The Department of Information Resources (department) adopts new §206.1, web site definitions; 206.2, accessibility and usability of state web sites; 206.3, privacy and security of state web sites; 206.4, state web site link and privacy policy; and 206.5, linking and indexing of state web sites. Sections 206.1(13), 206.1(26), 206.2(a)(3) and 206.3(c) are adopted with changes to the text as published in the March 15, 2002, issue of the Texas Register (27 TexReg 1962). Sections 206.4 and 206.5 are adopted without changes and will not be republished. Simultaneous with adoption of these rules, the department is adopting the repeal of §201.12, state web sites, so that all state web site rules are transferred from chapter 201 to chapter 206 of Title 1.

In accordance with §2001.033(a)(1), Government Code, the department's reasoned justification for adopting these rules is contained in the order adopting the rules, which includes, by reference, this preamble and the rules adopted in §§206.1-206.5. The department's reasoned justification for adoption of the rules includes a summary of comments received from interested parties that shows the names of the interested groups offering comments and whether they were for or against adoption of the rules; the factual basis for the rules as adopted and the rational connection between the factual basis for the rules and the rules as adopted; and the reasons why the department disagrees with some of the comments.

Comments on the rules were received from the University of Texas System Administration, the University of Texas at Austin, the University of Texas at Dallas, the University of Texas Health Science Center - San Antonio, the Texas Technology Access Project of the University of Texas at Austin, and the Texas Workers' Compensation Commission. The Texas Technology Access Project of the University of Texas at Austin was for the adoption of the rules. The University of Texas System Administration, the University of Texas at Austin, the University of Texas at Dallas, the University of Texas Health Science Center - San Antonio, and the Texas Workers' Compensation Commission were against adoption of the rules as proposed.

A summary of the comments received by the department concerning the proposed rules is set forth below.

Two groups made general comments to the effect that universities have different needs than administrative or regulatory agencies, and requesting an exemption from the rules. The department disagrees with these comments because they are premised upon a misunderstanding of the intended scope of the proposed rules, and because the department does not have statutory authority to provide an exemption from the rules for institutions of higher education or other state agencies. The new rules as adopted, just as their predecessor rule in 1 T.A.C. §201.12, apply only to state web sites as that term is defined in the rule. A "state web site" includes a state agency's home page and any key public entry points. The term "key public entry point" is defined as "[a] Web page that a state agency has specifically designed for members of the general public to access official information (e.g., the governing or authoritative documents) from the agency." Governing or authoritative documents are intended to refer to documents such as enabling legislation, agency rules and policies, and information of general interest to members of the public. The rule is not intended to apply to web sites maintained by students, faculty or staff of educational institutions, nor to sites maintained for commercial or proprietary activities such as those by which a university may compete with private and public sector health or medical centers.

Two groups challenged the department's assertion in its preamble that the proposed rules will result in no anticipated economic cost to persons as a result of the adoption of the rules. The groups asserted that there would be labor and training costs associated with the implementation of the rules. The department disagrees with the comments for the reasons indicated above; i.e., that the rule applies only to state web sites. The department believes that the cost of implementing the requirements of the rule, if any, will be insubstantial and would otherwise be subsumed in the normal costs incurred by state agencies in maintaining state web sites. One group also commented that the cost to transcribe web-based video, available at some sites maintained by state agencies, would be significant. While the department does not disagree that such transcription may be costly, it disagrees that the rules would apply to such video services, inasmuch as they do not constitute governing or authoritative documents as contemplated by the definition of "key public entry point."

Several groups commented that the department should clarify whether the standards referred to in the rules, including accessibility standards, would apply to internal web sites operated by students, faculty or staff. As indicated elsewhere in this preamble, the rule would not apply to such web sites unless and to the extent they constitute "state web sites." The department therefore disagrees that such clarification must be made by modifying language in the rules themselves.

One group stated that the definition of "generally accessible Internet site" as contained in §206.1(5) is vague. The same group challenged the use of the phrase "graceful transformation" within the definition on the same basis. The department disagrees with these comments because both the concepts and the language used in the definition are derived from W3C standards for accessible web sites; see "Web Content Accessibility Guidelines 1.0" available at www.w3.org.

One group requested that language referring to "individuals" in §206.1, definitions, be amended to refer to "members of the public" instead. The department agrees with this comment and has amended §206.1(13) 206.1(26) accordingly.

One group objected to the requirement in §206.2(a)(2) that state Web sites meet the definition of a generally accessible Internet site, claiming that such a requirements imposes a "non-attainable goal" on state agencies. The department disagrees with this comment, in part because of the fact that the rule is intended to apply to far fewer web sites than the commenter believes, and also because making such sites accessible is appropriate both for public policy reasons and to achieve compliance with applicable law, including but not limited to the Americans with Disabilities Act.

One group suggested that the requirement in §206.2(a)(3) that state agencies avoid the use of vendor-specific non-standard extensions be modified to prohibit the use of such extensions. The department disagrees with this comment because of the need for agencies to retain some flexibility in determining which non-standard extensions may in fact be necessary for use in order to serve the agency's particular constituencies.

Another group requested the department to amend §206.2(a)(3) to specify which standards apply, expressly including any additional standards; still another requested that the word "appropriate" be included when referring to standards. The department agrees in part with these suggestions, and has therefore amended the text of this subsection to state that agencies should comply with "applicable" standards, and requiring agencies to refer to the department's guidelines for guidance on applicable standards and non-standard extensions, since these evolve over time. The department disagrees that such standards be specified in the rule text, however, since these standards may evolve relatively rapidly.

One group questioned the meaning of the term "non-standard extensions" as used in §206.2(a)(3). While the department disagrees that a useful definition can and should be included in the text of the rules, it nevertheless agrees that state agencies should have additional guidance on this topic if needed. Accordingly, the department has included language requiring agencies to refer to the department's guidelines for guidance on what may currently be regarded as non-standard extensions.

One group questioned whether a state agency is required to appoint an Accessibility Coordinator as referred to in §206.2(b). The department disagrees any implication that such a reference be removed from the rule text, since an accessibility coordinator, regardless of his or her actual title or designation or the fact that such a coordinator may perform other functions, is an essential function that should be performed by a state agency to maintain accessibility of state web sites.

Two groups claimed that the privacy and security requirements in §206.3(a)(1) - (4) are burdensome, and that analogous privacy requirements are already contained in the Federal Educational Right to Privacy Act. The groups asserted that they should therefore be exempted from the rules. The department disagrees that an exemption is either appropriate or possible, as indicated in the department's response to the first general comment above.

One group requested that the department clarify whether the language in §206.3(b) requires state agencies to obtain PICS ratings for their state web sites. The department responds that no such ratings are required, but disagrees with any implication that this must be made explicit in the rule text.

One group commented that the requirement in §206.3(c)(4) for use of SSL sessions to encrypt e-mail addresses should be removed. The department disagrees with this comment because of the statutory obligation of state agencies to maintain the confidentiality of e-mail addresses contained in §552.136, Government Code. The same group inquired as to whether an SSL session is required where e-mail addresses are permitted, but not required, to be entered. The department agrees in part that the language in this portion of the rules should be clarified, and has modified the text of the rule to provide that e-mail addresses must be encrypted through use of an SSL session when such information is provided by a member of the public in the course of completing a web based electronic form. Two groups requested clarification as to whether this requirement is intended to apply to employees' internal e-mail addresses. The department responds, for reasons discussed above pertaining to the intended scope of the rules, that the provision in question is not intended to apply to employees' internal e-mail addresses. The department disagrees that any change to the rule text is required, however.

One group commented that the requirements in §206.4 pertaining to links from state agencies to other web sites does not go far enough. The group suggested that state agencies should be required to link only to web pages that are accessible. The department disagrees that such a change to the rule text should be made, since such a change would either effectively cause the department to regulate the content of outside web sites, which exceeds the department's statutory authority, or could severely curtail the number of sites to which state web sites may link, thus effectively resulting in web sites that are less useful to site visitors. Nevertheless, the department believes that the intent behind the comment is commendable, and therefore urges state agencies to encourage owners of sites that are linked to by state web sites to comply voluntarily with the accessibility standards contained in this rule.

Another group commented that the linking policy contained in §206.4(1)(F) would be unworkable for universities' web sites. The department disagrees with this comment because the rule applies only to state web sites as defined in §206.1, and thus is more limited in scope than the group apparently assumes.

One group objected to the linking policy pertaining to graphics or tables contained in §206.4(1)(B). The department disagrees that this prohibition should be removed because to do so could result in shifting the downloading burden to state agency servers, resulting in a loss of efficiency in the use of state resources and a concomitant restriction in the availability of such resources to the general public. The same group commented that the language in §206.4(1)(B) requiring full forward links is too restrictive, and suggested that new windows should be permitted to be opened, as long as a notification to users is provided. The department disagrees with this comment, since the rule is intended to apply only to outside web sites and not state web sites per se.

One group inquired as to whether the provisions of §206.4(3)(B) pertaining to e-mail addresses indicated that e-mail addresses are not open records. The department responds that such e-mail addresses are excluded from the scope of public information pursuant to in §552.136, Government Code. The same group asked whether or not student e-mail addresses would be regarded as open records. The department believes that student e-mail addresses would be treated as open records to the extent such addresses are based upon domains that are state property; nevertheless, the department must defer such questions to the Office of the Attorney General, which has the authority to issue rulings regarding open records requests.

Two groups commented that §206.5(b) fails to differentiate between the missions and universities and those of regulatory and administrative agencies. The department disagrees with the comments for the reasons stated earlier in this preamble relating to the limited scope of the rules. The two groups also commented that the required links contained in that subsection were inappropriate because they consumed valuable home page real estate. The department disagrees with these comments because the majority of the links are statutorily required, and those that are not required (privacy and security policies and accessibility policies) are desirable both from a public policy perspective and because web site users have increasingly come to expect such information to be easily accessible from an organization's home page.

The new rules are adopted pursuant to §2054.121, Government Code, which requires the department to adopt a policy concerning state web sites and requires state agencies to post a link to the policy adopted by the department, and §2054.052(a), Government Code, which provides that the department may adopt rules as necessary to implement its responsibilities under the Information Resources Management Act.

Section 2054.121, Government Code, and §2054.052(a), Government Code, are affected by the rules.