Transmitting IRS forms to colleges

Is it common for schools to require IRS data (1040s and W2s) without providing a secure way to transmit the PII?

I ask because three of my son’s schools are request that info but do not accept IDOC. One of them recently emailed him and instructed him to just email the PDFs, which is kind of astonishing to me.

My older two children’s colleges all used IDOC and IRS DRT to collect the info they needed to process a financial aid application so this is new to me.

Are there any rules or laws that apply to how private institutions receive, store and process PII? Is it all just up to institutional policy?

How have other CC members handled this situation?

thanks for all input!

Well…back in the Stone Age…when my kids went to college, we mailed the requested forms…and blacked out things like our SS numbers except the last four digits.

Have you been selected for verification? Did you originally link your FAFSA to the IRS DRT?

Yes, FAFSA /DRT are linked and documents are uploaded to IDOC for the one school that uses that service.

At least one of the three non-IDOC schools definitely wants the info simultaneous with the application.

I assume I can black out SSNs but I have not verified if that is true.