Rule: Cross-Media Electronic Reporting

Thursday,
October 13, 2005
Part III
Environmental
Protection Agency
40 CFR Parts 3, 9, 51 et al.
Cross-Media Electronic Reporting; Final
Rule
VerDate Aug<31>2005 18:22 Oct 12, 2005 Jkt 208001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\13OCR3.SGM 13OCR3
59848 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations
ENVIRONMENTAL PROTECTION environmental programs that EPA has schwarz.david@epa.gov, or Evi Huffer
AGENCY delegated, authorized, or approved them (2823T), Office of Environmental
to administer. This rule includes Information, U.S. Environmental
40 CFR Parts 3, 9, 51, 60, 63, 69, 70, performance standards against which a Protection Agency, 1200 Pennsylvania
71, 123, 142, 145, 162, 233, 257, 258, state’s, tribe’s, or local government’s Avenue, NW., Washington, DC 20460,
271, 281, 403, 501, 745 and 763 electronic document receiving system (202) 566–1697, huffer.evi@epa.gov.
[FRL–7977–1] will be evaluated before EPA will
SUPPLEMENTARY INFORMATION:
approve changes to the delegated,
RIN 2025–AA07 authorized, or approved program to General Information
provide electronic reporting, and
Cross-Media Electronic Reporting A. Affected Entities
establishes a streamlined process that
AGENCY: Environmental Protection states, tribes, and local governments can This rule will potentially affect states,
Agency (EPA). use to seek and obtain such approvals. tribes, and local governments that have
ACTION: Final rule. DATES: This rule shall become effective been delegated, authorized, or
January 11, 2006. approved, or which seek delegation,
SUMMARY: EPA is establishing the
ADDRESSES: The public record for this authorization, or approval to administer
framework by which it will accept
rulemaking has been established under a federal environmental program under
electronic reports from regulated
docket number OEI–2003–0001 and is Title 40 of the Code of Federal
entities in satisfaction of certain
located in the EPA Docket Center, (EPA/ Regulations (CFR). For purposes of this
document submission requirements in
DC) EPA West, Room B102, 1301 rulemaking, the term ‘‘state’’ includes
EPA’s regulations. EPA will provide
Constitution Ave., NW., Washington, the District of Columbia and the United
public notice when the Agency is ready
DC. The EPA Docket Center Public States territories, as specified in the
to receive direct submissions of certain
documents from regulated entities in Reading Room is open from 8:30 a.m. to applicable statutes. That is, the term
electronic form consistent with this 4:30 p.m., Monday through Friday, ‘‘state’’ includes the District of
rulemaking via an EPA electronic excluding legal holidays. (See Columbia, the Commonwealth of Puerto
document receiving system. This rule SUPPLEMENTARY INFORMATION below.) Rico, the Virgin Islands, Guam,
does not mandate that regulated entities FOR FURTHER INFORMATION CONTACT: For American Samoa, the Commonwealth of
utilize electronic methods to submit general information on this final rule, Northern Marina Islands, and the Trust
documents in lieu of paper-based contact the docket above. For more Territory of the Pacific Islands,
submissions. In addition, EPA is not detailed information on specific aspects depending on the statute.
taking final action on the electronic of this rulemaking, contact David The rule will also potentially affect
recordkeeping requirements at this time. Schwarz (2823T), Office of private parties subject to any
States, tribes, and local governments Environmental Information, U.S. requirements in Title 40 of the CFR that
will be able to seek EPA approval to Environmental Protection Agency, 1200 require a document to be submitted to
accept electronic documents to satisfy Pennsylvania Avenue, NW., EPA. Affected Entities include, but are
reporting requirements under Washington, DC 20460, (202) 566–1704, not necessarily limited to:
Category Examples of affected entities
Local government ............... Publicly owned treatment works, owners and operators of treatment works treating domestic sewage, local and re-
gional air boards, local and regional waste management authorities, and municipal and other drinking water au-
thorities.
Private ................................ Industry owners and operators, waste transporters, privately owned treatment works or other treatment works
treating domestic sewage, privately owned water works, small businesses of various kinds, sponsors such as
laboratories that submit or initiate/support studies, and testing facilities that both initiate and conducts studies.
Tribe and State govern- States, tribes or territories that administer any federal environmental programs delegated, authorized, or approved
ments. by EPA under Title 40 of the CFR.
Federal government ........... Federally owned treatment works and industrial dischargers, and federal facilities subject to hazardous waste regu-
lation.
This table is not intended to be B. How Can I Get Copies of This for public viewing at the Cross-Media
exhaustive, but rather provides a guide Document and Other Related Electronic Reporting Rule (CROMERR)
for readers regarding entities likely to be Information? Docket in the EPA Docket Center (EPA/
affected by this action. This table lists DC), EPA West, Room B102, 1301
1. Docket. EPA has established an
the types of entities that EPA is now Constitution Ave., NW., Washington,
official public docket for this action
aware can potentially be affected by this DC. The EPA Docket Center Public
under Docket ID No. OEI–2003–0001.
action. Other types of entities not listed Reading Room is open from 8:30 a.m. to
The official public docket consists of the
in the table can also be affected. If you 4:30 p.m., Monday through Friday,
documents specifically referenced in
have questions regarding the excluding legal holidays. The telephone
this action, any public comments
applicability of this action to a received, and other information related number for the Public Reading Room is
particular entity, consult the person to this action. Although a part of the (202) 566–1744, and the telephone
listed in the preceding FOR FURTHER official docket, the public docket does number for the Office of Environmental
INFORMATION CONTACT section. not include Confidential Business Information Docket is (202) 566–1752.
Information (CBI) or other information You may have to pay a reasonable fee
whose disclosure is restricted by statute. for copying.
The official public docket is the An electronic version of the public
collection of materials that is available docket is available through EPA’s
Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59849
electronic public docket and comment 2. Definition of ‘‘electronic document’’ E. Unfunded Mandates Reform Act
system, EDOCKET. You may use 3. Definition of ‘‘electronic signature’’ F. National Technology Transfer and
EDOCKET at http://www.epa.gov/ 4. Definition of ‘‘electronic signature Advancement Act
device’’ G. Executive Order 13045
edocket/ to view public comments, H. Executive Order 13175
5. Definition of ‘‘transmit’’
access the index listing of the contents 6. Definition of ‘‘valid electronic signature’’ I. Executive Order 13211 (Energy Effects)
of the official public docket, and to V. Requirements for Direct Electronic J. Congressional Review Act
access those documents in the public Reporting to EPA
docket that are available electronically. A. What are the requirements for electronic I. Overview
Although not all docket materials may reporting to EPA? A. Why does the Agency seek to provide
be available electronically, you may still B. What is the status of existing electronic electronic alternatives to paper-based
access any of the publicly available reporting to EPA?
reporting and recordkeeping?
C. What is EPA’s Central Data Exchange?
docket materials. After selecting the In the Federal Register of August 31,
1. Overview of general goals
‘‘Using EDOCKET’’ icon, select ‘‘quick 2. Comments on the proposal 2001 (66 FR 46162), EPA published a
search,’’ then key in the appropriate 3. The aspects of CDX that have not notice of proposed rulemaking,
docket identification number. Double changed since proposal announcing the goal of making
click on the document identification 4. The major changes that EPA has made electronic reporting and electronic
number to bring up the docket contents. to CDX since proposal
D. How will EPA provide notice of changes
recordkeeping available under EPA
2. Electronic Access. You may access regulatory programs. The Agency
this Federal Register document to CDX?
VI. Requirements for Electronic Reporting believes that the submission and storage
electronically through the EPA Internet of electronic documents in lieu of paper
under EPA-Authorized Programs
under the ‘‘Federal Register’’ listings at A. What is the general regulatory documents can:
http://www.epa.gov/fedrgstr/. approach? • Reduce the cost and burden of data
Organization of This Document B. When must authorized state, tribe, or transfer and maintenance for all parties
local government programs revise or to the data exchanges;
Information in this Preamble is modify their programs to allow • Improve the data and the various
organized as follows: electronic reporting? business processes associated with its
I. Overview 1. The general requirement
use in ways that may not be reflected
A. Why does the Agency seek to provide 2. Deferred compliance for existing systems
electronic alternatives to paper-based C. What alternative procedures does EPA directly in cost-reduction, e.g., through
reporting and recordkeeping? provide for revising or modifying improvements in data quality, and the
B. What does the electronic reporting rule authorized state, tribe, or local speed and convenience with which data
do? government programs for electronic may be transferred and used; and
C. What is the status of the proposed reporting? • Maintain the level of corporate and
electronic recordkeeping provisions? 1. The application individual responsibility and
D. How were stakeholders consulted 2. Review for completeness accountability for electronic reports and
during the development of today’s final 3. EPA actions on applications records that currently exists in the paper
rule? 4. Revisions or modifications associated environment.
E. What alternatives to today’s final rule with existing systems
did EPA consider? 5. Public hearings for Part 142 revisions or Recent federal policy and law are also
II. Background modifications strong drivers of electronic alternatives
A. What has been EPA’s electronic 6. Re-submissions and amendments to traditional reporting and
reporting policy? D. What general requirements must state, recordkeeping. The Government
B. How does today’s final rule change tribe, and local government electronic Paperwork Elimination Act (GPEA) of
EPA’s electronic reporting policy? reporting programs satisfy? 1998, Title XVII of Public Law 105–277,
III. Scope of the Electronic Reporting Rule E. What standards must state, tribe, and requires the Director of the Office of
A. Who may submit electronic documents? local government electronic document Management and Budget (OMB) to
B. Which documents can be filed receiving systems satisfy?
electronically? 1. Timeliness of data generation
ensure that executive agencies provide
C. How does this final rule implement 2. Copy of record for the option of the electronic
electronic reporting? 3. Integrity of the electronic document maintenance, submission, or disclosure
IV. Major Changes from Proposed Electronic 4. Submission knowingly of information as a substitute for paper
Reporting Provisions 5. Opportunity to review and repudiate when practicable, and for the use and
A. How does the rule streamline the copy of record acceptance of electronic signatures,
approval of electronic reporting under 6. Validity of the electronic signature when practicable. See GPEA section
authorized state, tribe, and local 7. Binding the signature to the document 1704. Given the enormous strides in
government programs? 8. Opportunity to review data transfer and management
1. Review of the proposal 9. Understanding the act of signing
2. Comments on the proposal 10. The electronic signature or subscriber
technologies, particularly in connection
3. Revisions in the final rule agreement with the Internet, replacing paper with
B. How has EPA revised the requirements 11. Acknowledgment of receipt electronic data transfer now promises
that state, tribe, and local government 12. Determining the identity of the increased productivity across almost all
electronic reporting programs must individual uniquely entitled to use a facets of business and government.
satisfy? signature device In seeking to make electronic
1. Review of the proposal VII. What are the Costs of Today’s Rule? alternatives available that were not
2. Comments on the proposed criteria for A. Summary of proposal analysis contemplated when most existing EPA
electronic document receiving systems B. Final rule costs regulations were written, EPA was
3. Revisions to the criteria in the final rule C. General changes to methodology and mindful of the need to maintain our
C. How has EPA accommodated electronic assumptions
submissions with follow-on paper VIII. Statutory and Executive Order Reviews
ability to carry out our statutory
certifications? A. Executive Order 12866 environmental and health protection
D. How has EPA changed proposed B. Executive Order 13132 mission, in part through ensuring the
definitions of terms? C. Paperwork Reduction Act integrity of environmental compliance
1. Definition of ‘‘acknowledgment’’ D. Regulatory Flexibility Act documents. Accordingly, the intended
effect of the proposed regulation was to requirements to assure that electronic and optical media approaches to
permit and encourage the use of documents are as legally dependable as paperless reporting to continue, and
electronic technologies in a manner that their paper counterparts. nothing in today’s rule should be
is consistent with EPA’s overall mission The requirements in Subpart B of the interpreted to proscribe or discourage
and that preserves the integrity of the rule apply to entities that choose to them.
Agency’s compliance and enforcement submit electronic documents for direct For entities that report to EPA directly
activities. reporting to EPA, including state, tribe, and do so by submitting electronic
The Agency believes that it is and local government facilities that documents, today’s action requires that
essential to ensure that electronic choose to submit electronic documents these documents be submitted either to
reports can play the same role as their to EPA to satisfy requirements that the Agency’s centralized electronic
paper counterparts in providing apply to them under other provisions of document receiving system, called the
evidence of what was reported and to title 40 of the CFR. However, the scope ‘‘Central Data Exchange’’ (CDX), or to
what identified individuals certified of this final rule excludes any data alternative systems designated by the
with respect to the report. Otherwise, transfers between EPA and states, tribes, Administrator as described herein and
electronic reporting places at risk the or local governments as a part of their in a separate Federal Register notice.
continuing viability of self-monitoring authorized programs or as a part of Entities that submit electronic
and self-reporting that provides the administrative arrangements between documents directly to EPA will satisfy
framework for compliance under most states, tribes, or local governments and the requirements in today’s rule by
of our environmental programs. The EPA to share data. The requirements in successfully submitting their reports to
purpose of today’s final rule is therefore Subpart D of the rule provide for one of these systems. While we do not
twofold. Today’s rule is intended to electronic reporting under authorized intend to codify any of the details of
provide regulated industry, EPA, and state, tribe, and local government how CDX operates or how it is
state, tribe, and local governments with programs and apply to the governmental constructed, the characteristics of the
electronic reporting alternatives that entities administering the authorized CDX and the submission scenarios are
improve the efficiency, the speed, and programs. Under the final rule, states, described later in this Preamble. In
the quality of regulatory reporting. At tribes, and local governments have the addition, the CDX design specifications
the same time, the rule is intended to choice of using electronic submission are included as a part of this rulemaking
ensure the legal dependability of rather than paper for reporting under docket.
electronic documents submitted under their authorized programs. Comments Many facilities submit documents
environmental programs. This includes, on the proposed rule indicated that directly to states, tribes, or local
among other things, ensuring that some states and local governments are governments under authorized
individuals will be held as responsible now requiring electronic reporting programs. For currently authorized
and accountable for the electronic under those programs. Existing programs that receive or wish to begin
signatures, which they execute, and for electronic document receiving systems receiving electronic documents in lieu
the documents to which such signatures must receive EPA approval in of paper, this rule requires EPA
attest as they currently are in cases of accordance with Subpart D in order to approval of program revisions or
documents where they execute meet the requirements of part 3. modifications that address their
handwritten signatures. This rule does not require that any electronic reporting implementations.
document be submitted electronically, For programs initially seeking
B. What does the electronic reporting and it does not require any state, tribe, authorization, this rule requires EPA
rule do? or local authorized program to receive approval of any electronic reporting
EPA is announcing today the final electronic documents. Public access to components of the programs. In both
regulatory provisions in a new part 3 of environmental compliance information cases, EPA approval will be based
Title 40 of the CFR for electronic is not affected by today’s action. largely on an assessment of the
reporting to EPA and under authorized Additionally, the scope of the final program’s ‘‘electronic document
state, tribe, and local government rule specifically excludes the receiving system’’ that is or will be used
programs. ‘‘Authorized program’’ is submission of any electronic document to implement electronic reporting. For
shorthand for a federal program that via magnetic or optical media—for this purpose, this rule includes
EPA has delegated, authorized, or example via diskette, compact disk performance-based standards that EPA
approved a state, tribe or local (CD), digital video disc (DVD), or tape— will use to determine that an electronic
government to administer under other as well as the transmission of document receiving system is
provisions of title 40 of the CFR, where documents via hard copy facsimile or acceptable. To implement electronic
the delegation, authorization, or ‘‘fax.’’ The exclusion of magnetic or reporting under currently authorized
approval has not been withdrawn or optical media submissions from the programs, EPA is creating a streamlined
expired. Section 3.3 of the rule codifies scope of this rule in no way indicates procedure that states, tribes, and local
this usage in the regulatory text. This EPA’s rejection of these technologies as governments may use to revise or
use of ‘‘authorized’’ does not mean that a valid approach to paperless reporting. modify their authorized programs to
EPA is precluded from an enforcement Magnetic and optical media incorporate electronic reporting.
action by a prior enforcement action submissions fulfill the goal of providing Today’s rulemaking also includes
being taken by a state, tribe, or local alternatives to submission on paper. special provisions for authorized
government under its authorized EPA has already successfully programs’ electronic document
program. The final rule incorporates implemented a paperless reporting receiving systems that exist at the time
changes made after publication of the alternative that utilizes magnetic and of publication of this final rule.
proposed rule that are discussed in optical media submissions to fulfill It is worth noting that EPA can
detail in section IV of this Preamble. many regulatory reporting requirements. approve changes to authorized state,
This rule establishes electronic Such instances include reporting related tribe, or local programs that involve the
reporting as an acceptable regulatory to the hazardous waste, Toxic Release use of CDX to receive data submissions
alternative across a broad spectrum of Inventory, and pesticide registration from their reporting communities, and
EPA programs, and establishes programs. EPA expects these magnetic EPA is exploring opportunities to
leverage CDX resources for use by states, maintenance of electronic records under options, with a focus on impacts to
tribes, and local governments. As these environmental regulations. EPA small businesses. Today’s rule does not
currently implemented, CDX provides proposed criteria under which the authorize the conversion of existing
the major systems infrastructure Agency would consider electronic paper documents retained to comply
components necessary to achieve records to be trustworthy, reliable, and with existing recordkeeping
electronic reporting consistent with the generally equivalent to paper records in requirements under other provisions of
standards in this rule for assessing state, satisfying regulatory requirements. For Title 40 of the CFR to an electronic
tribe, or local government electronic entities that choose to keep records format for record-retention purposes.
document receiving systems. electronically, the proposal would have
D. How were stakeholders consulted
Additionally, EPA has set the goal of required the adoption of best practices
during the development of today’s final
making CDX operations fully consistent for electronic records management. For
rule?
with the requirements in today’s rule facilities maintaining records to satisfy
within two years. the requirements of authorized This final rule reflects more than ten
While today’s rule establishes programs, the proposal would have years of interaction with stakeholders
electronic reporting as a regulatory allowed for EPA approval of changes to that included states, tribes, and local
alternative, EPA will make the the authorized programs to provide for governments, industry groups,
electronic submission alternative electronic recordkeeping. Under the environmental non-government
available for specific reports or other proposal, approval would have been organizations, national standard setting
documents only as EPA announces its based on a determination that the committees, and other federal agencies.
readiness to receive them through CDX authorized program would require best As detailed in the proposal, many of our
or another designated system. EPA will practices for electronic records most significant interactions involved
publish announcements in the Federal management, corresponding to EPA’s electronic reporting pilot projects
Register as CDX and other systems provisions for electronic records conducted with state agency partners,
become available for particular maintained to satisfy EPA including the States of Pennsylvania,
environmental reports. These elements recordkeeping requirements. New York, Arizona, and several others.
are discussed in more detail in section Further, EPA proposed that once the In May, 1997, work began with
V of this Preamble. rule took effect, any records subject to approximately 35 states on the State
In a notice published concurrently the rule that were maintained to satisfy Electronic Commerce/Electronic Data
with today’s rule, EPA clarifies the the requirements of EPA programs could Interchange Steering Committee (SEES)
status of electronic reporting directly to only be maintained electronically after convened by the National Governors’
EPA systems that exist as of the rule’s EPA announced in the Federal Register Association (NGA) Center for Best
publication date. In accordance with 40 that EPA was ready to allow electronic Practices (CBP). Also, EPA sponsored a
CFR 3.10, EPA is designating for the records maintenance to satisfy the series of conferences and meetings,
receipt of electronic submissions, all specified recordkeeping requirements. beginning in June, 1999, with the
EPA electronic document receiving Also under the proposal, records explicit purpose of seeking stakeholder
systems currently existing and receiving maintained under an authorized state, advice before drafting the proposal.
electronic reports as of the date of the tribe, or local government program Reports of these conferences and
notice. This designation is valid for a could only be maintained electronically meetings are available in the docket for
period of up to two years from the date once EPA had approved the necessary this rulemaking, along with the product
of publication of the notice. During this changes to the authorized program. of the SEES effort, a document entitled,
two-year period, entities that report Based on the comments received on ‘‘A State Guide for Electronic Reporting
directly to EPA may continue to satisfy the proposed electronic recordkeeping of Environmental Data,’’ and reports on
EPA reporting requirements by provisions, EPA reconsidered its some of the more recent state/EPA
reporting to the same systems as they approach to electronic recordkeeping electronic reporting pilots.
did prior to CROMERR’s publication and is not issuing final recordkeeping For the proposal, EPA provided a 6-
unless EPA publishes a notice that rules at this time. The Agency is month public comment period, which
announces changes to, or migration conducting additional analysis and closed on February 27, 2002. During
from, that system. Any existing system intends to publish a supplemental that time, we received 184 sets of
continuing to receive electronic reports notice or re-proposal to solicit written comments on the proposed rule.
at the expiration of this two-year period additional comments before a final rule The commenters represented a broad
must receive redesignation by the on electronic recordkeeping is issued. spectrum of interested parties: States,
Administrator under § 3.10. Notice of We will be reviewing provisions related local governments, specific businesses,
such redesignation will be published in to the methods used to ensure accuracy, trade associations, and other federal
the Federal Register. accessibility and the ability to detect agencies. Substantive changes to the
alterations of records stored electronic reporting provisions based on
C. What is the status of the proposed electronically, as well as other possible public comments are discussed in detail
electronic recordkeeping provisions? controls for electronic recordkeeping. in section IV of this Preamble. In
At this time, EPA is only finalizing The Agency intends to utilize this addition, EPA received comments at
the provisions for electronic reporting to review to engage states, tribes, local four public meetings held around the
EPA and under authorized programs. governments, and industry in country and at two meetings with states
The August 31, 2001, proposal, meaningful consultation to ensure that held in Washington, DC. The comments
however, also addressed records that the EPA has the best available and meeting summaries can be found in
EPA or authorized programs require information on which to base its the docket to this rulemaking. Today’s
entities to maintain under any of the decisions. In conjunction with these final rule reflects many of the comments
environmental programs governed by consultations—and before issuing any and concerns raised by commenters on
Title 40 of the CFR or related state, tribe, notice or re-proposal—EPA will conduct the proposal. (A complete discussion of
and local laws and regulations. For such additional analysis on the costs and the options considered by EPA and
records, EPA proposed specific benefits of alternative approaches, and other background information on the
provisions for administering the the technical feasibility of various Agency’s policy on electronic reporting
can be found in the proposed rule.) The whom a signature device or credential compliance, or informational
majority of comments focused on the (e.g. a PIN, password, or PKI certificate) (voluntary) reporting to EPA via EDI.
costs and burden of the proposed is issued. This less stringent alternative For purposes of the 1996 policy, the
Subpart D electronic recordkeeping would have omitted the provision for standard transmission formats used by
provisions. EPA’s response to public identity-proofing in the final EPA were to be based on the EDI
comments to the proposal can be found § 3.2000(b)(5)(vii). In terms of regulatory standards developed and maintained by
in the rulemaking docket, in the impact, this would be a significant the American National Standards
Response to Comments document. reduction in stringency. Most of the Institute (ANSI) Accredited Standards
E. What alternatives to today’s final rule burden on regulated entities imposed by Committee (ASC) X12. By linking our
did EPA consider? today’s rule is associated with the approach to the ANSI X12 standards, we
registration process involved in hoped to take advantage of the robust
EPA considered both a more stringent obtaining a signature device or ANSI-based EDI infrastructure already
and a less stringent alternative to the credential, and any requirement to in place for commercial transactions,
regulatory approach taken in this rule. establish the registrant’s identity raises including a wide array of commercial
The more stringent alternative is the aggregate burden substantially. off-the-shelf (COTS) software packages
reflected in the electronic provisions and communications network services,
published, August 31, 2001, in the EPA rejected this less stringent
alternative, because we believe that it and a growing industry community of
Notice of Proposed Rulemaking for EDI experts available both to EPA and
CROMERR. The proposed version of would seriously undermine the rule’s
ability to assure the legal dependability to the regulated community. At the time
CROMERR was more stringent by virtue EPA was writing this policy, ANSI-
of setting much more prescriptive, of electronic submissions. It is a basic
principle of electronic authentication based EDI was arguably the dominant
detailed requirements that electronic mode of electronic commerce across
document receiving systems would have (E-authentication) that individuals being
authenticated are who they say they are. almost all business sectors, from
to satisfy. For example: aerospace to wood products, at least in
• Proposed § 3.2000(d) contained E-authentication depends critically on
the degree of trust we can place in the the United States. (A complete
very specific requirements for submitter
credential the individual presents, and discussion of EPA’s 1996 policy can be
identity management that a system
would have to satisfy, including such trust depends heavily on the found in the preamble to the proposed
detailed requirements for renewal of process of establishing the individual’s rule.)
registration and revocation of identity (or ‘‘identity-proofing’’) when With this final rule, EPA is making
registration under specified he or she first registers for the changes to the 1996 policy for three
circumstances; credential. If the identity-proofing primary reasons. First, and most
• Proposed § 3.2000(e) contained very process is not sufficiently stringent and important, the technology environment
detailed requirements for the signature/ credible, then it may be uncertain who has changed substantially since the
certification scenario that a system is using the credential in a specific 1996 policy was written. Web-based
would have to provide for, specifying instance where it is presented. Where electronic commerce and public key
the exact sequence of steps to be the credential is used to create an infrastructure (PKI) are two examples.
followed in electronically signing a electronic signature, inadequate While both were available and in use for
submission, and requiring such features identity-proofing may create uncertainty some purposes in 1996, they had not yet
as on-screen, scroll-through as to who the signatory is, as a result, achieved the level of acceptance and use
presentation of the data to be submitted the signature may be rendered that they enjoy today. We could not
for review of the signatory prior to undependable for any legal purpose. have anticipated in 1996 that this
signing. Accordingly, EPA believes that, evolution would occur as rapidly as it
EPA received significant public notwithstanding the cost, it is necessary has. Clearly, these developments require
comment on this approach, both from to specify that identity-proofing be that we extend our approach to
states and from regulated companies, conducted. The § 3.2000(b)(5)(vii) electronic reporting beyond EDI and
and there were at least three closely identity-proofing requirement is Personal Identification Numbers (PINs).
related themes. The first was that such explained in detail in section VI.E.12 of In addition, they teach us that it is
prescriptive requirements would greatly this Preamble. generally unwise to base regulatory
limit the flexibility of states to requirements on the existing
implement electronic reporting in a II. Background information technology environment or
cost-effective way. The second theme A. What has been EPA’s electronic on assumptions about the speed and
was that many of the requirements— reporting policy? direction of technological evolution.
especially those specifying the Second, we believe that technology-
signature/certification scenario—were On September 4, 1996, EPA published specific provisions would be very
not appropriate to many cases where a document entitled ‘‘Notice of Agency’s complex and unwieldy. The resulting
electronic reporting would occur. Third General Policy for Accepting Filing of regulation would likely place
and finally, many of these commenters Environmental Reports via Electronic unacceptable burdens on regulated
expressed skepticism that these very Data Interchange (EDI)’’ (61 FR 46684) entities trying to understand and
detailed requirements represented the (hereinafter referred to as ‘the 1996 comply.
only possible approach to ensuring the Policy’), where ‘‘EDI’’ generally refers to Third, and finally, an electronic
legal dependability of electronic the transmission, in a standard syntax, reporting architecture that makes a
submissions and signatures. These of unambiguous information between centralized EPA or state system the
themes are discussed in detail in section computers of organizations that may be platform for such functions as electronic
IV.B of this Preamble. completely external to each other. This signature/certification is now quite
EPA also considered a less stringent notice announced EPA’s basic policy for viable—and quite consistent with the
alternative that would have refrained accepting electronically submitted standard practices of Web-based
from specifying requirements to environmental reports, and its scope electronic commerce. Given the state of
establish the identity of an individual to was intended to include any regulatory, technology six years ago, we could not
have considered this approach in the amended with each technological electronically under other Title 40
1996 policy. innovation. regulations, and nothing in today’s rule
However, this regulatory strategy does limits EPA’s ability to require electronic
B. How does today’s final rule change not mean abandoning any control over reporting under other parts of Title 40.
EPA’s electronic reporting policy? how electronic documents are In general, entities may submit
For practical purposes, the most submitted. In place of specific documents electronically as provided
important change that today’s rule technologies or detailed procedural for under authorized state, tribe, or local
makes is in our technical approach to steps, today’s rule requires that government programs. Nothing in this
electronic reporting. In contrast to the electronic submissions be made to CDX rule prohibits state, tribe, or local
1996 policy, today’s rule does not or other designated EPA systems, or to governments from requiring electronic
generally specify or limit the range of state, tribe, or local government systems reporting under applicable state, tribe,
allowable electronic submission that are determined to satisfy a certain or local law.
technologies and formats. Under today’s specified set of technology-neutral
B. Which documents can be filed
rule, complaint electronic reporting performance standards. As a practical
electronically?
approaches can include user-friendly matter, the use of these systems (e.g.,
‘smart’ electronic forms to be completed CDX or others that meet the specified This rule addresses document
performance standards) will involve submissions required by or permitted
on-line or downloaded for completion
submission procedures that we believe under any EPA or authorized state,
off-line at the user’s personal computer,
are sufficient to ensure the legal tribe, or local program governed by
as well as data transfers via the Internet
dependability of electronic reports so EPA’s regulations in Title 40 of the CFR.
or secure email in a variety of standard
that they meet the needs of our Nonetheless, EPA will need time to
and common off-the-shelf, application-
compliance and enforcement programs. develop the hardware and software
based formats. Similarly, in terms of
In addition, while the specified components required for each
electronic signature technology, the rule
performance standards may be individual type of document. Similarly,
allows for a range of approaches,
technology-neutral, agency electronic states, tribes, and local governments
including various implementations of
reporting systems that implement the will need time to evaluate their
PINs and passwords, the use of private electronic document receiving systems
or personal information, digital standards will incorporate suites of very
specific technologies that will further to ensure that they meet the standards
signatures based on PKI certificates, and promulgated in today’s final rule.
other signature technologies as they determine the process for actual
electronic submission. Sections V.B and Accordingly, once this rule takes effect,
become viable for our applications. As specific documents submitted directly
EPA or authorized programs implement V.C of this Preamble describe these
requirements and the associated to EPA that are not already being
electronic submission for specific submitted electronically to existing EPA
reports, the rule allows them to select technologies in some detail for the case
of reporting directly to EPA via CDX. systems can only be submitted
one or more of the available submission electronically after EPA announces in
and signature approaches according to III. Scope of the Electronic Reporting the Federal Register that CDX or an
their circumstances and the program- Rule alternative system is ready to receive
specific requirements. EPA is today promulgating a new Part those specific documents. (See section
EPA’s goals are to make this 3 in Title 40 of the CFR. The new Part V.B of this Preamble for a discussion of
electronic reporting alternative as applies to all persons who submit the status of electronic reporting
simple, attractive and cost-effective as reports or other documents to EPA directly to EPA systems that exist as of
possible for reporting entities, while under Title 40, and to state, tribe, and the rule’s publication date.) Documents
ensuring that electronically submitted local programs that administer or seek may be submitted electronically under
documents are as legally dependable as to administer authorized programs the provisions of an authorized state,
their paper counterparts. We believe under Title 40. The new part 3 does not tribe, or local program.
that today’s rule achieves these goals, address contracts, grants or financial
but—unlike the 1996 policy—without C. How does this final rule implement
management regulations contained in
requiring specific technologies or setting electronic reporting?
Title 48 of the CFR.
detailed procedural steps for the The new 40 CFR part 3 consists of
submission of electronic documents. A. Who may submit electronic four (4) Subparts. Subpart A provides
Our strategy—as initially set out in the documents? that any requirement in Title 40 to
August 31, 2001, notice of proposed Any entity that submits documents submit a report directly to EPA can be
rulemaking, and as finalized today—is addressed in this rule (see section III.B., satisfied with an electronic submission
to impose as few specific requirements below) directly to EPA can submit them that meets certain conditions (specified
as possible on reporting entities, and to electronically as soon as EPA announces in Subpart B) once the Agency
generally keep requirements neutral that CDX or a designated alternative publishes a notice that electronic
with respect to technology. As a system is ready to receive these reports. document submission is available for
consequence, today’s rule enables EPA, (See section V of this Preamble for a that requirement. Subpart A also
the states, tribes, and local governments discussion on requirements for provides that electronic reporting can be
to offer regulated companies diverse electronic reporting to EPA, and section made available under EPA-authorized
approaches to electronic reporting that V.B for a discussion of the status of state, tribe, or local environmental
can be tailored to their technical electronic reporting directly to EPA programs. In addition, Subpart A makes
capabilities and to the level of systems that exist as of the rule’s clear: (1) that electronic document
automation they wish to achieve. In publication date.) Under this rule, the submission, while permissible under
addition, the strategy gives EPA, the affected entities may elect to utilize the the terms of this rule, is not required by
states, tribes, and local governments the electronic reporting alternative. These any provision of this rule; and (2) that
flexibility to adapt electronic reporting entities are not required by this final this rule confers no right or privilege to
systems to evolving technologies rule to report electronically; however, submit data electronically and does not
without requiring that regulations be they may be required to report obligate EPA or states, tribes, or local
agencies to accept electronic data. determination, EPA intends to maintain 2. Comments on the proposal. In
Subpart A also contains key definitions an easily accessed list of EPA reports for comments on the provisions for
and discusses compliance and which electronic reporting has been electronic reporting under authorized
enforcement. implemented—cross-referencing the programs, a recurring theme was the
Subpart B sets forth the general applicable Federal Register notices—on complexity of the proposed
requirements for acceptable electronic the Exchange Network and Grants requirements for EPA approval of
documents submitted to EPA. It webpage at www.epa.gov/ program revisions or modifications to
provides that electronic documents exchangenetwork. allow electronic reporting. The
must be submitted either to CDX or to comments in many cases seemed
other EPA designated systems. It also IV. Major Changes From Proposed directed equally to the approval process
includes general requirements for Electronic Reporting Provisions and to the proposed criteria for
electronic signatures. The requirements A. How does the rule streamline the approval. Comments on the criteria are
in Subpart B apply to entities that approval of electronic reporting under discussed in more detail in section
submit electronic documents for direct authorized state, tribe, and local IV.B.2 of this Preamble.
reporting to EPA, including states, government programs? As for the comments that clearly
tribes, and local governments that addressed the process, there were two
submit electronic documents to EPA to 1. Review of the proposal. EPA major concerns. The first was that the
satisfy requirements that apply to them proposed that states, tribes, and local process, due to the various current
under Title 40 of the CFR. Subpart B governmental entities would use the program authorization regulations, is
does not apply to any data transfers procedures for program revision or inherently complicated, time-
between EPA and states, tribes, or local modification provided in existing consuming and resource-intensive. In a
governments as a part of their program-specific regulations governing few cases, commenters noted the
authorized programs or as a part of state, tribe, or local authorized particular worry that having to seek EPA
administrative arrangements between programs. approval for each program
states, tribes, or local governments and In the Preamble to the proposed rule, implementing electronic reporting
EPA to share data. Additionally, we noted that our approach raised would be especially burdensome, and
Subpart B does not apply to the certain administrative concerns, that EPA’s proposed approach of
submission of any electronic document especially in cases where a streamlining the internal review
via magnetic or optical media—for governmental entity wished to use a component of the program revision
example via diskette, compact disk, or single system to accept electronic process would be of little help.
tape—or to the transmission of submissions across a number of The second concern was the impact of
documents via hard copy facsimile or authorized programs, corresponding to the rule on electronic reporting that was
‘‘fax.’’ EPA’s use of CDX to receive reports already underway. Commenters noted
Subpart C is reserved for future EPA across EPA programs. To receive EPA that many authorized programs are
electronic recordkeeping requirements. approval for such implementations, the already accepting electronic
Finally, Subpart D sets forth the governmental entity would have to submissions, or would be by the time
process and standards for EPA approval apply for revision or modification under the final rule is published, and they
of changes to authorized state, tribe, and each authorized program affected, using worried about the timing of the
local environmental programs to allow procedures that might vary substantially requirement that the electronic
electronic reporting to satisfy from program to program. While these document receiving systems they use for
requirements under these programs. procedures might vary, each substantive this purpose be approved by EPA under
Again, for purposes of Subpart D, review would still refer to the same associated program revision or
‘‘electronic reporting’’ entails proposed part 3 criteria, and—in the modification procedures. Under the
submission via telecommunications, case of a single system proposed provisions, such systems
and Subpart D requirements do not implementation—would apply these would have to be EPA-approved as soon
apply in cases of submission via criteria to the same system. EPA as the rule became effective, which was
magnetic or optical media or hard copy intended this approach to facilitate an not practicable. Given the need to
‘‘fax.’’ With respect to electronic administrative streamlining of the address the criteria for approval, such
reporting, Subpart D includes simplified approval process, by allowing a single applications could only be initiated
performance-based standards for EPA review of all cross-program once the rule was finalized, and they
acceptable state, tribe, or local agency applications associated with a particular might take months to complete and get
electronic document receiving systems electronic document receiving system, approved, or substantially longer in
against which EPA will assess which would enable EPA to make a cases where the revision or modification
authorized program electronic reporting single decision to approve or disapprove required state legislative or regulatory
elements. It also provides a streamlined all the associated applications. While changes. During the months or years
process for approving applications for this approach would not eliminate that the revision or modification was in
revisions to authorized programs for multiple applications, it would at least process, the authorized program would
electronic reporting. simplify the interactions between the either have to shut down their
Given the provisions of Subpart A, a applicant and EPA during substantive electronic document receiving systems
regulated entity wishing to determine review, and would speed EPA action on or, of necessity, operate them out of
whether electronic reporting directly to the applications themselves. compliance with the rule. Commenters
EPA was available under some specific EPA also considered more radical were particularly concerned with the
regulation will have to verify that EPA streamlining alternatives, including a disruptive impacts of having to shut
has published a Federal Register notice centralized approval process provided these systems down. They pointed out
announcing their availability and will for by regulation, and the proposal that reversion to paper-based
have to locate any additional provisions requested comment on whether any of submissions in such cases may be
or instructions governing the electronic these alternatives would be preferable to difficult and expensive, both for the
alternative for the particular reporting the administrative approach to agencies and for the submitting entities
requirement. To facilitate this streamlining. that are affected, and that resuming
system operation after a long hiatus may electronic signature method, (3) to prosecute an environmental crime or
require resources more typically submitter registration, (4) signature/ to enforce against a civil violation
associated with system start-up. certification scenario, (5) transaction should have no less evidentiary value
Additional comments on program record, and (6) system archives. than its paper equivalent. For example,
revision or modification and EPA’s These criteria were based upon EPA’s where there is a question of deliberate
responses can be found in the consideration of the roles that many falsification of compliance data—it must
rulemaking docket, in the Response to electronically submitted documents will be possible to establish the signatory’s
Comments document. likely play in environmental program identity beyond a reasonable doubt no
3. Revisions in the final rule. To management, including compliance matter whether the submission was
address the concern that the proposed monitoring and enforcement, and the electronic or paper.
program revision or modification to need to ensure that such roles were not A seventh, more general proposed
accommodate electronic reporting was compromised by the transition from criterion, entitled ‘‘Validity of Data,’’
too complicated and burdensome, the paper to electronic submission. In many addressed the standard of legal
final rule provides streamlined respects electronic submission enhances dependability directly. The idea, in
procedures for adding electronic a document’s utility for environmental general, was that a system used to
reporting to existing authorized programs: it significantly reduces the receive electronic documents must be
programs. These are optional resources and time involved in making capable of reliably generating evidence
procedures that a state, tribe, or local the content available to its users, and for use in private litigation, in civil
government may use if it chooses, in can greatly facilitate data quality enforcement proceedings, and in
place of the applicable program-specific assurance and analysis. Nonetheless, criminal proceedings in which the
procedures, to seek EPA approval for electronic submissions may also be standard for conviction is proof beyond
revisions or modifications that provide open to challenge, primarily with a reasonable doubt that the electronic
for electronic reporting. EPA believes respect to their authenticity, and document was actually signed by the
that in most cases these optional particularly where they are used to individual identified as the signatory
procedures will be substantially simpler establish the actions and intentions of and that the data it contains was not
and quicker than their program-specific the submitters. We normally consider submitted in error. The six more
alternatives. These new procedures are such uses in the case of environmental detailed, function-specific criteria
discussed in detail in section VI.C of reporting, especially where electronic represented the requirements for
this Preamble. submissions are made to report on an satisfying this more general ‘‘Validity of
To address the concern that the entity’s compliance status and where Data’’ criterion. Taken together, the
required program revisions or the submission includes a responsible seven proposed criteria were intended
modifications may disrupt authorized individual’s certification to the truth of to ensure the legal dependability of
programs that already have electronic what is reported. For such cases, EPA electronically submitted documents by
reporting underway, the final rule identified a programmatic need to be providing:
provides for a two-year delayed able to authenticate the submission • Standards for valid electronic
compliance date—in effect, a two-year content and the certification—for signatures and authentic electronic
‘‘grace period’’—before such programs example, to be able to address issues of documents to be admitted as evidence
have to submit their applications for fraud or false reporting where they in a judicial proceeding;
revision or modification. Programs will arise—and it is primarily this need that • Assurance that electronic
be allowed this grace period where they was addressed by the six proposed
documents can be authenticated to
have systems that fit the definition of criteria.
provide evidence of what an individual
‘‘existing electronic document receiving The point of the proposal’s six
system,’’ explained in section VI.B.2 of function-specific categories was to submitted and/or attested to; and
this Preamble. In addition, these ensure the authenticity of electronic • Assurance that electronic signatures
provisions allow the grace period to be documents submitted in lieu of paper resist repudiation by the signatory.
extended, on a case-by-case basis, where reports, so that they will be able to play By providing for these and other facets
an authorized program may need to wait the same role as their paper of an electronic document’s legal
for legislative or regulatory changes counterparts in providing evidence of dependability, proposed CROMERR was
before a complete application can be what was reported and to what an intended to preserve the ability of EPA
submitted. identified individual certified with and its authorized programs to hold
respect to the report. For example, in individuals accountable when they
B. How has EPA revised the certify, attest or agree to the content of
the case of paper submissions, the
requirements that state, tribe, and local compliance reports under
evidence surrounding a handwritten
government electronic reporting signature is normally sufficient to environmental laws and statutes. By the
programs must satisfy? demonstrate that the signature is same token, proposed CROMERR was
1. Review of the proposal. EPA authentic and rebut any attempt by the also intended to ensure that EPA and its
proposed a detailed set of criteria that signatory to repudiate it and EPA authorized programs will have the
would have to be met by any system intends the standards in today’s rule to documentary evidence they need to
that is used to receive electronic provide evidence for electronic bring actionable cases of false or
documents submitted to satisfy signatures that has a corresponding fraudulent reporting into court.
document submission requirements level of non-repudiation. Since these 2. Comments on the proposed criteria
under any EPA-authorized state, tribe, evidentiary issues typically arise in the for electronic document receiving
or local environmental program. The context of judicial or other legal systems. EPA received a substantial
proposed criteria addressed the proceedings, electronic documents need number of comments on the proposed
capabilities that EPA believed a state, the same ‘‘legal dependability’’ as their criteria for state, tribe, and local
tribe, or local government’s electronic paper counterparts. The over-arching electronic document receiving systems,
document receiving system must have standard in the concept of ‘‘legal both in written submissions and at
regarding six function-specific dependability’’ is that any electronic meetings with the public and with state
categories: (1) System security, (2) document that may be used as evidence and local government officials. While a
few of these comments questioned the tampering, and encryption is probably company participation in electronic
‘‘Validity of Data’’ criterion, the great the most straightforward way to do this. reporting and involve unacceptable
majority dealt with the detailed Encryption can be accomplished in a expenses for implementing agencies.
function-specific criteria. There were at number of ways. Approaches include Commenters also noted that the
least three recurring and closely related PKI-based digital signature, digital required § 3.2000(e)(1)(i) would be
themes. First, the criteria were too signature where the asymmetric key- difficult to integrate with company
prescriptive and inflexible, and would pair is not associated with a PKI workflow practices in many cases.
prevent state, tribe, and local agencies certificate, and various forms of Finally, there is the ‘‘one size fits all’’
from adapting their electronic reporting symmetric-key cryptography. issue. Some of the comments raised this
approaches to their needs and changing Additionally, it may be possible to as another version of the
circumstances, and foreclose new and avoid cryptography altogether by storing ‘‘prescriptiveness’’ issue, but adding
creative ways to achieve legal the hash value in a system with that the proposal developed just one
dependability. Second, the criteria appropriately controlled access. Thus, a model of electronic reporting and
would make electronic reporting solution using PKI-based digital attempted to make it fit the differing
unnecessarily complex, costly, and signatures represents only one among a circumstances of the various state, tribe,
burdensome. Third, while the criteria number of possible approaches to and local agencies that would have to
might be appropriate for some cases, the satisfying the proposed §3.2000(c)(5) comply. Other comments emphasize the
‘‘one size fits all’’ approach was not requirement. point that the proposal takes
workable for all reports in all programs. A number of commenters also requirements apparently tailored to
misinterpreted the criteria under assuring an electronic document’s
Commenters tended to associate these
proposed § 3.2000(e) Electronic authenticity and applies them to all
three themes with certain
signature/certification scenario cases of electronic reporting, whether or
misperceptions about the proposed
(especially the provisions for signatory’s not the question of authenticity is likely
requirements for signature method and
review of data under § 3.2000(e)(1)(i)) as to arise.
the signature/certification scenario.
requiring signatories to scroll through EPA has considered these and related
Concerning signature method, a
their submissions on-screen before they comments in writing today’s rule. We
common concern was that the criteria
affix their electronic signatures, and do not wish to set overly prescriptive
would require states to implement PKI-
requiring state systems to enforce this requirements and so foreclose
based digital signatures. Commenters required ‘‘scroll-through’’. However, the acceptable electronic reporting
generally appear to have inferred this proposal provided not that the signatory alternatives that could offer equivalent
from proposed § 3.2000(c) Electronic must review the data on-screen, but or better assurance of legal
Signature Method, together with EPA’s rather that he or she be given the dependability while, perhaps, being
own choice of PKI for some submissions opportunity to do so. The example of easier for a state, tribe, or local agency
to CDX, as discussed in the Preamble. the enforced on-screen ‘‘scroll-through’’ to implement. We do not wish to set
Whatever EPA’s plans for CDX, state, then envisioned for CDX, and provided requirements that impose unnecessary
tribe, and local government systems do in the CDX section of the proposal’s costs or burdens. And, while we do not
not have to conform to the CDX model. preamble, was in error. EPA did not see a ‘‘bright line’’ around the universe
Implementing a particular system of intend to require this ‘‘scroll-through’’ of cases where document authenticity
necessity requires the choice of specific of submitted data prior to signature. might be of concern, we also do not
technologies. To make those choices EPA certainly does expect and wish to address authenticity with
does not imply that these are the only encourage reporting entities to review requirements that leave states, tribes,
possible choices that would satisfy data intended for electronic submission and local governments with too little
whatever requirements the rule places prior to signature, but does not mandate flexibility in how they may adapt their
on electronic reporting systems. this or any other particular mode or electronic reporting implementations to
Concerning § 3.2000(c), commenters method of signatory review in today’s their particular circumstances.
tended to focus on paragraph (5) of this rule. Accordingly, EPA has decided to
section, which stated that the signature Returning to the three comment finalize criteria for electronic document
method had to ensure ‘‘that it is themes—of prescriptiveness, cost and receiving systems that directly articulate
impossible to modify an electronic burden, and a ‘‘one size fits all’’ the underlying goal of assuring the legal
document without detection once the approach—commenters who raised the dependability of electronic documents
electronic signature has been affixed.’’ prescriptiveness issue generally argued authenticity, and to add more specific
EPA did not intend for this provision to that, even supposing that there were no requirements only to the extent that
establish PKI-digital signature as the specific objections to the detailed they are needed to achieve this
required signature method. Given § 3.2000 provisions, EPA had failed to underlying goal. Accordingly, the
current technology, approaches to make the case that every single provisions of today’s rule have been
satisfying the § 3.2000(c)(5) requirement requirement under these provisions is clarified as general performance
frequently involve the computation of a necessary to ensure the legal standards necessary to ensure the legal
number—called a ‘‘hash’’—that has a dependability of electronic submissions. dependability of the electronic
unique relation to the content of the Commenters who argued that the documents they receive. Additional
electronic document such that any proposed rule would be too costly and comments on the proposed criteria and
change to the document content would burdensome generally focused on EPA’s responses can be found in the
change the computed hash. Given the § 3.2000(c)(5) and § 3.2000(e)(1)(i), rulemaking docket, in the Response to
hash, the associated document can be discussed above, or on the proposed Comments document.
confirmed as unmodified at any time by § 3.2000(d) registration and signature 3. Revisions to the criteria in the final
calculating a new hash and showing agreement provisions. There were many rule. In today’s final rule, we intend to
that the new and original hashes are comments to the effect that the complex fulfill the underlying goal of the
identical. Using such a hash-based § 3.2000(d) registration and re- proposed § 3.2000 criteria for electronic
approach, it is important to ensure that registration requirements would pose document receiving systems. This is to
the hash has been secured from substantial barriers to regulated assure the authenticity and non-
repudiation of electronic documents ‘‘Validity of Data’’ criterion. the legal dependability of the electronic
submitted in lieu of paper reports, so Accordingly, for the final rule, we documents such systems receive. The
that they are as legally dependable—that started with the proposed § 3.2000(b) resulting § 3.2000(b) in the final
is, as admissible in evidence and and then clarified the remaining electronic reporting rule reflects the
accorded the same evidentiary weight— proposed § 3.2000 criteria as general requirements discussed in the table
as their paper counterparts. As noted performance standards for electronic below. The citation for the
earlier, this goal was expressed most document receiving systems, which corresponding language in the proposed
directly in the proposed § 3.2000(b) were incorporated as needed to assure rulemaking is also provided.
Citation/subject area in proposed rule Citation/requirement in final section 3.2000(b)
Proposed § 3.2000(g), addressing system archives ................................ Section 3.2000(b)’s leading clause requires that the system be able to
generate the required data as needed and in a timely manner.
Proposed §§ 3.2000(e)(3) and 3.2000(f), addressing signature/certifi- Section 3.2000(b)’s leading clause and § 3.2000(b)(4) require that the
cation scenarios and transaction record. system be able to generate a ‘‘copy of record’’ that is made available
to the submitters and/or signatories for review and repudiation.
Proposed §§ 3.2000(c) and 3.2000(d), addressing the electronic signa- Section 3.2000(b)(5)(i) requires that the system be able to show that
ture method and submitter registration process. any electronic signature on an electronic document was created by
an authorized signatory with a device that the identified signatory
was uniquely entitled and able to use.
Proposed § 3.2000(c)(5), addressing requirement that it be impossible Section 3.2000(b)(5)(ii) requires that the system be able to show that
to modify an electronic document without detection once it has been the electronic document cannot be altered without detection once it
electronically signed. has been electronically signed.
Proposed § 3.2000(e), addressing the signature/certification scenario ... Sections 3.2000(b)(5)(iii)—(iv) require that the system be able to show
that, before signing, any signatory had the opportunity to review what
he or she was certifying to in a human-readable format, and to re-
view the certification statement including any provisions relating to
criminal penalties for false certification.
Proposed § 3.2000(d), addressing the submitter registration process .... Section 3.2000(b)(5)(v) requires that the system be able to show that
the signatory signed an ‘‘electronic signature agreement’’ or a ‘‘sub-
scriber agreement’’ acknowledging his or her obligations connected
with preventing the compromise of the signature device.
Proposed § 3.2000(e)(2), addressing acknowledgment ........................... Section 3.2000(b)(5)(vi) requires that the system be able to show that it
automatically sent an acknowledgment of any electronic submission
it received that bears an electronic signature; the acknowledgment
must identify the electronic document, the signatory and the date
and time of receipt, and be sent to an address that does not share
the access controls of the account used to make the submission.
Proposed § 3.2000(d)(1)–(3), addressing submitter registration. ............. Section 3.2000(b)(5)(vii) requires, for each electronic signature device
used create an electronic signature on documents that the system
receives, that the system be able to establish the identity of the indi-
vidual uniquely entitled to use that device and his or her relation to
the entity on whose behalf he or she signs the documents.
The requirements in is an authoritative answer to the agreement, as well as the opportunity to

§ 3.2000(b)(5)(iii)–(iv) of today’s rule, question of what information content a review what they are signing, helps
concerning ‘‘opportunity to review,’’ do signatory was certifying to or attesting establish that where signatures appear
not place the responsibility for to. The related requirement that the on electronic documents, the signatories
providing an opportunity, or for system be able to provide timely access had the requisite intent to certify. That
showing whether or not an opportunity to copies of record and related data is, these requirements help ensure that
was actually taken, on the state, tribe, or reflects a practical concern that the data the signatories knew what they were
local government electronic document be accessible in time and in a format to signing, knew what signing meant, and
receiving system. What is required is serve the purposes for which it is understood the legal implications of
that the system provide evidence needed. false certification. As for the
sufficient to show that an opportunity Concerning the requirement that requirement that document content
was provided; this point is explained in signature devices be uniquely assigned cannot be altered without detection after
greater detail in sections VI.E.8 and to, and held by individuals, EPA signature, an acceptable electronic
VI.E.9 of this Preamble. believes that an acceptable electronic document receiving system must
EPA believes that the standards in document receiving system must be able provide evidence sufficient to allow a
§ 3.2000(b) of today’s rule, as developed to attribute a signature to a specific court to attribute the intention to certify
from the proposed ‘‘Validity of Data’’ individual, to help assure that the to the document’s current content to the
criterion, together with other proposed signatory cannot repudiate signatory, so that he or she cannot
criteria clarified as general performance responsibility for the signature. Non- repudiate this content.
standards, represent the minimum set of repudiation is also strengthened by the Finally, today’s § 3.2000(b)(5)(vii)
requirements for electronic document signed electronic signature agreement, requirement that the system be able to
receiving systems necessary to ensure which establishes that the signatory was establish the identity of the individual
the legal dependability of the electronic informed of his or her obligation to keep who is assigned a signature is based on
documents such systems receive. For the signature device from compromise proposed § 3.2000(d). Proposed
example, the requirement for a copy of by ensuring that it is not made available § 3.2000(d) logically entails today’s
record is necessary to ensure that there to anyone else. Requiring the signature § 3.2000(b)(5)(vii), because satisfying the
provisions of the former guarantees its provisions are technology-neutral, it is made to provide for direct electronic
compliance with the latter. However, remains possible that revisions will be reporting to EPA with follow-on paper
today’s § 3.2000(b)(5)(vii) limits the required to reflect technological changes signatures. For such submissions to
scope of the proposed § 3.2000(d)(3) or changes in prevailing industry norms authorized programs, we have added to
requirement that, in registering for their and practices. If these or other § 3.2000(a)(2) of today’s rule the
signature devices, registrants must circumstances require it, EPA thus requirement that authorized program
execute their electronic signature reserves the right to revisit the issues provisions for follow-on paper signature
agreements on paper with handwritten addressed in this rule. submissions ‘‘ensure that the paper
signatures. In today’s § 3.2000(b)(5)(vii), submission contains references to the
C. How has EPA accommodated
this requirement is limited to a special electronic document sufficient for legal
electronic submissions with follow-on
class of ‘‘priority report’’ submittals. certainty that the signature was
paper certifications?
(See section VI.E.12 of this Preamble.) In executed with the intention to certify to,
addition, today’s § 3.2000(b)(5)(vii) Currently there are EPA and state attest to, or agree to the content of that
offers alternatives to this handwritten programs that take electronic electronic document.’’
signature requirement, to allow submissions where the requirements for
a signed certification statement are met D. How has EPA changed proposed
electronic reporting solutions that are definitions of terms?
completely free of paper transactions. with a follow-on paper submission with
The alternative provisions, found in handwritten signatures. A number of The ‘‘Definitions’’ section of the final
today’s § 3.2000(b)(5)(vii)(A)–(B), are commenters suggested that such an rule, § 3.3, provides new definitions for
elaborations of the proposed approach be recognized and allowed to ‘‘copy of record,’’ ‘‘electronic signature
§ 3.2000(d)(1) requirement for ‘‘evidence continue under the electronic reporting agreement,’’ and ‘‘valid electronic
[of identity] that can be verified by rule. EPA has no wish to proscribe such signature,’’ as well as the revisions to
information sources that are an approach, and does not judge the definition for ‘‘electronic signature
independent of the registrant and the whether or not follow-on paper device,’’ to help articulate the final
entity or entities’’ for which the signature/certification is to be preferred § 3.2000(b) standards for electronic
registrant will submit electronic to the approach where the signature/ document receiving systems. These
documents. The elaborations are certification is electronic. To make this terms are explained in more detail in
necessary to assure that individuals’ clear in the final rule, we have added a section VI, below. (See especially,
clause to § 3.10(b) that allows follow-on sections VI.E.2., VI.E.10. and VI.E.6.)
identities can be established without
handwritten signatures to substitute for Similarly, in section VI.B.2 of this
being able to rely on their handwritten
electronic signatures on submissions to Preamble we note the role of the new
signatures—and, in the final rule, the
EPA where ‘‘EPA announces special definition for ‘‘existing electronic
requirements apply only to ‘‘priority
provisions’’ for this purpose. A document receiving system;’’ and, in
report’’ submittals, and only where the
corresponding clause in § 3.2000(a)(2) of section VI.E.12 we discuss the new
choice is made to not use paper in the
today’s rule makes a similar allowance definitions for ‘‘agreement collection
execution of electronic signature
for electronic reporting under certification,’’ ‘‘disinterested
agreements. Section VI.E.12 of this
authorized state, tribe, or local individual,’’ ‘‘information or objects of
Preamble outlines all of today’s
programs, again, where ‘‘the program independent origin,’’ ‘‘local registration
§ 3.2000(b)(5)(vii) provisions in much makes special provisions to accept a authority,’’ ‘‘priority reports,’’ and
more detail. In any event, we have made handwritten signature on a separate ‘‘subscriber agreement.’’ Section 3.3 also
these changes to the proposed paper submission.’’ reflects a number of clarifying and/or
§ 3.2000(d) approach to help address Among other things, these ‘‘special simplifying changes for definitions of
commenters’ concerns with ‘‘one size provisions’’ would allow follow-on terms, as follows.
fits all’’ provisions, as well as to allow paper signature submission only if it 1. Definition of ‘‘acknowledgment.’’
states, tribes, and local government as were reliably linked or cross-referenced This definition has been added in
much flexibility as possible as they with the associated electronic conjunction with § 3.2000(b)(5)(vi) of
implement their electronic reporting document. The linking or cross- today’s rule, to make clear that in the
systems. referencing is necessary in part to context of this rule, acknowledgment
In sum, the overall approach to the ensure that we can always determine means a confirmation of electronic
standards for electronic document which signature submissions belong document receipt.
receiving systems in today’s rule reflects with which electronic documents. Paper 2. Definition of ‘‘electronic
a balancing of the concerns raised by the signature submissions must also provide document.’’ This definition has been
public comments, especially those sufficient evidence that the signatory revised from the proposed version in
relating to the proposal’s burden on intended to certify to or attest to the several ways. First, the use of
states, tribes, local governments and content of the electronic document as ‘‘communicate’’ has been eliminated,
regulated entities, against the need to this content is recorded in the copy of thereby eliminating the need for a
ensure the legal dependability of record for the submission. There are separate definition of that term. Second,
electronic documents submitted under various approaches to cross-referencing the exclusion of magnetic and optical
authorized programs. Finally, EPA notes or linking that would meet these needs, media and facsimile submissions has
that to date the Agency has had limited most of which involve the inclusion of been eliminated. We believe it is clearer
experience with the practical extra data elements in the signature to exclude such submissions from the
application of electronic signatures and submission that reference the associated scope of CROMERR under § 3.1, entitled
electronic reporting generally. With the electronic document. Such data ‘‘Who does this part apply to?’’ Today’s
benefit of practical experience accepting elements might include summary data rule now provides this exclusion in
electronic reports under this rule, EPA from the electronic document, the date §§ 3.1(b) and 3.1(c). Third, the
may determine that this rule needs to be and time of the electronic submission, definition has also been revised so that
revisited, to either add or eliminate or even the calculated hash value of the it explains what a ‘‘document’’ is in an
certain safeguards. In addition, while electronic document. EPA may use electronic medium. Instead of saying
EPA has sought to write this rule so that these and other alternatives if a decision that an ‘‘electronic document means a
document. * * *,’’ the final version be ‘‘logically associated’’ with it. This EPA, in § 3.10, and under authorized
says that ‘‘electronic document means point is explained further in section programs, in § 3.2000(a)(2). The
any information in digital form. * * *,’’ VI.E.2 of this Preamble, in discussing definition specifies three main
where information is explained as the copy of record requirement. conditions for validity. The first refers
potentially including ‘‘data, text, 4. Definition of ‘‘electronic signature to features of the signature that are
sounds, codes, computer programs, device.’’ The definition of ‘‘electronic intrinsic to the items of information of
software or databases.’’ Fourth, this signature device’’ has been revised to which it consists: The signature must
definition clarifies that in this context, clarify that where a device is used to consist of the kind of information that
‘‘data,’’ is used in its normal sense as create an individual’s electronic has been established as appropriate for
denoting a delimited set of data signature, then the device must be the signing of the document in question,
elements, each of which is a unit of unique to that individual, and he or she and the specific information content
meaning in a document and consists of must be uniquely entitled to use it at the must pass the validation tests which the
a content or value together with an time that the signature is created. system uses to determine that the
understanding of what the meaning Correspondingly, the device is signature belongs uniquely to the
and/or context of the content or value is. compromised if it is available for use by identified signatory. The second
Finally, the definition stipulates that any other individual, that is, if some condition refers to the status of the
where an electronic document includes other individual is able to use the electronic signature device used to
data, the understanding of what the data device to create signatures if he or she create the signature, and ensuring that
content or value means must either be wishes. To the extent that §§ 3.10(b) and the device was not compromised at the
explicitly included in the electronic 3.2000(b)(5)(i) of the final rule prohibit time it was used to create the signature.
document or be readily available the acceptance of signatures created This ties validity to the element of
through such sources as an applicable with compromised devices, via the compromise within the definition of
data element dictionary, or a form or definition of ‘‘valid electronic ‘‘electronic signature device.’’ That is, at
template that specifies what each data signature,’’ the element of compromise the time of signature, the device must
element means when it is presented in rules out the sharing of electronic not have been made available to
the specific file format used for the signature devices or delegating their use someone other than the individual who
electronic document’s submission. to create individuals’ electronic is entitled to use it. The third condition
A consequence of this approach is signatures. Additionally, the definition refers to the signatory’s status at the
that the identity of an electronic includes the element that an individual time of signature as someone who is
document consisting wholly of data is needs to be entitled to use the electronic authorized to sign the document in
independent of the format in which it is signature device; that is, the individual question by virtue of his or her legal
presented or submitted. That is to say, needs to be the ‘‘owner’’ of the device. status and/or relationship to the entity
rearranging or reformatting the data The nature of the device itself will on whose behalf the signature is
elements in an electronic document determine the way in which an executed. In the context of
does not change it into a different one, individual comes to own it. In the case environmental reporting, this condition
at least so long as the signatory’s of personal identification numbers or would make invalid electronic
intention and understanding of what the certificate-based private/public key signatures on company compliance
data elements each mean is preserved in pairs, there is normally some process of reports created by individuals who do
the process. This does not conflict with formally assigning the device to the not work for or in any way represent the
the ordinary understanding of the term individual, often through a trusted third
company. Generally, in the context of
‘‘document,’’ since we speak quite often party. In other cases, for example
environmental reporting, individuals
of ‘‘reformatting a document,’’ with the password or personal information-based
who sign submissions to environmental
clear understanding that what results signature devices, the process may have
agencies are explicitly authorized to do
will be the same document in a new the individuals invent and assign the
so, by their management and/or by the
format. Correspondingly, under the devices to themselves ‘‘ the basis for
agency to which they report. However,
definition of ‘‘copy of record,’’ a ‘‘true their ownership of the devices being
in some cases the authorization may be
and correct’’ copy of an electronic determined by the circumstances or
implicit in the signatory’s legal status
document does not necessarily have to context within which they do this.
5. Definition of ‘‘transmit.’’ In the and relationship to the regulated entity.
reflect the format in which the
document was submitted, provided that proposed rulemaking the term ‘‘submit’’ For example, an owner or operator of a
the document consists wholly of data. was defined as the ‘‘means to company is generally authorized to sign
This independence of document successfully and accurately convey an notifications or letters to an
identity from format may not always electronic document so that it is environmental agency whether or not
hold where other kinds of information received by the intended recipient in a this is explicitly provided for by law or
are included in the electronic format that can be processed by the regulation.
document, e.g. text or images; in such electronic document receiving system.’’ As ‘‘valid electronic signature’’ is
cases a copy of record may have to However, the term ‘‘submit’’ is used used in §§ 3.10 and 3.2000(a)(2), the
include format or formatting more widely in the rule in ways that are validity of an electronic signature is
information. not consistent with this definition. necessary for the signatory’s electronic
3. Definition of ‘‘electronic signature.’’ Accordingly, in the final rule the submission to satisfy a federal or
This definition has been revised by function of successful and accurate authorized program reporting
substituting ‘‘information in digital conveyance of an electronic document requirement. Additionally, as the term
form’’ for ‘‘electronic record,’’ to avoid is now termed ‘‘transmit.’’ is used in § 3.2000(b), it also refers to a
problems with defining ‘‘electronic 6. Definition of ‘‘valid electronic performance requirement for an
record.’’ The definition has also been signature.’’ Beyond its role in electronic document receiving system,
revised to make clear that the electronic § 3.2000(b), this definition has also been namely that the system must not accept
signature for an electronic document added to help clarify and simplify the and must be able to detect submissions
need not always be ‘‘included’’ within signature requirements associated with with signatures that are not valid. These
that document; in some cases it may just electronic reporting, both directly to requirements in terms of ‘‘validity’’ are
meant to provide a form of insurance for program and fails to comply with the did prior to CROMERR’s publication
electronic signatures to protect against applicable provisions for electronic unless EPA publishes a notice that
the risks of repudiation. Nonetheless, a reporting. Section 3.4 also contains announces changes to, or migration
signatory may be legally bound by a provisions originally published under from, that system. Any existing systems
signature even where not all the § 3.10(d) and (e) of the proposal, continuing to receive electronic reports
requirements for its validity have been stipulating that the electronic signature at the expiration of this two-year period
met, e.g., where the signature has been will make the person who signs the must receive redesignation by the
executed with a compromised electronic document responsible, bound, or Administrator under § 3.10. Notice of
signature device. The signatory of an obligated to the same extent as he or she such redesignation will be published in
electronic submission cannot avoid would be signing the corresponding the Federal Register.
responsibility for its contents by paper document by hand. EPA’s goal is that all its systems for
pointing to a technical flaw or other The § 3.10 requirement that there be receiving electronic reports be
defect in the signature process. an electronic signature applies only consistent with the CROMERR
where a paper document would have to standards for electronic document
V. Requirements for Direct Electronic bear a signature were it to be submitted, receiving systems, set forth in
Reporting to EPA either because this is required by a § 3.2000(b) of today’s rule. EPA
A. What are the requirements for statute or regulation, or because a generally hopes to achieve this
electronic reporting to EPA? signature is required to complete the consistency within a two-year transition
paper form. The rule does not impose period for existing EPA systems;
Under the final rule, the requirements
any new or additional signature however, EPA is not bound by the
for electronic reporting to EPA remain requirements for documents that are § 3.2000(b) standards of today’s rule or
essentially unchanged from those in the submitted in electronic form. In the two-year period. This two-year
proposal. Section 3.10 provides, first, addition, as noted in section IV.C of this period is similar to the two-year
that electronic documents must be Preamble, § 3.10(b) of today’s rule also transition period provided under
submitted to an appropriate EPA allows EPA to make special provisions, § 3.1000(a)(3) for systems operated
electronic document receiving system. in specific cases, for accepting under EPA-authorized programs. In a
Generally this will be EPA’s Central handwritten signatures in follow-on number of cases, EPA may work toward
Data Exchange (CDX), although EPA can paper submissions in lieu of the this goal by migrating existing electronic
also designate additional systems for the required electronic signatures. In such reporting to CDX or to other, new
receipt of electronic documents and is cases, it is critical that the special CROMERR-consistent systems. As we
doing so in a separate Federal Register provisions ensure that the electronic change or migrate existing electronic
notice. Second, where a paper document cannot be altered without reporting programs to achieve
document must bear a signature under detection and is reliably linked to the consistency with the CROMERR
existing regulations, an electronic handwritten signature. standards, we intend to provide
document that substitutes for the paper As in the proposal, this final rule does sufficient advance notice to reporting
document must be signed (by the person not specify any required hardware or entities so that any new requirements
authorized to sign under the current software. Accordingly, the rule text does can be accommodated without causing
applicable provision) with a valid not include any detail about CDX per se significant disruption to their electronic
electronic signature. or about what will be required of reporting activities.
Only electronic submissions that meet regulated entities who wish to use it.
these two requirements will be Nonetheless, as stated in the proposal, C. What is EPA’s Central Data
recognized as satisfying a federal our goals include the sharing of detail Exchange?
environmental reporting requirement, on how CDX implements direct 1. Overview of general goals. The
although failure to satisfy these electronic reporting to EPA. Section proposal described EPA’s ‘‘Central Data
requirements will not preclude EPA V.C.4 of this Preamble explains how Exchange’’ as a system to be developed
from bringing an enforcement action CDX has changed since we described it and maintained by EPA’s Office of
based on the submission or otherwise in the proposal, especially in relation to Environmental Information (OEI) that
relying on the submission. A new the many comments we received on would serve as EPA’s gateway or
compliance and enforcement section CDX-related issues. ‘‘portal’’ for receiving documents
has been added to the final rule to electronically from our reporting
clarify certain compliance and B. What is the status of existing community. The goal of CDX was to
enforcement issues related to electronic electronic reporting to EPA? augment, and, where appropriate,
reporting. Section 3.4 makes clear that In a notice published concurrently streamline and consolidate EPA’s
EPA can seek and obtain any with today’s rule, EPA clarifies the environmental reporting functions by
appropriate federal civil or criminal status of electronic reporting directly to offering our reporting community faster,
penalties or other remedies for failure to EPA systems that exist as of the rule’s easier, and more secure submission
comply with an EPA reporting publication date. In accordance with 40 options through a single venue for
requirement if a person submits an CFR 3.10, EPA is designating for the electronic submission of environmental
electronic document to EPA under this receipt of electronic submissions, all data. As a cornerstone of EPA’s efforts
rule that fails to comply with the EPA electronic document receiving to advance electronic government, CDX
provisions of § 3.10. Similarly, § 3.4 systems currently existing and receiving would support the electronic
makes clear that EPA can seek and electronic reports as of the date of this submission needs of thousands of
obtain any appropriate federal civil or notice. This designation is valid for a regulated entities submitting data to
criminal penalties or other remedies for period of up to two years from the date EPA for certain air, water, waste, and
failure to comply with a state, tribe, or of publication of this notice. During this toxic substances programs. Ultimately,
local government reporting requirement two-year period, entities that report EPA planned to offer, wherever
if a person submits an electronic directly to EPA may continue to satisfy practicable, all regulated entities that
document to a state, tribe, or local EPA reporting requirements by report directly to EPA, an option to file
government under an authorized reporting to the same systems as they their specific environmental documents
electronically through CDX. Regulated building blocks that would support each case. In some instances CDX may
entities that submit reports under an these functions. The functions described support a more interactive ‘‘workflow’’
authorized program would also be able in the proposal included: (1) Access environment for submitting data; in
to file their documents through CDX in management, (2) data interchange, (3) others, CDX may accept batch
cases where the state, tribe or local signature/certification management, (4) transmissions of user-formatted files. It
government that administered the submitter and data authentication, (5) is also true that the technical
program chose to use CDX as a gateway transaction logging, (6) copy of record capabilities of a particular reporting
for electronic data submissions from its provisions and acknowledgment, (7) community vary considerably, so CDX
reporting community. archiving, (8) error checking, (9) will offer more than one electronic
The reporting community using CDX translation and forwarding, and (10) submission option in many cases. CDX
would be able to access web ‘‘reporting’’ outreach. The proposal then described currently provides support for web-
forms with built-in data quality checks, five building blocks that would support forms, file, and record-level submissions
and/or submit standard file formats CDX functions, which were: (1) Digital in various formats including flat file and
through common, user-friendly signatures based on PKI, where CDX XML and EPA plans to continue this
interfaces that allowed them to would rely predominately on a third flexible approach.
electronically submit data across vastly party vendor under the General Services Comments on registration process.
different environmental programs. Both Administration (GSA) Access Comments from regulated entities raised
the reporting community and EPA Certificates for Electronic Services concerns about the costs and time
would benefit by gaining access to (ACES), (2) a process for registering required to register individuals in each
environmental reports more quickly and users and managing their access to the company, and EPA’s failure to address
with fewer errors, and by avoiding the CDX, (3) a client server-architecture, (4) the increasingly common cases where
inefficiencies of having to keystroke EDI standards, as the primary format for the preparer of an environmental report
data from paper reports. CDX was also exchanging environmental data, and (5) and the certifying official are different
being developed to support a newly a consistent user interface for making individuals.
emerging Environmental Information electronic submissions. Because electronic submission is
Exchange Network (EIEN) that would 2. Comments on the proposal. EPA being offered as an option to the
facilitate the electronic exchange of received more than 100 comments on reporting community, EPA recognizes
environmental data between EPA and the CDX concept as described in the the need to design CDX registration to
state, tribe, and local environmental proposal. A number of these comments be as user-friendly as practicable, in part
agencies. However, in keeping with the were related to one of four main subject by taking account of the flow of work,
scope of the proposed rule the areas, as follows. or ‘‘workflow’’ involved in meeting a
description of CDX features and Comments on Uniformity of particular environmental reporting
functions in this section apply only to Approach. Several comments expressed requirement. For example, since
electronic submissions to CDX from concern about the proposed proposal, EPA has developed
regulated entities; the description characterization of CDX as promoting approaches to register both preparers
doesn’t apply to EIEN exchanges with ‘‘uniformity of process and technology’’. and certifying officials for at least two
CDX in which states, tribes, or local The phrase was used to highlight the reporting programs. Changes to the CDX
governments participate as a part of benefits of CDX, which included EPA’s registration process are discussed in
their authorized programs or as a part of plans to avoid the costly proliferation of more detail in section V.C.4.
administrative arrangements with EPA redundant systems. However, comments Comments on digital signatures based
to share data. pointed out that this ‘‘uniformity’’ on PKI. Comments pointed out that
The Concept of Uniformity. The implied an inflexible and overly reliance on PKI for all cases of
proposal also characterized CDX as prescriptive set of CDX technical and electronic signature may violate the
providing an environment that would security requirements, which would GPEA directive to vary electronic
promote a uniformity of technologies discourage CDX use. Such comments signature approaches with the
and processes. By adopting CDX to were similar to those discussed in circumstances of their use. Several
support the electronic reporting needs section IV.B.2 of this Preamble, raising comments underlined this concern by
across various EPA programs, EPA concerns about the prescriptiveness and pointing to PKI’s costs and burdens. The
hoped to avoid the proliferation of ‘‘one size fits all’’ approach of the comments objected that registering
program-specific electronic reporting proposed criteria for electronic through CDX and acquiring digital
approaches that could lead to document receiving systems. signature certificates would be overly
duplicative investments in electronic EPA understands that ‘‘uniformity of complicated, and would require that
document receiving systems and process and technology’’ could imply registrants provide private or personal
possibly conflicting requirements for inflexibility, and this is not generally information. Some comment also
submitters. how we intended to develop CDX. In expressed concern about the
The CDX Functions and Building fact, CDX is currently using a wide incompatibility of a PKI-based approach
Blocks. As described in the proposed range of technologies and processes to with workflow, given that
rule, CDX was being designed with the address CDX’s functions that are environmental reports were frequently
goal of fully satisfying the criteria that tailored to individual EPA program prepared by staff and then signed by the
the proposal specified for state, tribe, submission requirements, including the facility owner, with staff turnover being
and local electronic document receiving technical capabilities of the reporting frequent. Another concern was the
systems; similarly, EPA would ensure community for the particular program. implications of CDX PKI software for
that other systems the Administrator EPA recognizes that, for example, company system security, for example,
designated to receive electronic permitting, compliance monitoring, and given the need to download CDX
submissions satisfied the criteria as the conduct of studies involve software through the company firewall.
well. The proposal discussed how CDX fundamentally different business EPA agrees that it should generally
would implement CROMERR-compliant processes, and that the associated minimize the complexity and cost of
electronic reporting by describing the submission of electronic documents electronic signatures or this will deter
primary CDX functions and the system may have to be handled differently in potential users of CDX from submitting
electronic documents. In implementing advancing the efforts of EIEN in submission or through a ‘‘smart web
CDX, EPA has revised the initial plan coordination with state, territorial, form’’. However, the types of formats
for electronic signatures to include non- tribes, and other partners. and approaches for submitting data
PKI electronic signatures. Section V.C.4 General Approach to Electronic through CDX have broadened, and these
discusses how we are changing the Reporting Implementation. In general, too are discussed in section V.C.4.
‘‘digital signature based on PKI building current instructions for client-side 4. The major changes that EPA has
block.’’ access of CDX suggest Internet access made to CDX since proposal. Over the
Comments on EDI Standards. and a system that uses both Microsoft last two years, CDX has evolved from a
Comments expressed both Windows and Microsoft Internet prototype system to a fully operational
encouragement and concern over CDX’s Explorer (IE). EPA acknowledges that electronic document receiving system.
prospective implementation of the Government Paperwork Elimination CDX supports tens of thousands of
standards-based exchange formats for Act (GPEA) directs OMB to develop registered users providing data to
data submissions. An exchange format procedures for agencies to follow in dozens of environmental reporting
is a predefined file structure, including using and accepting electronic programs across the major EPA media
data elements and higher level syntax documents and signatures and these offices. CDX registered users include
that describes how the data extracted procedures ‘‘may not inappropriately representatives from state, tribe, and
from a system must be arranged in a file favor one industry or technology.’’ local agencies, industries, laboratories,
for transmission to another system. A Consistent with this GPEA directive, and other federal agencies. While CDX
standards-based format adheres to EPA is committed to considering ways continues to provide a secure, single
certain widely-accepted industry, to allow other vendors’ technologies to point of registration, access, and
national, or international file structure access CDX. Accordingly, over the six exchange between reporting entities and
definitions. Several comments months following the publication of EPA programs, the building blocks
expressed concern about the costs of today’s rule, EPA intends to assess the supporting the CDX functions have
configuring their systems to generate a full range of issues that affect CDX’s changed substantially. These changes
CDX-specified standard format; others ability to support multiple platforms reflect EPA’s experience operating CDX
expressed concerns about the costs of and browsers. These issues include the over the past two years, evolving trends
potential changes to the format once it technical requirements for the electronic in Internet technologies, and comments
is implemented on their systems. By signature options, form entry options, received on the proposed rule from
contrast, other comments strongly data upload options, network interface potential CDX users.
supported requiring standards-based options, current capabilities of the CDX
formats—even recommending that we Digital signatures based on PKI. The
hardware/software platform, and proposal described the CDX approach to
require such formats by rule for EPA potential impacts of new client-side
and EPA-authorized state, tribe, and electronic signatures in terms of digital
platforms on the CDX life cycle signatures and PKI. Since proposal, EPA
local electronic document receiving management, technical support
systems. has come to appreciate the complexity
requirements, and help desk training and costs of implementing PKI, and to
CDX’s approach to standards-based
and support. Based on this assessment, recognize that non-PKI electronic
formats has changed considerably since
EPA intends to determine the target signatures, as described in section
the proposal, in large part because of the
universe of client-side platforms and IV.B.2 of the preamble today’s rule, may
emergence of Internet-based approaches,
browsers that CDX can feasibly be acceptable in many cases. Thus, for
most notably Extensible Mark-up
accommodate, and will identify the electronic reports currently submitted to
Language (XML). These changes are
actions and timeline necessary to build CDX, only in one case is PKI used for
discussed in more detail in section
V.C.4. EPA believes that the use of out CDX support for this target universe. electronic signature. The other cases
standard formats can be encouraged As described in the proposal, CDX involve PIN-based electronic signatures
without requiring this by rule. users will need to: or other non-PKI electronic signature
Additional comments on CDX and • Register with CDX, during which approaches. As an example of the latter,
EPA’s responses can be found in the time they may need to supply this year we anticipate implementing
rulemaking docket, in the Response to information used to identify themselves, electronic signatures for an EPA
Comments document. their company, and the EPA documents reporting requirement by having
3. The aspects of CDX that have not they wish to submit electronically; signatories use a password that is self-
changed since proposal. • Verify and/or correct registration generated during CDX registration in
General Goals. EPA’s continues its information; and combination with certain items of
efforts to establish CDX as the gateway • Access their CDX web account information that are unlikely to be
or ‘‘portal’’ for receiving documents through a secure website, and agree to available to anyone except the signatory.
electronically from the Agency’s the terms and conditions of using the This is a ‘‘knowledge-based’’ approach,
reporting community. In so doing, site, which include safeguarding their which is being used extensively by
EPA’s goal—to augment, and where self-generated password, before using commercial software vendors
appropriate, to streamline and web forms or uploading files to submit supporting the United States Internal
consolidate EPA’s environmental electronic documents or data to EPA. Revenue Service (IRS) for electronic tax
reporting functions through CDX— These are the minimum steps for filings or ‘‘e-filings’, and is being
remains unchanged. The functions that gaining access to CDX at this time. adopted by other agencies. EPA expects
comprise CDX operations continue to Additional steps are involved in that these non-PKI-based approaches to
remain the same though the range of acquiring an electronic signature device, signature will continue to dominate
technologies and processes used to although these steps have changed CDX implementations of electronic
support these functions has somewhat since the proposal and are reporting. We currently intend to use
considerably broadened. CDX continues discussed in section V.C.4. CDX also PKI where such needs as security or
to implement electronic reporting offers at least two general methods for assuring very robust non-repudiation of
capabilities for EPA’s many reporting electronically for many signature make this the most
environmental programs, while programs it supports, either through file appropriate approach.
In addition, EPA’s approach to PKI agreement and mailed it to EPA’s CDX. more new standards-based formats, and
itself—described in the proposal as CDX will continue this approach for some other approach such as a smart-
relying on ACES—is also undergoing reports where electronic signatures are form hosted on a secure website.
change. Changes with respect to the role required, although EPA is exploring the Client-side architecture and
and method of identity proofing for use of an entirely paperless signature transaction environment. The proposal
those persons who apply for PKI agreement process for at least some of described a downloaded ‘‘client’’ that
certificates is being further evaluated. these cases. CDX registration to submit would generally supplement the
As proposed, the identity proofing was reports that do not include electronic browser to support the signature and
to be conducted by the third party ACES signatures will not involve a ‘‘signature security for CDX; such ‘‘client side’’
vendor; currently, CDX identity holder’’ agreement. software is no longer needed for all
proofing is conducted for the most part EDI Standards. The proposal cases of electronic reporting to CDX.
by EPA’s own contractor staff, who are described EPA’s plans to use EDI as the However, in some cases CDX now uses
able to issue digital certificates to basis of standards-based formats for various technologies to transparently
members of the reporting community exchanging data between reporting insert routines into browsers during a
with less cost and in less time than the entities and CDX. Since proposal, CDX user session to support special
ACES vendor. EPA has also begun to development has reflected a significant functions—for example to support the
explore alternatives to ACES for PKI evolution in formatting standards to creation of a PKI-based electronic
certificates, partly because ACES- accommodate the Internet—away from signature with an ACES business class
provided certificates do not support EDI and toward the use of XML. XML certificate.
message encryption, which EPA may consists of a set of predefined tags and
D. How will EPA provide notice of
need for certain environmental message structures that, like EDI, allows
changes to CDX?
reporting applications. In addition, EPA machine-to-machine exchange of data in
is considering its use of ACES in the a mutually agreed upon format, enabling As noted in the proposal, the fully-
light of recent federal advances in exchange of data across different implemented CDX will be subject to
establishing interoperability across systems. However, unlike EDI, XML is change over time, to take advantage of
federal PKI domains, which may allow tailored to Internet-based opportunities offered by evolving
EPA to eventually leverage PKI’s of communications and security protocols. technologies, as well as to improve the
other federal agencies or institute an in- Additionally, an XML formatted file in system. EPA’s decision to avoid
house PKI. combination with a style sheet can be codifying technology-specific or
CDX Registration. Since the proposed displayed in a Web browser. Such detailed procedural provisions for
rule, CDX has broadened it approach to features would allow CDX to use the electronic reporting is meant, in part, to
registration to better accommodate the same standard format both for accommodate changes to CDX without
workflow involved in specific exchanging data files and for designing requiring that we amend our
environmental reporting programs. web forms. The structure of XML also regulations. Nonetheless, EPA
While CDX still requires registration, addresses some of the challenges in recognizes that such changes can affect
there are three distinct areas where the archiving data received, because the regulated entities that participate in
registration process has changed since XML tags that accompany the data in an electronic reporting; therefore, the final
proposal. First, the proposal described XML file can be used to interpret the rule provides for advance notice when
CDX registration as the first step toward data’s context without the aid of EPA intends to make changes to CDX.
the issuance of a PKI-based digital additional software. This could facilitate As discussed in the proposal, we
signature, and it was implied that all the recovery of data from archived files, distinguish four categories of changes:
persons opting to use CDX would need and reduces the need to maintain the • ‘‘Significant’’ changes that are likely
a digital signature. As noted above, this versions of the software originally used to affect the kinds of hardware, software
is no longer the case. Second, in the to generate the files. or services involved in transmitting
proposal, CDX registration began when CDX and specific EPA programs may electronic reports (§ 3.20(a)(1));
a person received an EPA invitation address the question of which (if any) • ‘‘Other’’ changes that will affect the
letter that contained a temporary code standards-based format to use for a process or the timing of transmitting
and instructions on how to access the particular report on a case-by-case basis, electronic reports to CDX, but without
CDX registration website. CDX has and EPA intends to develop appropriate affecting the kinds of hardware,
adopted additional approaches to technical instructions for CDX software or services involved in making
initiating registration for certain EPA submitters as program-specific reporting the transmissions (§ 3.20(a)(2));
programs, for example, embedding a formats are adopted. These instructions • ‘‘Emergency’’ changes necessary to
link to CDX registration in reporting normally will be distributed to the protect the security or operational
software that is distributed to the affected reporting communities via links integrity of CDX (§ 3.20(b)).
program’s reporting community, or on the CDX website and/or through • ‘‘De minimis or transparent’’
providing a public website where program and CDX outreach efforts. EPA changes that will have minimal or no
prospective CDX users can submit is working with authorized state, tribe, impact on the process or the timing of
initial registration data EPA. While CDX and local programs to develop transmitting electronic reports to CDX.
continues to register persons by standards-based reporting formats to ‘‘Significant’’ changes include changes
invitation letter for reporting under meet their shared needs. In many to the types of file formats CDX will
certain environmental programs, instances, CDX contemplates a long accept—for example a change from
registration options will continue to transition period between file formats extended markup language (XML)
broaden as the number of environmental currently used to exchange data with formats to some non-XML format—as
programs supported by CDX expands. regulated entities and any new, well as changes to the technologies that
Finally, in the proposal, CDX standards-based formats. During this may be used for file transfer to CDX or
registration was completed when the transition, CDX may offer submitters for creating electronic signatures on
registrant printed out a ‘‘signature several electronic submission options; transmitted reports. ‘‘Significant’’
holder’’ agreement from the CDX these may include an existing data changes will not generally include
registration website, signed this format familiar to submitters, one or optional upgrades to software, the
provision of additional formatting (or VI. Requirements for Electronic B. When must authorized state, tribe, or
other technical) options, or changes to Reporting Under EPA-Authorized local government programs revise or
CDX that simply reflect changes to the Programs modify their programs to allow
underlying regulatory reporting electronic reporting?
A. What is the general regulatory
requirements. ‘‘Other’’ changes include 1. The general requirement. As
approach?
an increase in—or re-ordering of—the discussed earlier, this rule does not
steps involved in transmitting electronic As explained in Part V of this require states, tribes, or local
reports, changes to the registration or preamble, the requirements in § 3.10 of governments to allow or require
credential (e.g., PIN, password, PKI today’s rule apply to reporting entities electronic reporting. Where they choose
certificate) provisioning process that that submit electronic reports directly to to do so, § 3.1000 generally provides
could affect users ability to access CDX, EPA. By contrast, today’s rule contains that they must revise or modify such
and changes to reporting formats that no requirements that apply directly to programs to ensure that their electronic
involve the reconfiguration of software. entities who submit electronic reports to reporting implementation will meet the
‘‘Emergency’’ changes include such state, tribe, or local government requirements of section 3.2000.
things as an upgrade to the system agencies. However, Subpart D of today’s Additionally, once these authorized
firewall protection. Finally, ‘‘de minimis rule does contain requirements that programs begin operating the electronic
or transparent’’ changes include the apply to state, tribe, or local government reporting systems under EPA-approved
myriad small or ‘‘back end’’ fixes and agencies that operate EPA-authorized revisions or modifications, they must
improvements that EPA makes to CDX programs. Subpart D of today’s rule keep EPA informed of changes to laws,
each week that have minimal or no requires that such agencies that receive, policies or the electronic reporting
or wish to begin receiving, electronic systems that could affect the program’s
impact on the transmission process.
reports under an authorized program compliance with § 3.2000. Where the
Such changes may range from fixing a
must apply to EPA for a revision or Administrator determines that such
typo on a data entry screen to re-
modification of that program and get changes require EPA review and
engineering the system’s archiving approval, EPA may ask the authorized
routines. EPA approval. Subpart D provides
standards for such approvals based on program to submit an application for
To address ‘‘significant’’ changes, consideration of the electronic revision or modification to address the
§ 3.20(a)(1) of the final rule provides document receiving system that the changes. Alternatively, the authorized
that EPA will give public notice in the state, tribe, or local government will use program can apply for a revision or
Federal Register of such changes and to implement the electronic reporting. modification on its own initiative.
will seek comment. EPA proposed to Additionally, Subpart D provides for For any of these program revisions or
provide this notice at least a year in special procedures for program modifications, states, tribes, or local
advance of contemplated revisions and modifications that provide governments may use either the
implementation, but based on for electronic reporting, to be used at the application procedures provided under
experience developing and operating a option of the state, tribe, or local § 3.1000(b)–(e) or the program-specific
CDX prototype, EPA no longer believes government in place of procedures procedures provided in other parts of
that a single time-frame is appropriate available under existing program- Title 40 or the applicable statute.
specific authorization regulations. Whichever procedure is used, the state,
in all situations. For example,
tribe, or local government must submit
‘‘significant’’ changes that could affect Generally speaking, EPA believes that an application that complies with the
the transmission of an annual report even absent today’s rule, an authorized requirements of § 3.1000(b)(1),
may respond to needs or events that program’s electronic reporting discussed in section VI.C.1. Section
arise less than a year in advance of the implementation would still need EPA’s 3.1000(b)(1) identifies the elements of
report’s due date. On the other hand, approval under a program revision or an electronic reporting program that
some ‘‘significant’’ changes may require modification. At least where electronic EPA would need to consider in order to
more than a year for reporting entities reports may play a role in enforcement approve a state’s, tribe’s, or local
to accommodate. Accordingly, the final proceedings, the authorized program’s government’s approach to receiving
rule provides that these Federal electronic reporting implementation has electronic documents, in lieu of paper,
Register notices will propose and seek the potential to affect program to satisfy requirements under their EPA-
public comment on an implementation enforceability, and as such, revises or authorized programs.
schedule for a ‘‘significant’’ change, modifies the program. Today’s rule 2. Deferred compliance for existing
along with describing and inviting makes this explicit in § 3.1000. In systems. For authorized programs that
comment on the change itself. To addition, the final rule includes have ‘‘existing’’ electronic document
address ‘‘other’’ changes to CDX, program-specific amendments to receiving systems as of the date this
§ 3.20(a)(2) of the final rule provides various provisions in 40 CFR to cross final rule is published, EPA is deferring
that EPA will give notice at least 60 reference those rules to the new Part 3. the deadline for these programs to
days in advance of implementation. The With this approach, EPA hopes to submit their applications for program
notice in this case will typically be to support and promote state, tribe, and revisions or modifications with respect
CDX users, and the method of notice local government efforts to make to such systems. The deferral is
may be electronic, perhaps using the electronic reporting available under generally two years from the date of this
facilities of CDX itself. For ‘‘emergency’’ their authorized programs, both by rule’s publication. This approach is
clarifying the requirement that EPA consistent with similar provisions under
and ‘‘de minimis or transparent’’
approve these electronic reporting other regulations governing program
changes, EPA will make decisions on
initiatives, and by providing a single, authorization where new requirements
whether, when, and how to provide
uniform set of standards and a specially- are imposed. Additionally, EPA
public notice on a case-by-case basis. designed process to facilitate electronic conducted extensive discussions with
reporting approval for otherwise entities operating authorized programs
authorized programs. about how much time they generally
would need to bring their systems into components that will constitute the package that can be reviewed in its
compliance with today’s rule, given system then such a system would be entirety and responded to within a
their funding cycles, program review considered ‘‘existing’’ under this rule. relatively short and predictable time-
schedules under ‘‘performance While many or most authorized frame.
partnership’’ agreements, the programs with existing systems may 1. The application. To request
timeframes for making any necessary need this two-year compliance deferral, modifications or revisions under this
system upgrades and completing an some may have no difficulty submitting rule, § 3.1000(b)(1) requires a state,
application for program revision or a completed application well before the tribe, or local government to submit an
modification, and any necessary end of two years. We strongly encourage application that generally contains three
legislative or regulatory changes. Based such early submissions when feasible. elements. The first is a certification that
upon these discussions, we believe that This will make better use of EPA’s state, tribe, or local government laws
this two-year period is generally review resources and will provide and/or regulations provide sufficient
sufficient to allow these programs to earlier certainty of compliance with this legal authority to implement electronic
make the transition to CROMERR- rule for existing state, tribe, and local reporting in conformance with § 3.2000
compliant systems without having to government electronic reporting and to enforce the affected authorized
discontinue their electronic reporting programs that are subject to this rule. In programs using electronic documents
operations. Today’s rule also allows addition, EPA believes that, whether collected under those programs; the
authorized programs to request through informal consultation or formal application must also include copies of
extensions to the two-year deadline application, identifying and addressing the relevant laws and/or regulations.
where the timeframe for regulatory or any existing system issues as early as This certification of legal authority is
legislative changes may be somewhat possible is the best way to avoid not meant to address actual
longer. disruption to electronic reporting conformance with § 3.2000(b); that is,
initiatives currently underway. the certification is not meant to reflect
EPA’s purpose in deferring the
a judgment about the capabilities of an
application deadline for program C. What alternative procedures does
agency’s electronic document receiving
revisions or modifications with respect EPA provide for revising or modifying
system. However, the certification
to existing electronic reporting is to authorized state, tribe, or local
would address § 3.2000(c), and must be
avoid disrupting authorized programs’ government programs for electronic
signed by the governmental official who
electronic reporting initiatives that are reporting?
is legally competent to certify with
already underway. With this goal in Under § 3.1000, this rule provides respect to legal authority on behalf of
mind, EPA has defined ‘‘existing procedures which a state, tribe, or local his or her government. In the case of a
electronic document receiving system’’ government, at its option, can use to state, this official must be the Attorney
broadly, to include not only those that seek approval for revisions or General or his or her designee. In the
are actually operational at the time the modifications with respect to electronic case of tribes or local governments, this
final rule is published, but also those reporting under its existing authorized official must be the chief executive or
that are substantially developed. We programs. These optional procedures administrative official or officer or his
recognize that it would be disruptive to are available both for revisions or or her designee. EPA realizes that
require that authorized programs shut modifications that seek initial EPA obtaining an Attorney General’s
down their operational systems during approval for electronic reporting certification for state applications may
the time it would take to prepare, programs, and also for revisions or involve considerable administrative
submit and have their applications for modifications to accommodate burden; however, as a legal matter, EPA
revision or modification approved. substantial changes to electronic believes that Attorneys General or their
However, there is often a very fine line reporting programs that already have designees are the only officials capable
between an operational system and a EPA approval. of certifying with respect to their states’
system under development; for Although there is always the legal authority. Where there are
example, where the developmental alternative of using the program-specific substantial administrative obstacles to
work is to scale a working prototype up procedures provided in other parts of 40 involving the Attorney General in such
to production. In addition, at least the CFR, EPA believes that, normally, a certifications, EPA urges the state
later stages of development are likely to state, tribe, or local government would Attorney General to provide for a
be restrained substantially or even find the procedures provided in this legally-competent designee who is
halted if a system must await EPA rule to be shorter, simpler, and easier. available to participate in the
approval to operate, and this may affect The § 3.1000 procedures allow submission of the state’s application.
system costs, availability of contractor submission of a single, relatively simple The second element of the
staff and their ability to complete the application to request revisions or application, and the most substantive, is
system in a timely manner. Avoiding modifications that address electronic a listing and description of the
such disruptions to substantially reporting across any number of electronic document receiving systems
developed systems is part of the goal of authorized programs. Additionally, the that do or will receive the electronic
the deferred compliance provisions. To procedures provide for a single, submissions addressed by the requested
define what counts as a ‘‘substantially straightforward EPA review process, program revisions or modifications. The
developed’’ system for this purpose, the with deadlines for EPA action written application should specify the
definition of ‘‘existing electronic into the rule. EPA believes that these electronic submissions each system will
document receiving system’’ uses procedures will be especially useful be used to receive, and which (if any)
evidence that system services or where the state, tribe, or local of these submissions involve electronic
specifications are already established by government is planning to implement signatures. In describing each system,
existing contracts or other binding all of its program-specific electronic the application should explain how the
agreements. Where an agency has reporting with a single system. Rather system will satisfy the applicable
already made legally binding than requiring approval program-by- requirements of § 3.2000. Many of these
agreements to procure a significant program, § 3.1000 allows the system to requirements apply only to systems that
proportion of the services and/or be addressed in a single application receive submissions with electronic
signatures; accordingly, the descriptions application in its entirety. Except in notification that an application is
for systems that receive no certain cases of requested revisions or complete after the two-year deadline has
electronically signed submissions will modifications associated with existing passed, for example, because the
be relatively short and simple. For each systems (see section VI.C.4) or with an application was submitted relatively
of the § 3.2000 requirements that do authorized public water system program late in the two-year period, EPA will
apply, the description should explain under 40 CFR part 142 (see section have 360 days to act on any requested
the functions the system will perform to VI.C.5), if EPA does not act on a modification or revision addressed by
satisfy the requirement, and the program revision or modification by the the application. As with the cases where
technologies that will be used to achieve end of the 180-day review period, then EPA has 180 days to act, this 360-day
this functionality. EPA does not expect that revision and/or modification is review period can be extended at the
such explanations to include detailed considered automatically approved by request of the state, tribe, or local
technical specifications of the systems, EPA. The rule allows this review period government submitting the application.
but rather to provide conceptual to be extended, at the request of the The rule provides for this extended
descriptions of the technical approach state, tribe, or local government review period to deal with the
and functionality. In implementing this submitting the application. This may possibility that EPA will receive a large
rule, EPA will provide applicants with accommodate situations where EPA and number of applications associated with
more detailed recommendations for the applicant are working through existing systems just before the two-year
preparing these system descriptions, issues that may take more than the 180- deadline expires. If the number of such
including examples and an application day review period to resolve, and they applications is sufficiently large, EPA
checklist. mutually find it in their best interest to may not be able to act on all of them
The third element of the application continue discussion before EPA makes within a 180-day review period. States,
is simply a schedule of upgrades to each its decision. tribes, or local governments that wish to
system addressed by the application—to Where EPA approves a program avoid the extended review may do so by
the extent that such upgrades can be revision or modification (by either submitting their applications addressing
anticipated—together with a brief affirmative or automatic approval), the existing systems early enough in the
discussion of how the upgrades will approval becomes effective when EPA two-year period to ensure that EPA can
assure continued compliance with publishes a notice of the approval in the determine completeness before the
§ 3.2000. This third element should be Federal Register. Where EPA denies a deadline. As noted in section VI.B.2,
thought of as an appendix to the second, requested revision or modification, EPA EPA strongly encourages such early
recognizing that the functionality with will explain the reasons for the action submissions wherever they are feasible.
which each electronic document and advise the applicant of the steps 5. Public hearings for Part 142
receiving system addresses the § 3.2000 that can be taken to remedy the revisions or modifications. Where a
requirements normally exists within the application’s defects and will generally complete application requests a revision
dynamic environment of the system life try to work with the applicant to or modification of an authorized public
cycle. address the issues that have posed an water system program under 40 CFR
2. Review for completeness. Once EPA obstacle to approval. Additionally, in part 142, EPA will make a preliminary
receives an application submitted under some cases, denial of approval under determination on the request—either an
the procedures in this rule, EPA will, the § 3.1000 process may result from approval or a denial—by the end of the
within 75 calendar days, send a letter EPA’s determination that the 180-day review period (or the 360-day
that either notifies the applicant that its application raises certain issues that are extended review period discussed in
application is complete or identifies highly program-specific and that these section VI.C.4). EPA will then publish a
deficiencies that render the application cannot be adequately addressed through notice of the preliminary determination
incomplete. An applicant that receives a the procedures provided in this rule. in the Federal Register. The notice will
notice of deficiencies may amend the For example, there may be issues that state the reasons for the preliminary
application and resubmit it. From the require a discussion of program features determination, and will inform
date EPA receives the amended that the § 3.1000(b)(1) application interested members of the public that
application, EPA will, within 30 would not cover. In such cases, EPA they may request a public hearing on
calendar days, respond with a letter that will identify the issues that exceed the the preliminary determination. Such
either notifies the applicant that the scope of the § 3.1000 process and will hearing requests must be submitted
amended application is complete or else advise the applicant to request the within 30 days of the notice’s Federal
identifies remaining deficiencies. If an revision or modification under the Register publication. If no requests are
amended application is not submitted applicable program-specific procedures submitted, and the Administrator does
within a reasonable time period to provided in other parts of Title 40. not hold a hearing on his or her own
remedy identified deficiencies, EPA has 4. Revisions or modifications motion, then the preliminary
the authority to review and act on the associated with existing systems. Some determination will be effective 30 days
incomplete application, as explained in applications will request modification after the initial Federal Register
section VI.C.3. or revision to an authorized program publication.
3. EPA actions on applications. EPA with an ‘‘existing electronic document If a request for hearing is granted, or
will act on an application by either receiving system’’. As noted in section the Administrator determines that a
approving or denying the requested VI.B.2, the deadline for submitting such hearing is warranted, EPA will publish
program revisions or modifications. In applications is two years after the an additional Federal Register notice
the case of a consolidated application publication of today’s rule. Where such announcing—at least 15 days in
for revision or modification of more applications are submitted and are advance of any such hearing—the date
than one program, EPA need not take determined to be complete before the and time of any hearing, contact
the same action on each revision or two-year deadline, EPA will have a 180- information, and the purpose of the
modification; some may be approved day review-period for any program hearing. At the hearing, a hearing officer
while others are denied. EPA will have modification or revision being will receive oral and written testimony,
180 calendar days from the time it sends requested, as explained in section and will forward a record of the hearing
a notice of completeness to act on an VI.B.3. However, where EPA sends to the EPA Administrator. After
reviewing the record of the hearing, EPA any electronic document it accepts bear electronic documents submitted under
will by order either affirm or rescind the a valid electronic signature wherever authorized programs by considering,
preliminary determination, and will the corresponding paper document among other things:
publish notice of this decision in the would have to be signed under existing • The roles that many electronically
Federal Register. If the order is to regulations or guidance, with the submitted documents would likely play
approve the revision or modification, signatory being the same person who is in environmental program management,
the approval will be effective upon authorized and/or required to sign including compliance monitoring and
publication of the order in the Federal under the current applicable provision. enforcement;
Register. As in the case of direct reporting to EPA • EPA’s statutory obligation to ensure
6. Re-submissions and amendments. (see section V.A), the requirement for an that authorized or delegated programs
States, tribes, or local governments electronic signature will apply only maintain the enforceability of
whose § 3.1000 applications for where the document would have to bear environmental law and regulations; and
revisions or modifications have been a signature were it to be submitted on • The consequent need to ensure that
denied in whole or in part may reapply paper, either because this is required by enforceability is not compromised as
for reconsideration, using either the statute or regulation, or because a authorized programs make the transition
§ 3.1000 procedures again, or, at their signature is required to complete the from paper to electronic submission of
option, the applicable program-specific paper form. This rule does not require compliance or enforcement-related
procedures. A state, tribe, or local that authorized programs impose any documents.
government may also, on occasion, new or additional signature The § 3.2000(b) standards for electronic
choose to amend a § 3.1000 application requirements for electronic documents document receiving systems in today’s
after the Administrator has determined that are submitted in lieu of paper and rule provide an expanded version of
the application to be complete. In such were not previously required to be what had been the proposed § 3.2000(b)
cases, the application will be considered signed when submitted in paper form. ‘‘Validity of Data’’ criterion. Like
to have been withdrawn and As with direct reporting to EPA,
proposed § 3.2000(b), final § 3.2000(b)
resubmitted as a new package, and a § 3.2000(a)(2) also allows an authorized
requires that electronic document
new 75-day completeness determination program to make special provisions for
receiving systems reliably enable EPA,
process will begin. An applicant may the required signatures to be executed
states, tribes, and local governments to
choose to withdraw and resubmit the on follow-on paper submissions. As
prove, in civil and criminal enforcement
package in this manner, for example, if noted in section IV.C, such provisions
it becomes clear relatively early into the must ensure that the paper submission proceedings, that the electronic
180-day review period that the containing the signatures is adequately documents they receive and maintain
application cannot be approved in its cross-referenced with the electronic are what they purport to be, that any
current form. For such re-submissions, document being signed, and must be changes to their content are
EPA will work diligently to expedite the described as a part of the § 3.1000(b)(1) documented, and that any associated
completeness determination. application. Systems that receive signatures were actually executed by the
electronic documents with such follow- designated signatories intending to
D. What general requirements must certify that content. Systems must be
on paper signature submissions are
state, tribe, and local government able to satisfy the § 3.2000(b)
subject to all applicable § 3.2000(b)
electronic reporting programs satisfy? requirements for any electronic
requirements, including the requirement
States, tribes, and local governments that the electronic document cannot be documents they receive that are
that accept electronic reports in lieu of altered without detection after the submitted in lieu of paper to satisfy an
paper under their authorized programs signature has been executed. authorized program requirement.
must satisfy the requirements of The following discussion highlights
§ 3.2000(b) and (c). Section 3.2000(b) E. What standards must state, tribe, and some of the § 3.2000(b) requirements for
sets forth the standards that acceptable local government electronic document electronic document receiving systems.
electronic document receiving systems receiving systems satisfy? The first five of these requirements
must satisfy, and these are explained in Section 3.2000(b) specifies the (timeliness of data generation, copy of
detail in section VI.E. In parallel with standards that electronic document record, integrity of the electronic
§ 3.4 on federal compliance and receiving systems must satisfy if they document, submission knowingly, and
enforcement, § 3.2000(c) requires that are to be approved for use by states, opportunity to review and repudiate
the state, tribe, or local government be tribes, or local governments to receive copy of record) apply to all electronic
able to seek and obtain any appropriate electronic documents in lieu of paper document receiving systems. The other
civil, criminal or other remedies under under an EPA-authorized program. highlighted requirements (validity of the
state, tribe, or local law for failure to EPA’s purpose in specifying such electronic signature, binding the
comply with a reporting requirement if standards remains the same as it was signature to the document, opportunity
a person submits an electronic when EPA specified the proposed to review, understanding the act of
document that fails to comply with the § 3.2000 criteria in proposed CROMERR. signing, the electronic signature or
applicable provisions for electronic As discussed in section IV.B.1, that subscriber agreement, acknowledgment
reporting. Similarly, § 3.2000(c) purpose was to ensure that of receipt, and determining the identity
contains provisions to ensure that an electronically submitted documents of an individual) apply only to systems
electronic signature provided to a state, have the same ‘‘legal dependability’’ as that receive electronically signed
tribe, or local government will make the their paper counterparts, so that any documents.
person who signs the document electronic document that may be used 1. Timeliness of data generation.
responsible, bound, and/or obligated to as evidence to prosecute an Section 3.2000(b) reflects the role that
the same extent as he or she would be environmental crime or to enforce electronic document receiving systems
signing the corresponding paper against a civil violation has no less play in supporting a wide range of
document. evidentiary value than its paper compliance and enforcement-related
Additionally, under § 3.2000(a)(2), the equivalent. EPA has been motivated to activities, including compliance
authorized program must require that provide for the legal dependability of research and analysis, civil actions, and
litigation, and the fact that the success true and correct copy; otherwise, it signatory-generated password with an
of such activities may be affected by the cannot meet other related system encrypted version maintained securely
relative ease or difficulty of accessing requirements, such as establishing at the electronic document receiving
the data related to electronic document integrity. (See section VI.E.3, system. In such cases, the signatory-
submissions. Accordingly, electronic below.) The copy of record is shown to generated password—which might be
document receiving systems must be true and correct in part by virtue of regarded as the signature—never
provide timely access to such data, its not being repudiated by the actually appears on the electronic
especially to data relevant to the submitters and/or signatories where it is document, so the signature that is
questions of what was submitted, by made available for their review and ‘‘included’’ in the copy of record may be
whom, and, where signatures are repudiation. (See section VI.E.5., an encrypted form of the signature, or
involved, who the signatories were and below.) In addition, the system must possibly nothing exactly corresponding
to what they certified. Much of this data provide sufficient evidence to show to a signature at all, but rather pointers
may be assembled in the copy of record, how the copy of record was derived or references to the processes or
together with any data needed to from and accurately reflects the encrypted data that provide the actual
establish that the copy is a ‘‘true and electronic document as it was received link to the signatory. There are
correct copy of an electronic document by the system; such evidence is also analogous strategies for biometric
received,’’ as specified by the § 3.3 copy necessary to establish document signatures. For example, the validity of
of record definition. To help the litigator integrity. To provide for such evidence, a biometric (e.g., a finger print, a retinal
develop evidence and present it in the the system may need to establish a scan, etc.) may be established by using
courtroom, it is advisable that the copy chain of custody for the copy of record, certain statistical algorithms to evaluate
of record be maintained and made particularly if there are a number of data provided by the biometric. In such
accessible in a form and format that processing steps that separate the copy cases, the copy of record might
requires the minimum possible of record from the file as it enters the document the process of validating the
‘‘assembly’’ of its elements, so that its system. On the other hand, where the signature, but without including the
connection with what was received and copy of record captures and preserves biometric data that was used to show
what was certified to by any signatories the file containing the electronic that the signature was valid. On any of
is easy to understand and to document exactly in the form and these approaches, the copy of record
demonstrate to others. format in which it is received, then a may satisfy the requirement that the
2. Copy of record. Under § 3.2000(b), chain of custody may not be necessary. copy ‘‘include’’ the signatures, provided
an acceptable electronic document Considerations of ‘‘timeliness’’ favor that what the copy does contain serves
receiving system must retain and be able maintaining copies of record in a way to establish whether the electronic
to make available a copy of record for that would not require a chain of document in question was signed and
each electronic document it receives custody. (See section VI.E.1., above.) by whom.
that is submitted in lieu of paper to Second, the copy of record must Third, the copy of record must
satisfy requirements under an include all the electronic signatures that include the date and time of receipt to
authorized program. For such have been executed to sign the help establish its relation to submission
submissions, the copy of record is document or components of the deadlines, to the circumstances of its
intended to serve as the electronic document. The method of inclusion submission, and to other possibly
surrogate for what we refer to as the may vary, depending on the nature of associated documents that may have
‘‘original’’ of the document received the signature. With a digital signature, been submitted or alleged to have been
where we are doing business on paper. created by encrypting a hash of the submitted. This is not generally
The copy of record is meant to provide document being signed with the private problematic, except in cases of
an authoritative answer to the question key in a private/public key-pair, the continuous streams of data conveyed to
of what was actually submitted and, as signature is simply a number that can the system. For such continuous data,
applicable, what was signed and and should be contained as a copy of reasonable alternatives may be
certified to in the particular case. record element. There is no risk of substituted that serve the same
As defined in § 3.3, a copy of record signature theft in this case. Each digital purposes, for example, associating
must satisfy at least four requirements. signature is bound to the specific stages of the data flow with dates and
First, it must be a true and correct copy document it signs, and the private key, times, say, at hourly intervals. Similarly,
of the electronic document that was which is actually used for signing, is the copy of record may include other
received. In the case of documents inaccessible to a would-be intruder. additional information to the extent that
consisting of data, this means that the With other forms of signature such as this is needed to establish the meaning
copy of record must contain exactly the personal identification numbers (PINs) of the content and the circumstances of
set of data elements that constituted the or passwords, items of personal receipt. Such additional information
electronic document that was information, or biometric images or might include data field labels,
submitted. In the case of a document values, including the signature as a copy signatory information such as references
consisting of other forms of information, of record element may raise signature to PKI certificates, and transmission
e.g., text or images, being a ‘‘true and theft issues. At least in theory, such source information.
correct copy,’’ may mean including file signatures could be detached or copied Fourth, the copy of record must be
and or visual format information along from a copy of record and re-used viewable in a human-readable format
with the items of information spuriously without detection. To that clearly indicates what the submitter
themselves, to the extent the meaning of address this risk, the signature, and, where applicable, the signatory
these items is dependent on format. (See especially in the case of a PIN or intended that each of the data elements
the discussion of the definition of password, may be encrypted for storage, or other information items in the
‘‘electronic document,’’ in section perhaps together with a hash of the document means. This supports the
IV.D.1.) For the copy of record to fulfill document signed, to bind the signature copy of record’s role as a surrogate
its intended role, it is not enough that to the document content. Another ‘‘original’’ of the paper document, and
it be a true and correct copy; it must approach may be to validate the serves to establish the content of the
also be capable of being shown to be a signatory’s identity, e.g. by comparing a document as it was signed and/or
submitted. The copy of record may readable format, so long as there is a provide evidence that the submitter had
satisfy this requirement in many well-documented way to display the some reliable way of knowing and/or
different ways. It might actually include stored data in such a format. In confirming that the submission took
explicit labels or descriptions for each addition, nothing in the ‘‘copy of place. This requirement is necessary to
data element or information item, or record’’ definition requires such copies help establish submitter responsibility
preserve a visual format in which the to be electronic. Particularly where the for the electronic document and to rule
data were submitted. Alternatively, it signature involves some easily out spurious submissions, whether by
may incorporate a conventional represented numerical value, the copy accident or through the actions of an
ordering of the items or elements, where of record may be created and unauthorized submitter or ‘‘hacker.’’
the information that associates such maintained in an imaging medium or on EPA believes that to satisfy this
ordered data with labels, descriptions, paper, provided that such copies can be requirement, the system must have
or other means of visual display is shown to have been created by the some follow-on communication with
maintained externally and can be electronic document receiving system to the submitter related to the submission.
invoked as needed—for example, to be true and correct copies of the This could be a communication
make the data elements appear within electronic documents received. Whether initiated by the submitter in cases where
fields in the image of a filled-out form. such alternatives are appropriate as it is realistic to rely on submitters to
Where the electronic document is interim or even long-term solutions will regularly check the system for evidence
created off-line by the submitter and depend on individual circumstances. It of documents submitted; where such
conveyed as a whole to the receiving may be difficult to provide a copy of submitter interactions are relied upon,
system, it is preferable for the copy of record for review and possible they must be documented.
record to reflect the mechanism or repudiation if the copy is not available Alternatively, the system must send
format for indicating meaning supplied as an electronic document that can be some form of acknowledgment of
in the submission. For example, if the viewed on-line or downloaded through submission as a response to the
submission is in some standard the network. submitter named, and must document
electronic data interchange format, then 3. Integrity of the electronic such acknowledgments, recording at
the copy of record might usefully document. Under § 3.2000(b)(1)—(2), an least their date, time, content and the
preserve that format. Taking this acceptable electronic document addresses to which they were sent. For
approach will help to resolve potential receiving system must be able to cases where the electronic document
chain of custody issues if questions establish that a given electronic bears an electronic signature, this
arise about whether the copy of record document was not altered without acknowledgment is explicitly provided
is true and correct. However, in cases detection in transmission or at any time for under § 3.2000(b)(5)(vi). (See section
where the electronic document is after receipt, and any such alterations VI.E.11.)
created on-line, for example, through must be fully documented. For purposes 5. Opportunity to review and
the use of a web-form, the format for the of § 3.2000(b)(1)—(2), EPA excludes repudiate copy of record. Under
copy of record will of necessity be an alterations that have no effect on the § 3.2000(b)(4), the copy of record must
artifact of the electronic document document’s information content. be available for review and timely
receiving system itself. This is not Examples of excluded alterations repudiation by the individuals to whom
problematic, as long as the system include the separation of a transmitted the document is attributed, as its
file into packets and their error-free submitters and/or signatories. The fact
provides a way to ensure that the
recombination, the error-free processes that the copy was available for this
meaning of each data element as
of file compression and extraction, as review and was not repudiated provides
supplied by the submitter remains
well as certain disk maintenance strong support for its being a ‘‘true and
unambiguous.
functions that may, for example, involve correct copy of an electronic document
Some commenters objected to copy of physically repositioning file received,’’ as specified by the § 3.3 copy
record requirements because of the components on the storage medium. To of record definition. Program managers
potential expense of redesigning satisfy § 3.2000(b)(1)—(2) requirements normally would set reasonable end
systems that are not currently capable of with respect to alterations that do affect dates for this process, especially where
creating and storing electronic copies of information content, a system may rely there is concern that the copy is not
records. EPA notes, however, that on a number of different but ‘‘officially’’ a copy of record until the
systems satisfying copy of record complementary capabilities, including process is complete.
requirements need not preserve the general provisions for system security, Satisfying this ‘‘opportunity to
electronic documents received in access control, and secure transmission. review’’ provision involves at least two
separate or special storage apart from Additionally, the system’s copy of requirements. The first is that the
the files that maintain the data or record provisions help make the case identified submitters and/or signatories
information content of the documents. that the electronic document is must have some way of knowing that
For example, data loaded from unaltered, or has been altered only as their submission was received, and that
submitted electronic documents to a documented (for example, through a a copy of record is available for review.
database may satisfy copy of record chain of custody), a case which is This requires some follow-on
requirements where the stored content strengthened where submitters and/or communication with the submitters and
includes the signatures, the date/time of signatories have had the opportunity to signatories related to the submission—
receipt, and an adequate chain of review the copy and have not contacted initiated either by the submitters/
custody. This may be the most practical the system to repudiate the copy. signatories or by the system, as
copy of record approach for receiving Finally there are specific technical discussed in section VI.E.4. Approaches
continuous data streams. Such an approaches to ensuring integrity, based, should be avoided that allow the initial
approach does not preclude satisfying for example, on calculating hash values submission and provision of copy of
the requirement that the copy of record associated with the document content. record to occur as a part of the same on-
be viewable in a human-readable 4. Submission knowingly. Under line session, because in cases of
format. The requirement does not mean § 3.2000(b)(3), an acceptable electronic spurious submission the identified
that the data must be stored in a human- document receiving system must submitters/signatures may never learn
that a copy of record exists. Second, to individual identified as its owner, and detected, the system must ensure their
ensure that the opportunity to review to no one else. Otherwise, the use of the rejection, and the rejection of any
and repudiate is meaningful, the copy of device to create the electronic signature subsequent submissions that use the
record must be viewable in a human- may not provide evidence that a same device. An acceptable receiving
readable format that clearly and specific, identifiable individual has system must provide for timely
accurately associates all the information certified to the truth or accuracy of an revocation or suspension of access by
elements of the electronic document electronic document. Accordingly, an those individuals with compromised
with descriptions or labeling of those acceptable electronic document signature devices.
elements. This second requirement is receiving system must provide evidence Finally, a signature must be created
consistent with the definition of ‘‘copy that the electronic documents it receives by an individual who is authorized to
of record,’’ as discussed in section and maintains do not contain signatures do so, primarily by virtue of his or her
VI.E.2. executed with compromised devices. relationship with the regulated entity on
6. Validity of the electronic signature. Such evidence will document the whose behalf the signature is executed.
Under § 3.2000(b)(5)(i), for each system’s approach to three related An electronic document receiving
electronic document that is required to functions: prevention of signature systems must be able to determine
bear an electronic signature, the device compromise, detection of whether the identified signatories have
receiving system must be able to compromises where they occur, and the necessary relationship with the
establish that each electronic signature rejection of known compromised regulated entity that enables them to
was a valid electronic signature at the submissions. sign the documents being submitted.
time of signing. Under § 3.3, as The approach to prevention will Generally, the system would obtain the
discussed in section IV.D.5, a valid include the way the system notifies information necessary for these
electronic signature must satisfy three submitters of their obligations to avoid determinations along with establishing
conditions. The first is that the signature signature compromise, including the the identity of the signature device
must be created with a signature device obligation not to share or delegate the owners. Section VI.E.12 of this Preamble
that is ‘‘owned’’ by the individual use of the device as a part of the discusses this point in more detail.
designated as signatory—‘‘owned’’ in electronic signature agreement. (See The system must also have some way
the sense that this individual is sections IV.D.4 and VI.D.8. of this to keep this information up-to-date, for
uniquely entitled to use it for creating Preamble, respectively.) Prevention also example, some way to reject signatures
signatures. To establish this, an involves choosing the kinds of signature where it is known that the signature
electronic document receiving system devices to support and determining how device owner is no longer authorized to
must be able to identify signature device they are to be used. Some devices are sign the electronic document in
‘‘owners’’ and must be able to determine inherently vulnerable to compromise, question. As with the initial registration
that an identified signatory is the owner for example, because protection from process, the provisions for updating this
of the device used to create the spurious use relies on ‘‘secret’’ (such as information may vary. For some cases,
signature in question. Section a PIN or password) that has to be shared it may be sufficient to rely on voluntary
3.2000(b)(5)(vii) explicitly requires the when the device is used. However, notifications from registrants when, e.g.,
ability to identify signature device vulnerable devices can sometimes be their job status changes. For other cases,
owners, and section VI.E.12 of this strengthened with appropriate it may be appropriate to identify a
Preamble discusses the implementation. In the case of a PIN or responsible company official who is
§ 3.2000(b)(5)(vii) requirements in password, adding an element that does charged with managing the
detail. not rely on secrecy—e.g. a physical authorizations of employees signing
Concerning the determination that an ‘‘token,’’ such as a smart card or documents on behalf of the company, to
identified signatory is the owner of the employee badge—that had to be used include keeping records of changes in
device used to create the signature, the along with the PIN or password may authorization status and/or sending
system needs to have unique signature greatly reduce the device’s notifications. For certain cases, the
validation criteria for each identified vulnerability. Alternatively, a system system might limit a signature device
signature device owner who submits accepting secret-based signatures might owner’s authorization to a defined
electronically signed documents; the be programmed to query the would-be period, which could be extended only
system must be able to apply these signatory about a randomly selected through a re-registration process.
criteria to each signature on documents piece of private information that has 7. Binding the signature to the
received. For example, in the case of a been (or could be) verified. This document. Under § 3.2000(b)(5)(ii), an
digital signature, the validation criteria approach would also reduce acceptable electronic document
include the existence of a valid PKI vulnerability to compromise, since the receiving system must establish that
certificate for the identified signatory discovery of a secret number or electronic documents cannot be altered
and the ability of the associated public password does not convey other private without detection once such documents
key to decrypt the encrypted message information about the secret’s owner. are signed. Well-implemented
digest that constitutes the signature. In For detection of compromises, there provisions for copy of record help
the case of a PIN, the validation are two complementary approaches. The satisfy this requirement. The fact that a
criterion may be simply that the PIN first is to ensure that the system signatory has not repudiated a
added to the document as a signature recognizes the signs of spurious document’s copy of record that he or
matches the PIN on file for the submission, for example, duplicate she has had the opportunity to review
identified signatory. reports, off-schedule submissions, and provides evidence that the copy
The second condition for an deviations from normal content or accurately reflects the document as it
electronic signature to be considered procedure. The second is to ensure that was signed. However, even where the
valid is that the signature must be the system empowers submitters to signatory affirms the authenticity of the
created with a device that has not been detect and report spurious submissions copy of record at the time of review, he
compromised. That is, at the time of by providing the regular ‘‘out of band’’ or she may still repudiate the document
signing, the electronic signature device acknowledgments discussed in section at a later date. Therefore, an acceptable
must in fact be available only to the VI.E.11. Once spurious submissions are electronic document receiving system
must provide a method of ensuring that 9. Understanding the act of signing. he or she receives system
any breach of a signed document’s Where a signatory is certifying to the acknowledgments of submissions he or
integrity can be detected. As discussed truth or accuracy of document content, she did not make, or if the device has
in section IV.B.2., such methods are the certification affirmatively represents become available to others. Finally, by
available in the form of signatures that that the signatory understands both signing the electronic signature or
incorporate a hash value of the content what the act of signing means and that subscribed agreement, an individual
being signed, or in the form of signature he or she is subject to criminal liability agrees that use of his or her electronic
processes that involve the creation of for false certification. Reporting formats signature device to sign documents
this hash and its maintenance in in the paper medium provide evidence creates obligations and/or legally binds
association with the signed document. that certifications are made with the him or her to the same extent as he or
Encrypting the hash value, for example, requisite understandings by placing the she would be bound or obligated by
by executing a digital signature, provide certification statement in a clearly executing handwritten signatures. EPA
the strongest approach to rebutting visible position near the place where believes that such agreements are
claims that the hash has been signatures are to be affixed and by necessary to assure—and provide
manipulated. Encryption may not be prominently displaying the statement evidence—that the signatory recognizes
necessary to the extent that the system that there are criminal penalties for false his or her obligations with respect to the
provides other means to prevent certification. Under § 3.2000(b)(5)(iv), electronic signature device. Insofar as
tampering and establish that the hash an acceptable electronic document the institutions surrounding the use of
has not been altered since it was receiving system must ensure that such electronic signatures are relatively new,
calculated. statements are presented in conjunction EPA believes that express recognition of
8. Opportunity to review. Where a with electronic signature/certification. signatory obligations through explicit
signatory is certifying to the truth or Satisfying this requirement is agreements avoids potential ambiguity
accuracy of document content, the straightforward where the system itself or misunderstandings.
provides for the signature process or 11. Acknowledgment of receipt.
certification represents the signatory as
where the governmental entity receiving Where an electronic signature is used to
knowing and understanding the content,
the submission provides or otherwise certify to the truth or accuracy of
as well as certifying to its truth. Under
has control over the signature/ document content—with criminal
§ 3.2000(b)(5)(iii), an acceptable
certification software being used. In liability for false certification—then it is
electronic document receiving system especially important to ensure that any
must be able to provide evidence that other cases, satisfaction will depend on
requiring that the signatories and/or individual identified as signatory has
the signatory had the opportunity to the opportunity to detect and repudiate
review what he or she was signing in a submitters incorporate such statements
into their documents before they are any spurious submissions made in his
human-readable format. Providing this or her name through unauthorized
evidence may be relatively simple, signed or into screens that are displayed
prior to signature. Confidence that the access to signature device and/or the
depending on the signature/certification electronic document receiving system.
scenarios that the system provides for or requirement is satisfied will depend in
part on the extent to which the To provide for this, § 3.2000(b)(5)(vi)
allows. In a case where the system only requires the system to automatically
allows signature/certification during an submission process involves the use of
common, easy-to-display file structures send acknowledgments of document
on-line client-server session, and where receipt to the individuals in whose
the server always explicitly gives the together with the software to display the
names the submissions are made, the
signatory the option of scrolling through files being signed.
acknowledgments in each case
an appropriately-formatted display of 10. The electronic signature or identifying the document in question,
the submission content before signing, subscriber agreement. Under the signatories, and the date and time of
documenting these server functions § 3.2000(b)(5)(v), an acceptable receipt.
should suffice to provide the required electronic document receiving system Additionally, § 3.2000(b)(5)(vi)
evidence. Cases that may be similarly must be able to provide evidence that requires that each acknowledgment be
straightforward include those where any signatory of documents received by sent to an address with access controls
signature/certification takes place off- the system has signed an electronic different and separate from those that
line, at the signatory’s computer, but signature agreement or subscriber enable the submission itself, so that in
using software provided by or certified agreement with respect to the electronic cases of compromised access, the
by the governmental entity whose signature device he or she uses to sign individual in whose name a submission
system will receive the signed electronic the documents. ‘‘Electronic signature is made would still receive the
document. In this case, the evidence is agreement’’ and ‘‘subscriber agreement’’ acknowledgment without interference.
provided by documenting how the are defined under § 3.3, the latter This is sometimes referred to as ‘‘out of
software works. Less straightforward are referring to electronic signature band’’ acknowledgment. In web-based
cases where the signature/certification agreements that are executed with ink commerce, this is fairly standard
software is completely beyond the on paper. (The distinct role of practice—a purchase is normally
control of the governmental entity. In subscriber agreements is explained in acknowledged directly to the internet
such cases, evidence of the opportunity section VI.E.12.) By signing such protocol (IP) address from which the
to review may need to rely on the use agreements, an individual agrees to purchase is made, as a part of the on-
of a submission format that protect his or her signature device from line session, but also is confirmed
demonstrably allows a human-readable compromise, that is, to keep a secret through a follow-up communication to
display of the content. For example, the code secret, a hardware token secured, an email address. Note that while the
fact that the file format is a Word or etc., and not to deliberately compromise ‘‘out of band’’ acknowledgment is
Excel file and that the file provides a the device by making it available to normally sent electronically, electronic
human readable display when opened others. He or she also agrees to promptly transmission is not required. A paper
with the right program may constitute report any evidence that the device has acknowledgment sent by U.S. Mail, or a
sufficient evidence that the opportunity been compromised, for example, to voice acknowledgment via telephone
to review has been provided. promptly notify the system manager if would serve the same purpose so long
as these are documented by the system reports are those that EPA has identified individual’’ does not have to involve a
so they may be produced, possibly as as likely to be material to potential PKI-based approach to electronic
evidence, at a later date. enforcement litigation. Given this signatures. Indeed, it does not have to
12. Determining the identity of the likelihood, it is important to provide not involve a third party at all; the
individual uniquely entitled to use a only for the provability of signature disinterested individual could simply
signature device. As discussed in device ownership in principle, but for be an employee of the agency operating
section VI.E.6, a system cannot accept the practical need to make this proof the electronic document receiving
an electronic signature as valid unless it with the resources typically available to system, if that agency itself has the
establishes an identity between the enforcement staff and within the resources to provide for identity-
individual designated as signatory and constraints of the judicial process in proofing as it registers signature device
the owner of the device used to create criminal and civil proceedings. To owners to use the system. Additionally,
the signature. Any circumstance casting address this practical dimension of if a trusted third party is wanted, there
doubt on the device’s ownership identity-proofing in the case of priority are alternatives to the CA. For example,
undermines the certainty that signatures reports, § 3.2000(b)(5)(vii) adds three with an appropriately defined
created with the device are valid; if it’s conditions to the general performance procedure, a notary public or some local
not certain whose device created the standard. The first is that the identity of government official could play this role;
signature then it’s not certain whether a signature device owner must be so could some other governmental
the actual signatory is the individual verified before the system accepts any agency, such as department of motor
who is designated as signatory in the electronic signature created with the vehicles, which is in the business of
submitted document. Additionally, it device. The second, in issuing credentials based (usually) on
must be clear what the signature device § 3.2000(b)(5)(vii)(A), is that this in-person verification of identity.
owner’s relation is to the entity on verification must be ‘‘by attestation of The third condition sets a standard for
whose behalf a document is signed, in disinterested individuals.’’ The third the evidence on which verification of
order to be certain that this device condition, also contained in identity would be based—evidence that
owner is an authorized signatory. This § 3.2000(b)(5)(vii)(A), specifies that the would be attested to by the disinterested
is also a condition of signature validity. verification be ‘‘based on information or individual provided for by the second
(See section VI.E.6.) Accordingly, to objects of independent origin, at least condition. The standard refers to
assure that electronically signed one item of which is not subject to ‘‘information or objects’’ and for each
documents are legally reliable, a system change without government action or requires that they be ‘‘of independent
accepting such documents must have a authorization.’’ origin’’ and include at least one item
process for determining who owns the that requires ‘‘governmental action or
signature devices used to create the Regarding the first condition, authorization’’ to change. Information
signatures, and their relations to the requiring identity-proofing before the ‘‘of independent origin’’ must be
entities on whose behalf they sign signature device is used helps prevent knowable empirically, and not simply
submitted documents. Section systems from accepting electronic as a matter of someone’s say so; objects
3.2000(b)(5)(vii) explicitly reflects this signatures that cannot be proved to be of independent origin could provide
performance standard by requiring that valid in the context of an enforcement such information. Such information,
a system provide for such proceeding. This is at least a potential where it concerns an individual’s
determinations ‘‘with legal certainty.’’ concern in any case of electronic identity, would generally come from
That is, the system must be able to signature, but it is also a very real three sources: first, documented, direct,
provide evidence sufficient to prove the concern in cases where what is signed in-person contact; second,
signature device owner’s identity and is a priority report. The second documentation of the individual’s
relation to entities on whose behalf he condition anticipates the need to prove history—e.g., as an employee, a
or she signs in a context where signature device ownership in court, by consumer, a student, etc.—with objects
designated signatories may have an ensuring the availability of someone such as credit cards, passports, etc.,
interest in repudiating their signature credible to offer testimony about the sometimes together with corroborating
device ownership or in distancing device owner’s identity who does not testimony; and third, forensic evidence
themselves from the entities on whose have an interest in repudiating device of unique, immutable traits, from such
behalf they are supposed to have signed. ownership. This is the idea of objects as fingerprints, photos, and
Section 3.2000(b)(5)(vii) does not verification by a ‘‘disinterested handwritten signatures.
specify how this performance standard individual,’’ the term defined under Evidence of identity from any of these
is to be met, however, at a minimum, an § 3.3 as ‘‘a person who is not the three sources will meet the
‘‘identity-proofing’’ capability must employer; the employer’s corporate § 3.2000(b)(5)(vii)(A) standard, provided
involve access to a set of descriptions parent, subsidiary, or affiliate; that the information used also includes
that apply uniquely to the individual in contracting agent; or relative (including at least one item that cannot be changed
question and refer to attributes that are spouse or domestic partner) of the without governmental action or
durable, documented, and objective. individual in whose name the electronic authorization—for example, a social
Such descriptions must be capable of signature device is issued.’’ The security number, a passport number, or
being shown at any time to uniquely condition suggests an identity-proofing a driver’s license number. This last
identify the individual without having process carried out by a trusted third requirement helps assure that the
to depend on anyone who might have party, and, in the current electronic identifying information used is
an interest in repudiating the commerce environment, this would sufficiently well-documented and
identification. Section 3.2000(b)(5)(vii) typically be a PKI certificate authority durable to support re-verification of
requires that more specific conditions (CA), whose business is to issue identity at some later date. The
be met for the special class of certificate-based electronic signature requirement also facilitates identity-
electronically signed documents that are devices that reflect identity-proofing at proofing that relies on database
included in the list that defines a specified level of assurance. However, searches, insofar as data on individuals
‘‘priority report’’ under § 3.3 and it is important to be clear that tends to be keyed to government-issued
Appendix 1 to Part 3. The priority verification by a ‘‘disinterested identifiers. Finally, while such
identifiers are items of information, they Identity in this case is established based environmental reporting costs. EPA’s
typically are presented on objects—e.g. on the forensic properties of the response to these comments is
a driver’s license or a passport—that handwritten signature on the agreement. explained in the following section.
provide independent evidence of their Finally, § 3.2000(b)(5)(vii)(B) gives Additional comments on the cost
authenticity. states, tribes, or local governments the analysis and EPA’s responses can be
EPA recognizes that the identity- flexibility to propose identity-proofing found in the rulemaking docket, in the
proofing requirements specified in methods that may not meet the specific Response to Comments document.
§ 3.2000(b)(5)(vii)(A) may be difficult to requirements of § 3.2000(b)(5)(vii)(A),
implement in some cases. The rule B. Final Rule Costs
but which are no less stringent than the
therefore allows a system to meet the methods that satisfy In response to comments received on
§ 3.2000(b)(5)(vii)(A) requirements for § 3.2000(b)(5)(vii)(A). For example, if a the proposed rule, EPA conducted
cases of priority reports in other ways. method of electronic identity-proofing additional cost analyses to determine
Under § 3.2000(b)(5)(vii)(C), a system were proposed that relies on the the impacts of this rule on regulated
may collect a subscriber agreement (see attestations of an LRA who is not a entities, states, tribes, and local
section VI.E.10) from each signatory of disinterested party, EPA would look for governments, and EPA programs. In
the priority reports received by the other features in the identity-proofing developing the analysis for this final
system, in lieu of satisfying method that guarantee the identity of rule, EPA relied heavily on existing
§ 3.2000(b)(5)(vii)(A). Alternatively, the the LRA and the trustworthiness of the sources of data that included:
system may collect a certification from identity-proofing that the LRA would • EPA’s 2002 Government Paperwork
a ‘‘local registration authority’’ (LRA) conduct. Similarly, if an identity- Elimination Act (GPEA) Report to OMB;
that such a subscriber agreement has proofing method were proposed that • Interviews with EPA programs,
been executed and is being securely relies on objects or information that are states, and nine industry representatives
stored. As defined under § 3.3, an LRA not of independent origin (e.g., a currently using CDX to report
is an individual who plays the role of company identification card), EPA electronically;
a custodian of subscriber agreements, would look for other features in the • EPA’s Information Collection
maintaining these paper agreements as authentication method that guarantee Requests (ICRs);
records and sending the system a • EPA’s Envirofacts Warehouse and
that the registrant’s identity could not
certification of receipt and secure Facility Registry System;
have been manufactured by the • Follow-up to comments received
storage for each such agreement he or registrant or another interested party.
she receives. The presumption is that from twenty state and local government
EPA’s expectation is that the advance of agencies and several major industry
such certifications would be sent technology may also make new methods
electronically to the system as signed associations; and
of identity-proofing available that meet • Market research to assess trends of
electronic documents. To become an the needs of the enforcement
LRA, an individual must have his or her large and small companies using the
community, and we expect that Internet, costs of technology for
identity established by notarized § 3.2000(b)(5)(vii)(B) could be used to
affidavit, and must be authorized in electronic signature and data exchange
accommodate such new methods when formats, and other technical issues.
writing by the regulated entity to issue implemented as part of electronic
these ‘‘agreement collection Based on the additional analyses, EPA
document receiving systems. estimates that under this rule there will
certifications’’ (defined under § 3.3) on
its behalf. VII. What are the costs of today’s rule? be a total cumulative cost savings to the
A state, tribe, or local government Agency, over the period 2003 to 2012,
A. Summary of Proposal Analysis ranging from $64.4 million to $75.4
adopting the subscriber agreement
alternative might chose to implement The Agency has conducted a number million, depending on the discount rate
through LRAs as a way of reducing the of analyses to ensure that this rule used. For those that adopt electronic
pieces of paper it had to manage in complies with the various statutory and reporting, EPA estimates a total
operating its electronic document administrative requirements that apply cumulative cost burden to state and
receiving system. While setting up the to EPA regulations. The results of the local governments under this rule, over
LRA relationships requires the analyses are summarized in this section. the period 2003 to 2012, ranging from
collection of affidavits and In the proposal, EPA estimated that $57.2 million to $65.2 million annually,
authorizations on paper, this involves the proposed rule could result in an depending on the discount rate used.
far fewer paper transactions than average annual reduction in burden of These costs result from the incremental
collecting the individual subscriber $52.3 million per year for those facilities burden to states to upgrade their
agreements from each person who signs reporting, $1.2 million per year for EPA, receiving systems to meet the rule’s
priority reports. However, only larger and $1.24 million for each of the 30 standards and apply for EPA approval of
companies or facilities with many states that were assumed to implement program modifications and revisions.
employees signing priority reports are programs over the eight years of the The model does not consider the
likely to be motivated and able to analysis. EPA received many comments potential cost savings to state and local
designate a company official as an LRA. on the costs associated with the governments resulting from processing
Although nothing in the rule prohibits proposed electronic reporting electronic submittals but believes the
third parties from serving as LRAs for provisions. Comments included savings would likely offset these
the smaller companies, a subscriber concerns about the proposal’s incremental costs. For facilities, EPA
agreement implementation will assumptions related to the number of estimates a total cumulative cost during
probably always involve accepting some affected entities, the number of this period ranging from $41.6 million
of these agreements directly from registered users per facility, the costs to to $51.9 million, depending on the
priority report signatories. What is state programs, and the costs of discount rate used. The net total
essential under § 3.2000(b)(5)(vii)(C) is implementing standard formats. Several cumulative cost of this rule, over the
that a subscriber agreement be available, commenters expressed support for the period 2003 to 2012, ranges from $34.4
as needed, to establish the identity of analysis findings, concurring that million to $41.7 million, depending on
the associated signature device owner. electronic reporting will reduce their the discount rate used.
C. General changes to methodology and ‘‘Baseline’’ scenario in which EPA VIII. Statutory and Executive Order
assumptions would enable electronic reporting Reviews
The research effort for the final rule through an approach other than A. Executive Order 12866
differed from that conducted for the CROMERR and a ‘‘To Be’’ scenario in
which EPA enables electronic reporting Pursuant to the terms of Executive
proposal in that it was much broader Order 12866 (58 FR 51735, October 4,
and involved far greater engagement under CROMERR. In comparing the
cumulative costs of this rule, EPA notes 1993), it has been determined that this
with external stakeholders. EPA used rule is a ‘‘significant regulatory action’’
this research to reevaluate assumptions that the ‘‘To Be’’ scenario would be a
more efficient approach than the because it raises novel legal or policy
made in the proposal and to refine the issues. As such, this action was
overall approach to the cost-benefit ‘‘Baseline’’ scenario. Under the
‘‘Baseline’’ scenario, EPA programs submitted to OMB for review. Changes
analysis. The process of reevaluating made in response to OMB suggestions or
costs to regulated entities included: would be left to implement their own
program-specific electronic reporting recommendations are documented in
• Analyzing the GPEA report to the public record.
determine the specific information requirements and electronic document
For EPA, the average annual cost to
collections identified as being suitable receiving systems. Also, under the
implement and operate electronic
for electronic reporting and their ‘‘Baseline’’ scenario, electronic reporting under this rule is estimated to
implementation schedule; reporting would be delayed, because be $60.94 million. The average annual
• Evaluating each information EPA would have to generate separate cost to implement and operate
collection request for an understanding rules and guidance to support program- electronic reporting in the absence of
of the types of activities that would be specific electronic document receiving this rule (i.e., where EPA implements
eliminated (such as mailing paper systems. Once these systems were electronic reporting on a program-
forms) or reduced (manual data quality established, reporting entities could specific basis) is estimated to be $70.36
checks) through electronic reporting; conceivably be required to register million for EPA. The average annual
• Interviewing trade associations, under different rules and through cost savings to EPA under this rule is
reviewing comments received, different systems across EPA programs. $8.42 million. The average annual cost
evaluating market trend research, and Based on the new research, EPA to states, tribes, and local governments
querying Envirofacts warehouse and revised assumptions about the costs in initially upgrading their electronic
Facility Registry System to establish an associated with authorized programs receiving systems and obtaining EPA
understanding of the numbers of and corresponding benefits to the approval for appropriate program
potential facility representatives that reporting entities. In contrast to the modification under the rule ranges from
would register for a particular program, proposal, EPA does not claim the costs roughly $5,000 to $460,000, depending
the rate of electronic reporting growth in associated in building electronic on the number of systems and extent of
a program, the number of facilities using document receiving systems for the upgrades needed. In addition, states,
web forms or file exchanges, and the authorized programs (state, tribe, and tribes, and local governments that
relative distribution of small to large local) or the benefits for their reporting upgrade their systems are expected to
businesses; and entities in using these systems. Since it incur system maintenance costs
• Establishing an understanding of is clear that authorized programs intend averaging about $10,000 annually.
the time required by facilities to register to proceed with electronic reporting on These costs reflect solely the
with CDX and maintain a CDX account, their own regardless of this rule, the incremental costs resulting from the
through interviews with CDX registered analyses for the final rule looks at the rule; they do not reflect the cost savings
users and the CDX hotline. incremental costs to electronic that states, tribes, and local governments
The process of reevaluating costs and document receiving systems that would will experience in implementing their
benefits to EPA, state, tribes, and local be developed absent this rule, in receiving systems. EPA has not
governments, included: quantified these savings as part of its
meeting the final rule’s requirements.
• Meeting with EPA programs and analysis. It should be noted that EPA
state program counterparts to identify Based on research and comments expects today’s rule to produce a net
the broad range of EPA authorized received on the proposal, EPA also cost savings for states, tribes, and local
programs and the types and number of revised the following key cost governments. However, it is not possible
agencies under each program; assumptions: to provide an adequate year-by-year
• Interviewing state and local • Increased costs for XML. EPA comparison of the costs of the two
agencies and their associations as substantially increased the cost estimate scenarios, because the Baseline Scenario
follow-up to public comment to obtain of integrating an XML format into a anticipates a more gradual process of
an understanding of their current facility’s environmental management EPA approval for state, tribe, and local
electronic reporting systems, long-term system (from $4,000 to $10,000). government electronic reporting
plans, and perceived impacts to their systems, starting at a later point in time.
• Increased number of registered
systems from this rule; The average annual cost to facilities to
• Evaluating current information users. EPA substantially increased the
submit electronic reports to EPA in
technology expenditures of CDX and number of registrants (from 3 registrant/
compliance with today’s rule ranges
other program system development facility to 6 registrants per facility) in
from $9 for those entities that choose
efforts, and general costs of EPA large companies that would use CDX.
simply to use a web browser to access
rulemakings with respect to federal • Broadened impacts of authorized CDX and fill out web forms, to $10,000
costs and benefits. programs. EPA substantially broadened per facility for those companies that
In preparing the CBA, EPA used a the number of state, tribe, and local wish to configure their environmental
computer model to estimate the annual environmental agencies potentially management systems to exchange data
costs to EPA, state and local impacted by the rule, to include health with CDX, using agreed-upon data
governments and regulated entities. To departments, county air boards, oil and exchange formats.
evaluate the costs and benefits of this gas agencies, and publicly-owned In addition to the monetary benefits
rule, two scenarios were modeled: a treatment works. identified by the analysis, EPA also
believes that there are many qualitative These checks can range from simple upgrading their electronic receiving
benefits that justify the initial costs verification of valid date formats, to systems and obtaining EPA program
associated with the rule. These benefits complex validations of proper modification approval depends on the
include: nomenclature and limits of chemicals amount of effort required to adhere to
• Responding to federal requirements, emitted into the environment. Improved the requirements of this rule. However,
such as GPEA, which, among other data quality will also help reduce the EPA estimates that for those states
things, requires federal agencies to time required for data correction and the deploying systems that meet rule
allow individuals or entities that deal effects of inaccurate reporting. standards, each state will incur a cost of
with the agencies the option to submit • Making data more readily available. about $12,000 in obtaining EPA
information or transact with the agency The process of creating, mailing, approval of its system. For a state where
electronically. This rule sets the legal receiving, entering, verifying, and upgrades to its systems are needed to
framework for most major EPA correcting paper reports consumes both meet rule requirements, the costs can
initiatives implementing electronic resources and time. This delays the range up to $460,000, depending on the
environmental data exchanges with the analysis of the data by EPA and size and complexity of its systems and
various stakeholders. authorized programs and its availability the extent of the upgrades needed.
• Maintaining consistency with to decision makers and the public. Maintenance costs for maintaining
emerging industry commercial • Provides the foundation for further compliance with this rule will cost each
practices. The implementation of process re-engineering. Moving data state about $10,000 annually. These
electronic government initiatives is a from a paper to an electronic system as costs include both capital costs required
reflection of the rapid evolution of early in the process as possible creates for hardware and software upgrades,
electronic commerce, which has the foundation on which many work- and labor costs incurred by state
occurred in industry since the flow re-engineering initiatives can be employees. EPA analyzed the most
expansion of the Internet and the World constructed. likely alternative scenario where, absent
Wide Web (WWW), in the early 1990s. this rule, EPA programs would
B. Executive Order 13132
In many ways, EPA and state, tribe, and implement rules that would require
local environmental agencies’ Executive Order 13132, entitled states to seek program modifications on
implementations of electronic reporting ‘‘Federalism’’ (64 FR 43255, August 10, a program by program basis. It should be
under today’s rule will be more 1999), requires EPA to develop an noted that these analyses do not
consistent with emerging practices and accountable process to ensure quantify the cost savings that states will
less burdensome to industry than paper ‘‘meaningful and timely input by state incur through offering electronic
reporting. and local officials in the development of reporting options to their reporting
• Providing sound environmental regulatory policies that have federalism entities. EPA believes these savings will
practice. Part of EPA’s mission is implications.’’ ‘‘Policies that have greatly outweigh the costs of complying
conserving environmental resources. federalism implications’’ are defined in with the rule. Based on these analyses,
The traditional paper-based reporting the Executive Order to include EPA believes that although the final rule
practices and processes consumes trees regulations that have ‘‘substantial direct imposes some compliance costs on state
and other resources for printing, effects on the states, on the relationship and local governments, the costs for
exchanging, reproducing, storing, and between the national government and most states are marginal and will result
retrieving grants, permits, compliance the states, or on the distribution of in net benefits over the most likely
reports, and supporting documents. power and responsibilities among the alternative scenario.
• Fostering more rapid environmental various levels of government.’’ Over the last several years, EPA has
compliance reporting. Organizations This final rule does not have provided substantial financial support
have become increasingly federalism implications. EPA has to states to assist in upgrades to
environmentally conscientious. This determined that the final rule will not information technology systems. For
change stems both from a desire to be have substantial direct effects on the example, in fiscal years 2002–2004, EPA
good corporate citizens and from fear of states, on the relationship between the provided approximately $65 million
negative media reporting. Hence, national government and the states, or dollars to states, tribes, and territories
organizations, especially large on the distribution of power and through grants to support their efforts to
companies, are becoming increasingly responsibilities among the various establish EIEN. EPA intends to award
interested in being able to demonstrate levels of government, as specified in additional grants for fiscal year 2005.
their environmental compliance. More Executive Order 13132. The final rule EPA’s fiscal year 2006 budget includes
rapid and accurate public posting of will not require states to accept $20 million for the EIEN Grant Program.
compliance data by environmental electronic reports. The effect of this rule States, tribes, and territories may apply
agencies is one way to help achieve this will be to provide an electronic for these grant funds to generally
goal. alternative to currently accepted upgrade their EIEN capabilities,
• Simplifying facility reporting. methods of receiving regulatory reports including improvements related to this
Electronic reporting and EPA’s planned on paper and to give the states the rule, e.g., to improve data validity and
implementation support a single point option of choosing to receive electronic user authentication procedures, as
of entry into agency systems, which will submissions in satisfaction of reporting required by today’s final rule.
enhance facilities’ ability to locate requirements under their authorized Although Section 6 of Executive
appropriate regulations, obtain programs or continuing to require Order 13132 does not apply to this rule,
information, ask questions, obtain submissions on paper. EPA has welcomed the active
forms, and submit data. Authorized states and local agencies participation of the states; on several
• Providing more accurate data. that choose to receive electronic reports separate occasions EPA has held
Replacing paper forms with electronic under this rule may incur expenses substantial consultations with state and
forms will result in more accurate data. initially in developing systems or local officials in developing this rule.
Systems incorporating electronic forms modifying existing systems to meet the State participation has resulted in
can perform real time edit checks that standards in this rule. The average changes to the final rule, including the
will reduce the number of input errors. annual cost to state agencies in section 3.1000 approval process and
special provisions such as deferred will take on average ten minutes to preparing and submitting the program
compliance for existing systems. register with CDX; however, if the modification application to EPA.
respondent contacts the CDX help desk Burden means the total time, effort, or
C. Paperwork Reduction Act financial resources expended by persons
for assistance with CDX registration, on
OMB has approved the information average the respondent will incur an to generate, maintain, retain, or disclose
collection requirements contained in additional six minutes. The average or provide information to or for a
this rule under the provisions of the annual number of respondents Federal agency. This includes the time
Paperwork Reduction Act (PRA), 44 registering with CDX is 19,434. It is needed to review instructions; develop,
U.S.C. 3501 et seq. and has assigned further expected that 201,331 acquire, install, and utilize technology
OMB control number 2025–0003. respondents will report electronically to and systems for the purposes of
The ICR for this rule covers the a state, tribe, or local government collecting, validating, and verifying
registration information, which will be receiving system. Respondents reporting information, processing and
collected from individuals wishing to to EPA or state, tribe, or local maintaining information, and disclosing
submit electronic reports to EPA on governments may also incur an and providing information; adjust the
behalf of regulated facilities. The additional burden of 20 minutes to existing ways to comply with any
information will be used to establish the prepare, sign, and submit an electronic previously applicable instructions and
identity of that individual and the signature agreement. The average requirements; train personnel to be able
regulated entity he or she represents. annual number of these respondents is to respond to a collection of
This information will be used by EPA to 177,009. In addition, the ICR estimates information; search data sources;
register and provide individuals with that 7,293 medium-sized and large complete and review the collection of
the ability to access the EPA’s electronic companies will register local information; and transmit or otherwise
document receiving system, CDX. In registration authorities (LRA) and incur disclose the information.
appropriate circumstances this an additional burden of 1 hour. This An agency may not conduct or
information will also be used to issue an includes the time to prepare and submit sponsor, and a person is not required to
electronic signature to the registered LRA designation applications, collect respond to a collection of information
individual. The ICR also covers and store subscriber agreements, and unless it displays a currently valid OMB
activities incidental to electronic prepare and submit certification of control number. The OMB control
reporting (e.g., submittal of an electronic receipt and secure storage. numbers for EPA’s regulations are listed
signature agreement to EPA as Finally, it is expected that a state, in 40 CFR part 9 and 48 CFR chapter 15.
applicable). It should be noted that the tribe, or local government would take In addition, EPA is amending the table
submission of environmental reports in between 210 and 330 hours to prepare in 40 CFR part 9 of currently approved
an electronic format to EPA and states, and submit its program modification OMB control numbers for various
tribes, and local governments is application to EPA. The average annual regulations to list the regulatory
voluntary for most examples of number of states applying to EPA is citations for the information
electronic reporting, and viewed as a expected to be 15; the average annual requirements contained in this final
service that EPA and its regulatory number of tribes and local governments rule.
partners are providing to the regulated applying to EPA is expected to be 46. In
community. The rule allows reporting D. Regulatory Flexibility Act
addition, the ICR estimates $4,450,658
entities to submit reports and other in annual capital/start-up costs for The Regulatory Flexibility Act (RFA),
information electronically, thereby states, tribes and local governments to 5 U.S.C. 601 et seq., generally requires
streamlining and expediting the process upgrade their receiving systems. The an agency to prepare a regulatory
for reporting. However, it should also be ICR estimates $663,975 in annual flexibility analysis of any rule subject to
understood that this rule does set forth operation and maintenance costs. This notice and comment rulemaking
requirements for regulated entities that includes costs to registrants and state, requirements under the Administrative
submit electronic reports directly to tribes and local governments in Procedure Act or any other statute
EPA and for states, tribes, and local submitting information to EPA. unless the agency certifies that the rule
governments that choose to implement will not have a significant economic
electronic reporting under their Public Burden Statement impact on a substantial number of small
authorized programs. EPA is issuing this The public reporting burden is entities. Small entities include small
rule on cross-media electronic reporting, estimated to be 10 minutes for an businesses, small organizations, and
in part, under the authority of GPEA, individual that reports electronically to small governmental jurisdictions.
Public Law 105–277, which amends the the CDX. This includes time for For the purpose of assessing the
PRA. preparing the on-line application and impacts of today’s rule on small entities,
In addition, the ICR covers state, tribe, calling the CDX help desk. small entity is defined as: (1) Small
and local government activities The public reporting burden in this business as defined by the RFA and
involved in upgrading their electronic ICR is estimated to be 15 minutes for an based on Small Business Administration
receiving systems to satisfy the individual that prepares and submits a (SBA) size standards; (2) a small
standards in the rule and in applying to subscriber agreement. governmental jurisdiction that is a
EPA for approval of program The public reporting burden is government of a city, county, town,
modification. States, tribes, and local estimated to be 30 minutes for a local school district, or special district with a
governments will undertake these registration authority. This includes population of less then 50,000; and (3)
activities only if they intend to collect time for preparing and submitting the a small organization that is any not-for-
information electronically under an EPA certification of receipt and secure profit enterprise which is independently
authorized program. storage to EPA or state/local agency. owned and operated and is not
The total annual reporting and The public reporting burden is dominant in its field.
recordkeeping burden this ICR estimates estimated to range from 210 hours for a After considering the economic
is 151,963 hours, which includes the local government to 330 hours for a state impacts of today’s final rule on small
tasks described above. It is expected that seeking to implement an electronic entities, the Agency certifies, pursuant
a respondent reporting directly to EPA receiving system. This includes time for to section 605(b) of the RFA, that this
action will not have a significant government jurisdictions possibly Before EPA establishes any regulatory
economic impact on a substantial subject to the rule are those with requirements that may significantly or
number of small entities. Courts have Publicly-Owned Treatment Works uniquely affect small governments,
interpreted the RFA to require a (POTWs). Only POTWs choosing to including tribes, it must have developed
regulatory flexibility analysis only when deploy electronic document receiving under section 203 of UMRA a small-
small entities will be subject to the systems would be subject to today’s government agency plan. The plan must
requirements of the rule. See Motor and rule. Through analysis and direct provide for notifying potentially
Equip. Mfrs. Ass’n v. Nichols, 142 F.3d discussions with municipal POTWs and affected small governments, enabling
449 (D.C. Cir. 1998); United Distribution trade associations, EPA did not identify officials of affected small governments
Cos. v. FERC, 88 F.3d 1105, 1170 (D.C. any such small government jurisdictions to have meaningful and timely input
Cir. 1996); Mid-Tex Elec. Co-op, Inc. v. planning to deploy electronic reporting into the development of EPA regulatory
FERC, 773 F.2d 327, 342 (D.C. Cir. 1985) systems. proposals with significant Federal
(agency’s certification need only Although not required by the RFA, intergovernmental mandates. The plan
consider the rule’s impact on entities (See Michigan v. EPA, 213 F.3d 663, must also provide for informing,
subject to the rule). This final rule 668–69 (D.C. Cir., 2000), cert. den. 121 educating, and advising small
would not establish any new direct S.Ct. 225, 149 L.Ed.2d 135 (2001)), as a governments on compliance with the
requirements applicable to small part of the analysis prepared under regulatory requirements.
entities. States that are directly Executive Order 12866, EPA also As described in section VIII.D. of this
regulated in this rulemaking are not considered the costs to small entities Preamble, above, EPA also evaluated the
small entities. that are indirect reporters to authorized possible impacts of this rule to small
This rule provides for EPA review and state, tribal, and local government governments. In particular, EPA was
approval of authorized state, tribe, and programs. For this final rule, EPA concerned that small governments could
local government programs that decide prepared a cost/benefit analysis to potentially be subject to the provisions
to provide for electronic reporting. This assess the economic impact of of § 3.1000, which would require these
rule includes performance standards CROMERR, which can be found in the programs to seek EPA approval for the
against which a state’s, tribe’s, or local docket for this rule. electronic document receiving systems.
government’s electronic document Although this rule will not have a EPA reviewed its programs, and also
receiving system will be evaluated significant economic impact on a conducted follow-up to comments from
before EPA will approve changes to the substantial number of small entities, the industry, state, and local government
delegated, authorized, or approved Agency nonetheless consulted with associations to determine possible
program to provide electronic reporting, small entities as well as organizations impacts to small local governments. As
and establishes a streamlined process such as the Small Business a result of this review, EPA concluded
that states, tribes, and local governments Administration (SBA). We made several that small local governments would not
can use to seek and obtain such changes to the rule based upon these be adversely impacted by the provisions
approvals. The rule also includes discussions. of § 3.1000 this rule.
special provisions for existing state The Agency has determined that this
E. Unfunded Mandates Reform Act
electronic reporting systems in place at rule does not contain a Federal mandate
the time of publication of this rule. Title II of the Unfunded Mandates that may result in expenditures of $100
Currently, entities that choose to Reform Act of 1995 (UMRA), Public million or more for states, tribes, and
submit electronic documents directly to Law 104–4, establishes requirements for local governments, in the aggregate, or
EPA submit documents to a centralized federal agencies to assess the effects of the private sector in any one year. Thus,
Agency-wide electronic document- their regulatory actions on states, tribes, today’s rule is not subject to the
receiving system, called the CDX, or to and local governments and the private requirements in sections 202 and 205 of
alternative systems designated by the sector. Under section 202 of UMRA, UMRA. The Agency has determined that
Administrator. This rule does not EPA must prepare a written statement, this rule contains no regulatory
change those systems. In addition, including a cost-benefit analysis, for requirements that might significantly or
today’s rule, does not require the proposed and final rules with ‘‘Federal uniquely affect small governments and
submission of electronic documents in mandates’’ that may result in thus this rule is not subject to the
lieu of paper documents. expenditures to states, tribes, and local requirements in section 202 of UMRA.
Because there is no requirement to governments, in the aggregate, or to the
adopt electronic reporting, EPA has private sector, of $100 million or more F. National Technology Transfer and
determined that small local in any one year. Before promulgating a Advancement Act
governments will not be directly rule for which a written statement is Section 12(d) of the National
impacted by this rule. Nonetheless, EPA needed, section 205 of the UMRA Technology Transfer and Advancement
also considered the possible impacts of generally requires EPA to identify and Act of 1995 (NTTAA), Public Law 104–
this rule to determine whether small consider a reasonable number of 113, section 12(d) (15 U.S.C. 272 note)
local governments could potentially be regulatory alternatives and adopt the directs EPA to use voluntary consensus
subject to the provisions of § 3.1000, least costly, most cost-effective or least standards in its regulatory activities
which would require these programs to burdensome alternative that achieves unless to do so would be inconsistent
seek EPA approval for their electronic the objectives of the rule. The with applicable law or otherwise
document receiving systems if they provisions of section 205 do not apply impractical. Voluntary consensus
choose to provide electronic reporting. when they are inconsistent with standards are technical standards (e.g.,
EPA reviewed its programs and applicable law. Moreover, section 205 materials specifications, test methods,
conducted follow-up to comments allows EPA to adopt an alternative other sampling procedures, and business
received from industry, state, and local than the least costly, most cost-effective practices) that are developed or adopted
government associations to determine or least burdensome alternative if the by voluntary consensus standards
possible impacts to small local Administrator publishes with the final bodies. The NTTAA directs EPA to
jurisdictions. Based on its review, EPA rule an explanation why that alternative provide Congress, through OMB, with
concluded that the only small was not adopted. explanations when the Agency decides
not to use available and applicable event, today’s rule is compatible with Indian tribes by giving them the
voluntary consensus standards. any of these current standards-based opportunity to submit electronic reports
The consensus standards relevant to approaches to electronic reporting, but to EPA in satisfaction of EPA reporting
an electronic reporting rule are the rule itself does not set requirements requirements and by allowing them to
primarily technical standards that at the level of detail that such standards implement electronic reporting under
specify file formats for the electronic address. their authorized programs.
exchange of data, telecommunications
network protocols, and electronic G. Executive Order 13045 I. Executive Order 13211 (Energy
signature technologies and formats. EPA Executive Order 13045, Protection of Effects)
is not setting requirements for electronic Children from Environmental Health This rule is not a ‘‘significant energy
reporting at the level of specificity Risks and Safety Risks (62 FR 19885, action’’ as defined in Executive Order
addressed by such formats, protocols April 23, 1997) applies to any rule that 13211, ‘‘Actions Concerning Regulations
and technologies, so consensus EPA determines (1) ‘‘economically That Significantly Affect Energy Supply,
standards are not directly applicable to significant’’ as defined under Executive Distribution, or Use’’ (66 FR 28355, May
today’s rule. For example, the final rule Order 12866 and (2) concerns an 22, 2001) because it is not likely to have
does not stipulate data exchange environmental health or safety risk that a significant adverse affect on the
formats, does not specify electronic EPA has reason to believe may have a supply, distribution, or use of energy.
signature technologies, and does not disproportionate effect on children. EPA EPA has concluded that this rule is not
address telecommunications issues. At interprets Executive Order 13045 as likely to have any adverse energy
the same time, there is nothing in encompassing only those regulatory effects.
today’s rule that is incompatible with actions that are risk-based or health-
these standards, and in implementing based, such that the analysis required J. Congressional Review Act
electronic reporting under this rule EPA under Section 5–501 of the Executive The Congressional Review Act, 5
is adopting standards-based approaches Order has the potential to influence the U.S.C. 801 et seq., as added by the Small
to electronic data exchange. regulation. Business Regulatory Enforcement
In the preamble to the proposed rule, This rule is not subject to Executive Fairness Act of 1996, generally provides
EPA described its initial plans to Order 13045 because it is not an that before a rule may take effect, the
implement a number of standards-based economically significant action as agency promulgating the rule must
approaches to electronic reporting, defined by Executive Order 12866 and submit a rule report, which includes a
including electronic data exchange it does not involve decisions regarding copy of the rule, to each House of the
formats based upon the ANSI environmental health or safety risks. Congress and to the Comptroller General
Accredited Standards Committee’s This rule contains general performance of the United States. EPA will submit a
(ASC) X12 for Electronic Data standards for the submission of report containing this rule and other
Interchange or EDI. That preamble also environmental data electronically. required information to the U.S. Senate,
discussed EPA’s interest in exploring H. Executive Order 13175 the U.S. House of Representatives, and
the use of Internet data exchange the Comptroller General of the United
formats based on XML, then under Executive Order 13175, entitled,
‘‘Consultation and Coordination with States prior to publication of the rule in
development by the World Wide Web the Federal Register. A major rule
Consortium (W3C). As a part of the Indian Tribal Governments’’ (65 FR
67249, November 6, 2000), requires EPA cannot take effect until 60 days after it
preamble discussion, EPA solicited is published in the Federal Register.
comment on these planned standards- to develop an accountable process to
ensure ‘‘meaningful and timely input by This action is not a ‘‘major rule’’ as
based electronic reporting defined by 5 U.S.C. 804(2). This rule
implementations. In response, EPA tribal officials in the development of
regulatory policies that have tribal will become effective on January 11,
received considerable feedback both 2006.
from states and from industry indicating implications.’’ ‘‘Policies that have tribal
a trend in the direction of XML, and implications’’ are defined in the List of Subjects
away from the deployment of ANSI ASC Executive Order to include regulations
that have ‘‘substantial direct effects on 40 CFR Part 3
X12 standards. In any event, CDX now
looks to XML to provide the formats for one or more Indian tribes, on the Environmental protection, Conflict of
its Internet data exchanges. EPA relationship between the Federal interests, Electronic records, Electronic
currently supports multi-agency Government and the Indian tribes, or on reporting requirements, Electronic
Integrated Project Teams to develop the distribution of power and reports, Intergovernmental relations.
XML formats and intends to use responsibilities between the Federal
40 CFR Part 9
standardized formats for this purpose to Government and Indian tribes.’’
the extent that they are available. In This rule does not have tribal Environmental protection, Electronic
addition, EPA currently registers XML implications, as specified in Executive records, Electronic reporting
formats in its System of Registries to Order 13175, and therefore consultation requirements, Electronic reports,
facilitate easy access to these formats for under the Order is not required. It will Intergovernmental relations, Reporting
partners wishing to exchange data. EPA not have substantial direct effects on and recordkeeping requirements.
is attempting to make use of applicable tribes, on the relationship between the
federal government and Indian tribes, or 40 CFR Part 51
standards-setting work being done by
several organizations, including the on the distribution of power and Environmental protection,
Electronic Business XML (ebXML), the responsibilities between the federal Administrative practice and procedure,
Organization for the Advancement of government and Indian tribes, as Air pollution control, Carbon monoxide,
Structured Information Standards specified in Executive Order 13175. Electronic records, Electronic reporting
(OASIS), and, internationally, the This action does not require Indian requirements, Electronic reports,
United Nation’s Center for tribes to accept electronic reports. The Intergovernmental relations, Lead,
Administration, Commerce, and effect of this rule is to provide Nitrogen dioxide, Ozone, Particulate
Transport (UN/CEFACT) Forum. In any additional regulatory flexibility to matter, Reporting and recordkeeping
requirements, Sulfur oxides, Volatile Hazardous substances, Indians-lands, Reporting and recordkeeping
organic compounds. Intergovernmental relations, Penalties, requirements, Water pollution control,
Reporting and recordkeeping Water supply.
40 CFR Part 60
requirements, Water pollution control.
Environmental protection, 40 CFR Part 281
Administrative practice and procedure, 40 CFR Part 142 Environmental protection,
Air pollution control, Aluminum, Environmental protection, Administrative practice and procedure,
Ammonium sulfate plants, Batteries, Administrative practice and procedure, Electronic records, Electronic reporting
Beverages, Carbon monoxide, Cement Chemicals, Electronic records, requirements, Electronic reports,
industry, Coal, Copper, Dry cleaners, Electronic reporting requirements, Hazardous substances, Insurance,
Electric power plants, Electronic Electronic reports, Indians-lands, Intergovernmental relations, Oil
records, Electronic reporting Intergovernmental relations, Radiation pollution, Reporting and recordkeeping
requirements, Electronic reports, protection, Reporting and recordkeeping requirements, Surety bonds, Water
Fertilizers, Fluoride, Gasoline, Glass requirements, Water supply. pollution control, Water supply.
and glass products, Grains, Graphic arts 40 CFR Part 403
40 CFR Part 145
industry, Heaters, Household
appliances, Insulation, Environmental protection, Environmental protection,
Intergovernmental relations, Iron, Confidential business information, Confidential business information,
Labeling, Lead, Lime, Metallic and Electronic records, Electronic reporting Electronic records, Electronic reporting
nonmetallic mineral processing plants, requirements, Electronic reports, requirements, Electronic reports,
Metals, Motor vehicles, Natural gas, Indians-lands, Intergovernmental Intergovernmental relations, Reporting
Nitric acid plants, Nitrogen dioxide, relations, Penalties, Reporting and and recordkeeping requirements, Waste
Paper and paper products industry, recordkeeping requirements, Water treatment and disposal, Water pollution
Particulate matter, Paving and roofing supply. control.
materials, Petroleum, Phosphate, 40 CFR Part 162 40 CFR Part 501
Plastics materials and synthetics, Environmental protection,
Polymers, Reporting and recordkeeping Environmental protection,
Administrative practice and procedure, Administrative practice and procedure,
requirements, Sewage disposal, Steel, Electronic records, Electronic reporting
Sulfur oxides, Sulfuric acid plants, Electronic records, Electronic reporting
requirements, Electronic reports, requirements, Electronic reports,
Tires, Urethane, Vinyl, Volatile organic Intergovernmental relations, Penalties,
compounds, Waste treatment and Intergovernmental relations, Pesticides
Reporting and recordkeeping
disposal, Zinc. and pests, Reporting and recordkeeping
requirements, Sewage disposal.
requirements, State registration of
40 CFR Part 63 pesticide products. 40 CFR Part 745
Environmental protection, Air 40 CFR Part 233 Environmental protection, Electronic
pollution control, Electronic records, records, Electronic reporting
Electronic reporting requirements, Environmental protection, requirements, Electronic reports,
Electronic reports, Hazardous Administrative practice and procedure, Intergovernmental relations, Hazardous
substances, Intergovernmental relations, Electronic records, Electronic reporting substances, Lead poisoning, Reporting
Reporting and recordkeeping requirements, Electronic reports, and recordkeeping requirements.
requirements. Intergovernmental relations, Penalties,
Reporting and recordkeeping 40 CFR Part 763
40 CFR Part 69 requirements, Water pollution control. Environmental protection,
Environmental protection, Air 40 CFR Part 257 Administrative practice and procedure,
pollution control, Electronic records, Asbestos, Electronic records, Electronic
Electronic reporting requirements, Environmental protection, Electronic reporting requirements, Electronic
Electronic reports, Guam, records, Electronic reporting reports, Hazardous substances, Imports,
Intergovernmental relations. requirements, Electronic reports, Intergovernmental relations, Reporting
Intergovernmental relations, Waste and recordkeeping requirements.
40 CFR Part 70 treatment and disposal.
Dated: September 22, 2005.
Environmental protection,
40 CFR Part 258 Stephen L. Johnson,
Administrative practice and procedure,
Electronic records, Electronic reporting Environmental protection, Electronic Administrator.
requirements, Electronic reports, records, Electronic reporting ■ Therefore, Title 40 Chapter I of the
Intergovernmental relations. requirements, Electronic reports, Code of Federal Regulations is amended
Intergovernmental relations, Reporting by adding a new Part 3, and amending
40 CFR Part 71 and recordkeeping requirements, Waste parts 9, 51, 60, 63, 69, 70, 71, 123, 142,
Environmental protection, treatment and disposal, Water pollution 145, 162, 233, 257, 258, 271, 281, 403,
Administrative practice and procedure, control. 501, 745, and 763 to read as follows:
Electronic records, Electronic reporting
40 CFR Part 271 PART 3—CROSS-MEDIA ELECTRONIC
requirements, Electronic reports,
Intergovernmental relations. Environmental protection, REPORTING
Administrative practice and procedure, Subpart A—General Provisions
40 CFR Part 123 Confidential business information,
Environmental protection, Electronic records, Electronic reporting Sec.
3.1 Who does this part apply to?
Administrative practice and procedure, requirements, Electronic reports, 3.2 How does this part provide for
Confidential business information, Hazardous materials transportation, electronic reporting?
Electronic records, Electronic reporting Hazardous waste, Indians-lands, 3.3 What definitions are applicable to this
requirements, Electronic reports, Intergovernmental relations, Penalties, part?
3.4 How does this part affect enforcement (2) EPA has first published a notice in Authorized program means a Federal
and compliance provisions of Title 40? the Federal Register announcing that program that EPA has delegated,
Subpart B—Electronic Reporting to EPA EPA is prepared to receive, in electronic authorized, or approved a state, tribe, or
3.10 What are the requirements for form, documents required or permitted local government to administer, or a
electronic reporting to EPA? by the identified part or subpart of Title program that EPA has delegated,
3.20 How will EPA provide notice of 40. authorized, or approved a state, tribe or
changes to the Central Data Exchange? (b) Electronic reporting under an EPA- local government to administer in lieu
authorized state, tribe, or local program. of a Federal program, under other
Subpart C—[Reserved]
(1) An authorized program may allow provisions of Title 40 and such
Subpart D—Electronic Reporting under any document submission requirement delegation, authorization, or approval
EPA-Authorized State, Tribe, and Local under that program to be satisfied with has not been withdrawn or expired.
Programs an electronic document provided that Central Data Exchange means EPA’s
3.1000 How does a state, tribe, or local the state, tribe, or local government centralized electronic document
government revise or modify its seeks and obtains revision or receiving system, or its successors,
authorized program to allow electronic modification of that program in
reporting?
including associated instructions for
accordance with § 3.1000 and also meets submitting electronic documents.
3.2000 What are the requirements
authorized state, tribe, and local the requirements of § 3.2000 for such Chief Information Officer means the
programs’ reporting systems must meet? electronic reporting. EPA official assigned the functions
(2) A state, tribe, or local government described in section 5125 of the Clinger
Authority: 7 U.S.C. 136 to 136y; 15 U.S.C. that is applying for initial delegation,
2601 to 2692; 33 U.S.C. 1251 to 1387; 33 Cohen Act (Pub. L. 104–106).
U.S.C. 1401 to 1445; 33 U.S.C. 2701 to 2761; authorization, or approval to administer Copy of record means a true and
42 U.S.C. 300f to 300j–26; 42 U.S.C. 4852d; a federal program or a program in lieu correct copy of an electronic document
42 U.S.C. 6901–6992k; 42 U.S.C. 7401 to of the federal program, and that will received by an electronic document
7671q; 42 U.S.C. 9601 to 9675; 42 U.S.C. allow document submission receiving system, which copy can be
11001 to 11050; 15 U.S.C. 7001; 44 U.S.C. requirements under the program to be viewed in a human-readable format that
3504 to 3506. satisfied with an electronic document, clearly and accurately associates all the
must use the procedures for obtaining information provided in the electronic
Subpart A—General Provisions delegation, authorization, or approval document with descriptions or labeling
§ 3.1 Who does this part apply to? under the relevant part of Title 40 and of the information. A copy of record
(a) This part applies to: may not use the procedures set forth in includes:
(1) Persons who submit reports or § 3.1000; but the application must (1) All electronic signatures contained
other documents to EPA to satisfy contain the information required by in or logically associated with that
requirements under Title 40 of the Code § 3.1000(b)(1) and the state, tribe, or document;
of Federal Regulations (CFR); and local government must meet the (2) The date and time of receipt; and
(2) States, tribes, and local requirements of § 3.2000. (3) Any other information used to
governments administering or seeking to (c) Limitations. This part does not record the meaning of the document or
administer authorized programs under require submission of electronic the circumstances of its receipt.
Title 40 of the CFR. documents in lieu of paper. This part Disinterested individual means an
(b) This part does not apply to: confers no right or privilege to submit individual who is not connected with
(1) Documents submitted via facsimile data electronically and does not obligate the person in whose name the electronic
in satisfaction of reporting requirements EPA, states, tribes, or local governments signature device is issued. A
as permitted under other parts of Title to accept electronic documents. disinterested individual is not any of the
40 or under authorized programs; or following: The person’s employer or
(2) Electronic documents submitted § 3.3 What definitions are applicable to
this part? employer’s corporate parent, subsidiary,
via magnetic or optical media such as or affiliate; the person’s contracting
diskette, compact disc, digital video The definitions set forth in this
section apply when used in this part. agent; member of the person’s
disc, or tape in satisfaction of reporting household; or relative with whom the
requirements, as permitted under other Acknowledgment means a
confirmation of electronic document person has a personal relationship.
parts of Title 40 or under authorized Electronic document means any
programs. receipt.
Administrator means the information in digital form that is
(c) This part does not apply to any
Administrator of the EPA. conveyed to an agency or third-party,
data transfers between EPA and states,
Agency means the EPA or a state, where ‘‘information’’ may include data,
tribes, or local governments as a part of
tribe, or local government that text, sounds, codes, computer programs,
their authorized programs or as a part of
administers or seeks to administer an software, or databases. ‘‘Data,’’ in this
administrative arrangements between
authorized program. context, refers to a delimited set of data
states, tribes, or local governments and
Agreement collection certification elements, each of which consists of a
EPA to share data.
means a signed statement by which a content or value together with an
§ 3.2 How does this part provide for local registration authority certifies that understanding of what the content or
electronic reporting? a subscriber agreement has been value means; where the electronic
(a) Electronic reporting to EPA. Except received from a registrant; the document includes data, this
as provided in § 3.1(b), any person who agreement has been stored in a manner understanding of what the data element
is required under Title 40 to create and that prevents unauthorized access to content or value means must be
submit or otherwise provide a document these agreements by anyone other than explicitly included in the electronic
to EPA may satisfy this requirement the local registration authority; and the document itself or else be readily
with an electronic document, in lieu of local registration authority has no basis available to the electronic document
a paper document, provided that: to believe that any of the collected recipient.
(1) He or she satisfies the agreements have been tampered with or Electronic document receiving system
requirements of § 3.10; and prematurely destroyed. means any set of apparatus, procedures,
software, records, or documentation permanent form, where ‘‘a writing’’ other penalties or remedies for failure to
used to receive electronic documents. means any intentional recording of comply with a State, tribe, or local
Electronic signature means any words in a visual form, whether in the reporting requirement if the person
information in digital form that is form of handwriting, printing, submits an electronic document to a
included in or logically associated with typewriting, or any other tangible form. State, tribe, or local government under
an electronic document for the purpose The physical instance of the scripted an authorized program and fails to
of expressing the same meaning and name or mark so created constitutes the comply with the applicable provisions
intention as would a handwritten handwritten signature. The scripted for electronic reporting.
signature if affixed to an equivalent name or legal mark, while (c) Where an electronic document
paper document with the same conventionally applied to paper, may submitted to satisfy a federal or
reference to the same content. The also be applied to other media. authorized program reporting
electronic document bears or has on it Information or objects of independent requirement bears an electronic
an electronic signature where it origin means data or items that originate signature, the electronic signature
includes or has logically associated with from a disinterested individual or are legally binds, obligates, and makes the
it such information. forensic evidence of a unique, signatory responsible, to the same extent
Electronic signature agreement means immutable trait which is (and may at as the signatory’s handwritten signature
an agreement signed by an individual any time be) attributed to the individual would on a paper document submitted
with respect to an electronic signature in whose name the device is issued. to satisfy the same federal or authorized
device that the individual will use to Local registration authority means an program reporting requirement.
create his or her electronic signatures individual who is authorized by a state, (d) Proof that a particular signature
requiring such individual to protect the tribe, or local government to issue an device was used to create an electronic
electronic signature device from agreement collection certification, signature will suffice to establish that
compromise; to promptly report to the whose identity has been established by the individual uniquely entitled to use
agency or agencies relying on the notarized affidavit, and who is the device did so with the intent to sign
electronic signatures created any authorized in writing by a regulated the electronic document and give it
evidence discovered that the device has entity to issue agreement collection effect.
been compromised; and to be held as certifications on its behalf. (e) Nothing in this part limits the use
legally bound, obligated, or responsible Priority reports means the reports of electronic documents or information
by the electronic signatures created as listed in Appendix 1 to part 3. derived from electronic documents as
by a handwritten signature. Subscriber agreement means an evidence in enforcement or other
Electronic signature device means a electronic signature agreement signed proceedings.
code or other mechanism that is used to by an individual with a handwritten
create electronic signatures. Where the Subpart B—Electronic Reporting to
signature. This agreement must be
device is used to create an individual’s EPA
stored until five years after the
electronic signature, then the code or associated electronic signature device § 3.10 What are the requirements for
mechanism must be unique to that has been deactivated. electronic reporting to EPA?
individual at the time the signature is Transmit means to successfully and (a) A person may use an electronic
created and he or she must be uniquely accurately convey an electronic document to satisfy a federal reporting
entitled to use it. The device is document so that it is received by the requirement or otherwise substitute for
compromised if the code or mechanism intended recipient in a format that can a paper document or submission
is available for use by any other person. be processed by the electronic permitted or required under other
EPA means the United States document receiving system. provisions of Title 40 only if:
Environmental Protection Agency. Valid electronic signature means an (1) The person transmits the
Existing electronic document electronic signature on an electronic electronic document to EPA’s Central
receiving system means an electronic document that has been created with an Data Exchange, or to another EPA
document receiving system that is being electronic signature device that the electronic document receiving system
used to receive electronic documents in identified signatory is uniquely entitled that the Administrator may designate for
lieu of paper to satisfy requirements to use for signing that document, where the receipt of specified submissions,
under an authorized program on this device has not been compromised, complying with the system’s
October 13, 2005 or the system, if not and where the signatory is an individual requirements for submission; and
in use, has been substantially developed who is authorized to sign the document (2) The electronic document bears all
on or before that date as evidenced by by virtue of his or her legal status and/ valid electronic signatures that are
the establishment of system services or or his or her relationship to the entity required under paragraph (b) of this
specifications by contract or other on whose behalf the signature is section.
binding agreement. executed. (b) An electronic document must bear
Federal program means any program the valid electronic signature of a
administered by EPA under any other § 3.4 How does this part affect signatory if that signatory would be
provision of Title 40. enforcement and compliance provisions of required under Title 40 to sign the paper
Federal reporting requirement means Title 40?
document for which the electronic
a requirement to report information (a) A person is subject to any document substitutes, unless EPA
directly to EPA under any other applicable federal civil, criminal, or announces special provisions to accept
provision of Title 40. other penalties and remedies for failure a handwritten signature on a separate
Handwritten signature means the to comply with a federal reporting paper submission and the signatory
scripted name or legal mark of an requirement if the person submits an provides that handwritten signature.
individual, handwritten by that electronic document to EPA under this
individual with a marking-or writing- part that fails to comply with the § 3.20 How will EPA provide notice of
instrument such as a pen or stylus and provisions of § 3.10. changes to the Central Data Exchange?
executed or adopted with the present (b) A person is subject to any (a) Except as provided under
intention to authenticate a writing in a applicable federal civil, criminal, or paragraph (b) of this section, whenever
EPA plans to change Central Data (2) Programs planning to receive to the Administrator that includes the
Exchange hardware or software in ways electronic documents under an following elements:
that would affect the transmission authorized program: A state, tribe, or (i) A certification that the state, tribe,
process, EPA will provide notice as local government that does not have an or local government has sufficient legal
follows: existing electronic document receiving authority provided by lawfully enacted
(1) Significant changes to CDX: Where system for an authorized program must or promulgated statutes or regulations
the equipment, software, or services receive EPA approval of revisions or that are in full force and effect on the
needed to transmit electronic modifications to such program in date of the certification to implement
documents to the Central Data Exchange compliance with paragraph (a)(1) of this the electronic reporting component of
would be changed significantly, EPA section before the program may receive its authorized programs covered by the
will provide public notice and seek electronic documents in lieu of paper application in conformance with
comment on the change and the documents to satisfy program § 3.2000 and to enforce the affected
proposed implementation schedule requirements. programs using electronic documents
through the Federal Register; (3) Programs already receiving collected under these programs, together
(2) Other changes to CDX: EPA will electronic documents under an with copies of the relevant statutes and
provide notice of other changes to authorized program: A state, tribe, or regulations, signed by the State Attorney
Central Data Exchange users at least local government with an existing General or his or her designee, or, in the
sixty (60) days in advance of electronic document receiving system case of an authorized tribe or local
implementation. for an authorized program must submit government program, by the chief
(3) De minimis or transparent changes an application to revise or modify such executive or administrative official or
to CDX: For de minimis or transparent authorized program in compliance with officer of the governmental entity, or his
changes that have minimal or no impact paragraph (a)(1) of this section no later or her designee;
on the transmission process, EPA may than October 13, 2007. On a case-by- (ii) A listing of all the state, tribe, or
provide notice if appropriate on a case- case basis, this deadline may be local government electronic document
by-case basis. extended by the Administrator, upon receiving systems to accept the
(b) Emergency changes to CDX: Any request of the state, tribe, or local electronic documents being addressed
change which EPA’s Chief Information government, where the Administrator by the program revisions or
Officer or his or her designee determines that the state, tribe, or local modifications that are covered by the
determines is needed to ensure the government needs additional time to application, together with a description
security and integrity of the Central Data make legislative or regulatory changes to for each such system that specifies how
Exchange is exempt from the provisions meet the requirements of this part. the system meets the applicable
of paragraph (a) of this section. (4) Programs with approved electronic requirements in § 3.2000 with respect to
However, to the extent consistent with document receiving systems: An those electronic documents;
ensuring the security and integrity of authorized program that has EPA’s (iii) A schedule of upgrades for the
the system, EPA will provide notice for approval to accept electronic documents electronic document receiving systems
any change other than de minimis or in lieu of paper documents must keep listed under paragraph (b)(1)(ii) of this
transparent changes to the Central Data EPA apprised of those changes to laws, section that have the potential to affect
Exchange. policies, or the electronic document the program’s continued conformance
receiving systems that have the with § 3.2000; and
Subpart C—[Reserved] potential to affect program compliance (iv) Other information that the
with § 3.2000. Where the Administrator Administrator may request to fully
Subpart D—Electronic Reporting determines that such changes require evaluate the application.
Under EPA-Authorized State, Tribe, EPA review and approval, EPA may (2) A state, tribe, or local government
and Local Programs request that the state, tribe, or local that revises or modifies more than one
government submit an application for authorized program for receipt of
§ 3.1000 How does a state, tribe, or local program revision or modification; electronic documents in lieu of paper
government revise or modify its authorized additionally, a state, tribe, or local documents may submit a consolidated
program to allow electronic reporting? government on its own initiative may application under this section covering
(a) A state, tribe, or local government submit an application for program more than one authorized program,
that receives or plans to begin receiving revision or modification respecting their provided the consolidated application
electronic documents in lieu of paper receipt of electronic documents. Such complies with paragraph (b)(1) of this
documents to satisfy requirements applications must comply with section for each authorized program.
under an authorized program must paragraph (a)(1) of this section. (3)(i) Within 75 calendar days of
revise or modify such authorized (5) Restrictions on the use of receiving an application for program
program to ensure that it meets the procedures in this section: The revision or modification submitted
requirements of this part. procedures provided in paragraphs (b) under paragraph (b)(1) of this section,
(1) General procedures for program through (e) of this section may only be the Administrator will respond with a
modification or revision: To revise or used for revising or modifying an letter that either notifies the state, tribe,
modify an authorized program to meet authorized program to provide for or local government that the application
the requirements of this part, a state, electronic reporting and for subsequent is complete or identifies deficiencies in
tribe, or local government must submit revisions or modifications to the the application that render the
an application that complies with electronic reporting elements of an application incomplete. The state, tribe,
paragraph (b)(1) of this section and must authorized program as provided under or local government receiving a notice
follow either the applicable procedures paragraph (a)(4) of this section. of deficiencies may amend the
for program revision or modification in (b)(1) To obtain EPA approval of application and resubmit it. Within 30
other parts of Title 40, or, at the program revisions or modifications calendar days of receiving the amended
applicant’s option, the procedures using procedures provided under this application, the Administrator will
provided in paragraphs (b) through (e) section, a state, tribe, or local respond with a letter that either notifies
of this section. government must submit an application the applicant that the amended
application is complete or identifies application submitted under paragraph (2) Requests for a hearing submitted
remaining deficiencies that render the (b) of this section is to an authorized under this section must be submitted to
application incomplete. program with an existing electronic the Administrator within 30 days after
(ii) If a state, tribe, or local document receiving system, and where publication of the notice of opportunity
government receiving notice of notification under paragraph (b)(3) of for hearing in the Federal Register. The
deficiencies under paragraph (b)(3)(i) of this section that the application is Administrator will give notice in the
this section does not remedy the complete is executed after October 13, Federal Register of any hearing to be
deficiencies and resubmit the subject 2007, if the Administrator does not take held pursuant to a request submitted by
application within a reasonable period any action under paragraph (c)(1) of this an interested person or on the
of time, the Administrator may act on section on the specific request for Administrator’s own motion. Notice of
the incomplete application under revision or modification within 360 hearing will be given not less than 15
paragraph (c) of this section. calendar days of such notification, the days prior to the time scheduled for the
(c)(1) The Administrator will act on specific request is considered hearing;
an application by approving or denying automatically approved by EPA at the (3) The hearing will be conducted by
the state’s, tribe’s or local government’s end of the 360 calendar days unless the a designated hearing officer in an
request for program revision or review period is extended at the request informal, orderly, and expeditious
modification. of the state, tribe, or local government manner. The hearing officer will have
(2) Where a consolidated application submitting the application. authority to take such action as may be
submitted under paragraph (b)(2) of this (d) Except where an opportunity for necessary to assure the fair and efficient
section addresses revisions or public hearing is required under conduct of the hearing; and
modifications to more than one paragraph (c)(3) of this section, EPA’s
authorized program, the Administrator (4) After reviewing the record of the
approval of a program revision or
may approve or deny the request for hearing, the Administrator will issue an
modification under this section will be
revision or modification of each order either affirming the determination
effective upon publication of a notice of
authorized program in the application the Administrator made under
EPA’s approval of the program revision
separately; the Administrator need not or modification in the Federal Register. paragraph (c)(1) of this section or
take the same action with respect to the EPA will publish such a notice rescinding such determination and will
requested revisions or modifications for promptly after approving a program promptly publish a notice of the order
each such program. revision or modification under in the Federal Register. If the order is
(3) When an application under paragraph (c)(1) of this section or after to approve the program revision or
paragraph (b) of this section requests an EPA approval occurs automatically modification, EPA’s approval will be
revision or modification of an under paragraph (c)(4) of this section. effective upon publication of the notice
authorized public water system program (e) If a state, tribe, or local government in the Federal Register. If no timely
under part 142 of this title, the submits material to amend its request for a hearing is received and the
Administrator will, in accordance with application under paragraph (b)(1) of Administrator does not determine to
the procedures in paragraph (f) of this this section after the date that the hold a hearing on the Administrator’s
section, provide an opportunity for a Administrator sends notification under own motion, the Administrator’s
public hearing before a final paragraph (b)(3)(i) of this section that determination made under paragraph
determination pursuant to paragraph the application is complete, this new (c)(1) of this section will be effective 30
(c)(1) of this section with respect to that submission will constitute withdrawal days after notice is published pursuant
component of the application. of the pending application and to paragraph (f)(1) of this section.
(4) Except as provided under submission of a new, amended § 3.2000 What are the requirements
paragraph (c)(4)(i) and (ii) of this application for program revision or authorized state, tribe, and local programs’
section, if the Administrator does not modification under paragraph (b)(1) of reporting systems must meet?
take any action under paragraph (c)(1) of this section, and the 180-day time
this section on a specific request for period in paragraph (c)(4) of this section (a) Authorized programs that receive
revision or modification of a specific or the 360-day time period in paragraph electronic documents in lieu of paper to
authorized program addressed by an (c)(4)(ii) of this section will begin again satisfy requirements under such
application submitted under paragraph only when the Administrator makes a programs must:
(b) of this section within 180 calendar new determination and notifies the (1) Use an acceptable electronic
days of notifying the state, tribe, or local state, tribe, or local government under document receiving system as specified
government under paragraph (b)(3) of paragraph (b)(3)(i) of this section that under paragraphs (b) and (c) of this
this section that the application is the amended application is complete. section; and
complete, the specific request for (f) For an application under this (2) Require that any electronic
program revision or modification for the section that requests revision or document must bear the valid electronic
specific authorized program is modification of an authorized public signature of a signatory if that signatory
considered automatically approved by water system program under part 142 of would be required under the authorized
EPA at the end of the 180 calendar days this chapter: program to sign the paper document for
unless the review period is extended at (1) The Administrator will publish which the electronic document
the request of the state, tribe, or local notice of the Administrator’s substitutes, unless the program has been
government submitting the application. preliminary determination under approved by EPA to accept a
(i) Where an opportunity for public paragraph (c)(1) of this section in the handwritten signature on a separate
hearing is required under paragraph Federal Register, stating the reasons for paper submission. The paper
(c)(3) of this section, the Administrator’s the determination and informing submission must contain references to
action on the requested revision or interested persons that they may request the electronic document sufficient for
modification will be in accordance with a public hearing on the Administrator’s legal certainty that the signature was
paragraph (f) of this section. determination. Frivolous or executed with the intention to certify to,
(ii) Where a requested revision or insubstantial requests for a hearing may attest to, or agree to the content of that
modification addressed by an be denied by the Administrator; electronic document.
(b) An electronic document receiving certifying to, attesting to or agreeing to which is not subject to change without
system that receives electronic by signing; governmental action or authorization; or
documents submitted in lieu of paper (iv) Each signatory had the (B) A method of determining identity
documents to satisfy requirements opportunity, at the time of signing, to no less stringent than would be
under an authorized program must be review the content or meaning of the permitted under paragraph (b)(5)(vii)(A)
able to generate data with respect to any required certification statement, of this section; or
such electronic document, as needed including any applicable provisions that (C) Collection of either a subscriber
and in a timely manner, including a false certification carries criminal agreement or a certification from a local
copy of record for the electronic penalties; registration authority that such an
document, sufficient to prove, in private (v) Each signatory has signed either an agreement has been received and
litigation, civil enforcement electronic signature agreement or a securely stored.
proceedings, and criminal proceedings, subscriber agreement with respect to the (c) An authorized program that
that: electronic signature device used to receives electronic documents in lieu of
(1) The electronic document was not create his or her electronic signature on paper documents must ensure that:
altered without detection during the electronic document; (1) A person is subject to any
transmission or at any time after receipt; (vi) The electronic document appropriate civil, criminal penalties or
(2) Any alterations to the electronic receiving system has automatically other remedies under state, tribe, or
document during transmission or after responded to the receipt of the local law for failure to comply with a
receipt are fully documented; electronic document with an reporting requirement if the person fails
(3) The electronic document was acknowledgment that identifies the to comply with the applicable
submitted knowingly and not by electronic document received, including provisions for electronic reporting.
accident; the signatory and the date and time of (2) Where an electronic document
(4) Any individual identified in the receipt, and is sent to at least one submitted to satisfy a state, tribe, or
electronic document submission as a address that does not share the same local reporting requirement bears an
submitter or signatory had the access controls as the account used to electronic signature, the electronic
opportunity to review the copy of record make the electronic submission; and signature legally binds or obligates the
in a human-readable format that clearly (vii) For each electronic signature signatory, or makes the signatory
and accurately associates all the device used to create an electronic responsible, to the same extent as the
information provided in the electronic signature on the document, the identity signatory’s handwritten signature on a
document with descriptions or labeling of the individual uniquely entitled to paper document submitted to satisfy the
of the information and had the use the device and his or her relation to same reporting requirement.
opportunity to repudiate the electronic any entity for which he or she will sign (3) Proof that a particular electronic
document based on this review; and electronic documents has been signature device was used to create an
(5) In the case of an electronic determined with legal certainty by the electronic signature that is included in
document that must bear electronic issuing state, tribe, or local government. or logically associated with an
signatures of individuals as provided In the case of priority reports identified electronic document submitted to
under paragraph (a)(2) of this section, in the table in Appendix 1 of Part 3, this satisfy a state, tribe, or local reporting
that: determination has been made before the requirement will suffice to establish that
(i) Each electronic signature was a electronic document is received, by the individual uniquely entitled to use
valid electronic signature at the time of means of: the device at the time of signature did
signing; so with the intent to sign the electronic
(A) Identifiers or attributes that are
(ii) The electronic document cannot document and give it effect.
verified (and that may be re-verified at
be altered without detection at any time (4) Nothing in the authorized program
any time) by attestation of disinterested
after being signed; limits the use of electronic documents
individuals to be uniquely true of (or
or information derived from electronic
(iii) Each signatory had the attributable to) the individual in whose
documents as evidence in enforcement
opportunity to review in a human- name the application is submitted,
proceedings.
readable format the content of the based on information or objects of
electronic document that he or she was independent origin, at least one item of Appendix 1 to Part 3—Priority Reports
Category Description 40 CFR Citation
Required Reports
State Implementation Plan .............. Emissions data reports for mobile sources ........................................... 51.60(c).
Excess Emissions and Monitoring Excess emissions and monitoring performance report detailing the 60.7(c), 60.7(d).
Performance Report Compliance magnitude of excess emissions, and provides the date, time, and
Notification Report. system status at the time of the excess emission.
New Source Performance Stand- Semi-annual reports (quarterly, if report is approved for electronic 60.49a(e) & (j) & (v), 60.49b(v).
ards Reporting Requirements. submission by the permitting authority) on sulfur dioxide, nitrous
oxides and particulate matter emission (includes reporting require-
ments in Subparts A through DDDD).
Semi-annual Operations and Cor- Semi-annual report provides information on a company’s exceedance 60.107(c), 60.107(d).
rective Action Reports. of its sulfur dioxide emission rate, sulfur content of the fresh feed,
and the average percent reduction and average concentration of
sulfur dioxide. When emissions data is unavailable, a signed state-
ment is required which documents the changes, if any, made to the
emissions control system that would impact the company’s compli-
ance with emission limits.
National Emission Standards for Include such reports as: Annual compliance, calculation, initial start- 61.11, 61.24(a)(3) & (a)(8),
Hazardous Air Pollutants Report- up, compliance status, certifications of compliance, waivers from 61.70(c)(1) & (c)(2)(v) & (c)(3) &
ing Requirements. compliance certifications, quarterly inspection certifications, oper- (c)(4)(iv), 61.94(a) & (b)(9),
ations, and operations and process change. 61.104(a) & (a)(1)(x) & (a)(1)(xi)
& (a)(1)(xvi), 61.138(e) & (f),
61.165(d)(2) & (d)(3) & (d)(4) &
(f)(1) & (f)(2) &(f)(3),
61.177(a)(2) & (c)(1) & (c)(2) &
(c)(3) & (e)(1) & (e)(3),
61.186(b)(1) & (b)(2) & (b)(3) &
(c)(1) & (f)(1), 61.247(a)(1) &
(a)(4) & (a)(5)(v) & (b)(5) & (d),
61.254(a)(4), 61.275(a) & (b) &
(c), 61.305(f) & (i), 61.357(a) &
(b) & (c) & (d), 63.9(h).
Hazardous Air Pollutants Compli- Reports containing results from performance test, opacity tests, and 63.10(d), 63.10(e)(1), 63.10(e)(3).
ance Report. visible emissions tests. Progress reports; periodic and immediate
startup, shutdown, and malfunction reports; results from continuous
monitoring system performance evaluations; excess emissions and
continuous monitoring system performance report; or summary re-
port.
Notifications and Reports ................ Reports that document a facility’s initial compliance status, notifica- 65.5(d), 65.5(e).
tion of initial start-up, and periodic reports which includes the start-
up, shutdown, and malfunction reports discussed in 40 CFR
65.6(c).
Continuous Emissions Monitoring ... Quarterly emissions monitoring reports and opacity reports which 75.64, 75.65.
document a facility’s excess emission.
Notice of Fuel or Fuel Additive Registration of new fuels and additives, and the submission and cer- 79.10, 79.11, 79.20, 79.21, 79.51.
Registration and Health Effects tification of health effect data.
Testing.
Manufacture In-Use and Product Reports that document the emissions testing results generated from 86.1845, 86.1846, 86.1847,
Line Emissions Testing. the in-use testing program for new and in-use highway vehicle igni- 90.113, 90.1205, 90.704,
tion engines; non-road spark-ignition engines; marine spark-ignition 91.805, 91.504, 92.607, 92.508,
engines; and locomotives and locomotive engines. 92.509.
Industrial and Publicly Owned Discharge monitoring reports for all individual permittees—including 122.41(l)(4)(i), 403.12(b) & (d) &
Treatment Works Reports. baseline reports, pretreatment standards report, periodic compli- (e) & (h).
ance reports, and reports made by significant industrial users.
Event Driven Notices
State Implementation Plan .............. Owners report emissions data from stationary sources ........................ 51.211.
Report For Initial Performance Test Report that provides the initial performance test results, site-specific 60.2200 (initial performance tests).
operating limits, and, if installed, information on the bag leak detec-
tion device used by the facility.
Emissions Control Report ............... Report submitted by new sources within 90 days of set-up which de- 61.153(a)(1), 61.153(a)(4)(i),
scribes emission control equipment used, processes which gen- 61.153(a)(5)(ii).
erate asbestos-containing waste material, and disposal information.
State Operating Permits—Permit Monitoring and deviation reports under the State Operating Permit .... 70.6(a)(3)(iii)(A), 70.6(a)(3)(iii)(B).
Content.
Title V Permits—Permit Content ..... Monitoring and deviation reports under the Federal Operating Permit 71.6(a)(3)(iii).
Annual Export Report ...................... Annual report summarizing the amount and type of hazardous waste 262.56(a).
exported.
Exceptions Reports ......................... Reports submitted by a generator when the generator has not re- 262.42, 262.55.
ceived confirmation from the Treatment, Storage, and Disposal Fa-
cility (TSDF) that it received the generator’s waste and when haz-
ardous waste shipment was received by the TSDF. For exports, re-
ports submitted when the generator has not received a copy of the
manifest from the transporter with departure date and place of ex-
port indicated; and confirmation from the consignee that the haz-
ardous waste was received or when the hazardous waste is re-
turned to the U.S.
Contingency Plan Implementation Follow-up reports made to the Agency for all incidents noted in the 264.56(j), 265.56(j).
Reports. operating record which required the implementation of a facility’s
contingency plan.
Significant Manifest Discrepancy Report filed by Treatment, Storage, and Disposal Facilities (TSDF) 264.72(b), 265.72(b).
Report. within 15 days of receiving wastes, when the TSDF is unable to re-
solve manifest discrepancies with the generator.
Unmanifested Waste Report ........... Report that documents hazardous waste received by a Treatment, 264.76, 265.76.
Storage, and Disposal Facility without an accompanying manifest.
Noncompliance Report .................... An owner/operator submitted report which documents hazardous 264.1090.
waste that was placed in hazardous waste management units in
noncompliance with 40 CFR sections 264.1082(c)(1) and (c)(2);
264.1084(b); 264.1035(c)(4); or 264.1033(d).
Notification—Low Level Mixed One-time notification concerning transportation and disposal of condi- 266.345.
Waste. tionally exempted waste.
Notification—Land Disposal Restric- One-time notification and certification that characteristic waste is no 268.9(d).
tions. longer hazardous.
Underground Storage Tank Notifi- Underground Storage Tank system notifications concerning design, 280.22.
cation. construction, and installation. As well as when systems are being
placed in operation. (EPA Form 7530–1 or state version.).
Free Product Removal Report and Report written and submitted within 45 days after confirming a free 280.64, 280.65.
Subsequent Investigation Report. product release, including information on the release and recovery
methods used for the free product, and when test indicate pres-
ence of free product, response measures.
Manufacture or Import Premanufacture notification of intent to begin manufacturing, import- 720.102, 721.25.
Premanufacture Notification. ing, or processing chemicals identified in Subpart E for significant
new use (forms 7710–56 and 7710–25).
Permit Applications 1
State Implementation Plan .............. Information describing the source, its construction schedule, and the 52.21(n).
planned continuous emissions reductions system.
State Operating Permits .................. Reports, notices, or other written submissions required by a State 70.6(c)(1).
Operating Permit.
Title V Permits—Permit Content ..... Reports, notices, or other written submissions required by a Title V 71.6(c)(1), 71.25(c)(1).
Operating Permit.
Title V Permits ................................. Specific criteria for permit modifications and or revisions, including a 71.7(e(2)(ii)(c).
certification statement by a responsible official.
Reclaimer Certification .................... Certification made by a reclaimer that the refrigerant was reproc- 82.164.
essed according to specifications and that no more than 1.5% of
the refrigerant was released during the reclamation.
Application for Certification and Control of Emissions for New and In-Use Highway Vehicles and En- 86.007–21 (heavy duty), 1844–01
Statement of Compliance. gines statement of compliance made by manufacturer, attesting (light duty).
that the engine family complies with standards for new and in-use
highway vehicles and engines.
Application for Certification ............. Application made by engine manufacturer to obtain certificate of con- 89.115, 90.107, 91.107, 92.203,
formity. 94.203.
National Pollutant Discharge Elimi- National Pollutant Discharge Elimination System (NPDES) Permits 122.21.
nation System. and Renewals (includes individual permit applications, NPDES
General Form 1, and NPDES Forms 2A–F, and 2S).
Resource Conservation and Recov- Signatures for permit applications and reports; submission of permit 270.11, 270.42.
ery Act Permit Applications and modifications. (This category excludes Class I permit modifications
Modifications. (40 CFR 270.42, Appendix I) that do not require prior approval).
Certifications of Compliance/Non-Applicability
State Implementation Plan Require- State implementation plan certifications for testing, inspection, en- 51.212(c), 51.214(e).
ments. forcement, and continuous emissions monitoring.
Certification Statement .................... Chemical Accident Prevention Provisions—Risk Management Plan 68.185.
certification statements.
Title V Permits ................................. Federal compliance certifications and permit applications .................... 70.5(c)(9), 70.5(d), 70.6(c)(5).
State Operating Permits .................. State compliance certifications and permit applications ....................... 71.5(c)(9), 71.5(d), 71.24(f).
Annual and Other Compliance Cer- Annual compliance certification report and is submitted by units sub- 72.90.
tification Reports. ject to acid rain emissions limitations.
Annual Compliance Certification Annual compliance certification report which is submitted in lieu of 74.43.
Report, Opt-In Report, and Con- annual compliance certification report listed in Subpart I of Part 72.
firmation Report.
Quarterly Reports and Compliance Continuous Emission Monitoring certifications, monitoring plans, and 75.73.
Certifications. quarterly reports for NOX emissions.
Certification Letters Recovery and Protection of Stratospheric Ozone: Recycling & Emissions Reduction. 79.4, 80.161, 82.162, 82.42.
Recycling Equipment, Motor Ve- Acquisition of equipment for recovery or recycling made by auto re-
hicle Air Conditioners Recycling pair service technician and Fuels and Fuel Additives Detergent ad-
Program, Detergent Package. ditive certification.
Response Plan Cover Sheet .......... Oil Pollution Prevention certification to the truth and accuracy of infor- 112 (Appendix f).
mation.
Closure Report ................................ Report which documents that closure was in accordance with closure 146.71.
plan and/or details difference between actual closure and the pro-
cedures outlined in the closure plan.
Certification of Closure and Post Certification that Treatment, Storage, and Disposal Facilities (TSDF) 264.115, 264.119, 264.119(b)(2),
Closure Care, Post-Closure No- are closed in accordance with approved closure plan or post-clo- 264.120, 265.115,
tices. sure plan. 265.119(b)(2), 265.120, 265.19.
Certification of Testing Lab Analysis Certification that the testing and/or lab analyses required for the treat- 270.63.
ment demonstration phase of a two-phase permit was conducted.
Periodic Certification ....................... Certification that facility is operating its system to provide equivalent 437.41(b).
treatment as in initial certification.
1 Included within each permit application category, though sometimes not listed, are the permits submitted to run/operate/maintain facilities
and/or equipment/products under EPA or authorized programs.
PART 9—OMB APPROVALS UNDER ■ 2. Section 60.25(b)(1) is amended by (b) * * *

THE PAPERWORK REDUCTION ACT adding a sentence to the end of the (1) * * *
paragraph to read as follows: (v) If the program chooses to accept
■ 1. The authority citation for part 9 electronic documents it must satisfy the
continues to read as follows: § 60.25 Emission inventories, source requirements of 40 CFR Part 3—
surveillance, reports. (Electronic reporting).
Authority: 7 U.S.C. 135 et seq., 136–136y;
15 U.S.C. 2001, 2003, 2005, 2006, 2601–2671; * * * * * * * * * *
21 U.S.C. 331j, 346a, 31 U.S.C. 9701; 33 (b)(1) * * * Submission of electronic ■ 4. Section 69.32 is amended by adding
U.S.C. 125l et seq., 1311, 1313d, 1314, 1318, documents shall comply with the a new paragraph (b)(1)(v) to read as
1321, 1326, 1330, 1342, 1344, 1345 (d) and requirements of 40 CFR part 3— follows:
(e), 1361; E.O. 11735, 38 FR 21243, 3 CFR, (Electronic reporting).
1971–1975 Comp. p. 973; 42 U.S.C. 241, * * * * * § 69.32 Title V conditional exemption.
242b, 243, 246, 300f, 300g, 300g-1, 300g-2, * * * * *
300g-3, 300g-4, 300g-5, 300g-6, 300j-1, 300j- PART 63—NATIONAL EMISSION (b) * * *
2, 300j-3, 300j-4, 300j-9, 1857 et seq., 6901– STANDARDS FOR HAZARDOUS AIR (1) * * *
6992k, 7401–7671q, 7542, 9601–9657, 11023, POLLUTANTS FOR SOURCE (v) If the program chooses to accept
11048.
CATEGORIES electronic documents it must satisfy the
■ 2. Section 9.1 is amended by adding requirements of 40 CFR Part 3—
a new entry in numerical order for part ■ 1. The authority citation for part 63 (Electronic reporting).
3 to read as follows: continues to read as follows:
* * * * *
Authority: 42 U.S.C. 7401 et seq.
§ 9.1 OMB approvals under the Paperwork
Reduction Act. ■ 2. Section 63.91 is amended by adding PART 70—STATE OPERATING PERMIT
* * * * * a new paragraph (d)(5)to read as PROGRAMS
follows: ■ 1. The authority citation for part 70
OMB continues to read as follows:
40 CFR citation § 63.91 Criteria for straight delegation and
Control No.
criteria common to all approved options. Authority: 42 U.S.C. 7401, et seq.
* * * * * ■ 2. Section 70.1 is amended by adding
* * * * * (d) * * * a new paragraph (f) to read as follows:
(5) Electronic documents. Submission
Cross-Media Electronic Reporting of electronic documents shall comply § 70.1 Program overview.
with the requirements of 40 CFR part * * * * *
Part 3 ........................................ 2025–0003
3—(Electronic reporting). (f) States that choose to receive
* * * * * * * * * * electronic documents must satisfy the
requirements of 40 CFR Part 3—
PART 51—REQUIREMENTS FOR PART 69—SPECIAL EXEMPTIONS (Electronic reporting) in their program.
PREPARATION, ADOPTION, AND FROM REQUIREMENTS OF THE
SUBMITTAL OF IMPLEMENTATION CLEAN AIR ACT PART 71—FEDERAL OPERATING
PLANS PERMIT PROGRAMS
■ 1. The authority citation for part 69
continues to read as follows: ■ 1. The authority citation for part 71
■ 1. The authority citation for part 51 continues to read as follows:
continues to read as follows: Authority: 42 U.S.C. 7545(c), (g) and (i),
and 7625–1. Authority: 42 U.S.C. 7401, et seq.
Authority: 23 U.S.C. 101; 42 U.S.C. 7401–
7671q. ■ 2. Section 69.13 is amended by adding ■ 2. Section 71.10 is amended by adding
a new paragraph (b)(1)(v) to read as a new sentence to the end of paragraph
■ 2. Section 51.286 is added to Subpart follows: (a) to read as follows:
O to read as follows:
§ 69.13 Title V conditional exemption. § 71.10 Delegation of part 71 program.
§ 51.286 Electronic reporting.
* * * * * (a) * * * Delegate agencies that choose
States that wish to receive electronic (b) * * * to receive electronic documents as part
documents must revise the State (1) * * * of their delegated program must satisfy
Implementation Plan to satisfy the (v) If the program chooses to accept the requirements of 40 CFR Part 3—
requirements of 40 CFR Part 3— electronic documents it must satisfy the (Electronic reporting).
(Electronic reporting). requirements of 40 CFR Part 3— * * * * *
(Electronic reporting).
PART 60—STANDARDS OF * * * * * PART 123—STATE PROGRAM
PERFORMANCE FOR NEW ■ 3. Section 69.22 is amended by adding REQUIREMENTS
STATIONARY SOURCES a new paragraph (b)(1)(v) to read as
follows: ■ 1. The authority citation for part 123
■ 1. The authority citation for part 60 continues to read as follows:
continues to read as follows: § 69.22 Title V conditional exemption. Authority: Clean Water Act, 33 U.S.C. 1251
Authority: 42 U.S.C. 7401–7601. * * * * * et seq.
■ 2. Section 123.25 is amended by (33) For states that wish to receive PART 258—CRITERIA FOR MUNICIPAL
revising paragraphs (a)(44) and (a)(45), electronic documents, 40 CFR Part 3— SOLID WASTE LANDFILLS
adding the phrase ‘‘Except for paragraph (Electronic reporting).
(a)(46) of this section,’’ at the beginning ■ 1. The authority citation for part 258
* * * * * continues to read as follows:
of the Note to paragraph (a), and adding
a new paragraph (a)(46) to read as PART 162—STATE REGISTRATION OF Authority: 33 U.S.C. 1345(d) and (e); 42
follows: PESTICIDE PRODUCTS U.S.C. 6902(a), 6907, 6912(a), 6944, 6945(c)
and 6949a(c).
§ 123.25 Requirements for permitting. ■ 1. The authority citation for part 162 ■ 2. Section 258.29 is amended by
(a) * * * continues to read as follows: adding a new paragraph (d) to read as
(44) § 122.35 (As an operator of a Authority: 7 U.S.C. 136v, 136w. follows:
regulated small MS4, may I share the
■ 2. Section 162.153 is amended by § 258.29 Recordkeeping requirements.
responsibility to implement the
adding a paragraph (a)(6) to read as * * * * *
minimum control measures with other
follows: (d) The Director of an approved state
entities?);
(45) § 122.36 (As an operator of a § 162.153 State registration procedures. program may receive electronic
regulated small MS4, what happens if I documents only if the state program
(a) * * * includes the requirements of 40 CFR
don’t comply with the application or
(6) Electronic Reporting under State Part 3—(Electronic reporting).
permit requirements in §§ 122.33
Registration of Pesticide Products for
through 122.35?); and
Special Local Needs. States that choose PART 271—REQUIREMENTS FOR
(46) For states that wish to receive to receive electronic documents under AUTHORIZATION OF STATE
electronic documents, 40 CFR Part 3— the regulations pertaining to state HAZARDOUS WASTE PROGRAMS
(Electronic reporting). registration of pesticides to meet special
* * * * * ■ 1. The authority citation for part 271
local needs, must ensure that the
continues to read as follows:
requirements of 40 CFR Part 3—
PART 142—NATIONAL PRIMARY (Electronic reporting) are satisfied by Authority: 42 U.S.C. 6905, 6912 and 6926.
DRINKING WATER REGULATIONS their state procedures for such ■ 2. Section 271.10 is amended by
IMPLEMENTATION registrations. revising paragraph (b) to read as follows:
■ 1. The authority citation for part 142 * * * * *
§ 271.10 Requirements for generators of
continues to read as follows: hazardous waste.
PART 233—404 STATE PROGRAM
Authority: 42 U.S.C. 300f, 300g-1, 300g-2, REGULATIONS * * * * *
300g-3, 300g-4, 300g-5, 300g-6, 300j-4, 300j- (b) The State shall have authority to
9, and 300j-11. ■ 1. The authority citation for part 233 require and shall require all generators
■ 2. Section 142.10 is amended by continues to read as follows: to comply with reporting and
redesignating paragraph (g) as paragraph Authority: 33 U.S.C. 1251 et seq. recordkeeping requirements equivalent
(h) and by adding a new paragraph (g) to those under 40 CFR 262.40 and
to read as follows: ■ 2. A new § 233.39 is added to Subpart 262.41. States must require that
D to read as follows: generators keep these records at least 3
§ 142.10 Requirements for a determination years. States that choose to receive
of primary enforcement responsibility. § 233.39 Electronic reporting.
electronic documents must include the
* * * * * States that choose to receive requirements of 40 CFR Part 3—
(g) Has adopted regulations consistent electronic documents must satisfy the (Electronic reporting) in their Program
with 40 CFR Part 3—(Electronic requirements of 40 CFR Part 3— (except that states that choose to receive
reporting) if the state receives electronic (Electronic reporting) in their state electronic manifests and/or permit the
documents. program. use of electronic manifests must comply
* * * * * with any applicable requirements for
PART 257—CRITERIA FOR
e-manifest in this section of this
CLASSIFICATION OF SOLID WASTE
PART 145—REQUIREMENTS FOR section).
DISPOSAL FACILITIES AND
STATE PROGRAMS * * * * *
PRACTICES
■ 3. Section 271.11 is amended by
■ 1. The authority citation for part 145 revising paragraph (b) to read as follows:
■ 1. The authority citation for part 257
Authority: 42 U.S.C. 300f et seq. § 271.11 Requirements for transporters of
Authority: 42 U.S.C. 6907(a)(3), 6912(a)(1), hazardous waste.
■ 2. Section 145.11 is amended by 6944(a) and 6949(c), 33 U.S.C. 1345(d) and
* * * * *
revising paragraphs (a)(30), (a)(31), (e).
(b) The State shall have authority to
(a)(32), and adding paragraph (a)(33) to ■ 2. Section 257.30 is amended by require and shall require all transporters
read as follows: adding a new paragraph (d) to read as to comply with reporting and
§ 145.11 Requirements for permitting. follows: recordkeeping requirements equivalent
to those under 40 CFR 263.22. States
(a) * * * § 257.30 Recordkeeping requirements. must require that transporters keep
(30) Section 124.12(a)—(Public * * * * * these records at least 3 years. States that
hearings); (d) The Director of an approved state choose to receive electronic documents
(31) Section 124.17 (a) and (c)— program may receive electronic must include the requirements of 40
(Response to comments); documents only if the state program CFR Part 3—(Electronic reporting) in
(32) Section 144.88—(What are the includes the requirements of 40 CFR their Program (except that states that
additional requirements?); and Part 3—(Electronic reporting). choose to receive electronic manifests
and/or permit the use of electronic requirements of 40 CFR Part 3— PART 763—ASBESTOS
manifests must comply with any (Electronic reporting).
applicable requirements for e-manifest ■ 1. The authority citation for part 763
■ 3. Section 403.12 is amended by continues to read as follows:
in this section of this section). adding a new paragraph (r) to read as
* * * * * follows: Authority: 15 U.S.C. 2605, 2607(c), 2643,
■ 4. Section 271.12 is amended by and 2646.
revising paragraph (h) to read as § 403.12 Reporting requirements for ■ 2. Section 763.98 is amended by
follows: POTW’s and industrial users. revising paragraphs (a)(1), (b)(3), and
* * * * * (d)(3) to read as follows:
§ 271.12 Requirements for hazardous
waste management facilities. (r) The Control Authority that chooses
§ 763.98 Waiver; delegation to state.
to receive electronic documents must
* * * * * (a) General. (1) Upon request from a
(h) Inspections, monitoring, satisfy the requirements of 40 CFR Part
3—(Electronic reporting). state Governor and after notice and
recordkeeping, and reporting. States that comment and an opportunity for a
choose to receive electronic documents PART 501—STATE SLUDGE public hearing in accordance with
must include the requirements of 40 MANAGEMENT PROGRAM paragraphs (b) and (c) of this section,
CFR Part 3—(Electronic reporting) in REGULATIONS EPA may waive some or all of the
their Program (except that states that requirements of this subpart E if the
choose to receive electronic manifests ■ 1. The authority citation for part 501 state has established and is
and/or permit the use of electronic continues to read as follows: implementing or intends to implement
manifests must comply with paragraph a program of asbestos inspection and
(i) of this section); management that contains requirements
* * * * * ■ 2. Section 501.15 is amended by that are at least as stringent as the
adding a new paragraph (a)(4) to read as requirements of this subpart. In
PART 281—APPROVAL OF STATE follows: addition, if the state chooses to receive
UNDERGROUND STORAGE TANK electronic documents, the state program
PROGRAMS § 501.15 Requirements for permitting. must include, at a minimum, the
■ 1. The authority citation for part 281 (a) * * * requirements of 40 CFR part 3—
continues to read as follows: (Electronic reporting).
(4) Information requirements: All
treatment works treating domestic * * * * *
Authority: 42 U.S.C. 6912, 6991 (c), (d), (e),
(g). sewage shall submit to the Director (b) * * *
within the time frames established in (3) Detailed reasons, supporting
■ 2. Section 281.40 is amended by papers, and the rationale for concluding
revising paragraph (d) to read as paragraph (d)(1)(ii) of this section the
information listed in paragraphs (a)(4)(i) that the state’s asbestos inspection and
follows: management program provisions for
through (xii) of this section. The
§ 281.40 Requirements for compliance Director of an approved state program which the request is made are at least
monitoring program and authority. that chooses to receive electronic as stringent as the requirements of
documents must satisfy the Subpart E of this part, and that, if the
* * * * *
(d) State programs must have requirements of 40 CFR part 3— state chooses to receive electronic
procedures for receipt, evaluation, (Electronic reporting). documents, the state program includes,
retention and investigation of records at a minimum, the requirements of 40
* * * * * CFR part 3—(Electronic reporting).
and reports required of owners or
operators and must provide for PART 745—LEAD-BASED PAINT * * * * *
enforcement of failure to submit these POISONING PREVENTION IN CERTAIN (d) * * *
records and reports. States that choose RESIDENTIAL STRUCTURES (3) The state has an enforcement
to receive electronic documents must mechanism to allow it to implement the
include the requirements of 40 CFR Part ■ 1. The authority citation for part 745 program described in the waiver request
3—(Electronic reporting) in their state continues to read as follows: and any electronic reporting
program. requirements are at least as stringent as
Authority: 15 U.S.C. 2605, 2607, 2681–
2692 and 42 U.S.C. 4852d.
40 CFR part 3—(Electronic reporting).
* * * * *
* * * * *
PART 403—GENERAL ■ 2. Section 745.327 is amended by ■ 3. Appendix C to subpart E of part 763
PRETREATMENT REGULATIONS FOR adding a new paragraph (f) to read as is amended by adding paragraph (I) to
EXISTING AND NEW SOURCES OF follows: section I to read as follows:
POLLUTION § 745.327 State or Indian Tribal lead-based Appendix C to Subpart E of Part 763—
■ 1. The authority citation for part 403 paint compliance and enforcement Asbestos Model Accreditation Plan
continues to read as follows: programs.
I. Asbestos Model Accreditation Plan for
* * * * * States
(f) Electronic reporting under State or * * * * *
■ 2. Section 403.8 is amended by adding
Indian Tribe programs. States and tribes (I) Electronic Reporting.
a new paragraph (g) to read as follows: States that choose to receive electronic
that choose to receive electronic
§ 403.8 Pretreatment Program documents under the authorized state or documents must include, at a minimum, the
Requirements: Development and Indian tribe lead-based paint program, requirements of 40 CFR Part 3—(Electronic
Implementation by POTW. must ensure that the requirements of 40 reporting) in their programs.
* * * * * CFR part 3—(Electronic reporting) are * * * * *
(g) A POTW that chooses to receive satisfied in their lead-based paint [FR Doc. 05–19601 Filed 10–12–05; 8:45 am]
electronic documents must satisfy the program. BILLING CODE 6560–50–P

Rule: Cross-Media Electronic Reporting

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Rule: Cross-Media Electronic Reporting

Încărcat de

Drepturi de autor:

Formate disponibile

Thursday,

October 13, 2005

Category Examples of affected entities

Citation/subject area in proposed rule Citation/requirement in final section 3.2000(b)

The requirements in is an authoritative answer to the agreement, as well as the opportunity to

Category Description 40 CFR Citation

Category Description 40 CFR Citation

Event Driven Notices

Category Description 40 CFR Citation

Category Description 40 CFR Citation

PART 9—OMB APPROVALS UNDER ■ 2. Section 60.25(b)(1) is amended by (b) * * *

S-ar putea să vă placă și