Attachment 1

United States EPA 745B18001 April 2021

Environmental Protection Agency Office of Chemical

Safety and Pollution Prevention

Access to Toxic Substances Control Act Confidential Business Information:

A guide for access to TSCA CBI for state, local, and tribal governments

April 2021

Disclaimer:

This Guidance does not constitute rulemaking by the United States Environmental Protection Agency, and cannot be relied on to create a substantive or procedural right enforceable by any party in litigation with the United States. Non-mandatory language such as “should” provides recommendations and does not impose any legally binding requirements.

The Toxic Substances Control Act statutory provisions and EPA regulations described in this document contain legally binding requirements for access to TSCA Confidential Business Information. This document is not a regulation itself, nor does it change or substitute those provisions and regulations. While EPA has made every effort to ensure the accuracy of the discussion in this guidance, the obligations of EPA and the regulated community are determined by statutes, regulations, or other legally binding requirements, which supersede this guidance document.

Interested persons are free to raise questions and objections about the substance of this guidance and the appropriateness of the application of this guidance to a particular situation. EPA may make changes in this document at any time without prior public notice.

Paperwork Reduction Act Notice:

This collection of information is approved by OMB under the Paperwork Reduction Act, 44 U.S.C. 3501 et seq. (OMB Control No. 2070-0209). Responses to this collection of information are mandatory for certain persons, as specified in TSCA Section 14(d). An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. The public reporting and recordkeeping burden for this collection of information is estimated to be 14.8 hours per response. Send comments on the Agency’s need for this information, the accuracy of the provided burden estimates and any suggested methods for minimizing respondent burden to the Regulatory Support Division Director, U.S. Environmental Protection Agency (2821T), 1200 Pennsylvania Ave., NW, Washington, D.C. 20460. Include the OMB control number in any correspondence. Do not send the completed form to this address.

Preface:

The Toxic Substances Control Act of 1976 (TSCA) was amended in June of 2016. The amendments, known as the Frank R. Lautenberg Chemical Safety for the 21st Century Act, changed and expanded many parts of TSCA. Among these changes, under TSCA section 14(d) (15 U.S.C. 2613(d)), is an expansion of the categories of people who may now access TSCA confidential business information (CBI). TSCA CBI is information submitted to EPA under TSCA for which a business has made a claim of business confidentiality. This information is protected from disclosure until the business withdraws the CBI claim, until the CBI claim expires, until EPA determines that the claim is not entitled to confidential treatment, or as authorized under TSCA and EPA regulations. Further, under section 14(d)(4) (15 U.S.C. 2613(d)(4)), TSCA authorizes disclosure to state, tribal, and local governments, under certain conditions. Section 14(c)(4)(B) (15 U.S.C. 2613(c)(4)(B)) requires that EPA develop guidance concerning the “content and form of the statements of need and agreements required” under section 14(d)(4), (5), and (6).

This document provides guidance for state, tribal, and local governments regarding access to TSCA CBI under TSCA section 14(d)(4). Guidance for health and environmental professionals and for emergency CBI access is covered in separate guidance documents:

Access to Toxic Substances Control Act Confidential Business Information:

A guide for access to TSCA CBI for medical and environmental professionals in non-emergency situations (Available at: https://www.epa.gov/tsca-cbi/requesting-access-cbi-under-tsca)

Access to Toxic Substances Control Act Confidential Business Information:

A guide for access to TSCA CBI in emergency situations

(Available at: https://www.epa.gov/tsca-cbi/requesting-access-cbi-under-tsca)

EPA is establishing the following process, set out in further detail by this guidance document:

1. Requesting governments have the option, in advance of making a specific request for CBI access, to submit a written request to EPA detailing the requesting government’s relevant legal authorities and measures for protecting TSCA CBI that the requesting government regards as comparable to EPA’s.

2. EPA will review the authorities and measures submitted to determine whether or not it finds the requesting government’s authorities satisfy the “comparability” standard in the statute.

3. If EPA finds that the requesting government has comparable legal authorities and measures, EPA and the requesting government will enter into agreement establishing the parameters of information sharing. A model agreement is provided in this document.

4. If EPA has an agreement with a requesting government in place, the requesting government can then make a short written request to EPA for TSCA CBI, explaining that the information is for the purpose of the administration or enforcement of a law. The written request should provide that the requesting government’s law and procedures have not changed if it has been pre-approved. In accordance with TSCA section 14(d)(4), governments that do not have an agreement already in place with EPA must submit their authorities for EPA review along with their statement requesting the specific TSCA CBI.

5. EPA will review the request and will provide the information to the requesting government upon approval.

6. Prior to disclosure to the requesting government, EPA will provide 15-day notice to the person or persons who asserted the CBI claim, per TSCA 14(g)(2)(C)(i).

Table of Contents

1. Definitions

2. State, tribal and local government access to TSCA CBI

   1. Written request for “administration or enforcement of a law” required

   2. Agreement with EPA ensuring appropriate measures and authority to maintain confidentiality required

Appropriate Measures to Maintain Confidentiality; Comparable to EPA’s

Adequate Authority to Maintain Confidentiality; Comparable to EPA’s

3. Agreement in Advance of a Request

4. EPA contact for access agreements or to make a specific request for access to CBI

5. Notice and waiting period

6. Accessing CBI

3. Model Access Agreement

1. Definitions

Local government: (i.e., “political sub-division of a state”) a separate legal entity of a State which usually has specific governmental functions. The term ordinarily includes a county, city, town, village, or school district, and, in many States, a sanitation, utility, reclamation, drainage, flood control, or similar district.

Requesting government: A State, local government (i.e. political sub-division of a State), or tribal government.

State: any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, the Canal Zone, American Samoa, the Northern Mariana Islands, or any other territory or possession of the United States.

TSCA: the Toxic Substances Control Act, 15 U.S.C. 2601, et seq.

TSCA confidential business information (TSCA CBI): information submitted to EPA under TSCA, for which a business has made a claim of business confidentiality that EPA has not denied, that has not otherwise expired, or that the business has not waived or withdrawn.

Tribal government: means any Indian Tribe, band, nation, or community recognized by the United States Secretary of the Interior and exercising substantial governmental duties and powers.

2. State, tribal, and local government access to TSCA CBI

TSCA section 14(d)(4) provides that TSCA CBI shall be disclosed to a requesting government on written request under certain conditions:

1. The requesting government must request disclosure in writing for the purpose of the administration or enforcement of a law; and

2. The requesting government must have one or more applicable agreements with EPA that are consistent with this document, and which will ensure that the entity has adequate authority to maintain the confidentiality of the information and will maintain the information in accordance with procedures comparable to the safeguarding procedures used by EPA.

This section outlines the recommended contents of a written request and how to submit. This section also addresses the requirements for an agreement with EPA. According to TSCA section 14(d)(4), the agreement must ensure that the requesting government has adequate authority to maintain the confidentiality of the requested information and appropriate safeguards to maintain confidentiality. As described in this section, EPA is providing two options for reaching an agreement with EPA.

• The first option allows a requesting government to seek pre-approval that it meets the appropriate measures and adequate authority requirements. Such approval would be memorialized in an agreement. The requesting government may later submit a written request that references the prior agreement and provide assurance that its confidentiality requirements that EPA previously approved have not changed. In accordance with TSCA section 14(d)(4), the written request must also explain that the information is for the purpose of administration or enforcement of a law.

• The second option allows a requesting government to submit a specific written request demonstrating it meets the appropriate measures, adequate authority, and purposes requirements described above, all at the same time. EPA will then review the request and make an agreement with the requester, if appropriate.

1. Written request for purpose of “administration or enforcement of a law” required

Pursuant to TSCA section 14(d)(4), a requesting government must submit a written request that specifies the information or type of information sought and explains that the information is for “administration or enforcement of a law.” In order to satisfy this requirement, written requests should include the legal citation to the relevant local, state, or federal law, and a brief description of the law. For example, a state government may request TSCA CBI for an incident or accident investigation that is required or authorized under the particular law.

The written request should be submitted by mail, fax, email, or delivery service to the address in Section II.D below. After reviewing the written request, EPA may request further information or clarification from the requesting government.

2. Agreement with EPA ensuring appropriate measures and authority to maintain confidentiality required

In accordance with TSCA section 14(d)(4), the requesting government must have one or more agreement(s) with EPA that ensure that the requesting government: (1) will take appropriate measures and (2) has adequate authority to maintain the confidentiality of the information in accordance with procedures comparable to the procedures EPA uses to safeguard the information. This section discusses the requirements concerning appropriate measures and adequate authority. Additionally, a model access agreement is appended to this document.

Appropriate Measures to Maintain Confidentiality; Comparable to EPA’s

Requesting governments should consider the factors discussed below, addressing appropriate measures and comparability. Prior to or along with a request for specific information, the requesting government should provide a statement to EPA addressing appropriate measures and comparability. This statement, along with any necessary revisions, would be included as part of the written agreement. EPA expects that the statement would typically (but not necessarily always) be made and signed by the chief legal officer or chief information security officer in the requesting government.

EPA handles TSCA CBI in accordance with the TSCA CBI Protection Manual ¹, or “the CBI Manual.” The CBI Manual sets forth the processes and procedures for managing TSCA CBI. It includes detailed provisions on the following aspects of managing TSCA CBI:

1. TSCA CBI Access—who may access TSCA CBI (Chapter 2)

2. TSCA CBI Responsibilities—protective controls and measures (Chapter 3)

3. TSCA CBI Document Management—applies primarily to paper documents (Chapter 4)

4. Procedures for violations, unaccounted for documents, and unauthorized disclosures (Chapter 5)

With the CBI Manual as background, EPA has developed the following factors for requesting governments to consider in developing their statement concerning appropriate measures to maintain confidentiality of information in accordance with procedures comparable to those used by EPA:

1. Personnel Access Generally:

• Employees (or contractors) of the requesting government should be made aware of the special procedures and handling requirements for CBI materials.

• Employees (or contractors) of the requesting government should be required to undergo training prior to, or in order to maintain access to such materials.

• Access to such materials should be subject to management or supervisory approval.

• The requesting government should keep a roster of personnel authorized to view/use such materials.

• Employees (or contractors) of the requesting government should be required to sign a confidentiality agreement or similar acknowledgement of their obligation to maintain the confidentiality of information to which they are granted access.

• Termination of access privileges should be documented.

• Personnel should be assigned to maintain access lists, approvals, agreements, and verify training requirements are met.

• Employees (or contractors) of the requesting government should be required to notify a supervisor or other responsible person of deviations in confidential materials handling procedures, including possible loss of documents or possible disclosure to unauthorized persons.

2. Physical and Electronic Security:

• Physical control of access to confidential materials should be maintained. For example, confidential materials should be stored in safes or locked cabinets, and/or in locked rooms.

• Storage containers/rooms used for storing confidential materials should be dedicated for storage and use of such materials.

• Secure electronic storage and access to such information should be maintained. For example, consider whether confidential materials are permitted to be emailed, or stored on computers that are connected to the Internet.

• A policy should be established concerning whether such materials are permitted to be removed from the government’s physical facilities and used or stored offsite, such as on an employee’s government-issued laptop computer.

3. Use of and Access to TSCA CBI:

   • There should be rules or procedures concerning personnel’s use and storage of confidential materials, including destruction of such materials, once they are no longer needed.

   • Confidential materials should be kept in secure areas/containers and not left unattended.

   • Documents and copies should be required to be tracked and accounted for.

   • Employees (or contractors) of the requesting government should be required to notify a supervisor or other responsible person of any loss or misplacement of confidential materials.

   • There should be rules or procedures for assuring that confidential materials are not inappropriately incorporated into materials that are being released to the public, or to other persons to whom disclosure is not authorized.

The list of considerations above is not exhaustive, but are considered to be the most central to a review for comparability. EPA can consider additional or alternative measures, procedures, and practices relevant to its assessment of the comparability of a requesting government’s measures to protect confidentiality under 14(d)(4). Governments should feel free to include any additional measures they consider to be helpful to EPA’s assessment of adequacy, and EPA may request further information or clarification from the requesting government.

Adequate Authority to Maintain Confidentiality; Comparable to EPA’s

TSCA section 14(d)(4) requires a requesting government to demonstrate adequate authority to maintain confidentiality of applicable documents and that such authority is comparable to that of EPA’s. In order to satisfy this statutory requirement, prior to or along with a request for specific information, the requesting government should provide a statement concerning its authorities. EPA expects that the statement would typically (but not necessarily always) be made and signed by the chief legal officer in the requesting government.

With certain exceptions, EPA is prohibited from disclosing TSCA CBI unless: (1) EPA determines that the information is not entitled to confidential treatment; (2) the CBI claim has expired or; (3) the submitter has waived or withdrawn the CBI claim. TSCA section 14 uses Exemption 4 of the Freedom of Information Act (FOIA) as the basic standard for eligibility for confidential treatment (note that section 14 also imposes procedural requirements for making CBI claims, and specifies that certain information is not protected from disclosure).

A requesting government that has a comparable exemption of confidential business information in its open records or other information disclosure laws should discuss the operation of such provisions, as well as any other state, local, or tribal authority that would affect the disclosure or withholding of TSCA CBI obtained from EPA. If there is no provision such as this, the requesting government should explain why their laws protecting CBI are nonetheless comparable to EPA’s. Similarly, if a requesting government can withhold the TSCA CBI under other authorities, such as an authority to withhold data obtained pursuant to a confidentiality agreement, such provisions would also be useful to cite in the statement referenced above. Finally, if a requesting government has a provision that requires the mandatory disclosure of TSCA CBI, it should provide such provision and explain how it is still able to protect TSCA CBI in a manner comparable to EPA.

EPA has developed the following factors for requesting governments to consider when developing the statement concerning the authorities it believes are comparable to federal laws and procedures for maintaining the confidentiality of business information:

1. CBI Exemption: Your government should have legal authority to protect TSCA CBI. For example, a requesting government should have a law similar to Exemption 4 of the federal FOIA (5 U.S.C. 552(b)(4)), which protects "trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential.”

2. Notice and Comment by Affected Business: In the event a third-party requests TSCA CBI information through your government’s applicable freedom of information provisions, or your government would like to disclose the information to the public, your government should permit businesses to claim information as CBI, and permit the affected business(es) an opportunity to comment on such claims prior to that information being released to the third party requester or the public.  For example, 40 C.F.R. 2.203(a)-(b), 2.204(e) and 2.214, as applied in 2.306(c)-(d) to information obtained under TSCA, require EPA to notify affected businesses that they may make confidentiality claims when it requests information from such businesses, and to notify and permit comment from businesses when the information has been requested under the FOIA, when EPA is otherwise making a determination as to the validity of the CBI claim, or when a FOIA requester initiates suit against EPA for release of the information.

3. Substantive Criteria for Determining Confidentiality: Your government should have authority providing substantive criteria for use in determining the adequacy of confidentiality claims made by the affected business. For example, see federal rules at 40 C.F.R. 2.205 and 2.208, as adapted in 2.306(e) and (g) to information obtained under TSCA. The criteria should address the following items:

• Waiver: Assertion by the business that the confidentiality claim has not expired by its terms, nor been waived or withdrawn;

• Protective Measures: The business has satisfactorily shown that it has taken reasonable internal measures to protect the confidentiality of the information and that it continues to take such measures;

• Publicly Unavailable: The information is not, and has not been, made reasonably obtainable without the business’s consent by other persons (other than governmental bodies) by use of legitimate means (other than discovery based on a showing of special need in a judicial or quasi-judicial proceeding); and

• Legally Protected: No statute specifically requires disclosure of the information and the business has satisfactorily shown that disclosure of the information is likely to cause substantial harm to the business’s competitive position.

A determination based on these criteria should be made by an appropriate office in your government. The office should consider the business’s claim and comments substantiating its claim.

4. Opportunity to Judicially Appeal a Release Decision: Your government should have provisions providing any business whose confidentiality claim is denied or denied in part the opportunity to appeal the adverse determination through judicial review under applicable state, local, or tribal law. For example, 40 C.F.R. 2.306(e)(3) provides businesses 30 working days to obtain judicial review from the time an affected business receives an adverse confidentiality determination from EPA.

5. Penalty for Wrongful Disclosure: Your government should have authorities requiring all officers or employees to take appropriate measures to safeguard the information from improper disclosure and have the ability to hold accountable any officers or employees that wrongfully disclose any TSCA confidential business information. For example, see 40 C.F.R. 2.211(a)-(c) and 2.306(c). See also TSCA section 14(h) (15 U.S.C. 2613(h)).

6. Contractors and Assigns: If your government permits contractors to access confidential information, the access should be limited to the extent it is necessary for the satisfactory performance of their work and are subject to the same rules and procedures to properly safeguard the information as apply to government employees. For example, TSCA 14(d)(2) and 40 C.F.R. 2.306(j) allow federal government contractors to access TSCA CBI, while generally requiring them to follow the same steps as federal employees to safeguard the information.

7. Mandatory Disclosure Requirements: Please list any laws, policy, or procedures that require mandatory disclosure of TSCA CBI outside of state, tribal, or local government employees or contractors. For example, EPA is usually required to release health and safety data, with some exceptions.

The Federal requirements listed above are not exhaustive, but are considered to be central to assessing comparability. EPA will consider additional or alternative authorities it finds relevant to its assessment of the adequacy of a government’s authority under 14(d)(4). Governments should feel free to include any additional authorities they consider to be helpful to EPA’s assessment of adequate legal authority, and EPA may request further information or clarification from the requesting government.

3. Agreement in Advance of a Request

In an effort to streamline the process, a requesting government may seek pre-approval (i.e., advance agreement with EPA) that its measures to maintain confidentiality are appropriate, it has adequate authority to maintain confidentiality, and such measures and authorities are comparable to EPA’s, in advance of an actual request for TSCA CBI. At the address provided below, the requesting government should provide the statements discussed in Sections II.A and II.B above, concerning appropriate measures, adequate authorities, and comparability. After review and approval of the submission, EPA will make an agreement with the requesting government. Reaching an advance agreement could reduce the time necessary for EPA review of a written request.

If a requesting government has an advance agreement, it must (in accordance with TSCA section 14(d)(4)) still file a written request that specifies the information or type of information sought and explains that the information is for “administration or enforcement of a law.” The written request should reference the prior agreement and provide assurance that the requesting government’s confidentiality requirements that EPA previously approved have not changed.

4. EPA contact for access agreements or to make a specific request for access to CBI

To request access to particular CBI, or to submit materials to support an access agreement, contact by mail or delivery service:

Director, Information Management Division

Office of Pollution Prevention and Toxics

Office of Chemical Safety and Pollution Prevention

William Jefferson Clinton Building East
1200 Pennsylvania Avenue, N. W.
Mail Code: 7407M
Washington, DC 20460

Phone: 202-564-0970

Requests may also be faxed or emailed:

Fax number: (202) 564-7470

Email: a current list of staff contacts is maintained on EPA’s website, at: https://www.epa.gov/tsca-cbi/requesting-access-cbi-under-tsca

Requests for access and materials supporting an access agreement will be evaluated by the EPA Office of Chemical Safety and Pollution Prevention, in consultation with the EPA Office of General Counsel. Requests will be acknowledged in writing, and a staff point of contact will be provided in the acknowledgement.

5. Notice and waiting period

Once the above requirements have been met, and EPA has determined that release of the information can be made to the requesting government, EPA will provide 15-day notice to the affected business before disclosing the information. TSCA section 14(g)(2)(C)(i).

Requesting governments should be aware that per TSCA 14(g)(2)(D)(i), an affected business may file a legal challenge in Federal court. If there is a legal challenge, EPA will inform the requesting government. EPA may still disclose the information to the requesting government despite such a legal challenge. See TSCA section 14(g)(2)(D)(ii)(II).

6. Accessing CBI

Once EPA has determined that the requesting government has met all the criteria of section 14(d)(4), and the required 15-day notice period has elapsed, EPA will make the requested documents available in either hard copy or by means of secure electronic access. When EPA notifies the requesting government that a request for access has been granted, EPA will also explain how access will be provided.

2. MODEL TSCA CONFIDENTIAL INFORMATION ACCESS AGREEMENT

1. PARTIES

The parties to this Agreement are the Environmental Protection Agency (EPA) and [state/tribe/subdivision of state] (the "Parties").

2. PURPOSE AND SCOPE

This Agreement facilitates EPA’s sharing of confidential information submitted to EPA under the Toxic Substances Control Act (TSCA) with [state/tribe/subdivision of state], as authorized under and in accordance with TSCA section 14(d)(4) (15 U.S.C. 2613(d)(4)).

3. AUTHORITY

TSCA section 14(d)(4) (15 U.S.C. 2613(d)(4)).

4. SHARING OF CONFIDENTIAL INFORMATION

1. Definitions: As used in this Agreement-

"Confidential Information" means information that has been submitted to EPA under TSCA and claimed as confidential pursuant to the requirements of TSCA.

2. The [state/tribe/subdivision of a state]:

1. Certifies that it has legal authority to maintain the confidentiality of Confidential Information obtained pursuant to this agreement and 15 U.S.C. 2613. A detailed statement, including relevant legal citations, from [state/tribe/subdivision of state] concerning such authority is attached to this Agreement as Appendix 1.

2. Agrees to follow the procedures set forth in Appendix 2 to safeguard the Confidential Information provided by EPA under this agreement.

4. MISCELLANEOUS

1. This Agreement does not create any right, benefit or privilege, substantive or procedural, enforceable at law or in equity against the United States, its departments, agencies, instrumentalities, or entities, its officers or employees, or any other person.

2. Confidential information covered by this Agreement is subject to criminal prohibitions against unlawful disclosure (15 U.S.C. 2613(h)).

3. In the event that the [state/tribe/subdivision of state] legal authority to maintain the confidentiality of CBI obtained pursuant to this agreement changes from that described in Appendix 1, or due to other relevant reason that result in the [state/tribe/subdivision of state] no longer being able to maintain the measures described in Appendix 2, the [state/tribe/subdivision of state] shall promptly notify EPA of these changed circumstances. Further sharing of CBI by EPA with [state/tribe/subdivision of state] will be immediately suspended pending EPA’s consideration of whether CBI may still be disclosed to the [state/tribe/subdivision of state] in accordance with 15 U.S.C. 2613(d), in light of the changed circumstances.

4. In the event that the [state/tribe/subdivision of state] becomes aware or has reason to believe that CBI disclosed to it pursuant to this Agreement has become lost or misplaced, has been or is suspected to have been disclosed to anyone other than as authorized in this agreement, the [state/tribe/subdivision of state] shall promptly notify EPA of the time, date, extent, and nature of the loss or disclosure or suspected disclosure.

4. TERMINATION OF AGREEMENT

This Agreement can be terminated with 90 day’s advance notice of termination by either party, or sooner by mutual consent of both parties.

4. MODIFICATION PROVISIONS

This Agreement can be modified at any time by mutual written agreement of both parties.

4. POINTS OF CONTACT

The following individuals are designated as points of contact for the Agreement:

U.S. Environmental Protection Agency [DD of IMD]:

[Requesting Government]:

4. SIGNATURE

This Agreement between EPA and [REQUESTING ENTITY] is agreed to by:

[Typically, the chief legal officer in the requesting government]

For the [state/tribe/subdivision of state]:

Administrator [or to whom authority delegated at the time of agreement]

For the Environmental Protection Agency:

APPENDIX 1

[Include a detailed statement, including relevant legal citations, concerning [state/tribe/subdivision of state] legal authority to maintain the confidentiality of Confidential Information obtained pursuant to this agreement and 15 U.S.C. 2613.]

APPENDIX 2

[Identify procedures that will be followed to safeguard the Confidential Information provided by EPA under this agreement.]

1 Available by searching for TSCA CBI Protection Manual, at https://www.epa.gov/nscep. This document refers to the 2003 edition of the Manual.