** EDA Unitedstates
Environmental Protection Agency
™ ™ SmbS m *
EPA 745B18001June 2018
Office of Chemical
Safety and Pollution Prevention
Access to Toxic Substances Control Act
Confidential Business Information:
A guide for access to TSCA CBI for state, local, and
tribal governments
June 2018

-------
Preface:
The Toxic Substances Control Act of 1976 (TSCA) was amended in June of 2016. The amendments,
known as the Frank R. Lautenberg Chemical Safety for the 21st Century Act, changed and expanded
many parts of TSCA. Among these changes, under TSCA section 14(d) (15 U.S.C. 2613(d)), is an
expansion of the categories of people who may now access TSCA confidential business information
(CBI). TSCA CBI is information submitted to EPA under TSCA for which a business has made a claim of
business confidentiality. This information is protected from disclosure until the business withdraws the
CBI claim, until the CBI claim expires, until EPA determines that the claim is not entitled to confidential
treatment, or as authorized under TSCA and EPA regulations. Further, under section 14(d)(4) (15 U.S.C.
2613(d)(4)), TSCA authorizes disclosure to state, tribal, and local governments, under certain conditions.
Section 14(c)(4)(B) (15 U.S.C. 2613(c)(4)(B)) requires that EPA develop guidance concerning the "content
and form of the statements of need and agreements required" under section 14(d)(4), (5), and (6).
This document provides guidance for state, tribal, and local governments regarding access to TSCA CBI
under TSCA section 14(d)(4). Guidance for health and environmental professionals and for emergency
CBI access is covered in separate guidance documents:
Access to Toxic Substances Control Act Confidential Business Information:
A guide for access to TSCA CBI for medical and environmental professionals in non-emergency situations
(Available at: https://www.epa.gov/tsca-cbi/requesting-access-cbi-under-tsca)
Access to Toxic Substances Control Act Confidential Business Information:
A guide for access to TSCA CBI in emergency situations
(Available at: https://www.epa.gov/tsca-cbi/requesting-access-cbi-under-tsca)
EPA is establishing the following process, set out in further detail by this guidance document:
1.	Requesting governments have the option, in advance of making a specific request for CBI
access, to submit a written request to EPA detailing the requesting government's relevant legal
authorities and measures for protecting TSCA CBI that the requesting government regards as
comparable to EPA's.
2.	EPA will review the authorities and measures submitted to determine whether or not it finds
the requesting government's authorities satisfy the "comparability" standard in the statute.
3.	If EPA finds that the requesting government has comparable legal authorities and measures,
EPA and the requesting government will enter into agreement establishing the parameters of
information sharing. A model agreement is provided in this document.
4.	If EPA has an agreement with a requesting government in place, the requesting government
can then make a short written request to EPA for TSCA CBI, explaining that the information is
for the purpose of the administration or enforcement of a law. The written request should
provide that the requesting government's law and procedures have not changed if it has been
pre-approved. In accordance with TSCA section 14(d)(4), governments that do not have an
agreement already in place with EPA must submit their authorities for EPA review along with
their statement requesting the specific TSCA CBI.
2

-------
5.	EPA will review the request and will provide the information to the requesting government
upon approval.
6.	Prior to disclosure to the requesting government, EPA will provide 15-day notice to the person
or persons who asserted the CBI claim, per TSCA 14(g)(2)(C)(i).
Disclaimer:
This Guidance does not constitute rulemaking by the United States Environmental Protection Agency,
and cannot be relied on to create a substantive or procedural right enforceable by any party in litigation
with the United States. Non-mandatory language such as "should" provides recommendations and does
not impose any legally binding requirements.
The Toxic Substances Control Act statutory provisions and EPA regulations described in this document
contain legally binding requirements for access to TSCA Confidential Business Information. This
document is not a regulation itself, nor does it change or substitute those provisions and regulations.
While EPA has made every effort to ensure the accuracy of the discussion in this guidance, the
obligations of EPA and the regulated community are determined by statutes, regulations, or other
legally binding requirements, which supersede this guidance document.
Interested persons are free to raise questions and objections about the substance of this guidance and
the appropriateness of the application of this guidance to a particular situation. EPA may make changes
in this document at any time without prior public notice.
3

-------
Table of Contents
I.	Definitions
II.	State, tribal and local government access to TSCA CBI
A.	Written request for "administration or enforcement of a law" required
B.	Agreement with EPA ensuring appropriate measures and authority to maintain
confidentiality required
Appropriate Measures to Maintain Confidentiality; Comparable to EPA's
Adequate Authority to Maintain Confidentiality; Comparable to EPA's
C.	Agreement in Advance of a Request
D.	EPA contact for access agreements or to make a specific request for access to CBI
E.	Notice and waiting period
F.	Accessing CBI
III.	Model Access Agreement
4

-------
I. Definitions
Local government: (i.e., "political sub-division of a state") a separate legal entity of a State which usually
has specific governmental functions. The term ordinarily includes a county, city, town, village, or school
district, and, in many States, a sanitation, utility, reclamation, drainage, flood control, or similar district.
Requesting government: A State, local government (i.e. political sub-division of a State), or tribal
government.
State: any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the
Virgin Islands, Guam, the Canal Zone, American Samoa, the Northern Mariana Islands, or any other
territory or possession of the United States.
TSCA: the Toxic Substances Control Act, 15 U.S.C. 2601, etseq.
TSCA confidential business information (TSCA CBI): information submitted to EPA under TSCA, for which
a business has made a claim of business confidentiality that EPA has not denied, that has not otherwise
expired, or that the business has not waived or withdrawn.
Tribal government: means any Indian Tribe, band, nation, or community recognized by the United
States Secretary of the Interior and exercising substantial governmental duties and powers.
5

-------
II. State, tribal, and local government access to TSCA CBI
TSCA section 14(d)(4) provides that TSCA CBI shall be disclosed to a requesting government on written
request under certain conditions:
1.	The requesting government must request disclosure in writing for the purpose of the
administration or enforcement of a law; and
2.	The requesting government must have one or more applicable agreements with EPA that are
consistent with this document, and which will ensure that the entity has adequate authority to maintain
the confidentiality of the information and will maintain the information in accordance with procedures
comparable to the safeguarding procedures used by EPA.
This section outlines the recommended contents of a written request and how to submit. This section
also addresses the requirements for an agreement with EPA. According to TSCA section 14(d)(4), the
agreement must ensure that the requesting government has adequate authority to maintain the
confidentiality of the requested information and appropriate safeguards to maintain confidentiality. As
described in this section, EPA is providing two options for reaching an agreement with EPA.
•	The first option allows a requesting government to seek pre-approval that it meets the
appropriate measures and adequate authority requirements. Such approval would be
memorialized in an agreement. The requesting government may later submit a written
request that references the prior agreement and provide assurance that its confidentiality
requirements that EPA previously approved have not changed. In accordance with TSCA
section 14(d)(4), the written request must also explain that the information is for the purpose
of administration or enforcement of a law.
•	The second option allows a requesting government to submit a specific written request
demonstrating it meets the appropriate measures, adequate authority, and purposes
requirements described above, all at the same time. EPA will then review the request and
make an agreement with the requester, if appropriate.
A. Written request for purpose of "administration or enforcement of a law" required
Pursuant to TSCA section 14(d)(4), a requesting government must submit a written request that
specifies the information or type of information sought and explains that the information is for
"administration or enforcement of a law." In order to satisfy this requirement, written requests should
include the legal citation to the relevant local, state, or federal law, and a brief description of the law.
For example, a state government may request TSCA CBI for an incident or accident investigation that is
required or authorized under the particular law.
The written request should be submitted by mail, fax, email, or delivery service to the address in Section
II.D below. After reviewing the written request, EPA may request further information or clarification
from the requesting government.
6

-------
B. Agreement with EPA ensuring appropriate measures and authority to maintain
confidentiality required
In accordance with TSCA section 14(d)(4), the requesting government must have one or more
agreement(s) with EPA that ensure that the requesting government: (1) will take appropriate measures
and (2) has adequate authority to maintain the confidentiality of the information in accordance with
procedures comparable to the procedures EPA uses to safeguard the information. This section discusses
the requirements concerning appropriate measures and adequate authority. Additionally, a model
access agreement is appended to this document.
Appropriate Measures to Maintain Confidentiality; Comparable to EPA's
Requesting governments should consider the factors discussed below, addressing appropriate measures
and comparability. Prior to or along with a request for specific information, the requesting government
should provide a statement to EPA addressing appropriate measures and comparability. This statement,
along with any necessary revisions, would be included as part of the written agreement. EPA expects
that the statement would typically (but not necessarily always) be made and signed by the chief legal
officer or chief information security officer in the requesting government.
EPA handles TSCA CBI in accordance with the TSCA CBI Protection Manual1, or "the CBI Manual." The
CBI Manual sets forth the processes and procedures for managing TSCA CBI. It includes detailed
provisions on the following aspects of managing TSCA CBI:
1.	TSCA CBI Access—who may access TSCA CBI (Chapter 2)
2.	TSCA CBI Responsibilities—protective controls and measures (Chapter 3)
3.	TSCA CBI Document Management—applies primarily to paper documents (Chapter 4)
4.	Procedures for violations, unaccounted for documents, and unauthorized disclosures (Chapter 5)
With the CBI Manual as background, EPA has developed the following factors for requesting
governments to consider in developing their statement concerning appropriate measures to maintain
confidentiality of information in accordance with procedures comparable to those used by EPA:
1. Personnel Access Generally:
•	Employees (or contractors) of the requesting government should be made aware of the
special procedures and handling requirements for CBI materials.
•	Employees (or contractors) of the requesting government should be required to
undergo training prior to, or in order to maintain access to such materials.
•	Access to such materials should be subject to management or supervisory approval.
•	The requesting government should keep a roster of personnel authorized to view/use
such materials.
•	Employees (or contractors) of the requesting government should be required to sign a
confidentiality agreement or similar acknowledgement of their obligation to maintain
the confidentiality of information to which they are granted access.
•	Termination of access privileges should be documented.
1 Available by searching for TSCA CBI Protection Manual, at https://www.epa.gov/nscep. This document refers to
the 2003 edition of the Manual.
7

-------
•	Personnel should be assigned to maintain access lists, approvals, agreements, and verify
training requirements are met.
•	Employees (or contractors) of the requesting government should be required to notify a
supervisor or other responsible person of deviations in confidential materials handling
procedures, including possible loss of documents or possible disclosure to unauthorized
persons.
2.	Physical and Electronic Security:
•	Physical control of access to confidential materials should be maintained. For example,
confidential materials should be stored in safes or locked cabinets, and/or in locked
rooms.
•	Storage containers/rooms used for storing confidential materials should be dedicated
for storage and use of such materials.
•	Secure electronic storage and access to such information should be maintained. For
example, consider whether confidential materials are permitted to be emailed, or
stored on computers that are connected to the Internet.
•	A policy should be established concerning whether such materials are permitted to be
removed from the government's physical facilities and used or stored offsite, such as on
an employee's government-issued laptop computer.
3.	Use of and Access to TSCA CBI:
•	There should be rules or procedures concerning personnel's use and storage of
confidential materials, including destruction of such materials, once they are no longer
needed.
•	Confidential materials should be kept in secure areas/containers and not left
unattended.
•	Documents and copies should be required to be tracked and accounted for.
•	Employees (or contractors) of the requesting government should be required to notify a
supervisor or other responsible person of any loss or misplacement of confidential
materials.
•	There should be rules or procedures for assuring that confidential materials are not
inappropriately incorporated into materials that are being released to the public, or to
other persons to whom disclosure is not authorized.
The list of considerations above is not exhaustive, but are considered to be the most central to a review
for comparability. EPA can consider additional or alternative measures, procedures, and practices
relevant to its assessment of the comparability of a requesting government's measures to protect
confidentiality under 14(d)(4). Governments should feel free to include any additional measures they
consider to be helpful to EPA's assessment of adequacy, and EPA may request further information or
clarification from the requesting government.
Adequate Authority to Maintain Confidentiality; Comparable to EPA's
TSCA section 14(d)(4) requires a requesting government to demonstrate adequate authority to maintain
confidentiality of applicable documents and that such authority is comparable to that of EPA's. In order
8

-------
to satisfy this statutory requirement, prior to or along with a request for specific information, the
requesting government should provide a statement concerning its authorities. EPA expects that the
statement would typically (but not necessarily always) be made and signed by the chief legal officer in
the requesting government.
With certain exceptions, EPA is prohibited from disclosing TSCA CBI unless: (1) EPA determines that the
information is not entitled to confidential treatment; (2) the CBI claim has expired or; (3) the submitter
has waived or withdrawn the CBI claim. TSCA section 14 uses Exemption 4 of the Freedom of
Information Act (FOIA) as the basic standard for eligibility for confidential treatment (note that section
14 also imposes procedural requirements for making CBI claims, and specifies that certain information is
not protected from disclosure).
A requesting government that has a comparable exemption of confidential business information in its
open records or other information disclosure laws should discuss the operation of such provisions, as
well as any other state, local, or tribal authority that would affect the disclosure or withholding of TSCA
CBI obtained from EPA. If there is no provision such as this, the requesting government should explain
why their laws protecting CBI are nonetheless comparable to EPA's. Similarly, if a requesting
government can withhold the TSCA CBI under other authorities, such as an authority to withhold data
obtained pursuant to a confidentiality agreement, such provisions would also be useful to cite in the
statement referenced above. Finally, if a requesting government has a provision that requires the
mandatory disclosure of TSCA CBI, it should provide such provision and explain how it is still able to
protect TSCA CBI in a manner comparable to EPA.
EPA has developed the following factors for requesting governments to consider when developing the
statement concerning the authorities it believes are comparable to federal laws and procedures for
maintaining the confidentiality of business information:
1.	CBI Exemption: Your government should have legal authority to protect TSCA CBI. For example, a
requesting government should have a law similar to Exemption 4 of the federal FOIA (5 U.S.C.
552(b)(4)), which protects "trade secrets and commercial or financial information obtained from
a person [that is] privileged or confidential."
2.	Notice and Comment by Affected Business: In the event a third-party requests TSCA CBI
information through your government's applicable freedom of information provisions, or your
government would like to disclose the information to the public, your government should permit
businesses to claim information as CBI, and permit the affected business(es) an opportunity to
comment on such claims prior to that information being released to the third party requester or
the public. For example, 40 C.F.R. 2.203(a)-(b), 2.204(e) and 2.214, as applied in 2.306(c)-(d) to
information obtained under TSCA, require EPA to notify affected businesses that they may make
confidentiality claims when it requests information from such businesses, and to notify and
permit comment from businesses when the information has been requested under the FOIA,
when EPA is otherwise making a determination as to the validity of the CBI claim, or when a FOIA
requester initiates suit against EPA for release of the information.
3.	Substantive Criteria for Determining Confidentiality: Your government should have authority
providing substantive criteria for use in determining the adequacy of confidentiality claims made
by the affected business. For example, see federal rules at 40 C.F.R. 2.205 and 2.208, as adapted
9

-------
in 2.306(e) and (g) to information obtained under TSCA. The criteria should address the following
items:
•	Waiver: Assertion by the business that the confidentiality claim has not expired by its terms,
nor been waived or withdrawn;
•	Protective Measures: The business has satisfactorily shown that it has taken reasonable
internal measures to protect the confidentiality of the information and that it continues to
take such measures;
•	Publicly Unavailable: The information is not, and has not been, made reasonably obtainable
without the business's consent by other persons (other than governmental bodies) by use of
legitimate means (other than discovery based on a showing of special need in a judicial or
quasi-judicial proceeding); and
•	Legally Protected: No statute specifically requires disclosure of the information and the
business has satisfactorily shown that disclosure of the information is likely to cause
substantial harm to the business's competitive position.
A determination based on these criteria should be made by an appropriate office in your
government. The office should consider the business's claim and comments substantiating its
claim.
4.	Opportunity to Judicially Appeal a Release Decision: Your government should have provisions
providing any business whose confidentiality claim is denied or denied in part the opportunity to
appeal the adverse determination through judicial review under applicable state, local, or tribal
law. For example, 40 C.F.R. 2.306(e)(3) provides businesses 30 working days to obtain judicial
review from the time an affected business receives an adverse confidentiality determination
from EPA.
5.	Penalty for Wrongful Disclosure: Your government should have authorities requiring all officers
or employees to take appropriate measures to safeguard the information from improper
disclosure and have the ability to hold accountable any officers or employees that wrongfully
disclose any TSCA confidential business information. For example, see 40 C.F.R. 2.211(a)-(c) and
2.306(c). See also TSCA section 14(h) (15 U.S.C. 2613(h)).
6.	Contractors and Assigns: If your government permits contractors to access confidential
information, the access should be limited to the extent it is necessary for the satisfactory
performance of their work and are subject to the same rules and procedures to properly
safeguard the information as apply to government employees. For example, TSCA 14(d)(2) and
40 C.F.R. 2.306(j) allow federal government contractors to access TSCA CBI, while generally
requiring them to follow the same steps as federal employees to safeguard the information.
7.	Mandatory Disclosure Requirements: Please list any laws, policy, or procedures that require
mandatory disclosure of TSCA CBI outside of state, tribal, or local government employees or
contractors. For example, EPA is usually required to release health and safety data, with some
exceptions.
The Federal requirements listed above are not exhaustive, but are considered to be central to assessing
comparability. EPA will consider additional or alternative authorities it finds relevant to its assessment
of the adequacy of a government's authority under 14(d)(4). Governments should feel free to include
10

-------
any additional authorities they consider to be helpful to EPA's assessment of adequate legal authority,
and EPA may request further information or clarification from the requesting government.
C. Agreement in Advance of a Request
In an effort to streamline the process, a requesting government may seek pre-approval (i.e., advance
agreement with EPA) that its measures to maintain confidentiality are appropriate, it has adequate
authority to maintain confidentiality, and such measures and authorities are comparable to EPA's, in
advance of an actual request for TSCA CBI. At the address provided below, the requesting government
should provide the statements discussed in Sections II.A and II.B above, concerning appropriate
measures, adequate authorities, and comparability. After review and approval of the submission, EPA
will make an agreement with the requesting government. Reaching an advance agreement could
reduce the time necessary for EPA review of a written request.
If a requesting government has an advance agreement, it must (in accordance with TSCA section
14(d)(4)) still file a written request that specifies the information or type of information sought and
explains that the information is for "administration or enforcement of a law." The written request
should reference the prior agreement and provide assurance that the requesting government's
confidentiality requirements that EPA previously approved have not changed.
D. EPA contact for access agreements or to make a specific request for access to CBI
To request access to particular CBI, or to submit materials to support an access agreement, contact by
mail or delivery service:
Director, Information Management Division
Office of Pollution Prevention and Toxics
Office of Chemical Safety and Pollution Prevention
William Jefferson Clinton Building East
1200 Pennsylvania Avenue, N. W.
Mail Code: 7407M
Washington, DC 20460
Phone: 202-564-0970
Requests may also be faxed or emailed:
Fax number: (202) 564-7470
Email: a current list of staff contacts is maintained on EPA's website, at: https://www.epa.gov/tsca-
cbi/requesting-access-cbi-under-tsca
Requests for access and materials supporting an access agreement will be evaluated by the EPA Office of
Chemical Safety and Pollution Prevention, in consultation with the EPA Office of General Counsel.
Requests will be acknowledged in writing, and a staff point of contact will be provided in the
acknowledgement.
11

-------
E. Notice and waiting period
Once the above requirements have been met, and EPA has determined that release of the information
can be made to the requesting government, EPA will provide 15-day notice to the affected business
before disclosing the information. TSCA section 14(g)(2)(C)(i).
Requesting governments should be aware that per TSCA 14(g)(2)(D)(i), an affected business may file a
legal challenge in Federal court. If there is a legal challenge, EPA will inform the requesting government.
EPA may still disclose the information to the requesting government despite such a legal challenge. See
TSCA section 14(g)(2)(D)(ii)(ll).
F. Accessing CBI
Once EPA has determined that the requesting government has met all the criteria of section 14(d)(4),
and the required 15-day notice period has elapsed, EPA will make the requested documents available in
either hard copy or by means of secure electronic access. When EPA notifies the requesting
government that a request for access has been granted, EPA will also explain how access will be
provided.
12

-------
III.
MODEL TSCA CONFIDENTIAL INFORMATION ACCESS AGREEMENT
I.	PARTIES
The parties to this Agreement are the Environmental Protection Agency (EPA) and
[state/tribe/subdivision of state] (the"Parties").
II.	PURPOSE AND SCOPE
This Agreement facilitates EPA's sharing of confidential information submitted to EPA under the Toxic
Substances Control Act (TSCA) with [state/tribe/subdivision of state], as authorized under and in
accordance with TSCA section 14(d)(4) (15 U.S.C. 2613(d)(4)).
III.	AUTHORITY
TSCA section 14(d)(4) (15 U.S.C. 2613(d)(4)).
IV.	SHARING OF CONFIDENTIAL INFORMATION
(a).	Definitions: As used in this Agreement-
"Confidential Information" means information that has been submitted to EPA under TSCA
and claimed as confidential pursuant to the requirements of TSCA.
(b).	The [state/tribe/subdivision of a state]:
(1)	Certifies that it has legal authority to maintain the confidentiality of Confidential
Information obtained pursuant to this agreement and 15 U.S.C. 2613. A detailed
statement, including relevant legal citations, from [state/tribe/subdivision of state]
concerning such authority is attached to this Agreement as Appendix 1.
(2)	Agrees to follow the procedures set forth in Appendix 2 to safeguard the Confidential
Information provided by EPA under this agreement.
V. MISCELLANEOUS
(a) This Agreement does not create any right, benefit or privilege, substantive or procedural,
enforceable at law or in equity against the United States, its departments, agencies,
13

-------
instrumentalities, or entities, its officers or employees, or any other person.
(b)	Confidential information covered by this Agreement is subject to criminal prohibitions
against unlawful disclosure (15 U.S.C. 2613(h)).
(c)	In the event that the [state/tribe/subdivision of state] legal authority to maintain the
confidentiality of CBI obtained pursuant to this agreement changes from that described in
Appendix 1, or due to other relevant reason that result in the [state/tribe/subdivision of
state] no longer being able to maintain the measures described in Appendix 2, the
[state/tribe/subdivision of state] shall promptly notify EPA of these changed circumstances.
Further sharing of CBI by EPA with [state/tribe/subdivision of state] will be immediately
suspended pending EPA's consideration of whether CBI may still be disclosed to the
[state/tribe/subdivision of state] in accordance with 15 U.S.C. 2613(d), in light of the
changed circumstances.
(d)	In the event that the [state/tribe/subdivision of state] becomes aware or has reason to
believe that CBI disclosed to it pursuant to this Agreement has become lost or misplaced,
has been or is suspected to have been disclosed to anyone other than as authorized in this
agreement, the [state/tribe/subdivision of state] shall promptly notify EPA of the time, date,
extent, and nature of the loss or disclosure or suspected disclosure.
VI.	TERMINATION OF AGREEMENT
This Agreement can be terminated with 90 day's advance notice of termination by either party,
or sooner by mutual consent of both parties.
VII.	MODIFICATION PROVISIONS
This Agreement can be modified at any time by mutual written agreement of both parties.
VIII. POINTS OF CONTACT
The following individuals are designated as points of contact for the Agreement:
U.S. Environmental Protection Agency [DD of IMD]:
[Requesting Government]:
IX. SIGNATURE
This Agreement between EPA and [REQUESTING ENTITY] is agreed to by:
14

-------
[Typically, the chief legal officer in the requesting government]
For the [state/tribe/subdivision of state]:
Administrator [or to whom authority delegated at the time of agreement]
For the Environmental Protection Agency:
APPENDIX 1
[Include a detailed statement, including relevant legal citations, concerning [state/tribe/subdivision
of state] legal authority to maintain the confidentiality of Confidential Information obtained pursuant
to this agreement and 15 U.S.C. 2613.]
APPENDIX 2
[Identify procedures that will be followed to safeguard the Confidential Information provided by EPA
under this agreement.]
15

-------