Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Comment: Commenter (6916) notes there was no analysis of the number of studies that could be affected by the Proposal. According to the commenter, were this rule to be finalized as proposed, it would permit or even require the Agency to disregard certain studies placed in the record in future substantive rulemakings under the Clean Air Act (CAA), among other statutes
Response: The rule as finalized does not categorically exclude any study based on availability of data. If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Comment: Commenters (6153, 6874, 8272) state that a recent example of important non-public data on a neurotoxicant is research on the pesticide chlorpyrifos. The commenters provide that researchers followed a cohort of children exposed to this pesticide before the current ban on residential use and found lower IQ and working memory to be associated with higher levels of prenatal chlorpyrifos exposure. The commenters state that, in a rulemaking process regarding agricultural use of chlorpyrifos, EPA requested the underlying data from the Columbia Center for Children's Environmental Health (CCEH). The commenters state that the response from CCEH explained that because of the detailed sociodemographic and health-related elements their data set contains, they did not believe they could submit extensive individual-level data to EPA in a way that would ensure participants' confidentiality. The commenters state that such concerns are not uncommon with the kinds of longitudinal data sets that allow identification of long-term consequences of environmental exposures.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Comment: Commenters (6144, 6174) state that, as EPA continues its review of the insecticide chlorpyrifos, this policy might restrict its ability to consider several critical epidemiological studies conducted by Columbia University that showed that in utero exposure to the chemical was linked to negative neurodevelopmental impacts. The commenters note that the health data was collected along with confidentiality pledges to the mothers. The commenters state that cutting out the use of this research would mean that EPA would have little information on the direct human health impacts of chlorpyrifos exposure and could result in a policy decision that is less protective of public health than it otherwise would have been.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Comment: Commenters (1424, 1529, 4828, 4842, 5981, 6125, 6133, 6137, 6144, 6153, 6174, 6874, 6939, 8272) express concern that supporting studies for the lead rules would not be allowed as scientific evidence under the new transparency ruling since they include private medical records and/or could not be ethically replicated.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Comment: Commenter (6446) expresses concern that the proposed rule would likely prevent EPA from considering epidemiological studies of children exposed in utero to mercury through maternal consumption of mercury-contaminated fish or marine animals because individual health data could not be made public. The commenter states that EPA used these epidemiological studies in its 2001 report, Water Criterion for the Protection of Human Health: Methylmercury, which served as a basis for the California State Water Board's recently adopted mercury water quality objectives.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Would Limit New Studies
Comment: Commenter (6367) states that their members recognize that subjects in clinical toxicology studies often divulge highly sensitive information regarding the behaviors, occupations, avocational activities, and physical and neurocognitive function of themselves and their communities with the expectation that this information be maintained in a confidential manner. The commenter is concerned that subjects' voluntary participation in clinical toxicology studies, and the willingness of medical toxicologists to undertake such studies, will be constrained if such information will become publicly available if the study is used to advance environmental protection.
Response: EPA will not make personally identifiable information (PII) publicly available.
Invalidating Studies Based Solely on Public Availability of Underlying Raw Data
A Study Should Not be Invalidated Solely Based on the Underlying Data Being Unavailable
Comment: Commenters (0040, 0106, 0107, 0118, 0501, 1203, 1289, 1945, 2020, 2337, 2911, 4591, 4838, 5013, 6111, 6120, 6125, 6144, 6160, 6351, 6791, 6864, 6875, 6897, 6905, 6922, 8317, 9224) state that raw data may not be available for a variety of reasons, having to do with privacy, proprietary, and other issues, that require researchers to keep at least some data out of public view. Commenter (6196) states that, in principle, no one disputes the benefits of improving access to underlying data for research on chemicals and pollutants. The commenter provides that the goals of "open science" have received support from several organizations and leading scientific journals and research institutions have adopted practices and policies to maximize data access. Commenters (0040, 0107, 1011, 0118, 0501, 1203, 1289, 1420, 1945, 1973, 1999, 2020, 2259, 2283, 2337, 2909, 2911, 4591, 4595, 4838, 4848, 4884, 5012, 5013, 5019, 6109, 6111, 6113, 6119, 6120, 6121, 6133, 6144, 6145, 6156, 6159, 6160, 6164, 6195, 6196, 6351, 6355, 6367, 6373, 6791, 6875, 6896, 6898, 6899, 6905, 6906, 6908, 6918, 6919, 6920, 6922, 6928, 8281-PH16, 8281-PH26, 8281-PH38, 8317, 9224) assert, however, that a study should not be invalidated solely based on the underlying data and models being unavailable. The commenters express concern that, under the proposed rule, the available science and evidence that could be used to inform future regulations would be limited (and not reflect the body of the "best available science") by the requirement to make all datasets publicly available, limiting the science base for regulatory decision making and protection of public health.
Commenter (6111) notes that releasing raw data will not improve the quality of the resulting report/study/analysis, and therefore will do nothing to render any individual study "better." The commenter provides that it has long been recognized by the professional public health, medical, and scientific research community -- and by EPA itself until now  -- whether the raw data underlying a study is released does not determine the quality of the study.
Commenter (5180) notes that the Proposed Rule provides that when the EPA develops regulations, the "EPA should ensure that the data underlying those are publicly available in a manner sufficient for independent validation." The commenter asserts that this approach would allow the EPA to consider only those scientific studies where the underlying data is made publicly available. The commenter states that, under the Proposed Rule, the EPA would have had to reject studies simply because they involved confidential personal data protected under the HIPAA that had not been made public "in a manner sufficient for independent validation."
Commenter (4838) states that the requirement that significant regulatory decisions be justified only by studies based on dose response data and models that are available to the public limits EPA's ability to rely on otherwise peer-reviewed, scientifically-valid studies that do not, or cannot, make their data publicly available because of confidentiality concerns. For example, the commenter notes that the EPA used the landmark Harvard Six Cities Study, demonstrating a dramatic link between premature mortality and air pollution, as part of its justification for key clean air regulation. The commenter provides that the study has been rigorously, independently peer-reviewed but the subjects were promised confidentiality and the data is not public. According to the commenter, EPA should not provide blanket limits on the use of studies that cannot be made public because they contain confidential health or business information. The commenter states that scrubbing studies of such information may be impossible while keeping the study reproducible.
Commenter (0040) notes that, of the 17 publications she is a co-author for, only 5 would meet the proposed requirements that evidence come from publicly available data. The commenter states that the other 12 are from projects where the data are subject to data use agreements and cannot be made public due to confidentiality agreements. The commenter adds that the fact that the underlying data is not available to the public does not make these 12 publications any less trustworthy. The commenter states that data for every study do not need to be publicly-open for the results to be useful.
Commenter (0106) states that studies must be accepted, if the peer review deems them worthy and "real" science, not just a study sponsored by a company or lobbying group with the conclusion written by that sponsor before the study begins.
Commenter (6120) asserts that, while the Proposed Rule cites requirements of major scientific journals for the availability of data, the commenter provides that the editors of those journals have also issued a joint statement discussing the importance of including all relevant studies articulating circumstances where data cannot be fully shared, such as when it includes personal identifiers. Commenter (6896) notes, as editors of leading peer-reviewed journals stated, "[i]t does not strengthen policies based on scientific evidence to limit the scientific evidence that can inform them; rather, it is paramount that the full suite of relevant science vetted through peer review, which includes ever more rigorous features, inform the landscape of decision making. Excluding relevant studies simply because they do not meet rigid transparency standards will adversely affect decision-making processes." Commenter (9227) notes that numerous representatives of the scientific community -- including editors of the very scientific journals whose policies EPA cites to in the Proposal, the American Association for the Advancement of Science, members of the SAB, and other scientists cited to by EPA -- have already voiced serious concerns about the Proposal. According to the commenter, as these experts have recognized, it is not consistent with good scientific practice, and certainly not consistent with the Agency's responsibility to utilize "best available science," to deem certain scientific studies unworthy of consideration simply because these studies cannot meet an arbitrary public availability requirement. Commenter (6109) requests that EPA make use of the best available science, as it always has. The commenter provides that the best available science may include studies that do not have publicly available data and that the EPA should not arbitrarily dismiss these studies. Commenter (1011) states that EPA should avoid insisting on complete release of data if the security of the data would remain in doubt or if the failure to comply with the proposed transparency standard would prohibit EPA's use of the best available science.
Commenter (8281-PH48) states that, if adopted the Proposed Rule would prevent EPA from considering the scientific studies that Rural Empowerment Association for Community Health (REACH) helps to conduct. The commenter notes that they cannot make all their data publicly available because we cannot risk compromising the confidentiality of the people who contribute to our work. According to the commenter, because they live in a rural community it would be relatively easy to identify study participants based on de-identified information like age, sex, occupation and number in households, even if the participants' names were redacted.
Commenter (6864) states that EPA is routinely in receipt of unpublished toxicity studies for chemicals designed for commerce. The commenter states that not all scientific findings are publishable, nor do scientific journals generally have enough space to include all data.
Response: Upon consideration of the comments, the EPA agrees that it is important not to categorically exclude any study because the data underlying a study at the stage required by this rulemaking may not be available for independent validation. Therefore, the EPA is not finalizing the proposal approach that would have categorically required that for studies to be considered pivotal science the underlying data would need to be available for independent validation. However, given that transparency is an important aspect of EPA's regulatory actions and assessments, it should be an important consideration in how the Agency considers pivotal science. As described in 40 CFR 30.5 of the final rule, the EPA will rely on the highest quality, most relevant studies available in determining the potential for hazard due to exposure to a pollutant, contaminant, or substance. Where there is convincing and well substantiated evidence to support a relationship between exposure and effect, the EPA will identify those studies --  based on the exposure situation being addressed, the quality of the studies, the reporting adequacy, and the relevance of the endpoints -- that would inform a dose-response assessment for those effect endpoints. From that subset, the specific dose-response studies or analyses that drive the requirements or quantitative analyses of an EPA significant regulatory action or influential scientific information will be identified as pivotal science.
Further, the EPA is finalizing the approach that gives greater consideration to pivotal science whose underlying dose-response data are publicly available or available through restricted or tiered access. Restricted or tiered access in this final rule means that the underlying dose-response data are available through a data sharing mechanism, such as through an agreement with the originating author or institution, access to a refined or redacted dataset that anonymizes the more sensitive portions of the analyzable dataset, a restricted access data repository or secure data enclave, or some other mechanism (e.g., Data Use Agreements) that allows a qualified subject matter expert access to enough data to support independent validation while still protecting sensitive information.
No Reason to Prevent Use of Human Health Studies Because Underlying Health Data are Not Available to the Public
Comment: Commenters (0128, 2020, 4848, 6351, 6905, 6914, 6919, 6922) assert that there is no reason to prevent the use of health data simply because the underlying health data are not available.
Response: This rule does not categorically exclude any study because the underlying dose-response data are not available, either publicly or via restricted access, for independent validation.
Comment: Commenter (0128) provides that it is common practice for biomedical scientists to use data from randomized controlled trials published in the clinical oncology literature to inform clinical practice guidelines for the American Society of Clinical Oncology and to inform coverage decisions on emerging treatments and diagnostic tests by medical directors at Blue Cross and Blue Shield health plans. The commenter states that the confidentiality of individual patient data is ALWAYS strictly maintained. Nevertheless, the commenter notes that the aggregated outcomes data fully informed and optimally guided clinical and coverage decisions based on the best available scientific evidence and analysis. The commenter states that maintaining the confidentially of individual health records is not incompatible with subjecting scientific evidence to rigorous peer review.
Response: Nothing in this comment is incompatible with the requirements of this rule.
Comment: Commenter (4848) asserts that the EPA has presented no scientific reason to prevent use of human health studies simply because the underlying medical records are not available for public inspection and review. Commenter (6137) state that the Proposal only excludes health-based science (dose-response studies, epidemiological studies) where underlying data is not disclosed, generally because it cannot or should not be disclosed to protect individual participants' privacy and confidentiality. The commenter contends that the EPA cannot exclude whole categories of scientific data untethered from a specific context or study, but rather must assess each health study on a case-by-case basis to determine whether or not it should be considered in a particular rulemaking, under EPA's long-standing scientific guidelines and policies and its regular approach in CAA rulemakings. Instead, the commenter states that this Proposed Rule excludes health studies from consideration as a class, up front, before EPA is even in the rulemaking stage under its authority. And it does so not for scientific reasons, but, according to the commenter, simply due to industry preferences  -  most notably because industry cannot pick them apart by replicating decades of air pollution health effects, or by contacting individuals who shared private medical information to replicate the collection of data.
Response: This rule does not categorically exclude any study because the underlying dose-response data are not available, either publicly or via restricted access, for independent validation.
Comment: Commenter (2020) provides that a long-established approach to developing scientific knowledge is the peer-reviewed process that allows experts to propose logical arguments, test them with data, models and experiments, and determine the best explanations for the outcomes. The commenter notes that when human health is involved, the data required are often personal (names, addresses, illnesses, etc.) and are not needed to make aggregate assessments about the impacts of, for example, living nearer to a road where fine particulate (PM2.5) levels are high and rates of asthma or other health impacts. Thus, according to the commenter, to require that such data are public for EPA to use them is effectively the blocking of established approaches to doing solid science in a manner that also protects privacy.
Commenter (6922) explains that, for decades EPA has relied upon epidemiological studies to help determine what pollutants or chemicals need to be regulated, and how rigorously to do so. EPA's reliance on those studies was reasonable  -  even though the underlying data was not public  -  because the studies underwent peer review to ensure these studies and their results were sound, replicable, and reliable. The commenter asserts that not having the raw data did not, and does not, make the science unsound. The commenter notes that the studies that include or rely on confidential health information often are among the best science that the Agency has to evaluate the effects of pollutant exposure on humans, and the costs imposed on individuals and society as a result of that exposure.
Commenter (6922) notes that studies that include or rely on confidential health information often are among the best science that the Agency has to evaluate the effects of pollutant exposure on humans, and the costs imposed on individuals and society as a result of that exposure. Similarly, the commenter notes that EPA routinely relies on data provided by regulated industries that is treated as CBI and is therefore protected from public disclosure because it may include customer or other personally-identifiable information, including electric and gas consumption. According to the commenter, this is no different from relying on public health studies that rely on data that is protected from disclosure for various reasons.
Commenter (6121) notes that much of the data showing the connection between chemicals and breast cancer risk comes from laboratory studies. However, epidemiological studies, and longitudinal studies, provide critical insights and important corroboration for these findings. The commenter adds that epidemiological studies also allow researchers to look at numerous factors in the lived experience of women to understand and parse out some of these complexities. According to the commenter, most of these critical epidemiological studies are funded by the federal NIH, which has a strong confidentiality policy intended to "protect the privacy of subjects by limiting the disclosure of identifiable, sensitive information." The commenter asserts that, forcing EPA scientists to disregard these critical studies because researchers have correctly protected the confidentiality of their participants' data will result in less scientifically sound conclusions and, most importantly, the public health benefits that the inclusion of these studies would provide.
Commenter (6145) asserts that, to have access to the best available science, studies must protect the privacy of those affected by environmental risks. According to the commenter, in its 2016 Plan to Increase Access to Results of EPA-Funded Scientific Research, the EPA recognizes the need to balance the interests of making information available to the public and protecting other interests, like privacy, as follows:
      While the Agency strives to increase access to its research results, it recognizes, consistent with the OSTP Memo, that Federal agencies have a responsibility to protect confidentiality and personal privacy, respect proprietary interests and property rights, and balance between the value of providing long-term access and its associated costs. It is important to recognize that some research data cannot be made fully available to the public but instead may need to be made available in more limited ways, e.g., establishing data use agreements with researchers that respect necessary protections. Whether research data are fully available to the public or available to researchers through other means does not affect the validity of the scientific conclusions from peer-reviewed research publications.
Commenter (6914) notes that under Toxic Substances Control Act (TSCA) and other laws, EPA relies on data and information that labor and public health organizations submit to inform rulemaking records. This data often is in the form of personal health data, exposure monitoring data, information on work practices and personal accounts; much of this data is not and would not be "publicly available in a manner sufficient for independent validation," as the proposal states. The commenter asserts that this is an unreasonable standard for research in general.
Response: This rule does not categorically exclude any study because the underlying dose-response data are not available, either publicly or via restricted access, for independent validation. If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
No Reason to Prevent Use of Old Studies Because Underlying Data is not Available
Comment: Commenter (1481) asserts that the Proposal is over-broad in its restrictions and would ignore older studies while also setting unrealistic bars for entrance of new evidence. The commenter notes that open data requirements would be a new qualification for the field not in line with prior publication standards. The commenter provides that, as a result, many quality studies would be disregarded due to the old societal standards under which they were published. Furthermore, the commenter states that, until experts in the field decide this is a standard which is necessary to ensure quality research, it seems arbitrary and short-sighted for a non-expert government official to decide this is necessary.
Commenter (6111) notes that the proposal would prevent EPA from relying on studies conducted many years ago for which data are no longer available.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
No Reason to Prevent Use if Underlying Proprietary or CBI Data is Unavailable to the Public
Comment: Commenter (6448) states that there are and will be situations in which EPA has a statutory requirement to make a determination for which scientific information will not be publicly available in a manner sufficient for independent validation. The commenter provides, for example, that during submission of new chemicals under Section 5 of TSCA, a manufacturer will submit proprietary information to the Agency whom will utilize this information in order to determine a risk finding; the outcome of which will be transparently disclosed but in a generic manner. The commenter adds that the registration of active ingredients under Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) would follow a similar pathway as well. The commenter recommends that EPA ensure that any guidelines comply with applicable laws and encourage the use of all relevant scientific information, regardless if the underlying data can be publicly disclosed. According to the commenter, this is particularly important when utilizing data and information developed individually or via consortia under the requirements of FIFRA or TSCA.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation. If there is a conflict between an environmental statute EPA administers and this rule, this rule will yield.
Scientific Mechanisms Intrinsic to the Scientific Process Sufficient to Ensure the Quality of a Study
Comment: Commenters (0040, 0732, 4838,4884, 5013, 6196, 6708, 6906, 6922, 9227) assert that public access to the underlying data is not necessary to ensure the validity of scientific information. Commenter (4591) notes that, in cases where it is not appropriate for data to be made publicly available, there are other mechanisms intrinsic to the scientific process for substantiating the relevance and validity of research results.
Commenter (9227) asserts that the Agency's arbitrary, single-minded focus on considering studies for which certain data and models are publicly available (but only the dose-response studies relevant to health protective regulation, not the ones supporting registration of chemicals) stands in stark contrast to the way the scientific community validates research findings. The commenter provides that the scientific community, and scientific journals look to a range of attributes when assessing the quality of a scientific study, including whether the study has been peer reviewed, whether the scientists used rigorous scientific methods, and whether the study's results have been reproduced or replicated. According to the commenter, while scientific journals and other institutions have encouraged making data and models publicly available, there is widespread recognition in the scientific community that doing so is often legitimately constrained due to legal and ethical protections on the confidentiality and privacy of data, or because the data is unavailable. Moreover, the commenter states that no scientist or scientific organization supports the Proposal's approach of excluding research for which the underlying data cannot be disclosed. The commenter notes that none of the materials EPA cites support such an extreme approach. To the contrary, the commenter provides that the scientific community recognizes that the quality of a study is not determined by whether the underlying data is publicly available and has long utilized a variety of tools for ensuring the integrity and rigor of research findings.
Response: If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Peer Review is Sufficient to Ensure Quality of a Study
Comment: Commenters (0040, 0732, 1203, 2020, 4595, 4838, 4884, 5013, 6108, 6196, 6708, 6875, 6922, 8281-PH16, 9224) suggest that existing peer-review processes are sufficient to ensure the quality of a study.
Commenter (4595) states that the Proposal sets an implied standard that peer-reviewed scientific research data that is not publicly available is not rigorous enough for use in decision making. Commenter (6196) contends that the unspoken premise of the Proposal is that unless EPA can guarantee full public access to a study's underlying data, the study must be deemed unreliable and should play no role in assessing a pollutant or chemical's effects on human health. The commenter states that this premise ignores the many ways in which the scientific community, regulators, and the public have traditionally determined the quality and relevance of study results.
Commenter (8281-PH16) notes that Congress intentionally directed EPA to consider peer reviewed research under the CAA, and mandates regular reviews of the science to ensure that EPA is reviewing and considering the most up to date science.
Commenter (6922) provides that the EPA already utilizes a rigorous peer review process sufficient to ensure that Agency rulemakings are based only on sound, reliable studies, as described in EPA's Science and Technology Policy Council Peer Review Handbook (4th Edition). For instance, the commenter notes that the primary function of EPA's SAB is to review the quality and relevance of scientific and technical information being used by EPA or proposed as the basis for its regulations. The commenter notes that the Proposed Rule does not explain why the existing processes and tools for vetting scientific research, including epidemiological studies, are insufficient.
Commenter (4884) notes that peer reviewed studies as well as the necessarily cautious, deliberate process by which EPA has developed past regulations has ensured the sound basis of EPA rules. The commenter provides that valid health effect studies are often non-public because they rely upon confidential medical records. The commenter states that other studies useful in the past have relied upon confidential business sensitive industry data. According to the commenter, if the analysis of the raw data is available and correct, such studies must be used to achieve the legislative intent of these environmental laws.
Commenter (2020) provides that most modern scientific journals require that data and models and methods required to reproduce the scientific findings are published when a peer-reviewed paper is published. The commenter states that this standard should be sufficient for EPA going forward. According to the commenter, the fact that past published papers were not held to this standard is something that current practices attempt to remedy, but this does not mean that decades of understanding should be ignored by EPA and EPA should apply best practices as does the scientific community.
Commenter (0040) provides that publication study results need to go through the peer review publication and replication processes. As such, the commenter states the conclusions are based on strengths of evidences and are weighed according to their merit. The commenter adds that this methodology-based process leads to more robust research and stronger evidence. Commenter (0732) provides that scientists convene multi-scientist panels to extensively review literature from all known sources, evaluate each article for many criteria of well-done studies, and then factor it into their carefully assessed estimates that are used to create health standards. Commenter (4838) asserts that studies with confidential data can still be appropriately peer-reviewed and subject to rigorous scientific scrutiny over their methods and conclusions without making confidential health or business information publicly available and that EPA should not provide blanket limits on the use of studies where information cannot be made public. Commenter (4595) states that, when preparing studies with protected data for peer review and publishing, researchers summarize the analysis of raw data and draw conclusions based on that analysis and that these methodologies are not 'secret' but rather common practice.
Commenter (6196) provides that study reports typically explain the protocols used to gather data, the methods used for data analysis, the doses or exposure concentrations at which effects were and were not observed, the nature, severity, and incidence of such effects, and any unusual occurrences that may affect interpretation of the results. The commenter adds that this information plays an important role in the peer review process, informing the judgment of independent reviewers as to whether a study is worthy of publication in the scientific literature. According to the commenter, Agency reviewers likewise consider these indicators of reliability in deciding how much weight a study deserves in making judgments about hazard and risk. The commenter notes that in its narrow focus on a single criterion for study acceptability, the proposal departs from this comprehensive, multi-faceted approach for determining the "best available science" to inform decision-making.
Commenter (1203) asserts that good science makes use of all verifiable data and if published in a peer-reviewed journal there is a paper trail that points back to the data, even if the raw data themselves are not available to every reader.
Commenter (5013) states that, in order to have reliable data and large sample sizes, researchers frequently study the records of patients treated in hospitals. Although all the underlying privacy data cannot be available for public review, reviewers wanting to reproduce a study in order to validate it can arrange to have confidential access to key data. Furthermore, the commenter contends that scientists can assess the merits of published research without seeing its data directly by considering such publicly released features as the study's research design, the methods used for data collection and analysis, and comparisons with previous results.
Commenter (6708) states that, if the EPA has an appropriate scientific peer-review process for its internal studies, studies should not be disqualified from consideration in rulemaking on the grounds that they could not release enough information to the public. The commenter adds that, in fact, the public's need for action on many issues regarding pollutants and the risk of exposure to dangerous substances should justify EPA rule-making based on some studies that require that some crucial information be kept private and thereby are rendered unrepeatable. The commenter contends that, instead of prioritizing this onerous, unnecessary, and potentially harmful attempt at transparency, the EPA should instead invest in having academic scientists available to its internal researchers and policymakers to review studies produced within and outside the agency to provide appropriate, timely, and independent feedback on findings regarding the health of the public.
Commenters (6875, 9224) states that, for data that is not produced by EPA, such as in scientific journals, and particularly when dealing with sensitive data, the process of peer reviewing should often be sufficient. According to the commenter, if multiple studies have gone through the peer review process and have come to the same conclusions, the Agency should not disregard these findings simply because the raw data is not available.
Commenter (6108) asserts that, for policy decisions based upon peer-reviewed journals and literature, the articles should be available to the public (for a nominal fee, if necessary), but it is not necessary to provide every underlying data point for public inspection in rulemaking. According to the commenter, requiring every individual data point from such studies to be made available will greatly reduce the number of sound scientific articles available for rulemaking and the peer review process is widely accepted in the scientific community. The commenter provides that Journals that publish peer-reviewed articles have ethical guidelines for reviewers and reputable publishers use a robust peer-review process that has a series of quality controls.,
Response: This rule does not categorically exclude any study because the underlying dose-response data are not available, either publicly or via restricted access, for independent validation. If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation. Further, nothing in this rule precludes EPA from considering peer reviewed data. EPA will continue to consider peer reviewed data. Finally, if there is a conflict between an environmental statute EPA administers and this rule, this rule will yield.
Public Notice and Comment Process for Significant Rulemakings Sufficient
Comment: Commenter (6922) notes that the EPA follows a robust public notice and comment process for its significant rulemakings. According to the commenter, where the public has valid reason to doubt the assumptions or data underlying a particular study or is aware of a study that EPA has not considered, the public can share conflicting studies and other information with EPA during the public participation process of the rulemaking. The commenter adds that the EPA is obliged to exercise independent reasoned judgment to disregard information the Agency deems unreliable or biased. The commenter provides that this is the traditional, well-settled process of reasoned administrative rulemaking.
Response: EPA agrees with the commenter and will continue to critically evaluate studies as described in 40 CFR 30.5.
Inconsistency with EPA Policies on Data Access and Availability
Comment: Commenter (9227) states that the EPA has previously stated in several different forums that a scientific study can be valid even if the underlying dose response data and models are not publicly available. For example, the commenter notes that the EPA recently explained in its own Plan to Increase Access to Results of EPA-Funded Scientific Research that even though "some research data cannot be made fully available to the public but instead may need to be made available in more limited ways," the lack of full public availability "does not affect the validity of the scientific conclusions from peer-reviewed research publications." Under the plan, the commenter explains that the EPA must make publications resulting from EPA-funded research publicly accessible on NIH's PubMed Central (PMC). The commenter provides that the plan aims to "maximize access, by the general public and without charge, to digitally formatted data resulting from EPA funded research, while protecting confidentiality and personal privacy, recognizing proprietary interests, business confidential information and intellectual property rights, and preserving the balance between the relative benefits and costs of long-term preservation and access." The commenter adds that the plan recognizes important exceptions for when "the research data cannot be released due to one or more constraints, such as requirements to protect confidentiality, personal privacy, proprietary interest, or property rights." According to the commenter, it specifically declares: "The validity of scientific conclusions drawn from research publications or their associated research data, or EPA's ability to consider those conclusions and data in its actions, does not depend on compliance with this Plan."
Likewise, commenter (9227) notes that the EPA's Science Policy Council explains in A Summary of General Assessment Factors for Evaluating the Quality of Scientific and Technical Information that EPA's determination as to the quality and reliability of a particular scientific study does not depend on one single factor (e.g., the public availability of underlying data), but instead turns on the agency's consideration of five general factors. The commenter states that Congress implicitly endorsed this approach by including a directive for EPA to use these same five factors in evaluating science under the TSCA Amendments passed in 2016, and just last year this Administration included these same factors in a recent regulation implementing TSCA. The commenter adds that the factors comprise: (1) soundness; (2) applicability and utility; (3) clarity and completeness; (4) uncertainty and variability; and (5) evaluation and review. Of these, the commenter states that the only ones with any possible direct relevance to EPA's proposed approach are the third and fifth factors, but neither supports the elevation of public availability of data above all other considerations or the exclusion of studies with non-public data. The commenter adds that the third factor, "clarity and completeness" requires EPA to consider "[t]he degree of clarity and completeness with which the data, assumptions, methods, quality assurance, sponsoring organizations and analyses employed to generate the information are documented," and the fifth factor, "evaluation and review," requires EPA to consider "[t]he extent of independent verification, validation and peer review of the information or of the procedures, measures, methods or models." According to the commenter, even clear and complete "documentation" of the data used does not require that the data be made publicly available. Nor, according to the commenter, does factor five require either that a study's findings must have been replicated using the same data, or that the data must be available to allow for such replication. The commenter provides that, moreover, these are only portions of two of five key factors to consider.
Similarly, commenter (9227) asserts that the EPA's Guidelines for Ensuring and Maximizing the Quality, Objectivity, Utility and Integrity of the Information Disseminated by the Environmental Protection Agency, ("EPA Information Quality Guidelines") issued pursuant to Section 515(a) of the Treasury and General Government Appropriations Act for Fiscal Year 2001 (Public Law 106-554; H.R. 5658) (the "Data Quality Act") make it clear that the public unavailability of underlying data or models does not render a study inappropriate for EPA's consideration. Specifically, the commenter notes that the EPA Information Quality Guidelines acknowledge that even with respect to science that will have "a clear and substantial impact on important public policies or private sector decisions," there will be circumstances where "access to data and methods cannot occur due to compelling interests such as privacy, trade secrets, intellectual property, and other confidentiality protections." Significantly, the commenter notes that the Guidelines do not instruct EPA to ignore such science. Rather, according to the commenter, the Guidelines instruct that if underlying data or methods are unavailable, "EPA should, to the extent practicable, apply especially rigorous robustness checks to analytic results and carefully document all checks that were undertaken." The commenter adds that the Guidelines further explain: "Original and supporting data may not be subject to the high and specific degree of transparency provided for analytic results; however, EPA should apply, to the extent practicable, relevant Agency policies and procedures to achieve reproducibility, given ethical, feasibility, and confidentiality constraints."
Commenter (9227) asserts that, far from instructing EPA not to consider scientific studies for which underlying data or models are unavailable, the EPA Information Quality Guidelines expressly acknowledge that EPA must balance a variety of important aims to fulfill its statutory obligations to protect public health and the environment. The commenter notes that the EPA explains in the guidelines that "most environmental statutes obligate EPA to act to prevent adverse environmental and human health impacts" and that "[f]or many of the risks that we must address, data are sparse and consensus about assumptions is rare." Thus, the commenter provides that rather than set rigid rules regarding what science and information EPA can rely upon in its rulemakings, EPA "seek[s] to strike a balance among fairness, accuracy, and efficient implementation." The commenter conveys that the EPA states: "Refusing to act until data quality improves can result in substantial harm to human health, safety, and the environment."
Commenter (9227) provides that even this Administration, in the context of promulgating regulations under TSCA, has adopted a regulatory definition of "best available science" expressly incorporating a multi-factor analysis, and that definition recognizes that public unavailability of data does not render a study incapable of being "best available science."
Response: This rule does not categorically exclude any study because the underlying dose-response data are not available, either publicly or via restricted access, for independent validation. If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation. Further, nothing in this rule precludes EPA from considering peer reviewed data. EPA will continue to consider peer reviewed data. Finally, if there is a conflict between an environmental statute EPA administers and this rule, this rule will yield.
As described in the preamble and provided in 40 CFR 30.5, EPA will consider a number of factors in determining the degree of consideration to give studies underlying pivotal science for which the dose-response data are not available for independent validation.
Strengthen Rule for Keeping Health, Personal and Proprietary Data Confidential
Comment: Commenter (6119) states that EPA should refine and strengthen the proposed rule for keeping health, personal, and proprietary data confidential to alleviate the apprehension of public access to personal or sensitive data while still ensuring that relevant epidemiological or toxicological studies can continue to be used to establish public health-based air quality and other standards.
Response: EPA is not requiring that health, personal and proprietary dose-response data underlying studies considered to be pivotal science be made available in a manner that would violate confidentiality.
Court Cases Have Ruled that EPA Should be Allowed to Use Studies Where Data is Not Entirely Available
Comment: Commenter (0566) states that, in two cases, the court has ruled that EPA should be allowed to use studies where data is not entirely available. The commenter provides that, in American Trucking Associations, Inc. v. EPA, 283 F.3d 355, 372 (D.C. Cir. 2002), the court said, "[i]f EPA and other governmental agencies could not rely on published studies without conducting an independent analysis of the enormous volume of raw data underlying them, then much plainly relevant scientific information would become unavailable to EPA for use in setting standards to protect public health and the environment .... [S]uch data are often the property of scientific investigators and are often not readily available because of ... proprietary interests ... or because of [confidentiality] arrangements [with study participants].'"
Commenter (0566) adds that, in 2010 the court reaffirmed its view that "raw data often is unavailable due to proprietary interests of a study's scientific investigators or confidentiality agreements with study participants" and that EPA is entitled to rely on published study results instead (Coalition of Battery Recyclers Ass'n v. EPA, 604 F.3d 613, 623 (D.C. Cir. 2010)).
Commenter (6922) notes that the Courts rejected a challenge to a CAA rulemaking, the U.S. Court of Appeals for the District of Columbia held that requiring agencies to obtain and publicize the data underlying all studies on which they rely "would be impractical and unnecessary.",  The commenter provides that, where EPA relied on the results of the scientific studies in the rulemaking record rather than on the raw data underlying those studies, the public was not denied meaningful participation in the rulemaking process.
Response: This rule does not categorically exclude any study because the underlying dose-response data are not available, either publicly or via restricted access, for independent validation. If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
Alternative Approaches to Data Availability
Comment: Commenter (6362) recommends that greater weight be given to studies using validated test methods and procedures, models, and approaches when and where those data are based on publicly accessible data, and transparent computer algorithms. The commenter states that other scientifically relevant and reliable studies and data should not be eliminated from consideration, but rather, accorded less weight when integrating evidence from multiple studies within and across different lines of evidence.
Commenters (6918, 9224) recommend that when data unavailable to the public is used, it should be acknowledged in an open process, including in the proposed or final rule's preamble, and that the Administrator should take the unavailability of underlying data and/or models into account in deciding what weight to give to a study.
Response: The commenters' recommendations are generally consistent with this rule. If a study is identified as pivotal science, EPA will still consider the study but may give it lesser consideration if the dose-response data are not available for independent validation.
<IP_ADDRESS>.2 Disclosability of Underlying Data
Privacy Data
Does the Handling of Privacy Data Conflict with Federal Laws?
Conflicts with Federal Privacy Laws/Policies and Confidentiality Agreements/Case Law
Comment: Commenters (0569, 0777, 1476, 1791, 1973, 1997, 2002, 2004, 2171, 2413, 2431, 2907, 2908, 4410, 4542, 4588, 4590, 4595, 4840, 4872, 5012, 5173, 5176, 5180, 6098, 6111, 6117, 6125, 6133, 6137, 6170, 6181, 6188, 6191, 6195, 6446, 6788, 6898, 6916, 6919, 6924, 6932, 8275, 8281-PH20, 8281-PH46, 9227) assert that, in many cases, releasing privacy data in the manner EPA proposed could be a violation of health privacy laws and confidentiality agreements with human subject participants. Commenters cite health privacy laws and/or confidentiality agreements legally mandated by IRB regulations, HIPPA, 21st Century Cures Act, Health and Human Services' "Federal Policy for the Protection of Human Subjects" regulations, the Food and Drug Administration (FDA) "Protection of Human Subjects" (also known as the Common Rule) and other FDA requirements, Procedures for Disclosure of Records Under the Freedom of Information Act (FOIA) requirements, and the National Death Index.
Commenter (4590) states that virtually all studies of population-level human health effects of pesticides, air pollutants, water contaminants, drugs, and nutrients, as well as post market surveillance for adverse reactions to medications, require a commitment to the confidentiality of the involved or impacted persons. According to commenter (6181), it is not possible for a host of epidemiological studies and long-term health studies to open their datasets without publishing sensitive information that cannot, by law, be made public. Commenter (6916) states that the proposal provides no discussion of how underlying data of relevant studies can be released consistent with the various laws and regulations protecting privacy and prohibiting disclosure. The commenter asserts that the failure to "consider an important aspect of the problem" renders the proposal arbitrary and capricious. Commenter (6133) expresses concern that the proposal conflicts with decades of statutory, regulatory and institutional progress to simultaneously protect public health and privacy. Commenters (5176, 6898) notes that the proposed rule would require researchers to make all data publicly available, which in some circumstances would not be ethical because of important patient confidentiality protections.
Commenters (2171, 5012, 6111, 6133, 6188, 6924, 8281-PH20, 8281-PH46, 9227) assert that the proposal conflicts with requirements of HIPAA. Commenter (6111) states that, for any research carried out by healthcare providers that involves the handling of individually identifiable health information, the HIPAA Privacy Rule imposes strict confidentiality requirements. Commenter (6188) states the proposal would require the sharing of data protected under HIPAA and otherwise barred from disclosure.
Commenters (2171, 4410, 4542, 4590, 4840, 6111, 6133, 6919, 6924, 8281-PH20, 9227) express concern that disclosure of analytic data sufficient to fully replicate study analysis could breach confidentiality requirements upheld by public and private research through IRBs. Commenters (4840, 9227) assert that under the Federal Policy for the Protection of Human Subject (also known as the Common Rule), for all federally-funded studies involving human research subjects, researchers must first obtain IRB approval and informed consent from study participants. Commenter (4590) states that Institutional committees for human subjects' protection routinely require non-disclosure of the subjects' identities; when disclosure is permitted, it is only in the most urgent and rare circumstance, usually when it is essential to the protection and safety of an individual subject. Commenter (6133) states that the proposal's provisions concerning the public sharing of underlying data from these studies directly contradict the requirements researchers adhere to under the purview of IRBs, which typically require investigators to ensure study participant confidentiality and data security. Commenter (6916) states that the criteria for IRB approval of research are at the very least in tension with the proposal's directive that "dose response data" are "publicly available in a manner sufficient for independent validation." Commenters (6924, 9227) provide that IRB reviews each human subjects research project to ensure that the specific research protocol protects individual rights. The commenters add that participants much be notified about the degree to which the confidentiality of their records will be maintained and must receive appropriate notification and give consent if study data is to be shared outside the research team. Commenter (9227) suggests that for studies that had received IRB approval prior to finalization of this proposed rule, there may be no practical opportunity to make the data publicly available. The commenter contends that, even for new studies, it may be extremely difficult, require additional (often unavailable) funding for elaborate protective measures, or simply impossible to obtain IRB approval for protocols that would allow the data to be made publicly available.
Commenter (6098) provides that FDA regulations and Procedures for Disclosure of Records Under FOIA requirements prohibit the sharing and disclosing of CBI and personal data:
           FDA- 21 CFR Chapter 1 Part 20 subpart D
               a. 61
 "Trade secrets and commercial or financial information which is privileged or confidential."
               b. 63
 "Personnel, medical, and similar files, disclosure of which constitutes a clearly unwarranted invasion of personal privacy.
 (a) "The names or other information which would identify patients or research subjects in any medical or similar report, test, study, or other research project shall be deleted before the record is made available for public disclosure."
 (b) "The names and other information which would identify patients or research subjects should be deleted from any record before it is submitted to the Food and Drug Administration. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made."
         2. 6 CFR Chapter 10, Part 1001.4(a) (Procedures for Disclosure of Records Under the FOIA, Categories of Exemptions)
 (4) "Trade secrets and commercial or financial information obtained from a person and privileged or confidential;"
 (6) "Personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy;
 (7)(iii) "Could reasonably be expected to constitute an unwarranted invasion of personal privacy;"
 (7)(iv) "Could reasonably be expected to disclose the identity of a confidential source, including a state, local, or foreign agency or authority or any private institution that furnished information on a confidential basis, and, in the case of a record or information compiled by a criminal investigation, or by an agency conducting a lawful national security intelligence investigation ,information furnished by a confidential source;
 (7)(vi) "Could reasonably be expected to endanger the life or physical safety of any individual"
 (9)" Geological and geophysical information and data, including maps, concerning wells."
Response: This rule does not require the release of any privacy or other confidential data. This rule does not conflict with HIPPA or any other privacy statute.
Does Not Conflict with Federal Laws
Comment: Commenter (6179) states that neither HIPAA nor the Privacy Rule place a blanket prohibition on releasing dose response data and models when protected health information (PHI) is de-identified. The commenter contends that the proposal does not explicitly claim new authority under existing environmental statutes to disclose protected sensitive and confidential information. According to the commenter, instead, they understand the proposal as seeking to provide the public with information that contextualizes pivotal regulatory science so comments on significant regulatory decisions can be more meaningful, while still protecting private, sensitive, and confidential information. The commenter suggests that EPA can clarify this position by explicitly stating that any final regulations arising from the proposal do not assert authorization under the law to disclose protected sensitive or confidential information, and that any such claim must be independently based on a statutory grant of authority from Congress.
Response: This rule does not require the release of any privacy or other confidential data. This rule does not conflict with HIPPA or any other privacy statute.
International Privacy Data Laws
Comment: Commenters (1973, 6873) express concern that the proposal does not address conflicts with international requirements for data disclosure.
Commenter (1973) states that European and Canadian privacy laws do not allow personal information from participants in research studies to be made public. The commenter states that Europe has just tightened its data privacy laws with the General Data Protection Regulation. According to the commenter, regulation limits movement of private data outside of the EU, which would prohibit the type of data access EPA proposes. The commenter states that it defines private data to include medical, physical, physiological, genetic, mental, economic, cultural or social identity of that natural person and it states that the data controller must "demonstrate that the data subject has consented to processing of his or her personal data." According to the commenter, if the data were made public, even (if possible) in unidentifiable ways, the data controller could still not demonstrate that it was only being used for the purposes and by the people to which the participant in the study consented. The commenter provides:
      As an example of the highly confidential personal information included in these types of studies, consider the Canadian Community Health Survey Cohort, which followed a cohort of 300,000 people and looked at the association of PM2.5 with mortality. The participants were linked to their tax records to obtain individual level information on income, which was used as a variable in the analysis. The data includes individual education, marital status, age, sex, immigrant status, minority status, weight, smoking, diet, alcohol consumption, and neighborhood level census data. Because of the highly confidential nature of the data, even the investigators did not have the data. They performed their analyses on the computers at Statistics Canada, where the data resides. Yet this study is a critical study for EPA to consider as it reviews the adequacy of its current 12 μg/m3 PM2.5 standard, because essentially all the participants lived in locations below that standard (the 95th percentile of exposure was 11.3 μg/m3). The Canadian Statistics Act prevents these data from being made public, yet how can EPA set standards based on the best available science without considering it?
      Or consider the recent study of the Medicare cohort by Di and coworkers. One key result came from a restricted analysis including only people residing in U.S. ZIP Codes with annual PM2.5 concentration below the 12 μg/m3 NAAQS. That analysis included 247,682,367 person-years of follow-up and 11,908,888 deaths. They found a 1.36% (95% Confidence Interval (CI) 1.31%, 1.41%) increase in mortality rate per 1 μg/m3 increase in PM2.5 below 12 μg/m3. Yet their Data Use Agreement with Medicare prohibits them from providing these data to anyone. How can EPA set a standard based on the best available science when such a huge study, with hundreds of millions of observations in the range relevant for determining the adequacy of the standard is excluded from consideration? Particularly when anyone else can apply to the Centers for Medicare and Medicaid Services for access to the data?
      Or consider the ESCAPE study. This study combined 22 cohorts across Europe, estimated address specific concentrations of multiple air pollutants for each participant, and examined the association of air pollution with mortality in these participants. European data privacy laws would certainly prevent the data from these people being made public as EPA proposes requiring before considering the results in setting standards for air pollution.
Response: This rule does not require the release of any privacy or other confidential data.
Comment: Commenter (6873) states that there are well-established requirements and procedures for protecting the privacy rights of research participants encoded in the international Helsinki Declaration of the World Medical Association. The commenter contends that coming up with new guidelines for releasing private data, even if the intent is to mask this data and make it available only to government scientists, will require review and approval by the U.S. (the FDA and other agencies) and the global research community.
Response: This rule does not require the release of any privacy or other confidential data. This rule does not conflict with HIPPA or any other privacy statute.
Handling of Privacy Data Under the Proposal
Comment: Commenters (0040, 1331, 4872, 5122, 6098, 6126, 6376, 6708, 6898, 6919, 6920, 8281-PH10, 8281-PH24, 8817) urge EPA to ensure the protection of individuals' privacy data. Commenters (0040, 6920) state that research participants enter into non-disclosure confidentiality agreements that require that their information be protected. Commenters (1006, 1011, 1459, 4588, 6191, 6932, 6935) express concern that it may not be reasonable to expect that all data can be made publicly available without inadvertently exposing privacy data. Commenter (6126) suggests that, in order to protect individual's privacy data, more attention is needed to assess the risk of re-identifying data before public releases occur and to ensure important disclosure avoidance practices.
Commenter (4588) states that researchers could redact and anonymize personal health data, but that (1) redaction would involve considerable time, cost, and administrative burden, (2) there are limits as to how much an individual's identity can be protected, especially in small communities where basic identifiers may be enough to recognize an individual. If the number of affected individuals in a study is small -- and this is not unusual with rare or serious outcomes -- then there is virtually no capacity to maintain anonymity for individuals who have consented to participate.
Commenter (1331) notes that, in the proposed rule, the mechanisms used to determine whether data can be made available or not do not go far enough to ensure regulations involving public health data will not be available to the public. The commenter states that the rule suggests the transparency requirement could be waived if not practical to implement in certain cases, but given the similarities between the data used in environmental epidemiology, a more specific protocol for the handling of this data in relation to the transparency rule would ensure privacy. The commenter states that a section specific to exempting public health data in the rule would lower regulatory costs significantly compared to case-by-case mechanism currently proposed.
Commenter (6098) encourages the EPA to coordinate and work with the other science based regulatory bodies to create an appropriate system of protecting and ensuring patient data to ensure that studies dealing with impact on human health are not discounted nor are subjected to privacy violating policy decisions as in this proposed regulation. The commenter states that patient data demonstrating the effects of substances on human health must not be excluded from any assessment performed by the EPA on determination of the hazards of a substance. The commenter further encourages the EPA to coordinate health data efforts with the FDA, OSHA and other Health and Human Services bodies to ensure a comprehensive system and consistent treatment and verbiage across all regulatory bodies when handling such data.
Commenter (6376) suggests that scientific studies involving or including sensitive health data should not be at risk of exclusion over concerns related to personal information being exposed. The commenter requests that EPA clearly establish guidelines to ensure transparency does not come at the cost of widespread exclusion due to inadequate protections for the variety of sensitive data included in different pertinent studies. The commenter states that the EPA has already shown sensitivity on this issue but should expand the mechanisms to include more than CBI, so as not to exclude widely accepted, peer-reviewed studies, which will now be entered into the public domain.
Commenter (6919) states that government agencies have a legal responsibility to protect residents from any risks associated with sharing personal health information  -  this includes discrimination. According to the commenter, while transparency is important, health-related data still holds a special status that must be maintained. The commenter contends that researchers can only conduct high-quality and reproducible research by protecting the personal health information of study participants. The commenter asserts that public health professionals must retain private personal data in their own study records in order to conduct accurate and useful surveillance to inform local, state, and national policies.
Commenter (8275) states that the principal focus of the proposed rule is to require full access to original data for scientific studies in order for those studies to be used for regulatory decision-making. The commenter suggests that, while the preamble to the rule indicates that this could be done while maintaining the protection of privacy and confidentiality of research participants, the proposed rule does not include specific provisions to make these protections possible.
Commenter (9227) states that even EPA's own Science Advisory Board (SAB) voiced concerns to making even limited releases of privacy data, saying:
      The proposed rule oversimplifies the argument that "concerns about access to confidential or private information can, in many case, be addressed through the application of solutions commonly in use across some parts of the Federal government." For studies already completed or underway, the participation of human subjects is undertaken according to terms approved by the cognizant IRB. These terms can vary from study to study. In some cases, the data cannot be released simply by redacting portions of it. For example, data may have been collected with an assurance to the participating individuals that their data would be kept confidential.
Response: This rule does not require the release of any privacy or other confidential data.
Comment: Commenters (2171, 2182, 2495, 6133) assert that EPA has not presented a compelling rationale for why the standard privacy needs to be violated. According to commenter (2495), understanding public health impacts requires only conducting valid statistical analyses on available data, and the disclosure of privacy information is not required to conduct these analyses.
Response: This rule does not require the release of any privacy or other confidential data. This rule does not conflict with HIPPA or any other privacy statute.
Comment: Commenters (1997, 5011, 6788, 9227) generally assert that the proposal would require researchers to choose between protecting study participant privacy (which is their legal responsibility) or informing the EPA's efforts to protect public health and safety. Commenter (6788) asserts that if researchers respect the privacy of their subjects, their research cannot be used by the EPA. Commenter (9227) states that some researchers might respond by choosing to work only on public administrative data sets, but this would harm rather than strengthen science quality by curtailing scientific inquiry. Thus, the commenter believes that the effects of EPA's proposed approach would cause some researchers to choose not to pursue research with human subjects, stifling scientific discovery, while others would forgo compliance with EPA's regulatory requirements and have their research ignored by EPA. As a result, the commenter contends that the EPA's proposal would both discourage the development of best available science as well as EPA's use of it.
Response: This rule does not require the release of any privacy or other confidential data. This rule does not conflict with HIPPA or any other privacy statute. Thus, this rule would not "require researchers to choose between protecting study participant privacy (which is their legal responsibility) or informing the EPA's efforts to protect public health and safety."
Comment: Commenters (0569, 2477, 4590, 4878, 5173, 6111, 6446) assert that, even when medical data is masked or coded, subjects can be identified if the population size is small enough or the defining characteristics described are rare enough (e.g., age, gender, income, illnesses, geographic location, specific profession).
Response: This rule does not require the release of any privacy or other confidential data. This rule does not regulate how medical or other private data are to be handled.
Comment: Commenter (6935) suggests that a final rule should encourage, but not mandate, that future studies provide transparency through confidentiality protections such as data masking.
Response: This rule does not regulate how medical or other private data are to be handled.
Comment: Commenter (0559) states that the NIH has established effective policies governing the sharing of data among researchers and with appropriate access by the public at large. The commenter further states that many journals, including the Endocrine Society, are establishing guidelines and standards for the submission of datasets to repositories that are consistent with NIH policies and the FAIR (findable, accessible, interoperable, re-usable) principles for scientific data management and stewardship. According to the commenter, research that abides by these policies and has been published in high-quality peer-reviewed journals should be considered independently validated and sufficiently available to the public.
Response: This rule does not regulate how medical or other private data are to be handled or require that they be shared.
Balancing Transparency and Handling of Privacy Data
Comment: Commenters (2788, 4589, 5129, 6111, 6125, 6133, 6188, 6366, 6909) suggest that the EPA rule needs to provide a balanced approach between transparency and privacy data privacy concerns of study participants and legal and ethical restrictions on the sharing of sensitive data. Commenter (6908) states that transparency is a virtue but not the only virtue and the agency should not be tempted to equate transparency with quality. The commenter states that, in addition to its own quality standards, the objective of the transparency is to improve quality through additional higher levels of trust or higher levels of scrutiny (which in turn generates higher trust).
Commenter (6111) asserts that transparency does not mean violating the confidentiality of study participants or making all raw data publicly available. According to the commenter, the proposed rule does not comport with the fundamental approach to conducting scientific and medical research that is the standard practice for experienced, advanced scholars and researchers. The commenter states that, in the professional scientific and medical research community, "transparency" means clear and detailed disclosure of all methods, data, assumptions, and uncertainties. Studies are considered "transparent" when the study design and methodology are clear enough to allow other scientists to challenge assumptions, test hypotheses, and either reproduce or replicate the study to determine whether the results obtained are consistent with the original study.
Response: EPA agrees that the clear and detailed disclosure of all methods, data, assumptions, and uncertainties is important. This rule does not require the disclosure of privacy data or otherwise violating confidentiality.
Commenter (4589) expresses concern that the proposal places undue emphasis on the need for "transparency" in the assessment of published studies and does not establish clear guidelines regarding the use of studies that include privacy data that have important relevance for risk assessment. The commenter requests that the proposal state explicitly that data "transparency" must necessarily be waived regarding the medical status of individuals who may have suffered adverse health problems as a result of occupational and environmental exposures. The commenter further suggests that the proposal clarify how medical confidentiality will be protected under considerations of expanded disclosure.
Commenter (6125) states that the National Research Council analyzed the balancing of transparency and disclosure of privacy data as one of many competing factors that needs to be balanced in the interest of making gradual progress over time. According to commenter, the report presents a summary of recommendations which include:
      No one way is optimal for all data users or all purposes. To meet society's needs for high quality research and statistics, the nation's statistical and research agencies must provide both unrestricted access to anonymized public-use files and restricted access to detailed, individually identifiable confidential data for researchers under carefully specified conditions.
      Ultimately, decisions about how much disclosure risk is acceptable in order to achieve the benefits of greater access to research data involve weighing the potential harm posed by disclosure against the benefits potentially foregone, as well as a judgment about who should make those decisions.
Commenter (6188) states that, while EPA specifically solicits comment on balancing "increased transparency" with protection for copyrighted or CBI, EPA has asked for input only on how to "provide protected access," not how to balance that access with appropriate privacy protections, creating the impression that no such balancing calculus is required in the case of individual health data. According to the commenter, this focus overlooks the significant personal privacy pitfalls of the proposal.
Commenter (2788) urges EPA to not censor science in the name of transparency. The commenter quotes former Associate Director for Environmental Health Emergencies at CDC Dr. Scott Deitchman:
      "Transparency in science is a movement whose time has come, but it can't be used to hobble science. Such a rule needs to explain how relevant data that can't be made public, particularly health data containing personally identifiable information (PII), can be used to contribute to the regulatory process. Such a rule also should call for a level playing field, requiring that ALL parties participating in the discussion of proposed regulation must transparently disclose the existence of all relevant studies - you can't bury a study whose conclusions don't support your position - as well as making the data available within necessary constraints to protect PII. The rule also should explain how the agency will transparently comply with the Office of Management and Budget's guidelines on the selection of peer reviewers, who will assess whether the data were correctly interpreted."
Similarly, commenter (5129) states that transparency should not be prioritized over the best conclusive data. The commenter notes that EPA should not create a false conflict between violating the privacy of the people who participate in research studies and protecting the public's health. The commenter contends that EPA's job is not to help industrial studies that are inherently biased to help their profits but to support the health of the American people.
Commenter (6909) states that this rule is based on false premises about transparency and scientific reliability. The commenter states that, in general, transparency in science is a good thing, however, EPA seems to have proposed this rule under the false premise that only scientific studies for which all underlying data is made publicly available can be adequately evaluated. The commenter states that this is simply not the case, and any discussion about mandating transparency through a bright line rule such as the one currently being proposed should be grounded in this fact.
Response: This rule does not regulate how medical or other private data are to be handled or require that they be shared.
Potential Harms Posed by Disclosure of Privacy Data
Harassment, Stigma and/or Retaliation
Comment: Commenters (5176, 6119, 6125, 6153, 6874, 6896, 6943, 8281-PH13) express concern that the proposal does not address the issue that the proposal requirements for open access to study data could make those who provide this information vulnerable to harassment and/or retaliation.
Commenter (5176) asserts that research participants often agree to provide their information on the condition that it remain confidential, out of fear of retaliation for participating in a study that may negatively impact the interests of powerful parties (i.e., landlords, employers, industry leaders, advocacy groups, etc.). Commenter (6119) states that protection of individuals', households', and families' private information cannot be assured if such information is openly available to the public.
Commenter (6125) states that the NRC report recognizes that protecting confidential information is critical to assuring research participants that they do not need to fear harm:
      It is essential that respondents believe they can provide accurate, complete information without any fear that the information will be disclosed inappropriately. Indeed, if the information was disclosed, harm might come to an individual respondent. Many government- sponsored surveys ask about sensitive topics (e.g., income or alcoholic beverage consumption), as well as about stigmatizing and even illegal behavior. The disclosure of such information might subject a respondent to loss of reputation, employment, or civil or criminal penalties.
Commenters (6153, 6874) state that privacy is of concern where data sets include information that could lead to participants facing stigma if it were to be made public. Commenters express concern that in reproductive health research, such information includes pregnancy outcomes such as abortion and miscarriage, and developmental delays that can result from environmental exposures during pregnancy or early life. Commenter (6943) states that study participants should not be subjected to additional stress over legitimate concerns that their personal health information could be released, be put at risk even if redacted, or, worse still, interpreted incorrectly.
Commenter (6896) states that protecting sensitive worker information is of concern in the construction industry as construction is a highly physical occupation; hiring is done quickly and often without much oversight; and construction employees are concerned about being blackballed when employers have reason to view them as physically compromised or vulnerable to health or safety risks on the jobsite. The commenter states that, for example, construction employers confirmed that they would be likely to refuse to hire employees whose medical records revealed decreased lung function. The commenter further states that construction workers have also expressed reticence to report injuries and illnesses because they feared employer retaliation or loss of future work opportunities. According to the commenter, when construction workers participate in research, they risk individual entitlements, impairment of family relationships, job retention, peer pressure, promotion opportunities, and obtaining and retaining medical and health benefits.
Commenter (8281-PH13) states that people talk to them about being exposed to pesticides, and that they are afraid to make a report because they fear losing their job, or fear retaliation.
Response: This rule does not regulate how medical or other private data are to be handled or require that they be shared. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws.
De-identification of Data May Reduce or Negate the Usefulness of the Data
Comment: Commenters (1420, 1945, 4542, 4878, 5170, 5173, 5176, 6111, 6896, 6919) assert that there are many studies where it is impossible to de-identify data to a level where the data is both usable and participants are properly protected. Commenters (0100, 1954, 5419, 6120, 6125) assert that, in epidemiological studies, redacting information consistent with privacy requirements may render health effects data meaningless/unusable.
Commenter (6919) asserts that researchers can only conduct high-quality and reproducible research by protecting the personal health information of study participants. Likewise, the commenter states that public health professionals must retain private personal data in their own study records in order to conduct accurate and useful surveillance to inform local, state, and national policies. The commenter suggests that the proposed rule would effectively keep critical studies in the dark  -  the opposite of transparency.
Commenter (6120) expresses concern that the proposed rule will prevent the use of key public health data whenever epidemiologists keep personal data confidential despite publishing in peer reviewed journals. The commenter suggests that, while the proposed rule cites requirements of major scientific journals for the availability of data, the editors of those journals have also issued a joint statement discussing the importance of including all relevant studies articulating circumstances where data cannot be fully shared, such as when it includes personal identifiers.
Commenter (4542) states that de‐identification methods can degrade the accuracy of data for multi‐variate statistical analysis or data mining, potentially masking important relationships, such as racial differences in outcomes. Commenters (0100, 1954, 5176, 6125) assert that since an address is identifying information, it cannot be released with the epidemiological data; but without that information, the health effect data is meaningless as there is no longer a means of correlating the effects to degree of exposure. Commenter 5149 contends that de-identification of data it develops to a form that would be acceptable for sharing would preclude their use in meaningful air pollution epidemiological research because identifying information such as the ZIP codes of residence is required to assign pollutant exposures, and identifying information such as age, gender, and race is required to allow adjustment for these factors in epidemiological models.
Commenter (4878) states that, while a study showed that consuming water from a private well located in an area with historical pesticide use is associated with an increased risk of Parkinson's disease, due to the nature of wells  --  typically serving a relatively limited number of people within a very small radius  --  the detail needed to perform the study renders proper de-identification impossible. Commenter (6111) states that, for some studies (e.g. prospective cohort studies that include extensive personal data; environmental health effects studies), it is impossible to de-identify the data without negating its scientific value.
Commenter (6133) states that the 2009 Integrated Science Assessment for PM2.5 notes that "[a]ppropriate statistical adjustment for confounders requires identifying and measuring all reasonably expected confounders." Commenter states that exclusion of some potentially sensitive confounding variables from an underlying dataset likely would lead a different team of investigators to a different result -- not as a result of any true difference in the quantitative exposure-effect relationship, but because the original work relied on complete data sets and the new analyses would not -- due to the proposal. Commenter states that the resulting discrepancies in quantitative findings could serve as motivation to call the original study results into question due to faulty and incomplete re-analyses.
Response: This rule does not require that in order to be used dose-response data be anonymized to the point that it is not informative. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws.
Comment: Commenter (6125) states that at a 2014 NAS workshop on data sharing, Greenbaum of the Health Effects Institute (HEI) noted that sharing de-identified data files would not be useful for air pollution cohort studies "because a de-identified one would not allow you to have location and a variety of other things that are absolutely essential."
Response: This rule does not require that in order to be used dose-response data be anonymized to the point that it is not informative. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws.
Comment: Commenters (2336, 2429, 6133, 6158, 6373, 6446, 6924, 9227) assert that, to protect against re-identification as required by HIPPA, it would be necessary to remove so much demographic information from the dataset that other scientists would not be able to perform a meaningful reanalysis or validation of the data. Commenter (2336) states that, under HIPAA, researchers would have to redact the participants' names, birthdates and death dates, among other information, before they could release their health-outcomes data publicly.
Commenter (9227) cites the HIPPAA guidelines document: "Of course, de-identification leads to information loss which may limit the usefulness of the resulting health information."
Commenters (6158, 6924) state that a workshop organized by the National Research Council in 2000 highlighted that the more identifiers within a dataset are redacted, the less useful the resulting data become in terms of reanalysis. Commenters assert that this indicates that in many cases, the results of a re-analysis completed with de-identified or masked data would necessarily be different than the original study. Commenters argue this runs counter to the rule's stated intent of using these techniques to allow public disclosure of data and validation of scientific findings. Commenters assert that the agency can't make data available (given its need to be de-identified) and simultaneously have its reanalysis be meaningful.
Response: This rule does not require that in order to be used dose-response data be anonymized to the point that it is not informative. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws.
Comment: Commenters (2429, 5015, 6909, 6925, 8281-PH20) express concern that the proposed rule does not address impacts on the quality of analysis that arise due to information loss.
Commenter (2429) asserts that, after simple data masking, coding, and de-identification, it is not guaranteed that statistical and inferential reproducibility will be achieved. Commenter (5015) expresses concern that it is not possible to conduct a high-quality air pollution and health study without knowing the locations of those being studied, i.e. where they live, and what are the sources and levels of their air pollution exposure. Commenter (8281-PH20) states that data de-identification and masking techniques can degrade the accuracy of data for further analysis.
Commenter (6909) states that de-identification techniques have the unfortunate side-effect of degrading the data's analytical integrity for purposes of further analysis  -  exactly the kind of further analysis EPA says it wants to enable by promulgating this rule. Commenter states that any claim that it is a simple matter for health data underlying a study to be anonymized and made public should be met with deep skepticism.
Commenter (6925) states that, requiring that health study data be made public, while protecting privacy, would likely dilute the results by introducing noise into the measurements. Commenter states that one of the most critical pieces of information that would certainly be protected from disclosure is patient addresses  -  this could potentially be "de-identified" by providing a larger geographic identifier, such as a zip code or county of residence. Commenter states that this process of deidentifying also leads to greater misclassification of exposure, and the higher likelihood that any true effect that exists will not be detected, simply due to imprecise exposure estimation.
Response: This rule does not require that in order to be used dose-response data be anonymized to the point that it is not informative. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws.
Participation in Research Studies
Comment: Commenters (1335, 1831, 1973, 2171, 2904, 4410, 5012, 6111, 6125, 6133, 6170, 6171, 6446, 6872, 6876, 6882, 6884, 6896, 6898, 6909, 8281-PH6, 8281-PH10, 8281-PH13, 8281-PH35, 8281-PH-10, 8281-PH48, 8818) express concern that this proposal will decrease people's willingness to participate in future studies of environmental exposures, due to concerns about trust and privacy.
Commenter (2904) states that, while transparency is important in science in order to maintain rigorous scientific method, a balance must occur to protect individuals involved in that research. The commenter states that the proposed rules will jeopardize research in small vulnerable communities who are often the very ones needing EPA and public health research. According to the commenter, a change in current standards will greatly impact research in these communities and their participation in much needed public health and environmental science. The commenter notes that tribes will not participate in research if their confidentiality and intellectual property rights are not ensured. The commenter adds that many important and disadvantaged populations are located in rural and other small communities that make de-identification of individuals and their data a significant challenge. The commenter explains that many participants or subjects in research studies come from protected groups who have a history of exploitation by the United States government, including Native American and Alaska Natives, and that Native peoples in the U.S. are unduly burdened by health disparities and by health disparities related to environmental hazards.
Commenter (1395) states that, if researchers are allowed to reveal confidential medical records, no one would agree to have their medical records used for such studies, and then this research could not be conducted. Commenter (1831) states that if, for instance, someone could not participate in a drug trial for a cure for genital herpes without announcing his affliction to the world, he would likely not participate; as a result, knowledge would not advance, suffering would go unrelieved, and medical research becomes impossible. Commenter (8281-PH35) states that the proposal would make public health research impossible, or much, much more difficult.
Commenters (2171, 4410) assert that it is well documented that privacy assurances are essential to recruit and maintain population-based cohorts. Commenter (1973) states that concern about privacy would have widespread ramifications for health research in general, since many of the cohort studies of air pollution (e.g. Framingham Heart Study, American Cancer Society Study, Nurses' Health Study, MESA study) were originally funded for other purposes and continue to do important research on cardiovascular disease and cancer.
Commenters (1420, 6125, 6133, 6872, 8281-PH6, 8281-PH10, 8281-PH24, 8281-PH13, 8281-PH48, 8281-PH48, 8817) assert that the proposal does not consider the negative effects it would have on recruitment for future epidemiological studies if members of the public had to permit access to sensitive personal and health information as a condition for study participation.
Commenter (1420) states that, while the proposed regulation sounds well-intentioned, the reality is that public health research relies heavily on personal health data and few people will allow their data to be used if those data were publicly available. Commenter (6125) expresses concern that informing prospective survey participants that data that could be used to identify them might be made publicly available could make it more difficult to enroll subjects in future studies. Commenter (6872) states that the threat of confidential data disclosure would create a strong disincentive for people considering participation in such studies going forward. Commenter (8281-PH6) states that it may be more challenging for researchers to recruit participants for their studies because of the fear that personal data could be shared. Commenter (8281-PH24) states that volunteers will cease to come forward for scientific research if their medical history and geographic information will be made public, thus putting critical scientific research at risk. Commenters (8281-PH10, 8281-PH13, 8281-PH48, 8281-PH48, 8817) assert that, if we could not assure patient confidentiality, we would not have their participation.
Commenters (6133, 6170, 6171, 6884, 6896, 6898) assert that human subjects will not be willing to provide sensitive information without a guarantee of confidentiality from the researchers for this information.
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws. Thus, the rule should not have a negative effect on study participants.
Comment: Commenter (6170) asserts that, in epidemiologic studies, most, if not all, human subjects will not be willing to provide such sensitive information without a guarantee of confidentiality from the researchers for this information. Commenters (6171, 6898) state that the inability of a scientist to guarantee confidentiality would be a major barrier to being able to recruit an appropriately diverse population of participants. Commenter (6884) states that farmworkers agree to participate because they are guaranteed that their information will remain anonymous, so that they do not risk retaliation for participating. Commenter (6896) states that construction workers will not participate in scientific research unless they know they will be protected from employer retaliation. Commenter (6896) states that sharing a dataset publicly as required by the proposed rule would directly violate the participant's consent.
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available.
Comment: Commenters (6446, 6909) state that the fact that the public would be able to de-anonymize much epidemiological data, after de-identification processes have been applied, would almost certainly have a chilling effect on voluntary public participation in important research. Commenter (6909) states that, while it is not perfectly clear what EPA's intent is, it is possible given the vagueness of the proposed rule's language that EPA will see fit under some circumstances to make data public itself when it wishes to use a study as a basis for a regulatory action. Commenter (6909) states that, even where it is possible to recruit study participants, it could become challenging to recruit enough participants who adequately represent the population to make the study useful from a statistical standpoint.
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws. Thus, the rule should not have a negative effect on study participants.
Comment: Commenters (1973, 6909, 8281-PH6) express concern that states that, if the proposed rule is implemented it is possible that EPA will conduct less epidemiological research and scientists, organizations, and research institutions will be less inclined to participate in EPA-funded research because of the risk of improperly disclosing personal information. Commenter (1973) states that concern about privacy would prevent future research on environmental exposures.
Commenter (6125) states that the NRC report recognizes that protecting confidential information can be critical to getting good data: "The reason for confidentiality pledges and for stringent procedures to prevent disclosure is that they improve the quality of data collected from individuals, households, and firms. It is essential that respondents believe they can provide accurate, complete information without any fear that the information will be disclosed inappropriately."
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available. Thus, this rule will not create a disincentive to new research.
Other Potential Harms
Comment: Commenter (6137) states that, as the Seventh Circuit has explained, people may have privacy interests in unidentifiable personal information: "Imagine if nude pictures of a woman, uploaded to the Internet without her consent though without identifying her by name, were downloaded in a foreign country by people who will never meet her. She would still feel her privacy had been invaded." Commenter states that, according to a 1993 study, more than 60 percent of Americans want hospitals, pharmaceutical companies, and researchers to obtain patient consent before using medical information -- even if that information has been de-identified.
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available.
Comment: Commenter (6147) states that there are sensitive ecological, cultural, and archeological data which must be kept private to assure their safety from vandalism, terrorism, and wanton destruction.
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available.
Comment: Commenter (4877) states that many studies also contain data that is sensitive in terms of security, business confidentiality, and intellectual property reasons, and this data should also be exempt from blanket data sharing requirements. Commenter (6373) states that, because an increasing number of epidemiological studies rely on spatial (e.g., residential address) and temporal (e.g., date of treatment) information to identify risk factors associated with exposures to environmental pollutants, releasing more data publicly can itself compromise national security.
Commenter (8913) states that an unintended consequence of the rule is the national security hazard which flows from the requirement of publication of data sets featuring personal identifiers. Commenter states that the proposal would open a portal into troves of personal confidential information, including the medical, mental health and lifestyle records of cohorts, including individuals associated with military activity and critical infrastructure (frequently the subject of study due to exposure to dangerous chemicals and radiation) who may then be subject to blackmail. Commenter states that hacking and other cybersecurity incidents in recent years demonstrate the inability to fully safeguard such information.
Response: This rule does not require the public disclosure of any sensitive or confidential data.
Confidential Business Information
Does the Handling of Confidential Business Information (CBI) Conflict with Legal Requirements?
Comment: Commenter (6098) states that trade secrets, commercial or financial information that is privileged or confidential are all protected by laws and regulations.
Commenter (6133) contends that the proposed rule's handling of CBI is unlawfully vague and arbitrary and capricious. According to the commenter, the differential treatment of health data and CBI submissions relevant and even integral to EPA's rulemakings, is the essence of arbitrary and capricious action.
Commenter (6196) expresses concern that industry-conducted studies may contain CBI required to be withheld by law.
Response: This rule does not require the public disclosure of any sensitive or confidential data, regardless of whether it is CBI or PII.
Comment: Commenter (6143) states that TSCA §14 provides explicit protections for CBI that is submitted to EPA. The commenter contends that TSCA itself recognizes that specific, limited classes of information should remain confidential, even if they play a role in decisions that the Agency makes pursuant to TSCA.
Response: This rule does not require the public disclosure of CBI. CBI will be handled in accordance with applicable statutes and regulations.
Handling of CBI Under the Proposal
Comment: Commenters (2401, 2787, 6133, 6148, 6196, 6361, 6872, 6920) oppose or express concern with the proposal's approach to CBI.
Commenter (6148) states that in some circumstances full transparency may not be achievable due to CBI. Commenter (2787) states that industry representatives have expressed concerns about requiring public disclosure of data, such as CBI, citing the potential for improper use of such data by competitors.
Commenter (6361) expresses concern that many studies performed using data from industrial sources would be excluded because they contain CBI, such as product formulations. The commenter states that, under federal law, there are criminal penalties for disclosing CBI, and without demonstrating how compliance will be achieved in tandem with making research data publicly available, it creates serious liability concern for the EPA's intentions.
Commenter (2401) opposes the proposed rule because it will have a negative effect on the relationship between private businesses across a variety of sectors and the EPA. The commenter states that, for proprietary reasons, many firms cannot publicly share results from research they have conducted (in companies in diverse sectors including construction, pharmaceutical, and retail products). The commenter states that this rule would effectively gag companies from sharing such research with the EPA because the work would then have to be made public in its entirety, effectively stopping private companies from cooperating and reaching out to the federal government to help inform regulation and best practice.
Commenter (6872) states that, while CBI data is the least transparent information utilized by EPA and legitimate questions exist regarding the scope of CBI designations, the mandatory public release of appropriate CBI risks undercutting U.S. businesses that are increasingly working to formulate greener, less toxic chemical products that provide a market advantage. The commenter states that mandatory public release of data appropriately considered CBI would create disincentives to the generation and submission of such data to EPA, hindering TSCA and pesticide assessments and could also jeopardize US environmental business innovations.
Commenter (6175) states that agricultural landowners have unique concerns as many also maintain places of residence on their farms, and data disclosed could include physical addresses and other identifying information. Any new data disclosure requirements should maintain consistency with established statutory privacy protections and judicial precedent.
Response: This rule does not require the public disclosure of CBI, nor does it include any requirements for the use or management of CBI data. CBI will be handled in accordance with applicable statutes and regulations.
Comment: Commenters (6857, 6935, 9243) suggest that any final rule should include a process for safeguarding CBI. Commenter (3971) contends that confidentiality can be protected in all the studies upon which EPA relies. Commenter (6935) reports that many states have CBI strategies that might be evaluated. Commenters (6857, 9243) state that, in some instances, there could be legal requirements preventing CBI from being disclosed while in others there may be concerns centered around competition in the marketplace. Commenters (6857, 9243) state that, in either instance, EPA should consider and provide some sort of mechanism for entities to share information with the agency when necessary without suffering unnecessary adverse impacts.
Commenter (6362) suggests EPA consider the following strategies to protect CBI.
 If necessary, when specialized expertise is needed, EPA could contract with an independent third-party science reviewer to confirm those findings.
 EPA might also consider an approach followed under FIFRA where Data Evaluation Records of studies are made publicly available, but not full studies.
 Another approach is that of the European Union's REACH program, which makes Robust Study Summaries (RSS) publicly available, while protecting from disclosure the competitively sensitive underlying data of health and safety studies.
 When protecting data while also promoting data access, the NIH guidelines should be consulted. Many of these guidelines could be applied in EPA's implementation of this proposed policy under each of the statutory programs EPA administers to ensure the guidelines adopted suit the specific needs of each statute.
 In circumstances where company CBI and other intellectual property may be implicated, EPA should confer with the CBI data owner to determine how to make that data available to the greatest extent possible without disclosing the CBI within that data, study, or model. The commenter provides the following example:
            For example, under TSCA, while the summarized study results, analysis, and final report may be publicly available, the underlying data in a health and safety study may qualify as CBI when the underlying data are not in the public domain and that data provides a commercial value to its owner. In such circumstance, it is the availability of the underlying data that determines whether or not an unpublished study can be used by a competitor to support its notification or registration of a substance overseas without obtaining ownership or citation rights to use such data, depriving the data owner of the value of its investment in the underlying data. Current EPA regulations require chemical manufacturers to submit health and safety studies under some circumstances. However, it is noteworthy that none of these regulations routinely require study submitters to submit underlying data along with a final report. This indicates that the final report likely communicates sufficient information about the potential health and environmental effects to the public when a company has submitted health and safety studies in which it has a commercial interest in protecting.
Commenter (6376) commends the EPA for understanding the need to blind CBI in the proposal. The commenter states that the ability to shield CBI is essential for the business community to share relevant scientific studies under the new proposal. The commenter adds that similar measures should be provided for other sensitive data or information from studies unrelated to CBI.
Response: This rule does not require the public disclosure of CBI, nor does it include any requirements for the use or management of CBI data. CBI will be handled in accordance with applicable statutes and regulations.
Comment: Commenters (0559, 6116, 6130, 6133, 6147, 6920) generally support increased access to CBI. Commenter (0559) states that responsible authorities, including state agencies, the EPA, and independent scientific reviewers should be able to request and have access to CBI when necessary to evaluate hazards due to chemical exposures. Commenter (6130) states that refinement of EPA dose-response models would be more likely accomplished by increased disclosure of CBI, not by the increased protection of CBI and decreased availability of scientific information. Commenter (6147) asserts that the codes for chemical formulations which are patented or are protected by CBI should be open to scrutiny by scientists and the community.
Commenters (6116, 6133, 6446, 6920, 6922) express concern that many studies performed using data from industrial sources would be excluded because they contain CBI. Commenter (6920) states that the proposed rule establishes increased protections for CBI, diminishing the amount of information available to the public to inform policy, whether from the scientific community or from the business community. The commenter asserts that these proposed provisions reduce rather than increase public transparency.
Commenter (6133) states that industry stakeholders may submit studies, data or information for which CBI redactions would prevent EPA from considering those materials, because the information is not "publicly available in a manner sufficient for independent validation." According to the commenter, this could prevent EPA from adopting standards, exclusions, or other regulatory provisions informed by that information. Commenter (6446) states that EPA has long recognized that, while CBI submitted to EPA cannot be shared with the public, the Agency routinely relies on that information, including scientific studies and other scientific information, as the foundation for important regulatory decisions.
Commenter (6133) states that other industry stakeholders opposed to the appeals and demands sought by the first set of stakeholders, would be harmed if EPA nonetheless considers the latter industry's submissions, notwithstanding redacted CBI that is not "publicly available in a manner sufficient for independent validation" -- while at the same time EPA refuses to consider confidential non-business information submitted by the opponent-stakeholders.
Response: This rule does not require the public disclosure of CBI, nor does it include any requirements for the use or management of CBI data. CBI will be handled in accordance with applicable statutes and regulations.
Comment: Commenter (6922) states that any rule should continue to protect CBI. The commenter asserts that, because the proposal risks disclosure of CBI, the proposal could discourage industry and research institutions from working with EPA and contributing information if the Agency cannot ensure that intellectual property, trade secrets, and customer data would be protected from disclosure. According to the commenter, if companies are reluctant to submit CBI to EPA, the Agency's rules will not be based on the best available data.
Response: This rule does not require the public disclosure of CBI, nor does it include any requirements for the use or management of CBI data. CBI will be handled in accordance with applicable statutes and regulations.
Balancing Transparency and Handling of CBI
Comment: Commenter (6143) states that TSCA itself recognizes that specific, limited classes of information should remain confidential, even if they play a role in decisions that the Agency makes pursuant to TSCA. The commenter asserts that EPA should ensure that any final action it takes on the proposed rule respects this balance, encouraging transparency while making limited exceptions to accommodate legitimate, protected privacy interests such as CBI.
Commenter (6366) states that there is a need to address consideration of private and confidential information that is contained within the pivotal regulatory science being used. The commenter contends that a final rule can be crafted that balances the responsibility EPA has under existing statutes for private and confidential information.
Response: This rule does not require the public disclosure of CBI, nor does it include any requirements for the use or management of CBI data. CBI will be handled in accordance with applicable statutes and regulations.
De-Identification Procedures and the Potential for Re-identification
De-identification Procedures Have Limitations
Comment: Commenters (0569, 0100, 1008, 1346, 1420, 1461, 1476, 1481, 2171, 2477, 2548, 2687, 4542, 4872, 5019, 5176, 6111, 6125, 6137, 6153, 6125, 6158, 6170, 6446, 6772, 6868, 6873, 6877, 6909, 6924, 6932, 8281-PH20, 8281-PH46, 9227) are generally opposed to the proposed disclosure provisions because de-identification procedures to anonymize personal health data and information can be burdensome and may not sufficiently mask personal identifiable information.
Commenter (6111) states that EPA's suggestion in the proposed rule that "simple data masking, coding, and de-identification" will be able to overcome these confidentiality concerns is incorrect. The commenter asserts that EPA's SAB states "[i]n some cases, the data cannot be released simply by redacting portions of it. For example, data may have been collected with an assurance to the participating individuals that their data would be kept confidential."
Commenter (9227) asserts that EPA ignores the real concerns, based in empirical evidence, about reidentification of individuals through cross linking with existing public datasets and the ensuing breach of privacy. The commenter states that experts have observed that even the disclosure of redacted or "de-identified" data sets have become more fraught as public health studies have become more rigorous, because these studies are relying upon greater quantities of ever more granular personal information.
Response: This rule does not require the disclosure of PII or mandate any procedures on the use or management of PII.
Comment: Commenter (6125) asserts that the proposal's unsecured promissory note that it will "make all reasonable efforts to explore methodologies, technologies, and institutional arrangements" for making data available and preserving privacy both fails to say how and fails to acknowledge the extreme difficulties in doing so. Commenter states that, by ignoring all the issues raised (including in the very sources it cites), the agency arbitrarily ignores key issues and record evidence. State Farm, 463 U.S. 43.
Response: This rule does not require the disclosure of PII or mandate any procedures on the use or management of PII.
Comment: Commenters (0100, 6873, 6896) explain there are barriers with respect to older studies.
Commenter (0100) states that each IRB committee usually specifies a fixed time period after completion of the study at which the researcher must destroy his or her copies of the raw data and, thus, would no longer have it available to supply to the EPA after this fixed destruction date. Commenter (6896) states that many data sharing and informed consent agreements include clauses for destroying or returning raw data sets after a study's completion, and so data sharing may not be possible. Commenter (6873) states that, for older studies, improving data access to the degree necessary to pass the openness requirements of this proposed rule could end up being almost impossible given that consent forms written 10-20 years ago were largely silent on the issue of broad sharing of data. The commenter adds that IRBs cannot release private data without consent and getting this consent from study participants where the personal information has long since retired and participants have either died or moved multiple times will be extremely challenging and costly at best, and effectively impossible at worst, therefore possibly rendering "old" studies unusable. Commenter (6896) states that data confidentiality laws have changed to increase protections for research subjects throughout the years and older datasets may contain data that would be considered illegal under current laws. The commenter states that requirements that subjects be notified on how their personally identifiable information is used and shared may prove so cumbersome as to make data sharing impossible for older datasets. The commenter adds that the individuals may be no longer living or be reachable through the contact information originally provided to researchers.
Commenter (6915) asserts that the proposal's suggestion that concerns about access to confidential or private data can simply be addressed through the application of tools used by other federal agencies, id. at 18,770-71, will be unworkable or impracticable for many past and even future studies. For example, the commenter provides that the proposal cites to guidance regarding methods to de-identify protected health information under the privacy rules of the 1996 HIPAA, Pub. L. No. 104-191, 110 Stat. 1936. Id. at 18,771 n.17. The commenter states that the cited guidance document is 28 pages, contains detailed instructions for de-identification, including how experts are to assess the risk of identification of information, and emphasizes the importance of data-sorting systems to manage protected health information for the de-identification process, including use of a one-way cryptographic function to obscure personally identifiable information. Among other things, the commenter states that the guidance provides that various identifiers of individuals -- including all names, geographic subdivisions smaller than a state (with one exception), dates directly related to an individual, telephone numbers, biometric identifiers, and so forth -- must be de-identified. HIPAA Guidance at 4-5. According to the commenter, the guidance thus highlights that, in fact, it is not easy to address confidentiality concerns: the de-identification process is complex and must be designed into the overall study process, something that cannot be done for historic studies. Moreover, the commenter asserts that, to the extent that one of the purposes of the proposal is to enable persons to replicate studies, this may not be possible where the de-identified data is critical to the studies' findings and conclusions.
Response: This rule does not require that dose-response data that contains privacy or other confidential data be made publicly available. It does not mandate any procedures on the use or management of PII. Dose-response data that contains privacy data or any other confidential data would be considered available for independent validation if it were available through restricted access consistent with all privacy laws.
Possibility of Re-identification
Comment: Commenters (1973, 2171, 2548, 2906, 6125, 6446, 6868) assert that data masking, coding and de‐identification techniques have limitations because re‐identification of participants is still possible.
Commenter (2548) states that data transparency and data sharing are not always viable options when researchers study human beings and must estimate exposures as a function of location and time. Commenter (5170) states that when individual characteristics are combined by linking datasets (for example, death records, age, sex, and exposure information), individuals can be identified. Commenter (6133) states that research has documented that de-identification techniques to render data anonymous are not "simple" as the proposal characterizes and can lead to the publication of protected confidential or private data. Commenter (4542) states that re‐identification of participants is also made possible by using external information available online and through other sources. Commenter (6909) states that even when "direct identifiers" like names, addresses, and birth dates are removed, "the data values themselves may possess some degree of subject specificity or uniqueness" that could potentially be used to identify individual study participants. Commenter (6133) asserts that, with the shift away from paper to electronic medical records in recent decades, "the potential for individuals to access, use, and disclose sensitive personal health data" has increased.
Commenters (2477, 3135) suggest that it is not always possible to de-identify the data set. Commenter (2477) states that Deoxyribonucleic Acid (DNA) samples/data can be delinked from identity, but the ability to re-link that later is inherent in DNA. Commenter (3135) states that the geneticist Craig Ventner and colleagues reported the ability to identify persons using their genetic code alone (without needing to do a DNA match).
Commenters (2171, 6446) specifically state that data masking, coding, and other procedures suggested to protect privacy, particularly in the context of epidemiological research, would not work. Commenter (6446) explains that even when medical data is masked or coded, subjects can be identified if the sample size is small enough, the characteristics described are rare enough, and/or the data includes, for example, subjects family structure, geographic location, dates of birth, sex/gender, medical conditions, occupations, and/or dates and causes of death. Commenter (2171) states that data availability, as proposed under this rule, would disclose information such as geocoded latitude/longitude residential locations; demographic covariates; and repeated measures in longitudinal population-based studies. According to the commenter, if made publicly available, as required by the proposed rule, the specificity of these non-private covariates would facilitate, with relative ease, the re-identification of individuals and their protected health information. The commenter states that it is this very specificity in geographic, demographic, and health information that contribute to epidemiological studies with the most robust quantification of dose-response and uncertainty relationships.
Commenter (1973) states that the arguments that data can be redacted to be non-identifiable are belied by modern data science. Re-identification can easily happen. The commenter provides the following examples.
      Consider the Harvard Six City study. To get good exposure estimates participants were recruited not across the cities involved but from one neighborhood in each city. In Boston that neighborhood was Watertown with a population of about 35,000. From data obtainable from the MA department of Public Health, the average number of deaths per year in Watertown is 208. Applying the average U.S. mortality rate per 1000 people to the population of Watertown would give very similar results. This is less than one death per day. Obviously knowing the date of death alone would uniquely identify most of the participants. But even if the data made public were restricted to providing only the year of death (which is required to replicate the analysis or do any reasonable analysis of the effect of air pollution on annual mortality) the analysis of such data also requires knowing the age, race, sex, and cause of death of each individual. Again, with only 200 deaths in a year, it is likely that most people can be identified from knowing those facts. After all, that is only 100 deaths per year for each sex, and those deaths occur across a range of at least 40 ages at death, and many different causes. Combining this with publicly available obituary data, or publicly available death certificate data, would complete the identification of each person.