Senate Sends Major Leahy-Related E-Commerce Bill to President's Desk Comments of Senator Patrick Leahy and Explanation of Key Issues

June 16, 2000

[(June 16, 2000) -- The U.S. Senate on June 16 joined the House in approving the final House-Senate agreement on the Electronic Signatures Bill. The 87-0 Senate vote sends the bill to the desk of the President, who will sign it. Sen. Patrick Leahy, D-Vt., is co-author of the Abraham-Leahy Bill that passed the Senate last November and was a conferee during the lengthy and difficult House-Senate negotiations on the bill. Leahy, Sen. Ernest Hollings (D-S.C.), Sen. Paul Sarbanes (D-Md.), Sen. Ron Wyden (D-Ore.), and Rep. John Dingell (D-Mich.) succeeded in preventing wholesale federal preemptions of state consumer protection laws in the final version of the bill. Sen. Leahy's comments:]

"The United States has been the incubator of the Internet through its infancy. The world closely watches whenever we debate or enact policies that affect the Internet, and that is another reason why we must act carefully and intelligently whenever we pass Internet-related laws. What we have produced here is the charter for the next growth phase of e-commerce, and this bill will be closely read and widely emulated. Because of the potential this bill had for eviscerating scores of basic state consumer protection laws that most Americans today take for granted, this bill also has presented us with perhaps the most significant consumer issues of a decade or longer – not for what, thank goodness, this bill is in its final form, but for what this bill nearly became in its earlier stages. To the benefit of consumers and in the interest of the smooth and sensible forward progress of Internet commerce, this bill largely strikes a constructive balance. It advances electronic commerce without terminating or mangling the basic rights of consumers."

STATEMENT OF SENATOR PATRICK LEAHY SENATE PASSAGE OF E-SIGN CONFERENCE REPORT JUNE 15, 2000 Mr. LEAHY. Mr. President, I am pleased that the Senate is finally considering the conference report on S.761, "The Electronic Signatures in Global and National Commerce Act". I wish that we could pass it tonight. Tomorrow, when the delayed vote occurs, I will be in Vermont. While I am never sorry to be in Vermont, I will regret missing the final tally. I was honored to serve as a conferee and help develop the conference report. I signed the conference report and support its final passage. I go back to my native State secure in the knowledge that it will pass overwhelmingly.

This legislation is intended to permit and encourage the continued expansion of electronic commerce and to promote public confidence in the integrity and reliability of online promises. These are worthy goals, and they are goals that I have long sought to advance.

For example, in the last Congress, many of us worked together to pass the Government Paperwork Elimination Act, which established a framework for the federal government's use of electronic forms and electronic signatures. Many of us have worked together in a successful bipartisan effort to promote the widespread use of encryption and relax out-dated export controls on this critical technology for ensuring the confidentiality and integrity of online communications and stored computer information. In areas as diverse as enhancing copyright and patent protections for new technologies and updating our criminal laws to address new forms of cybercrime, we have been able to work together in a constructive, bipartisan way to make real progress on a sound legal framework for electronic commerce to flourish.

The conference report is the product of such bipartisan cooperation. I think we all know that there were some bumps along the way. At one point, industry representatives were warned against even speaking with any Democrats. But the final product is bipartisan. It is an example of Congress at work rather than at loggerheads. It is legislators legislating rather than politicians posturing and unnecessarily politicizing important matters of public policy.

I commend Chairman Bliley and Chairman McCain for making this a real conference, in which all conferees, Republican and Democratic, had an opportunity to air their concerns and contribute to the final report. We all might have written some provisions differently, but the conference report is a solid and reasonable consensus bill that will establish a Federal framework for the use of electronic signatures, contracts, and records, while preserving essential safeguards protecting the Nation's consumers.

The conference report adheres to the five basic principles for e-sign legislation articulated by the Democrat Senators in a letter dated March 28, 2000.

It ensures effective consumer consent to the replacement of paper notices with electronic notices.

It ensures that electronic records are accurate, and relevant parties can retain and access them.

It enhances legal certainty for electronic signatures and records and avoids unnecessary litigation by authorizing regulators to provide interpretive guidance.

It avoids unintended consequences in areas outside the scope of the bill by providing clear federal regulatory authority for records not covered by the bill's "consumer" provisions.

And, it avoids facilitating predatory or unlawful practices. These principles are not rocket science but are simply intended to ensure that the electronic world is no less safe for American consumers than the paper world. The American public has enough concern when they go online. They worry whether their privacy will be protected, whether a damaging computer virus will attack their computer, whether a computer hacker will steal their personal information, adopt their identity and wreak havoc with their good names, or whether their kids will meet a sexual predator. These worries are all serious drags on electronic commerce.

An AARP survey of computer users over the age of 45 released on March 31st found that almost half of respondents already think that electronic contracts would give them less protection than paper contracts, while only one-third believe they would have the same degree of protection. With this conference report, we have avoided aggravating consumers' worries. Companies doing business online want to reassure consumers and potential customers that their interests will be protected online, not heighten their concern about electronic commerce. Our conference report should be helpful in this regard.

Mr. President, the United States has been the incubator of the Internet through its infancy. The world closely watches whenever we debate or enact policies that affect the Internet, and that is another reason why we must act carefully and intelligently whenever we pass Internet-related laws. What we have produced here is the charter for the next growth phase of e-commerce, and this bill will be closely read and widely emulated. Because of the potential this bill had for eviscerating scores of basic state consumer protection laws that most Americans today take for granted, this bill also has presented us with perhaps the most significant consumer issues of a decade or longer – not for what, thank goodness, this bill is in its final form, but for what this bill nearly became in its earlier stages. To the benefit of consumers and in the interest of the smooth and sensible forward progress of Internet commerce, this bill largely strikes a constructive balance. It advances electronic commerce without terminating or mangling the basic rights of consumers.

Before I discuss specific provisions of the conference report, I note that I saw in the Congressional Record of the House proceedings a statement by Chairman Bliley that is formatted like a managers' statement of a conference report. I feel I must clarify that those are Mr. Bliley's views, not a statement of the managers. In fact, I saw it for the first time today, when I picked up the Congressional Record, and have not yet had a chance to study it thoroughly.

I will now describe how the conference report gives effect to the Democratic Senators' five basic principles.

First, the conference report will ensure informed and effective consumer consent to the replacement of paper notices and disclosures with electronic notices and disclosures, so that consumers are not forced or tricked into receiving notices and disclosures in an electronic form that they cannot access or decipher.

Under the House bill, a business could obtain a consumer's "consent" simply by specifying the hardware and software needed to access the notices and disclosures. This approach would have done little or nothing to protect technologically unsophisticated consumers, who may not know whether they have the necessary hardware and software even if the technical specifications are provided.

I maintained that any standard for affirmative consent must require consumers to consent electronically to the provision of electronic notices and disclosures in a manner that verified the consumer's capacity to access the information in the form in which it would be sent. Such a mechanism provides a check against coercion, and additional assurance that the consumer actually has an operating e-mail address and the other technical means for accessing the information.

Section 101(c) of the conference report requires the use of a technological check, while leaving companies with ample flexibility to develop their own procedures. The critical language, which Senator Wyden and I developed and proposed, provides that a consumer's consent to the provision of information in electronic form must involve a demonstration that the consumer can actually receive and read the information. Section 101(c) also provides that if there is a material change in the hardware or software requirements needed to access or retain the information, the company must again verify that the consumer can receive and read the information, or allow the consumer to withdraw his or her consent without the imposition of any conditions, consequences or fees. In addition, prior to any consent, a consumer must be notified of his or her rights, including the right to receive notices on paper and any available option for reverting to paper after an electronic relationship has been established.

Senator Gramm has criticized the conference report on the ground that its technological check on consumer consent unfairly discriminates against electronic commerce. But those most familiar with electronic commerce have never seriously disputed the need for a technological check. In fact, many high tech firms have acknowledged that it is good business practice to verify that their customers can open their electronic records, and many already have implemented some sort of technological check procedure. I am confident that the benefits of a one-time technological check far outweigh any possible burden on e-commerce, and it will greatly increase consumer confidence in the electronic marketplace.

Let me make special note of section 101(c)(3), a late addition to the conference report. Without this provision, industry representatives were concerned that consumers would be able to back out of otherwise enforceable contracts by refusing to consent, or to confirm their consent, to the provision of information in an electronic form. At the same time, however, companies wanted to preserve their autonomy as contracting parties to condition their own performance on the consumer's consent. For example companies anticipated that they might offer special deals for consumers who agreed not to exercise their right to paper notices. Section 101(c)(3) makes clear that failure to satisfy the consent requirements of section 101(c)(1) does not automatically vitiate the underlying contract. Rather, the continued validity of the contract would turn on the terms of the contract itself, and the intent of the contracting parties, as determined under applicable principles of State contract law. Failure to obtain electronic consent or confirmation of consent would, however, prevent a company from relying on section 101(a) to validate an electronic record that was required to be provided or made available to the consumer in writing.

I should also explain the significance of section 101(c)(6), which was added at the request of the Democratic conferees. This provision makes clear that a telephone conversation cannot be substituted for a written notice to a consumer. For decades, consumer laws have required that notices be in writing, because that form is one that the consumer can preserve, to which the consumer can refer, and which is capable of demonstrating after the fact what information was provided. Under appropriate conditions, electronic communications can mimic those characteristics; but oral notice over the telephone will never be sufficient to protect consumer interests.

Second, the conference report will ensure that electronic contracts and other electronic records are accurate and that relevant persons can retain and access them. Consumers must be able to retain electronic records and must have some assurance that they provide reasonable guarantees of the accuracy and integrity of the information that they contain.

Under section 101(e) of the conference report, the legal effect of an electronic contract or record may be denied if it is not in a form that can be retained and accurately reproduced for later reference and settlement of disputes. This means that the parties to a contract may not satisfy a statute of frauds requirement that the contract be in writing simply by flashing an electronic version of the contract on a computer screen. Similarly, product warranties must be provided to purchasers in a form that they can retain and use to enforce their rights in the event that the product fails.

Third, the conference report will enhance legal certainty for electronic signatures and records and avoid unnecessary litigation by authorizing Federal and State regulators to provide interpretive guidance. Even with the representation on this conference of Members from committees of varied jurisdiction, we could not begin to think of every circumstance that might arise in the future as to which this legislation will apply. It was therefore essential to provide regulatory agencies with sufficient flexibility and interpretive authority to implement the statutes modified by the legislation.

Most importantly, the conference report preserves substantial authority for Federal and State regulators with respect to record-keeping requirements. In a letter dated May 23, 2000, the Department of Justice expressed concern that an early draft of the conference report, produced by certain Republican conferees, would "seriously undermine the government's ability to investigate, try and convict criminals who alter or hide required records in programs such as Medicare, Medicaid, and federal environmental laws." The Department explained:

"Record Retention. As presently drafted, the bill leaves the public at risk for serious waste, fraud, and abuse. For example, under the current bill, there is nothing to prevent a Medicare contractor from retaining its financial records on a spreadsheet (such as Excel or Quattro Pro). However, because those programs generally contain no security features to monitor changes to the files they create, anyone could change one number on a spreadsheet, which would then change all other numbers affected by the impermissible entry, reflecting a financial picture different from the reality. The government could have its hands tied in seeking to establish rules to ensure that such records could not be altered."

The Department's concerns regarding the Federal Government were shared by the States, whose regulators need and deserve the same flexibility as Federal regulators. This is particularly true in areas where the States are the primary regulators, as they are with respect to insurance and State-chartered banks. Having pressed this point throughout the conference, I am pleased that the final report treats Federal and State regulators with equal respect, and that it has won the support of the National Conference of State Legislatures.

Under earlier drafts of this conference report, as in H.R. 1714 as passed by the House, a requirement that a record be retained could be met by retaining an electronic record that accurately reflected the information set forth in the record "after it was first generated in its final form as an electronic record." By striking that final phrase, we made clear that agencies, through their interpretive authority, can ensure that electronic records remain accurate throughout the period that they are required by law to be retained. For additional certainty, we expressly authorized agencies to set performance standards to assure the accuracy, integrity, and accessibility of records that are required to be retained and, if necessary, to require retention of a record in paper form. We also delayed the effective date of the Act with respect to record retention requirements, to give agencies time to put in place appropriate regulations designed to assure effective and sustainable record retention, and to prevent companies from retaining materials in any easily alterable form that they chose until regulations are forthcoming. Together, these changes will avoid facilitating lax record-keeping practices that could impede the enforcement of program requirements, anti-fraud statutes, environmental laws, and many other laws and regulations.

Fourth, the conference report will avoid unintended consequences for laws and regulations governing "records" outside its intended focus on business-to-consumer and business-to-business transactions. I was seriously concerned that the sweeping legislation passed by the House would allow hazardous materials transporters to provide truckers with the required description of the materials via electronic mail, so that key information might not be available to clean-up crews in the event an accident disabled the driver. Similarly, I worried that the House bill would allow employers to provide OSHA-required warnings on a Web site rather than on a dangerous machine.

The conference report raises no such concerns. For one thing, it specifically excludes from its scope any documents required to accompany the transportation or handling of hazardous materials, pesticides, and other toxic or dangerous materials. For another thing, it expressly preserves all Federal and State requirements that information be posted, displayed or publicly affixed. In addition to allaying concerns about OSHA-warnings, this provision ensures that the bill will not inadvertently undermine Federal and State labeling requirements, such as requirements that poisonous products be labeled with the skull and crossbones symbol.

Perhaps more importantly, the scope of the legislation has been narrowed. As reported by the conference committee, the bill covers signatures, contracts and records relating to a "transaction" in or affecting interstate or foreign commerce, with the critical term -- "transaction" -- defined to mean "an action or set of actions relating to the conduct of business, consumer, or commercial affairs between two or more persons." The conferees specifically rejected including "governmental" affairs in this definition. Thus, for example, the bill would not cover records generated purely for governmental purposes, such as regular monitoring reports on air or water quality that an agency may require pursuant to the Clean Air Act, Clean Water Act, Safe Drinking Act, or similar Federal or State environmental laws.

Fifth and finally, the conference report avoids the problem created by many earlier drafts, including the House bill, of potentially facilitating unfair and deceptive practices. It does this through a broad savings clause which clarifies that the bill does not limit any legal requirement or prohibition other than those involving the writing, signature, or paper form of a contract. Laws -- including common law rules -- that prohibit fraud, unfair or deceptive trade practices, or unconscionable contracts are not affected by this Act. A wrongdoer may not argue that fraudulent conduct that complies with the technical requirements of section 101(c) is beyond the reach of anti-fraud laws. By the same token, a consumer is always entitled to assert that an electronic signature is a forgery, was used without authority, or otherwise is invalid for reasons that would invalidate the effect of a signature in written form.

This legislation has come a long way in conference. It is far from the reckless bill it was in danger of becoming. Still, it is far from perfect. As a general matter, I believe it may still be unduly preemptive of State regulatory and record-keeping authority. It is ironic that the same Members who claim to be vigilant guardians of States' rights are so quick to impose broad Federal mandates on the States when it suits their political interests. The majority has failed to explain why the expansion of the Internet justifies jettisoning the federalist principles that have governed our Republic for more than two centuries. I have worked hard, in connection with this bill and others, to preserve State authority in areas traditionally reserved to the States, particularly where there is no conflict between the Federal goals and State jurisdiction. We should preempt State authority only when there is a demonstrated need to establish a national standard, and even then, only for as long as is necessary.

That being said, the conference report appropriately rejects the massively preemptive approach taken by earlier versions of this legislation, including the House-passed bill. As the National Governors' Association observed in a letter to Congress dated March 14, 2000, "H.R. 1714's ambiguity with respect to preemption [was] very troubling". It authorized States to "modify, limit, or supersede" the Federal statute by adopting the Uniform Electronic Transactions Act (UETA), but then rendered this authorization irrelevant by stating that no State law (including UETA) was effective to the extent that it was inconsistent with the Federal statute or technology specific.

By contrast, the conference report does not preempt the laws of those States that adopt UETA, so long as UETA is adopted in a uniform manner. Such exceptions to UETA as a State may adopt are preempted, but only to the extent that they violate the principle of technological neutrality or are otherwise inconsistent with the Federal statute. This affords States considerable flexibility; for example, a State may enact UETA to incorporate the consumer consent procedures set forth in section 101(c).

In addition, section 104(a) of the conference report expressly preserves governmental filing requirements. Federal agencies are already working toward full acceptance of electronic filings, pursuant to the schedule established by the Government Paperwork Elimination Act. I am confident that State agencies will follow our lead. Until they are technologically equipped to do so, however, they have an unqualified right under section 104(a) to continue to require records to be filed in a tangible printed or paper form.

I have a number of other concerns about the conference report. In particular, I am troubled that the conference report fails to provide a clear Federal rule – or, indeed, any rule at all – concerning how it is intended to affect requirements that information be sent, provided, or otherwise delivered. The absence of a delivery provision is particularly conspicuous given the fact that the prototype for this legislation does include such a provision. Section 8(a) of UETA provides that if a law requires information to be sent in writing to another person (but does not specify a particular method of delivery), the requirement is satisfied if the information is sent in an electronic record that the recipient can retain. Under section 8(b), if a law requires information to be sent by a specified method – whether by regular U.S. Mail, express mail, registered mail, certified mail, or another method – then the information must be sent by the method specified in the other law, except that parties may contract out of regular mail requirements to the extent permitted by the other law. UETA also contains a detailed rule for determining when an electronic record is sent, and when it is received.

The conference report touches upon the issue of delivery in section 101(c)(2)(B), but only with respect to specified methods that require verification or acknowledgment of receipt, such as registered or certified mail. What happens to State law requirements that a notice be sent by first-class mail or personal delivery? How about a law that requires information to be provided, sent, or delivered in writing, but does not specify a particular method of delivery? I raised these questions during the conference, but the conference report provides few answers.

The conference report does provide some guidance in the case of States that enact UETA. In such States, section 8(a) of UETA will govern with respect to general delivery requirements, and section 8(b)(2) of UETA will govern with respect to requirements that information be delivered by a specified method, subject to section 102(c) of the federal legislation. Section 102(c) prevents States that enact UETA from circumventing the federal legislation through the imposition of new nonelectronic delivery methods. Thus, States enacting UETA may continue to prescribe specific delivery methods, so long as there is an electronic alternative for any nonelectronic delivery methods.

This leaves the question of how the Federal legislation will affect Federal delivery requirements and State delivery requirements in non-UETA States. Because our bill is silent on this question, and because repeal and preemption by implication are disfavored, a court or agency interpreting the legislation could reasonably conclude that these Federal and State delivery requirements remain in full force and effect. Indeed, this interpretation is practically compelled by the plain language of the legislative text. It does, however, have the potential to undermine one of our key legislative objectives – that is, the elimination of unintended and unwarranted barriers to electronic commerce. For this reason, it will be tempting to discern in this legislation some sort of plan to permit electronic delivery of information whenever delivery is required by law, even when the law specifies a particular method by which delivery must be made. Let me assure the courts and regulators that have occasion to read these words that this legislator had no such plan.

Had we in fact addressed this issue in conference, my goal would have been to ensure that any specific requirement that information be sent or delivered not be relaxed or weakened through this Act. I believe an electronic method of delivery should be at least as reliable, secure, and effective as the method it replaces. Thus, a law that requires information to be delivered to a person by first class mail should not be satisfied simply by posting the information on a Web site; at a minimum, the person must also be notified of the location and availability of the information. Nor is information delivered, in my view, if it is electronically posted for an unreasonably short period of time, or sent electronically in a manner that inhibits the ability of the recipient to store or print the information.

Having failed to address the issue of delivery, we may be compelled to revisit the issue at a later date. We will, by then, have the benefit of the Commerce Department's study under section 105(a) of the conference report, regarding the effectiveness and reliability of electronic mail as compared with more traditional methods of delivery.

Another troubling provision in the conference report appears at the end of section 101, and concerns the liability of insurance agents and insurance brokers. This provision appeared for the first time in a conference draft produced by the Republican conferees on May 15th. In its original incarnation, this provision gave insurance agents and brokers absolute immunity from liability if something went wrong as a result of the use of electronic procedures. This was not just a shield from vicarious liability, or even from negligence; rather, it was an absolute shield, which would protect insurance agents and brokers from their own reckless or even wilful conduct. No matter that insurance agents and brokers are perfectly capable of protecting themselves through their contracts with insurance companies and their customers. Senator Hollings and I opposed the provision as unnecessary and indefensible as a matter of policy, and we succeeded in transforming it into a clarification that insurance agents and brokers cannot be held vicariously liable for deficiencies in electronic procedures over which they had no control. In this form, the provision remains in the bill as a stark reminder of the power of special interests.

Section 104(d)(1) is another political compromise that blemishes this conference report, although I believe its actual impact will be negligible. It provides that Federal agencies may exempt a specified category or type of record from the consumer consent requirements of section 101(c), but only if such exemption is "necessary" to eliminate a "substantial" burden on electronic commerce, and it will not increase the material risk of harm to consumers. While Chairman Bliley indicated in his floor statement yesterday that this test should not be read as too limiting, the opposite is true. The test is, and was intended to be, demanding. The exemption must be "necessary," and not merely "appropriate," as Chairman Bliley suggested. It should also be noted that the conferees considered and specifically rejected language that would have authorized State agencies to exempt records from the consent requirements.

Finally, I want to discuss the concept of technology neutrality that is so central to this bill. This legislation is, appropriately, technology neutral. It leaves it to the parties to choose the authentication technology that meets their needs. At the same time, it is undeniable that some authentication technologies are more secure than others. Nothing in the conference report prevents or in any way discourages parties from considering issues of security when deciding which authentication technology to use for a particular application. Indeed, such considerations are wholly appropriate.

Pursuant to the Government Paperwork Elimination Act, passed by the previous Congress, the Office of Management and Budget (OMB) has adopted regulations to permit individuals to obtain, submit and sign government forms electronically. These regulations direct Federal agencies to recognize that different security approaches offer varying levels of assurance in an electronic environment and that deciding which to use in an application depends first upon finding a balance between the risks associated with the loss, misuse or compromise of the information, and the benefits, costs and effort associated with deploying and managing the increasingly secure methods to mitigate those risks.

The OMB regulations recognize that among the various technical approaches, in an ascending level of assurance, are "shared secrets" methods (e.g., personal identification numbers or passwords), digitized signatures or biometric means of identification, such as fingerprints, retinal patterns and voice recognition, and cryptographic digital signatures, which provide the greatest assurance. Combinations of approaches (e.g., digital signatures with biometrics) are also possible and may provide even higher levels of assurance.

In developing this legislation, the conference committee recognized that certain technologies are more secure than others and that consumers and businesses should select the technology that is most appropriate for their particular needs, taking into account the importance of the transaction and its corresponding need for assurance.

Mr. President, the benefits of electronic commerce should not, and need not, come at the expense of increased risk to consumers. I am delighted that we have been able to come together in a bipartisan effort in which Democrats and Republicans in the Senate and House are joining in s-sign legislation that will encourage electronic commerce without sacrificing consumer protections. I want to commend Senator Hollings, Senator Sarbanes and Representative Dingell, the ranking Democrats on the other Committees participating in the House-Senate Conference, for their leadership and steadfast efforts on behalf of our dual objectives. I thank Chairman Bliley and Chairman McCain for allowing the conference process to work and to result in a report that so many of us can support. I also want to praise Senator Wyden for his dedication to this project and for never losing sight of the need to create a balanced bill. It has been a privilege to work with all of these distinguished Members on this landmark legislation.

I am profoundly grateful to the Administration for its work on this legislation. Andy Pincus, Sarah Rosen Wartell, Michael Beresik, Gary Gensler, and Gregory Baer, in particular, have devoted countless hours to ensuring that the conference report will create a reasonable and responsible framework for electronic commerce.

I would also like to thank the Senate and House staff who worked so hard to bring this matter to a reasonable conclusion. On my staff, Julie Katzman and Beryl Howell. In addition, Maureen McLaughlin, Moses Boyd, Carol Grunberg, Marty Gruenberg, Jonathan Miller, Kevin Kayes, Steve Harris, David Cavicke, Mike O'Rielly, Paul Scolese, Ramsen Betfarhad, James Derderian, Bruce Gwinn, Consuela Washington, and Jeff Duncan – all deserve credit for their role in crafting the consensus legislation that the Senate passes today. Thanks, too, to House Legislative Counsel Steve Cope, for his technical assistance and professionalism throughout this conference.

This conference report enjoys strong bipartisan and bicameral support. It passed the House of Representatives yesterday by an overwhelming majority. It has been well received by industry and consumer representatives alike, by the States as well as by the Administration. I urge its speedy passage into law.