.
 

Illustration 1.  Agency ABC wishes to ensure that records retained by private parties are kept in a format that cannot be tampered with and that it can easily read with its equipment.  The agency requires that records be retained on a write-once, read-many device meeting an established industry standard S.  The only manufacturer that currently makes equipment meeting that industry standard is Manufacturer M.  The regulation is permissible, assuming the other provisions of E-SIGN and any other applicable laws are met.

Illustration 2.  The same situation as in Illustration 1, but Agency ABC specifically requires the use of equipment made by the Manufacturer M.  The regulation is not permissible.

         b.  Requiring use of paper. (Section 104(b)(3)(B)).  This provision permits agencies to require retention of a record in a tangible printed or paper form if there is a “compelling governmental interest relating to law enforcement or national security for imposing such requirement” and “imposing such requirement is essential to attaining such interest.”

C.   Filing requirements

         E-SIGN preserves agencies’ authority to specify standards and formats for records filed with the agency (Section 104(a)).  Therefore, as a rule, filing requirements will be governed by GPEA, not by E-SIGN.   GPEA generally provides for agencies to allow for the use and acceptance of electronic signatures and records when practicable. GPEA sets timetables for this.

         Agencies should review their regulations regarding filings to determine what changes, if any, are needed in those regulations.  Agencies should make any changes needed in this area by October 2003, the deadline under GPEA.  To the extent that regulated filings are also information collections under the PRA, agencies should address options for automating these transactions as part of their GPEA planning.

D.   Government Guaranteed Loans and Mortgage Insurance
 

         These programs generally involve at least two contracts: A contract between the borrower and a private lender, and a separate guarantee or insurance contract between the private lender and the government.  The government generally is not a party to the first contract (the loan or mortgage transaction), but is a party to the second contract (the guarantee or insurance).

         Although E-SIGN would not require the government to use or accept electronic signatures in its guarantee or insurance contract  (Section 101(b)(2)), the government may do so because of GPEA’s requirements.  An agency can specify the format (for example, paper, with ink signatures, or a particular technology or software) for records filed with that agency (Section 104(a)).  An agency could also require that crucial documents in the transaction (for example, copy of note and mortgage) be filed with the agency or its contractor in whatever form the agency chooses.

         Aside from the filing requirements discussed above, the agency might have less control over how the loan or mortgage contract would be documented between the parties.  To the extent that the agency has rulemaking authority with regard to the transaction, however, it could interpret Section 101 accordingly.  The agency also could interpret the record retention provisions of Section 101(d) (subject to applicable restrictions in Section 104(b)).  For example:
 

• The agency could interpret the terms (such as "accessibility") used in Section 101(d).
• Under Section 104(b)(3)(A) the agency could specify “performance standards to ensure accuracy, record integrity, and accessibility of records.”
• The agency could specify the specific technology that must be used to keep the records, if the agency determines that such a requirement (i) serves an important governmental objective, and (ii) is substantially related to the achievement of that objective.

E.   Government as Market Participant

         1.  When Does E-SIGN Apply?

         Whether a particular action or interaction by a government agency is covered by Section 101(a) can be a complicated question.  As explained in Part I, section B above, distinctively governmental activities are not within the scope of E-SIGN.  For example, particular activities undertaken by an agency involving the government's obligations regarding Medicare are not covered by Section 101(a), even though those activities may be analogous to activities engaged in by a private party (e.g., provision of health insurance).

         When the government engages in "business, consumer or commercial affairs," its actions could be deemed "transactions" within the meaning of Section 101(a).  In that event, the question of whether Section 101(a) mandates the government's use or acceptance of electronic signatures and records might depend upon whether the transaction is a contract to which the government is a party.

         a.  Contract to which agency is a party.  Section 101(b)(2), in effect, states that Title I of E-SIGN does not require agencies to "use or accept" electronic signatures or records for contracts to which they are parties.⁸

         An agency and a private party with whom it is contracting may choose by mutual agreement whatever particular methodologies they wish to use.  For example, they could specify in the contract that certain notices or records must be on paper, with an ink signature, or that the contract, notices or related records must be in a particular electronic format or must use a particular type of software.  Section 101 states  “[n]otwithstanding any statute, regulation, or other rule of law . . . .”  Thus, the operative portions of Section 101 trump statutes, regulations and rules of law, but this should be read narrowly to leave open the option for parties to agree to limitations on the use of electronic methods.  The restrictions of Section 104 should not apply to consensual agreements between the government and another party to a government contract.  The restrictions in Section 104 apply only to what the government may require by regulations, not to what the government and those with whom it contracts may agree upon.

Illustration 1.  An agency seeks to lease office equipment.  E-SIGN would not require the agency to use or accept electronic signatures and records for the lease itself, because the agency would be a party to the contract, but the agency is likely to implement an electronic method under GPEA.

Illustration 2.  Assume the agency and the lessor enter into the lease (on paper, with ink signatures), and the lessor seeks to serve a notice (such as a notice of a breach or foreclosure) electronically.  The lease expressly states that notices must be given in writing, signed with an ink signature.  In this case, the electronic notice was not sufficient.  Even under E-SIGN, parties to a contract (including the government, when it is a party) are free to specify contract terms such as the form of notices.⁹

         To the extent the agency has rulemaking authority in connection with the transaction, it may have the ability to interpret Section 101 in ways that will allow it some control over the format of the transaction.  It also might be able to require that records be filed with the agency in specified formats.

         2.  Should an Agency Agree to Use Electronic Records and Signatures for Contracts to Which It is a Party?

         When the government is a party to a contract, it has the ability to determine, subject to GPEA, whether to use and accept electronic methods, even if the other parties to the contract wish to do so.  Agencies should use their discretion, taking into account the applicable requirements of GPEA as applied to the contract, and considering any policy implications.  Even when the government is not a party to a contract, in many instances it may have a significant financial stake (such as the mortgage insurance and loan guarantee contracts described above).  It must assess whether it needs to take steps to ensure that it is protected from financial loss that might occur if the private parties do not use means that will allow the government to protect its rights in the transaction.

         3.  What is an Agency’s Interpretive Authority?

         To the extent that agencies determine that they need to have some control over, for example, contracts between private parties that expose the government to liability or loss (for example, government guaranteed loans by a private lender to a borrower), agencies may use their rule-making authority, as discussed above.  Further, to the extent that agencies need to require that certain documents in the underlying transaction (for example, the underlying loan contract) need to be submitted to the agency (directly or to a loan servicer (a contractor) who maintains the records for the agency) Section 104(a) preserves the agency's ability to require this.

         4.  How Does E-SIGN Apply to Transactions in which the Government is a Party?
 

         Section 101(c) establishes a special rule for the use of electronic records in consumer transactions (see Section A(1)(c) above).  If a statute, regulation, or other rule of law requires that information be provided to a consumer in writing, an electronic record of the information may be used to fulfill this requirement only if the consumer affirmatively consents to the use of the electronic record and several other requirements spelled out in Section 101(c) are satisfied.  Under the Act, a consumer is an individual who obtains products or services primarily for personal, family, or household purposes (Section 106(1)).

         The requirements of Section 101(c) likely will apply to a federal agency in very limited circumstances.  First, these requirements will apply only where the agency is engaging in a transaction as a market participant (as opposed to strictly governmental transactions related to taxation or public benefits administration) and the agency is providing products or services directly to a consumer.  Second, there must be a statute, regulation, or other law requiring the consumer to receive certain information relating to the transaction in writing.  Third, the agency must seek to require the consumer to receive that information electronically.  Fourth, the information must not be part of a contract to which the agency is a party.

F.   Effective Dates
 
 

Appendix A: Legislative History of E-SIGN

         At the time E-SIGN was passed, a number of Senators and Representatives made floor statements about E-SIGN,  Especially comprehensive statements were delivered by Senators Hollings, Wyden, and Sarbanes, who made a joint statement, and by Congressman Dingell, who made two statements.  The joint Senate statement and the first statement of Congressman Dingell were very similar.  146 Cong. Rec. S5229 (June 16, 2000); 146 Cong. Rec. H4357 (June 14, 2000); 146 Cong. Rec. E1071 (June 21, 2000).  Senator Abraham and Congressman Bliley also made extensive statements, which were likewise similar to one another.  146 Cong. Rec. S5283 (June 16, 2000); 146 Cong. Rec. H4352 (June 14, 2000).  In signing E-SIGN, the President stated that he did so

with the understanding, reflected in the Congressional Record statements of Senators Hollings, Wyden, and Sarbanes, and Congressman Dingell, that this Act gives State and Federal governments the authority they need to establish record retention requirements, prescribe standards and formats for filings, and issue other regulations and orders to implement the legislation necessary to prevent waste, investigate and enforce the law, operate programs effectively, and protect consumers and the public interest. As they explained, this legislation principally addresses commercial and consumer activities, not governmental activities that have already been addressed by the Government Paperwork Elimination Act.  To the extent that these two laws overlap, I instruct Federal agencies to construe them in a manner consistent with protecting the public interest and effectively carrying out agency missions.

[t]he Conferees specifically rejected including 'Governmental' transactions.  Members should understand that this bill will not in any way affect most Governmental transactions, such as law enforcement actions, court actions, issuance of Government grants, applications for or disbursement of Government benefits, or other activities that the Government conducts that private actors would not conduct.  Even though some aspects of such Governmental transactions (for example, the Government's issuance of a check reflecting a Government benefit) are commercial in nature, they are not covered by this bill because they are part of a uniquely governmental operation.  Likewise, activities conducted by private parties principally for governmental purposes are not covered by this bill. Thus, for example, the act of collecting signatures to place a nomination on a ballot would not be covered, even though it might have some nexus with commerce (such as the signature collectors' contract of employment).

ENDNOTES:
¹  Agencies should refer to OMB Memorandum M-00-10, Implementation of the GPEA, for general guidance in this area, and to OMB's procedural guidance on developing GPEA plans, issued July 25, 2000, for specific instructions on actions to be taken.

²  The PRA defines an information collection as:
                  "the obtaining, causing to be obtained, soliciting, or requiring the disclosure to an agency, third parties or the public of information by or for an agency by means of identical questions posed to, or identical reporting, record keeping or disclosure requirements imposed on, ten or more person, whether such collection of information is mandatory, voluntary, or required to obtain or retain a benefit."  5C.F.R. 1320.3 (2000).

³  The examples and discussion that follow are intended as guidance and do not address every possible situation.  In some instances other circumstances may render a particular discussion or illustration inapplicable.

⁴  There are also certain categories of requirements that are not subject to E-SIGN at all.  See, for example, Section 101 (f) (referring to public notices).

⁵  Section 106(1) defines consumer as an individual who obtains, through a transaction, products or services which are used primarily for personal, family, or household purposes, and also means the legal representative of such individual.

⁶  Agencies should be aware of Congress's decision to reiterate this standard and be cautious in exercising their interpretive authority.  Congressman Dingell and Senators Hollings, Wyden and Sarbanes explained in Senate and House floor statements that, because "each agency will be proceeding under its preexisting rulemaking authority, ... regulations or guidance interpreting Section 101 will be entitled to the same deference that the agency's interpretations would usually receive."  146 Cong. Rec. E1071 (June 21, 2000).

⁷  The Legislation's sponsors said in their floor statements that they intended that federal agencies have authority to interpret E-SIGN in order to protect industry and consumers, address abusive electronic practices, prevent waste, fraud and abuse, and enforce the law.  146 Cong. Rec. H4346, H4358-59 (June 14, 2000); 146 Cong. Rec. E1071 (June 21, 2000).

⁸  Section 101(b)(2) states that Title I "does not... require any person to agree to use or accept electronic records or electronic signatures, other that a governmental agency with respect to a record other that a contract to which it is a party".  Thus, Title I of E-SIGN does not require governmental agencies to use or accept electronic records or signatures with regard to contracts to which they are parties.

⁹  Some might argue that, while Section 101(b)(2) states that the government will not be forced to use or accept electronic records and signatures for contracts, that might not apply to records other that the contract itself.  They might assert that the government must accept electronic notices under a contract.  We would disagree with that position.  Section 101(b)(2) applies broadly to the entire transaction involving a government contract, including all records relating to the contract.

See id. at H4357.
 
 

• More information on:  E-Commerce