Finally, the EPA is not categorically excluding any studies from consideration when promulgating significant regulatory actions and finalizing influential scientific information. Rather, the Agency will continue to evaluate the quality of all relevant studies, consistent with the intended use of the information. The EPA will subsequently consider dose-response data availability when evaluating pivotal science and give greater consideration to studies where the underlying dose-response data are available for independent validation. There may be pivotal science where the underlying dose-response data are not available in a manner sufficient for independent validation. In these cases, the EPA may still use these studies in significant regulatory actions and influential scientific information after either giving lesser consideration to the study or studies or if the Administrator grants an exemption under 40 CFR 30.7.
The EPA intends for the final rule to be implemented in a transparent manner. The final rule requires the EPA to document the rationale for exemptions granted by the Administrator to the requirements included in the final rule in the significant regulatory action or influential scientific information. Additionally, the EPA expects to identify pivotal science in proposed significant regulatory actions or external review drafts of influential scientific information, which will allow the public, if they so choose, to independently validate the pivotal science and provide comment to the EPA.
10.7.7 Physical Objects, Drafts and Preliminary Analyses Exclusion
Comment: Commenter (6880) states that, in describing the data to which the proposal applies, EPA states in 40 CFR 30.3 "[t]he provisions of this section do not apply to physical objects (like laboratory samples), drafts, and preliminary analyses." According to the commenter, as these are already excluded from the definition of "research data," it would be redundant for EPA to exclude them if they were using said definition. Also, the commenter asserts that, by mentioning these exclusions while remaining silent on trade secrets and privacy information that are excluded from the definition of "research data," EPA clearly signals that those data are not excluded from the "data" to which EPA refers in the proposal. The commenter contends that the proposal is clear that it applies to a much broader range of data than that included in the cited definition of "research data." The commenter states that this would allow EPA to ignore research findings if it were not possible to make public all the underlying data, including data that is excluded from the definition of "research data."
Response: Based on a consideration of this and other similar comments, the EPA issued a SNPRM in 2020, which included clarifications, modifications and additions to certain provisions proposed in the 2018 NPRM. In the 2020 SNPRM, the EPA deleted the 2018 proposed 40 CFR 30.2 definition of ``research data,'' because, as noted by the commenter, this definition excludes ``trade secrets, commercial information, materials necessary to be held confidential by a researcher until they are published, or similar information which is protected under law'' and ``[p]ersonnel and medical information and similar information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy, such as information that could be used to identify a particular person in a research study.'' The EPA clarified in the 2020 SNPRM that these types of data would not be disclosed in violation of any statutory prohibitions.
In the final rule, the EPA has defined "data" to mean "the set of recorded factual material commonly accepted in the scientific community as necessary to validate research findings in which obvious errors, such as keystroke or coding errors, have been removed and that is capable of being analyzed by either the original researcher or an independent party."
In the final rule, the EPA has also revised the requirements of 40 CFR 30.3 to clarify how the provisions of the 40 CFR part 30 apply to EPA activities. As stated in 40 CFR 30.3, "The provisions of this part apply to science that serves as the basis for informing a significant regulatory action or influential scientific information, as well as to dose-response data underlying pivotal science, regardless of the source of funding or identity of the party conducting the science." Because the provisions of 40 CFR part 30 apply to science that serves as the basis for informing a significant regulatory action or influential scientific information, the EPA finds it appropriate to further clarify that this science does not include physical objects (like laboratory samples), drafts, and preliminary analyses, and influential scientific information and/or pivotal science that meet one or more of the exemptions identified in Section IX of the OMB Final Information Quality Bulletin for Peer Review.
10.8 "Regulatory Decisions" Definition at 40 CFR 30.2
10.8.1 Amend Definition to Remove Limitation of Applicability to Only Final Regulations
Comment: Commenter (4932) recommends that EPA alter the "regulatory decisions" definition by striking the word "final" to make the Transparency Proposal fully consistent with Executive Order 12866. The commenter states that the necessary (and seemingly unintended) implication of including the word "final" in the definition is that the transparency objective (i.e., the disclosure of pivotal regulatory science) does not apply to advanced notices of proposed rulemaking or proposed rulemakings. The commenter asserts that the public must have access to pivotal regulatory science at these earlier steps in the rulemaking process in order to assess effectively the merit of the Agency's regulatory science. The commenter concludes that EPA's adoption of their recommendation would address this timing issue.
Response: The 2018 proposed rule included proposed definitions for "dose-response data and models," "pivotal regulatory science," "regulatory decisions," "regulatory science," and "research data." Some commenters stated that several of the proposed definitions were unclear, including some that seemed to overlap (e.g., "pivotal regulatory science" and "regulatory science"). Some commenters also stated that certain terms used in the proposed regulatory requirements were not clear and should be defined. The final rule no longer uses the term "regulatory decisions" and thus the term is not defined.
The preamble to the final rule also notes that EPA sees no need to include the proposed rule stage of significant regulatory actions in the final regulatory text for this rulemaking because, as a practical matter, these proposed rules must comply with this final rule in order to be finalized. The EPA does not introduce the studies and analyses it relies on for a rulemaking at the final rule stage. The basis for a rulemaking is provided for public review and comment in the public docket when the proposed rule is issued or if subsequently added to the docket through a separate opportunity for public comment. The EPA expects to identify pivotal science in proposed significant regulatory actions or external review drafts of influential scientific information, which will allow the public, if they so choose, to independently validate the pivotal science and provide comment to the EPA.
The EPA also sees no need to include advance notices of proposed rulemakings in this final rule because advance notices of proposed rulemakings are preliminary in nature and frequently focus on soliciting initial comment on a regulatory issue or approach. Therefore, advance notices of proposed rulemaking are not consistent with the purpose of this final rule.
 10.8.2 Proposal is Inconsistent with Regards to What Types of Regulatory Actions Would be Covered
Comment: Commenter (6133) states that in some places the Proposal suggests that the rule would apply only to final rulemakings (e.g., "regulatory decisions" definition). See 83 Fed. Reg. at 18771 ("EPA solicits comment on whether and to what extent these requirements, or other provisions and policies, should apply to other stages of the rulemaking process . . .."). The commenter asserts that applicability of the rule to only final rulemakings is inconsistent with OMB guidance on Executive Order 12866 that states that the definition is intended to cover "any policy document of general applicability and future effect, which the agency intends to have the force and effect of law, such as guidance, funding notices, manuals, implementation strategies, or other public announcements, designed to implement, interpret, or prescribe law or policy or to describe the procedure or practice requirements of an agency." OMB, Memorandum for Heads of Executive Departments and Agencies, and Independent Regulatory Agencies, at 5 n.3 (Oct. 12, 1993). Therefore, according to the commenter, there is an inconsistency between what EPA says it is doing, and what it is really proposing. The commenter states that without knowing what types of agency actions would be covered, the public cannot understand the Proposal's true impact.
Response: The EPA agrees that the use of "regulatory decisions" is confusing, given that the term was only intended to apply to a subset of regulations. To clarify the definition, the EPA has changed the term from "regulatory decisions" to "significant regulatory actions" in the final rule. The EPA finds that the definition of "significant regulatory actions" used in the final rule (i.e., "final regulations determined to be `significant regulatory actions' by the Office of Management and Budget pursuant to Executive Order 12866") sufficiently identifies the applicability of the final rule.
10.8.3 Regulatory Decisions Should Also Apply to Permitting Activities
Comment: Commenter (6180) recommends that the definition for "regulatory decisions" be revised to apply to permitting activities.
Response: The EPA does not agree with this comment and will not expand the applicability of this rulemaking beyond significant regulatory actions and influential scientific assessments to individual party adjudications, permit proceedings, site-specific actions, and enforcement actions because these actions are typically focused on individual regulated entities.
 10.8.4 Recommends that the Regulatory Decisions Definition Include EPA-Focused Criteria
Comment: Commenter (6906) provides that, throughout the proposed rule, EPA establishes that the guidelines for strengthening the transparency in regulatory science would only apply to "significant regulatory actions" as described by Executive Order 12866. The commenter understands why the Agency uses Executive Order 12866 as the basis for determining whether a regulatory action is significant; as its' four criteria have long been the standard to which the "significance" of a regulatory action is judged. The commenter states that they do not want to discount the decades-long use of this Executive Order with nearly every regulatory action but recommend that it would be useful for the Agency to develop more specific EPA-focused criteria. The commenter states that the EPA-focused criteria could take into account the range of regulatory and policy activities that the Agency conducts. According to the commenter, one possible way to meet this suggestion is by having each Program Office establish a list of rulemaking categories that would not be deemed significant, and thus minimizing any potential confusion. The commenter contends that using this approach could aid future regulators and stakeholders in future determinations as to when these transparency guidelines need to be accounted for. Furthermore, the commenter states that this could be one potential method of "narrowing the scope" of this proposed rulemaking without sacrificing the integrity of what the rule intends to do.
Response: The EPA is finalizing the applicability of this final rule to significant regulatory actions as defined in Executive Order 12866, and influential scientific information because of the broad impact of these actions and assessments. Influential scientific information means scientific information the Agency reasonably can determine will have or does have a clear and substantial impact on important public policies or private sector decisions. Following the Agency's Peer Review Guidance, each Program determines what science produced will be designated as influential scientific information. Also, as described in the preamble to the final rule, the requirements in this final rule set the overarching structure and principles for science transparency in the EPA's significant regulatory actions and influential scientific information. The EPA intends to develop internal implementation guidance and promulgate either statute-specific science transparency regulations or programmatic regulations implementing this procedural rule, which will clarify how the Agency will implement the provisions from this final rule for specific programs authorized under the statutes EPA administers.
10.8.5 Basis for Regulatory Decisions
Comment: Commenter (0039) recommends that EPA require all regulatory decisions, meaning "significant regulatory actions," as defined by the OMB pursuant to Executive Order 12866, be based on:
 Scientific research that meets the "best available reproducible science" standard;
 At least one study on the effect of publication bias on this scientific research;
 At least one meta-analysis of this scientific research; and
 Explicit consideration of whether the corpus of scientific research has accounted for different aspects of the irreproducibility crisis, including flawed statistics, arbitrary research methods, publication bias, and disciplinary and/or political groupthink.
Response: As described in the preamble to the final rule, consistent with existing Agency practice (Ref. 35), the EPA will review and evaluate all relevant scientific studies when developing significant regulatory actions and influential scientific information. The EPA will continue to use the following, established factors to assess the quality of studies used to develop significant regulatory actions and influential scientific information: soundness, applicability and utility, clarity and completeness, uncertainty and variability, and evaluation and review.
When evaluating potential links between exposure to a pollutant, contaminant, or substance and effects and the nature of the dose-response relationship, the EPA will follow best practices and rely on the highest quality, most relevant studies in determining the potential for hazard due to exposure to a pollutant, contaminant, or substance. Where there is convincing and well-substantiated evidence (consistent with Agency guidelines on hazard identification and dose-response assessment) to support a relationship between exposure and effect, the EPA will identify a subset of those studies for use in characterizing the quantitative relationship between the amount of dose or exposure to a pollutant, contaminant, or substance and an effect. This will be based on the exposure situation being addressed, the quality of the studies, the reporting adequacy, and the relevance of the endpoints. From that subset, the specific dose-response studies or analyses that drive the requirements, quantitative analyses, or both will be identified as pivotal science (see Section III.E of the final rule preamble). Once the EPA has identified pivotal science -- for either significant regulatory actions or influential scientific information -- the EPA will then evaluate if the underlying dose-response data are available in a manner sufficient for independent validation. The EPA will give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of personally identifiable information (PII), CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation. The EPA acknowledges, and agrees with commenters, that there may be pivotal science for which the underlying dose-response data are not publicly available due to technological feasibility or cannot be made available in a secure environment that still allows for independent analysis. For example, dose-response data underlying older pivotal science may no longer be available or may not exist in a currently usable format. In these cases, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator (see Section III.G). See Section III.E for a description of the factors the EPA will consider when determining the consideration to afford to pivotal science when the underlying dose-response data are not available for independent validation.
The EPA expects to identify pivotal science, and the consideration afforded to pivotal science, in proposed significant regulatory actions and external review drafts of influential scientific information, which will allow the subject matter experts, if they so choose, to independently validate the pivotal science and provide comment to the EPA. The EPA believes that this approach will allow the public to more effectively comment, engage, and hold the EPA accountable during the future development of specific significant regulatory actions and influential scientific information.
The specific request found in these comments regarding the scientific basis for or other concerns associated with a significant regulatory action will be in part addressed through the availability of dose-response data underlying pivotal science.
 Chapter 11: Availability of Data and Models
The proposal Federal Register preamble states that the proposed rule is intended to strengthen the integrity, transparency, and validity of the scientific information relied upon by EPA (83 FR 18769). The proposal notes that, in applying the best available science to its regulatory decision-making, EPA must comply with federal transparency and data integrity laws (83 FR 18769). Several comments were received regarding the integrity and transparency of regulatory decision making. In this section these comments are organized as follows:
Section 11.1: NPRM Transparency and Integrity of Regulatory Decision Making vs. Availability of Raw Data
       Basis for EPA Decision Making Regarding Use/Non-Use of Studies Not Required to be Transparent; and
       EPA Actions in Other Areas.
Section 11.2: SNPRM Data Availability-Related Comments
       Confidential Business Information, Proprietary Data, or Personally Identifiable Information
The specific comments provided in this Chapter reflect the comment letters that provide arguments supported by detailed rationale, examples, and references/documentation. The Docket ID numbers for these commenters are cited throughout this Chapter. In addition, some general comment letters may also include comments related to comments included and responded to in this Chapter. These comments are summarized in Appendix B. Note that points and issues raised in these general comment letters may also be raised by the more detailed comments summarized in this Chapter. The responses provided in this Chapter adequately address these more general comments.
 11.1. NPRM Transparency and Integrity of Regulatory Decision Making vs. Availability of Raw Data
 11.1.1 Basis for EPA Decision-Making Regarding Use/Non-Use of Studies Not Required to be Transparent
Comment: Commenter (5176) states that the proposed rule does not enhance transparency in science. The commenter states that the proposed rule undermines its claim of promoting transparency within the EPA regarding environmental policymaking. According to the commenter, the proposed rule does not say that a scientist has to make her study data publicly available, if the EPA is to consider using that study to inform policy; rather, it says that her study will not be considered as a basis for EPA decision-making. The commenter adds that the proposed rule requires no transparency regarding when and under what circumstances the EPA might decide unilaterally that a rigorous, independently validated, peer-reviewed study cannot be used as a basis for regulatory policymaking, solely on the grounds that its underlying data are not publicly available. Under the proposed rule, the commenter notes that the public would never know that a decision not to use a particular study had been made. The commenter contends that, in that sense, the proposed rule will foster a lack of transparency about EPA decisions and the science that serves as the basis for its regulatory policy.
Commenter (9224) asserts that, in order to increase transparency, it would be important to have the agency give a thorough explanation as to why certain studies and data sets were chosen and not others, rather than relying on public access to the individual data. The commenter states that the public does not need the individual data in order to determine if there are inherent issues within the study itself. The commenter states that the analysis of the data is already done multiple times throughout the publication process, via peer review. The commenter states that, while it is useful to have the data EPA uses, it is perhaps more important to understand the methodology and reasoning behind why EPA chooses the data it does.
Response: The EPA disagrees that this rule will foster decreased transparency in regulatory decision-making. In this final rule, the EPA is not categorically excluding any studies from consideration when promulgating final significant regulatory actions or developing influential scientific information. Rather, the Agency will continue to evaluate the quality of all relevant studies, consistent with the intended use of the information. The EPA will also continue to rely on the highest quality, most relevant studies available in determining the potential for hazard due to exposure to a pollutant, contaminant, or substance. When characterizing the quantitative relationship between the amount of dose or exposure to a pollutant, contaminant, or substance and an effect, the EPA will identify pivotal science and give greater consideration to pivotal science for which the underlying dose-response data are available in a manner sufficient for independent validation. As stated in 40 CFR 30.5(c), the Agency will identify the pivotal science that was given lesser consideration and provide a short description of why lesser consideration was given.
As codified in this rule in 40 CFR 30.4, EPA will continue its practice of making public the science that serves as the basis for informing a significant regulatory action available in the public docket. The EPA has established various guidelines for how it assesses scientific evidence in its regulatory actions and influential scientific information, such as the Framework for Human Health Risk Assessment to Inform Decision Making. The Agency will continue to follow this and other guidelines under this rule. Consistent with the intent of this rulemaking, the EPA also intends to clearly identify the studies considered pivotal in the documentation at the proposed rule stage for significant regulatory actions and when influential scientific information is disseminated for peer review.
Comment: Commenter (6134) asserts that the proposed rule puts EPA in the position of defining "transparent" and allows them to decide if particular studies should be included in their rule making process. The commenter states that it is not designed to make an already robust review process better.
Response: The EPA disagrees with the commenter that this rule allows the Agency to decide if particular studies should be included in the rulemaking process. Under this final rule, no studies are categorically excluded from consideration. Rather, the purpose of this action is to increase transparency by codifying internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. Also see the response to the preceding comment.
11.1.2 EPA Actions in Other Areas
Comment: Commenter (6168) states that the litany of ways the EPA under the current administration has been secretive and has sought to limit information and evidence of chemical harms suggests that the idea of "transparency" grows not out of commitment to openness and public participation. The commenter states that, rather, it is being used here strategically, in bad faith, to limit the evidence used in regulatory decision-making and to undermine moves toward protective regulations. The commenter lists the following examples:
 EPA has made less accessible or removed extensive information about climate change that had been available on EPA's website.
 EPA has failed to provide the information necessary for independent evaluation of its decisions under Toxic Substances Control Act (TSCA), e.g. EPA's recent decision to green light a new fragrance chemical despite a range of health concerns.
 EPA has pushed to delay releasing reports documenting harms of chemicals, e.g. formaldehyde and Per- and Polyfluoroalkyl Substances (PFAS).
 EPA has reduced opportunities for public participation by creating short comment periods and trying to circumvent public comment entirely.
 EPA's procedure for implementing TSCA is designed to limit the range of information included in regulatory decisions by limiting the sorts of uses/exposures that will be analyzed.
 EPA has drastically shifted influence away from the broader public and toward business interests, for example in private meetings and in appointments to science advisory boards.
 Especially under Scott Pruitt -- who was Administrator when this proposed rule was written and published -- EPA has been secretive, for example denying Freedom of Information Act (FOIA) requests until required to release documents by courts. Pruitt's secrecy was famous: not telling reporters where he was speaking, not letting the press into events, hiding, and even changing his calendars, etc.
Response: The EPA disagrees that this final rule is meant to limit the evidence used in regulatory decision-making and to undermine moves toward protective regulations. Rather, the purpose of this action is to increase transparency by codifying internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. Under this final rule, no studies are categorically excluded from consideration. Where the underlying data is available, EPA will give greater consideration to the pivotal science. Where the underlying data is unavailable, EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator under 40 CFR 30.7.
Comment: Commenter (6868) suggests several discrete actions the Agency could take to increase transparency and public trust in how EPA develops policy other than the proposed rule:
       Making the schedule of the EPA Administrator/Acting Administrator available to the public,
       Granting media representatives full access to public meetings,
       Ensuring public access to factual information on the environmental and public health effects of climate change,
       Minimizing the role regulated industry representatives play on EPA advisory committees, and
       Meeting court ordered deadlines for promulgation of major regulatory actions and providing full cooperation with any pending federal investigations of agency staff misuse of office.
Response: These suggestions are outside the scope of this rule. The purpose of this action is to increase transparency by codifying internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. These requirements build upon open data initiatives in the federal government and scientific community and advance the EPA's mission and commitment to the public by prioritizing transparency of the underlying dose-response data in pivotal science for the most impactful of EPA's assessments and regulatory actions.
11.2 SNPRM Data Availability-Related Comments
11.2.1 Confidential Business Information, Proprietary Data, or Personally Identifiable Information
<IP_ADDRESS> 40 CFR 30.5 Requirements
<IP_ADDRESS>.1 Deletion of Research Data Definition
The supplemental proposal states the EPA is deleting the 2018 proposed 40 CFR 30.2 definition of research data because this definition excludes trade secrets, commercial information, materials necessary to be held confidential by a researcher until they are published, or similar information which is protected under law and personnel and medical information and similar information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy, such as information that could be used to identify a particular person in a research study. The EPA proposes that these types of data are intended to be subject to this rulemaking.
Comment: Commenters (10038, 10740, 11361, 12710) oppose the proposal and express concern over the deletion of the definition of "research data."
Commenter (10740) suggests that it is the intent of this proposed rule to preclude scientific evidence based on data and models informed by raw data, including medical records, that is required to be held confidential and concludes that this is not transparency, nor is it science.
Commenter (11361) asserts that the effect of the proposed deletion is readily apparent: it will dramatically shift the balance of the kinds of studies that will be utilized in Agency decision-making, reducing the proportion of public health studies and increasing the proportion of assay-based and computational modeling studies. The commenter states that this is likely to make the link between regulations and health protections less clear, not more.
Commenter (11361) asserts it is an ill-conceived move by the EPA to put current researchers in the position of either complying with privacy laws or allowing their research to have real-world impacts by informing regulations. The commenter notes that in this supplemental notice of proposed rulemaking (SNPRM or supplemental proposal), the EPA explicitly bucks the use of the term "research data" in the 2018 proposed rule because "research data" excluded data that was protected under various privacy laws, such as confidential business information (CBI) and personally identifiable information (PII), and the EPA is requiring that that protected information be made public or be disregarded.
Commenter (12710) states that "research data" excludes the "physical objects (like laboratory samples), drafts, and preliminary analyses" that proposed § 30.3 will exclude. The commenter states that research data also excludes trade secrets and personal and medical information that if disclosed would constitute an invasion of privacy. The commenter states that this is not excluded from EPA's new definition of data; instead, throughout the proposal studies that allow "tiered access" to PII are mentioned and yet offer very little detail in the preamble (no sources) and none in the proposed regulation as to what constitutes acceptable "tiered access."
Response: While the EPA maintains the approach of the 2020 supplemental proposed rule, that the types of data included in the proposed definition for "research data" should be subject to this final rule, the EPA emphasizes that this final rule does not require that data be made publicly available. Rather, this final rule of internal agency procedure requires that the EPA give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of PII, CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation.
The EPA acknowledges, and agrees with commenters, that there may be pivotal science for which the underlying dose-response data are not publicly available due to technological feasibility or cannot be made available in a secure environment that still allows for independent analysis. This may include studies containing protected information from the proposed definition of "research data." In these cases, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator.
<IP_ADDRESS>.2 Protected Data
Comment: Commenter (12472) states that the data access requirements described in the supplemental proposal may pose difficulties for emissions inventories used in modeling. The commenter states that, when developing emissions inventories for modeling, there are instances where CBI, PII, or proprietary data is used but cannot be shared in raw form due to access agreements with originators of that data. The commenter states that, for instance, on-road mobile, commercial marine vessels, rail, area, or oil and gas inventories are often constructed with PII, CBI, or proprietary data. The commenter states that the economic growth factors used in forecasting emissions may be constructed with code or models that are considered CBI or proprietary data. The commenter states that the Texas Commission on Environmental Quality is legally prohibited from releasing some of these datasets, but it is necessary to collect such information in order to prepare emissions inventories for air quality modeling. The commenter states that, in these instances, as allowed in the supplemental proposal, the EPA should consider studies and other data even if the underlying data and models are not publicly available.
Response: The EPA acknowledges that there may be pivotal science for which the underlying dose-response data are not publicly available due to technological feasibility or cannot be made available in a secure environment that still allows for independent analysis. This may include modeling studies that rely on underlying CBI, PII, or proprietary dose-response data. In these cases, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator.
Comment: Commenter (12718) expresses concern that the supplemental proposal offers no meaningful articulation of privacy and confidentiality safeguards for the American people. The commenter states that the Agency has no established statistical Agency or unit designated under the Confidential Information Protection and Statistical Efficiency Act of 2018 (Title 3 of PL 115-435) to apply civil and criminal penalties for violations of protection. The commenter states that this is disappointing in that these protections were unanimously upheld by the Republican and Democratic appointees to the U.S. Commission on Evidence-Based Policymaking as a model for federal agencies, including EPA, then reauthorized with strong bipartisanship in Congress.
Response: The EPA clarifies that this rule is not intended to establish enforcement of civil and criminal penalties for violations of data protections. Rather, this internal rule establishes procedures for the EPA to give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of PII, CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation.
<IP_ADDRESS> Confidential Business Information (CBI)
<IP_ADDRESS>.1 Transparency Standards for CBI and Public Health Data
Comment: Commenters (10339, 11403, 11479, 12403, 12442, 12455, 12702) express concern that, under the proposed rule, CBI may not be held to the same standards of transparency as public health information. Commenter (12442) states that the rule is arbitrary and capricious because this rule creates a double standard by allowing specific industry data to be kept confidential while exposing sensitive data underlying health-based studies.
Commenter (10339) states that the rule and supplemental proposal still fail to explain whether the Agency will ensure that CBI will also be held to the same standards of transparency, disclosure, and access. Commenter (12403) asserts the proposal's approach to CBI favors private sector research over independent institutions.
Commenter (11403) asserts that the proposal would result in EPA policy being based on secret industry CBI that has been protected under this proposed rule. The commenter notes that the proposed rule restricts the use of the exemption to circumstances where "compliance is impracticable because technological barriers render sharing of data or models infeasible." The commenter asserts that, in practice, this exemption would result in EPA policy being based exclusively on secret industry CBI that has been protected under this proposed rule and potentially outdated studies that have been exempted by the Administrator under this section 30.9. The commenter states that, under this exemption, data that is not publicly available because of a technological barrier would arbitrarily be considered prioritized over health data that would be blocked from consideration by this proposed rule.
Commenter (11479) suggests the EPA appears to be more concerned with protecting industry data and CBI than with protecting public health information. The commenter states that this disparity is exemplified by the fact that the Agency requests commenters to provide feedback on how to balance protections for copyrighted and CBI but does not seek similar advice on how to protect patient health data. The commenter states that emails show that top EPA officials responsible for drafting the proposed rule struggled with how to incorporate exemptions and limit the rule's impact on industry data. The commenter states that Dr. Beck's comments on protecting CBI also resemble her testimony in front of a Senate Homeland Security and Government Affairs subcommittee, where she represented her former employer, the American Chemistry Council, whose members have a significant financial interest in EPA regulatory matters. The commenter states that the proposed rule and supplemental proposal's focus on protecting industry over protecting the public health research community illustrates the Agency's disinterest in seeking actual transparency in decision making; instead, the EPA is seeking an opportunity to protect data for the industries it is supposed to regulate, at the expense of science-based public health safeguards. The commenter adds that this bias is affirmed by Dr. Yamada's response to an email from Dr. Beck, in which he writes that he "didn't know about the intricacies of [confidential business information]" and that the Agency would have to "thread this one real tight!"
Commenter (12442) contends that, while the proposed rule would subject studies to additional scrutiny by exposing the privacy of participants and raise the standards by which they can be considered, the rule would allow for the continued confidentiality of equally critical and often much more opaque business information such as economic cost modeling or industry labeled proprietary data, which is rarely subject to verification at all, let alone rigorous peer review. The commenter states that this approach would only serve to eliminate the strong and well-founded basis for health and environmental regulations millions of Americans depend on while keeping information deemed confidential by for profit industry interests out of the public eye. The commenter states that the dividing line drawn by this proposal creates two camps: the privileged, industry data kept out of the public eye and often used to avoid protections like pollution controls for heavily emitting sources such as coal-fired power plants and oil refineries; and the epidemiological data prejudiced by EPA's proposed transparency rule that is used to support protections for the benefit of public health and welfare. The commenter states that this is a text book example of an arbitrary and capricious rulemaking.
Commenter (12442) states that, in the prevention of significant deterioration (PSD) air permitting process, permitting decisions often rely on CBI. The commenter states that, as a result, the public is barred from commenting on, let alone knowing, the information on which an effective emission control may be bypassed in favor of a lax permit that would result in negative air quality impacts that could otherwise be avoided. The commenter states that a rule truly designed to increase transparency should require the data of source operators and owners to be released to the public.
Commenter (12455) contends the supplemental proposal allows companies to manipulate which studies would be considered by declaring them CBI, or by seeking to publish the study in a journal that prohibits sharing data pre-publication. The commenter is also concerned that studies published in subscription journals vs. open source may be treated differently.
Commenter (12702) states that, under the proposed rule and supplemental proposal, the EPA would be required to establish an exemption process to utilize CBI or alternative process to give higher weight to data that did not include CBI. The commenter is concerned that either approach could decrease the consistency with which data are treated and increase the discretion of EPA in making such determinations. The commenter states that CBI from regulated or effected entities is in some cases critical to determine the most appropriate standard, control technology, and regulatory requirements. The commenter states the EPA should not finalize a rule, such as this one, that decreases transparency of the rulemaking process by obscuring the basis of and process for taking regulatory actions.
Response: To take into consideration studies that involve PII, CBI or proprietary data, the EPA is finalizing an approach that takes gives greater consideration to pivotal science whose underlying dose-response data involve PII, CBI or proprietary data are available through restricted or tiered access. Restricted or tiered access in this final rule means that the underlying dose-response data are available through a data sharing mechanism, such as through an agreement with the originating author or institution, access to a refined or redacted dataset that anonymizes the more sensitive portions of the analyzable dataset, a restricted access data repository or secure data enclave, or some other mechanism (e.g., Data Use Agreements) that allows a qualified subject matter expert access to enough data to support independent validation while still protecting sensitive information.
<IP_ADDRESS>.2 Plan for CBI
Comment: Commenters (10974, 11378, 11491, 11496, 11894, 12455, 12465) contend that the EPA does not sufficiently describe how the proposed rule would cover CBI. Commenter (11378) contends the criteria for evaluation and plans for long-term management regarding research utilizing confidential and proprietary data remain unclear in the supplemental proposal. Commenter (11496) states the EPA has not described how pivotal peer-reviewed science from other countries would be incorporated, including CBI.
Commenter (11491) asserts that, under the proposal as supplemented, there would be uncertainty about how CBI submissions would be treated. The commenter states that understanding the costs and practicability of compliance the EPA often relies upon regulated industry to submit CBI. The commenter notes that, where CBI is excluded, compliance costs are based on outdated numbers or technology. The commenter states that CBI might be at increased risk of public release, creating a disincentive for companies to voluntarily submit information, and Agency use of legally protected CBI might be disfavored, depriving the rulemaking process of important information.
Commenter (11894) states that, much, if not most, of the information used to determine if a chemical may present an unreasonable risk to human health or the environment or would result in substantial human exposure or release to the environment is claimed as CBI and, thus, it could not comply with the transparency rule. The commenter states that how the EPA will deal with this remains to be seen as the proposed rule merely states that it is an issue to be worked out. The commenter states that, under the 2016 TSCA amendments, the EPA must make an affirmative finding on the safety of a new chemical or significant new use of an existing chemical before it is allowed into the marketplace.
Commenter (12455) states that the supplemental proposal needlessly complicates the use of pesticide reviews, which are traditionally based on CBI studies. The commenter states that it is unclear whether older studies, when they come up for review, will be completely excluded from consideration as they would not qualify under the supplemental proposal.
Commenter (12465) is concerned with the lack of details around appropriate access to CBI. The commenter notes that there will be situations in which CBI cannot be shared publicly, but this should not preclude the inclusion of the CBI in regulatory decisions. The commenter states that, while noting that "[n]othing in the proposed rule compels the disclosure of any confidential or private information in a manner that violates applicable legal and ethical protections," the lack of specificity and applicability is found wanting and the Agency should expand this guidance at great length should the rule go forward.
Response: Under this rule there is no categorical exclusion of pivotal science if the underlying dose-response data are not available for independent validation. Thus, dose-response data involving PII or CBI that cannot be made legally or ethically available or proprietary information that cannot be made available through either law or contractual agreement could still be considered as pivotal science. Availability of dose-response data would be done in accordance with existing laws and contractual agreements.
To take into consideration studies that involve PII, CBI or proprietary data, the EPA is finalizing an approach that takes gives greater consideration to pivotal science whose underlying dose-response data involve PII, CBI or proprietary data are available through restricted or tiered access. Restricted or tiered access in this final rule means that the underlying dose-response data are available through a data sharing mechanism, such as through an agreement with the originating author or institution, access to a refined or redacted dataset that anonymizes the more sensitive portions of the analyzable dataset, a restricted access data repository or secure data enclave, or some other mechanism (e.g., Data Use Agreements) that allows a qualified subject matter expert access to enough data to support independent validation while still protecting sensitive information.
Even if the underlying dose-response data are not available for independent validation, the pivotal science including these dose-response data may still be considered as pivotal science, although it would be given lesser consideration than pivotal science where the underlying dose-response data are available, including through restricted or tiered access, for independent validation.
Comment: Commenter (12453) appreciates that the EPA has continued in the supplemental proposal to confirm that it will apply the rule consistent with statutory requirements to protect proprietary data and CBI.
Response: EPA thanks the commenter.
<IP_ADDRESS> Proprietary Data
<IP_ADDRESS>.1 General
Comment: Commenter (12430) expresses concern that the term "proprietary data" in 40 CFR 30.5 is not defined.
Response: EPA is not providing a definition of proprietary data because this rule does not regulate such data or treat such data categorically. This rule describes the extent to which EPA will give consideration to pivotal science in which the underlying dose-response data are available or are not available for independent validation.
Comment: Commenter (11378) asserts that the proposal to make information publicly available would potentially violate legally binding proprietary data agreements. The commenter states that deemphasizing geospatial research in which proprietary data agreements necessitate restrictions to public data access would severely limit the EPA's mission to protect human health and the environment, with consequent deleterious effects on environmental and health policy among state and local government agencies.
Commenter (12430) expresses concern that restricting models to those that are publicly available, or that meet the vaguely described exceptions in proposed 40 CFR 30.5, would severely limit the science that the EPA may consider or reference. The commenter states that, while models are critical to help humans assess and analyze large quantities of data, they are nearly always proprietary. The commenter adds that most scientists and agencies purchase access to and use these models for data.
Response: This rule does not require any dose-response data be made publicly available. Thus, there is no categorical exclusion for dose-response data that includes proprietary data. Availability of dose-response data would be done in accordance with existing laws and contractual agreements.
To take into consideration studies that involve PII, CBI or proprietary data, the EPA is finalizing an approach that takes gives greater consideration to pivotal science whose underlying dose-response data involve PII, CBI or proprietary data are available through restricted or tiered access. Restricted or tiered access in this final rule means that the underlying dose-response data are available through a data sharing mechanism, such as through an agreement with the originating author or institution, access to a refined or redacted dataset that anonymizes the more sensitive portions of the analyzable dataset, a restricted access data repository or secure data enclave, or some other mechanism (e.g., Data Use Agreements) that allows a qualified subject matter expert access to enough data to support independent validation while still protecting sensitive information.
Even if the underlying dose-response data are not available for independent validation, the pivotal science including these dose-response data may still be considered as pivotal science, although it would be given lesser consideration than pivotal science where the underlying dose-response data are available, including through restricted or tiered access, for independent validation.
<IP_ADDRESS>.2 Plan for Proprietary Data
Comment: Commenter (11378) expresses concern that the criteria for evaluation and plans for long-term management regarding research utilizing proprietary data remain unclear in the supplementary proposal.
Response: The rule imposes no requirements on the criteria for evaluation and plans for long-term management regarding research utilizing proprietary data.
Comment: Commenter (12453) appreciates that the EPA has continued in the supplemental proposal to confirm that it will apply the rule consistent with statutory requirements to protect proprietary data, including the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) and Federal Food, Drug, and Cosmetic Act (FFDCA) provisions. Commenter (12465) recommends that the EPA ensure that any new guidelines comply with applicable laws and encourages the use of all relevant scientific information, regardless of whether the underlying data can be publicly disclosed, especially with respect to data and information developed individually or via consortia under the requirements of FIFRA or TSCA.
Response: EPA will comply with all applicable laws. It will continue to consider all relevant pivotal science in its significant regulatory actions and influential scientific information.
<IP_ADDRESS>.3 Tribes
Comment: Commenter (12423) states that, while the proposed rule addresses public health studies, for tribal peoples many of these studies are intertwined with proprietary lifeways including subsistence activities, ceremonies, and spiritual beliefs. The commenter notes that, for example, consumption patterns might reveal locations or numbers of wildlife and plant harvest areas that tribes wish to keep private or might reveal information about how and what a tribe eats. The commenter states that, in the case of the retrospective cohort study for waste disposal practices, self-reported daily subsistence food consumption was included to determine whether these foods provided a protective benefit for the surrogate exposures studied.
Commenter (12423) states that fish consumption is a primary pathway of exposure for multiple chemicals that are released to aquatic systems from a multitude of source and, for many tribes, fish is consumed in far greater quantities than the general population. The commenter notes that it is therefore critical to document the extent of fish consumption in tribes when setting water quality standards and developing water quality policies, either at a national level, state level, or project-specific level in the case of contaminated site cleanups. The commenter further notes that because the fish consumed is not from the grocery store but obtained through traditional practices on tribal lands, community level studies must be carried out. The commenter states that in doing so, not only is the small-scale population problem tripped, but the reluctance of tribal members to share their practices is substantial. The commenter states that tribal members have specific locations in which they harvest fish and some tribes have had conflicts with local and state officials on their treaty rights to harvest the fish or other species. The commenter provides that some tribal members are reluctant to reveal that they may eat less fish than they could or fear that they may have violated some ordinance through subsistence and ceremonial fishing. The commenter states that subsistence is intricately tied to tribal values, beliefs, and lifeways, and is often a spiritual exercise.
Commenter (12423) asserts that, while the EPA is not in the business of collecting and reviewing data on the religious practices and beliefs of American citizens, the proposed rule essentially asks just that of tribes. The commenter states that, by placing tribes in the position of either revealing aspects of their spiritual lifeways that are not relevant to the study purpose or not being protected by the nation's environmental laws, the proposed rule may have implications for the American Indian Religious Freedom Act of 1978 (AIRFA) (42 U.S.C. § 1996.).
Response: This final rule does not require data revealing proprietary lifeways or personal religious practices be made publicly available. In this final rule, the EPA will give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of PII, CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation. The EPA acknowledges that there may be pivotal science for which the underlying dose-response data are not publicly available due to technological feasibility or cannot be made available in a secure environment that still allows for independent analysis. This may be the case for exposure studies evaluating tribal fish consumption patterns. In these cases, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator. Where the Agency is making dose-response data publicly available, it shall do so in a fashion that is consistent with law, protects privacy, confidentiality, CBI, and is sensitive to national security.
<IP_ADDRESS> Personally Identifiable Information (PII)
<IP_ADDRESS>.1 Publicly Available Consistent with Law
Legal Protections Could Result in Exclusion of Studies
Comment: Commenters (9372, 10040, 10865, 10866, 10975, 11359, 11361, 11378, 11184, 11396, 11492, 11576, 12715) express concern that studies will be excluded from consideration by the EPA because legally mandated privacy protections prohibit the proposed requirement to make data publicly available.
Commenter (9372) states that pollution can affect cognitive outcomes, like academic test scores and cognitive disabilities, in children. The commenter states that the Family Educational Rights and Privacy Act requires that any educational records be kept private on secure servers because the release of such information could harm students. The commenter states that this is a ridiculous request that's designed to remove research from policymaking with no benefit. The commenter states that most of the best papers use restricted data because almost no individual data are publicly available anymore. The commenter states that only aggregated data can be released publicly, and aggregated data is often not as good as individual-level data, particularly if there is heterogeneity in the outcomes.
Commenter (10040) asserts data privacy laws largely prevent information from studies involving humans from being made public in the manner being considered by the EPA. The commenter states that, by limiting EPAs ability to use rigorously conducted peer reviewed literature simply because they do not meet transparency standards stands to block consideration of research that is critical to decision making to protect the public's health.
Commenter (10865) states that there are many credible scientific studies where the exposure of raw data to the public is infeasible or would reveal confidential patient information.
Commenter (10866) notes that many studies are conducted on large datasets such as those that draw on hospital records. The commenter states that the proposal, by requiring that the entire dataset be made available, would expose to public scrutiny data that would allow the identification of individual persons included in the study. The commenter notes that, because this would violate legally mandated privacy protections, this step would result in the de facto exclusion from EPA consideration of valuable and significant research studies.
Commenter (11378) notes that after reviewing the supplementary proposal associated with Strengthening Transparency in Regulatory Science Proposed Rulemaking (EPA-HQ-OA-2018-0259-9322), they are concerned that by giving primacy to research in which data and models are made publicly available the proposed rule will limit the use of valid scientific research for promulgating environmental regulations and finalizing scientific information. The commenter contends that the integrity of much environmental and health research requires the tradeoff that certain business, proprietary, and PII remain confidential. The commenter adds that making such information publicly available would potentially violate long-standing human subjects research protocols (i.e. the 1974 National Research Act), as well as legally binding proprietary data agreements.
Commenter (11184) asserts that the supplemental proposal does not address the fact that many past and ongoing public health studies simply cannot lawfully, ethically, or efficiently publicly release the underlying data. The commenter states that, even if applied only to future research, the supplemental proposal would limit participation, limit the information that can be collected, and waste limited resources. The commenter states that proposed 40 CFR 30.5 remains a poorly formed scheme in search of a problem that would ultimately force the EPA to arbitrarily make public health and environmental decisions based on incomplete or improperly weighted information.
Commenter (11396) asserts that the EPA's proposal would, despite any clarifications and modifications made in the supplemental proposal, block the use of studies that rely on confidential patient information from being used in policymaking. The commenter states that many studies, including older studies, depend on or have historically used such data that legally cannot be made public. The commenter states that the fact that this information must be kept confidential to protect patients does not make the data any less valid.
Commenter (11360) states that it is understandable that when issuing regulations, scientific information helps to provide the rationale for decisions; however, not being able to publicly disclose all sensitive data does not justify the EPA dismissing the use of important scientific work that could very well inform regulatory and policy decisions.
Response: In this final rule the EPA is not categorically excluding any studies from consideration when promulgating final significant regulatory actions or developing influential scientific information. Rather, the Agency will continue to evaluate the quality of all relevant studies, consistent with the intended use of the information. The EPA will also continue to rely on the highest quality, most relevant studies available in determining the potential for hazard due to exposure to a pollutant, contaminant, or substance.
In this final rule, the EPA will give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of PII, CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation. The EPA acknowledges that there may be pivotal science for which the underlying dose-response data are not publicly available due to technological feasibility or cannot be made available in a secure environment that still allows for independent analysis. This may be the case, for example, for studies that rely on health records containing PII. In these cases, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator. Where the Agency is making dose-response data publicly available, it shall do so in a fashion that is consistent with law, protects privacy, confidentiality, CBI, and is sensitive to national security.
Comment: Commenter (12596) suggests the EPA must balance the rule's sound policy goals with the Agency's legal obligation to be a good steward of private, sensitive, and confidential information. The commenter states that statements in the supplemental proposal "clarifying" that the EPA does not intend to make data and models public for which the Agency lacks access or does not have the authority to provide access. The commenter appreciates reassurances in the supplemental proposal concerning sensitive information and anticipates that the Final Transparency Rule can be implemented in a manner that moots disclosure concerns. For the sake of clarity, the commenter reiterates the request from their proposal comments that the EPA explicitly state that the rule does not assert authorization under the law to disclose protected sensitive or confidential information, and that any such claim must be independently based on a statutory grant of authority from Congress.
Response: The EPA confirms that this final rule does not assert authorization under the law to disclose protected, sensitive, or confidential information. This is a rule of internal agency procedure and does not require the EPA or any entity outside the federal government to make data available. Where the Agency is making dose-response data publicly available, it shall do so in a fashion that is consistent with law, protects privacy, confidentiality, CBI, and is sensitive to national security. Finally, as this rule makes clear, if implementing this procedural rule would result in conflicts with existing statutes, and their implementing regulations, this rule will yield to the statutes and regulations.
Comment: Commenter (11496) asserts the EPA does not provide the tools necessary for this rule to function without causing a conflict with established Federal data privacy rules.
Commenter (12403) contends the proposal undermines privacy protections for participants in human subject research. Commenter (12458) states that confidentiality of health data in research is often ethically, if not legally required.
Response: The EPA disagrees with the commenters that this rule would conflict with either Federal data privacy laws or regulations, or the ethics of patient confidentiality. This is a rule of internal agency procedure and does not require the EPA or any entity outside the federal government to make data available. Where the Agency is making dose-response data publicly available, it shall do so in a fashion that is consistent with law, protects privacy, confidentiality, CBI, and is sensitive to national security. Finally, as this rule makes clear, if implementing this procedural rule would result in conflicts with existing statutes, and their implementing regulations, this rule will yield to the statutes and regulations.
Common Rule
Comment: Commenters (9372, 11182, 12422) express concern that the supplemental proposal may not be consistent with the Common Rule.
Commenter (9372) asserts that the requirement that researchers post data publicly violates the Common Rule guidelines for Human Subjects research.
Commenter (11182) states that a key duty in the American College of Epidemiology's ethical guidelines is the protection of confidentiality and privacy., The commenter states that this duty echoes the obligation to maintain patient confidentiality in Occupational and Environmental Medicine (ACOEM) Code of Ethics, as it does for all professional medical and scientific organizations. The commenter states that the 1979 Belmont report laid the groundwork for privacy and confidentiality in human research. The commenter states that the ethical principles guiding the report and underlying the ethical practice of science and medicine are autonomy (respect for persons), beneficence (do no harm), and distributive justice (equitable risks and benefits). The commenter states that the Belmont report led directly to the 1991 Common Rule, which set the regulations for the ethical conduct of human-subjects research., The commenter states that in the 2018 updated Common Rule, confidentiality protections for people who volunteer to participate in research were strengthened. The commenter states that the public must feel confident that their private information is protected, and researchers must be able to assure their research subjects that confidentiality is maintained. The commenter states that the supplemental proposal rejects this basic ethical tenet. The commenter states that even with the unexplained and untested "tiered access" proposition, researchers will be unable to provide that reassurance.
Commenter (12422) states that, depending on how it is implemented and interpreted by the Administrator, under this regulation, human studies could only be used by EPA if the investigators surrender confidential data that the investigators had promised the study subjects and institutional review boards (IRBs) would never be released. The commenter states that, while the EPA might agree to redact these data before public posting, they could be given to anyone who signed a confidentiality agreement designed by the agency. The commenter states that implications for the protections of human subjects and informed consent under the Common Rule (the Federal Policy for the Protection of Human Subjects) have yet to be evaluated.
Response: The EPA disagrees with the commenters that this final rule would either require the release of human subject research data in conflict with the Common Rule, or cause the EPA to categorically exclude human health data from consideration in EPA significant regulatory actions or influential scientific information. The EPA is not categorically excluding any studies from consideration when promulgating significant regulatory actions or developing influential scientific information. Rather, the Agency will continue to evaluate the quality of all relevant studies, consistent with the intended use of the information. The EPA will also continue to rely on the highest quality, most relevant studies available in determining the potential for hazard due to exposure to a pollutant, contaminant, or substance.
In this final rule, the EPA will give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of PII, CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation. The EPA acknowledges that there may be pivotal science for which the underlying dose-response data are not publicly available due to technological feasibility or cannot be made available in a secure environment that still allows for independent analysis. This may be the case, for example, for studies that rely on human subject research data. In these cases, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule from the Administrator. Where the Agency is making dose-response data publicly available, it shall do so in a fashion that is consistent with law, protects privacy, confidentiality, CBI, and is sensitive to national security.
Health Insurance Portability and Accountability Act (HIPAA) and Institutional Review Boards (IRBs)
The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients control and rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.
Comment: Commenters (9372, 11183, 11190, 11404, 11479, 11496, 12718, 12715, 12720) express concern that the supplemental proposal may not be consistent with HIPAA and/or IRB requirements. Commenter (11404) states that HIPAA protections must be honored. Commenter (11183) asserts that the proposed rule violates HIPAA standards.
Commenter (9372) states that researchers cannot make their data publicly available because there are laws against that type of thing to protect the privacy of health and education information such as HIPAA.
Commenter (11190) contends the proposed rule is impractical to implement, because there are good and justifiable regulations protecting private health information, described by HIPAA. The commenter states that human subjects in medical studies participate in these studies with the assurance that their private medical information will never be revealed.
Commenter (11479) states that, while we can assume that the agency believes that a simple anonymization process is enough to fully and completely protect people's confidential data, a simple anonymization process is at odds with the legal and ethical frameworks developed to protect human participants in scientific studies. The commenter states that HIPAA requires that medical information be protected by a set of administrative, physical, and technical safeguards, and a scientist who releases raw anonymized data to the public could be in violation of their IRB approval, which governs a study's informed consent process. The commenter states that the release of underlying human health data may include participants who cannot consent to such a process, like participants who have died. In a rare joint statement on the proposed rule, the editors of six prominent scientific journals wrote that some data "cannot be shared openly; even anonymized personal data can be subject to re-identification, and it has been a longstanding practice for agencies and journals to acknowledge the value of data privacy adjustments."
Commenter (11496) states that the EPA has not described how future studies could comply with the proposed data access requirements while maintaining compliance with other applicable statutes, such as HIPAA, while assuring participants they will continue to prevent disclosure of personal health information to unknown third parties in the future.
Commenter (12718) states that the EPA's proposed approach in the supplemental proposal presumes that access to data or information must be  -  as an absolute  - accessible to EPA officials, even when that level of access might be inconsistent with IRB requirements, consent statements, or other ethical procedures that should be paramount in government's commitment to its citizens for protecting data and confidentiality. The commenter states that the EPA's supplemental proposal offers no meaningful articulation of privacy and confidentiality safeguards for the American people. The commenter states that the Agency has no established statistical agency or unit designated under the Confidential Information Protection and Statistical Efficiency Act of 2018 (Title 3 of PL 115-435) to apply civil and criminal penalties for violations of protection. The commenter states that this is disappointing in that these protections were unanimously upheld by the Republican and Democratic appointees to the U.S. Commission on Evidence-Based Policymaking as a model for federal agencies, including the EPA, then reauthorized with strong bipartisanship in Congress.
Commenter (12715) notes that the SNPRM does not specify how confidential health information covered by the HIPAA Privacy Rule can be protected outside of HIPAA-covered entities but, again, designing and implementing such protections would be expensive and time consuming.
Commenter (12720) asserts that the proposal's requirement for the public sharing of underlying data of these studies contradicts HIPAA's legal protections for private medical data and requirements researchers adhere to under IRBs, which typically require investigators to ensure participant confidentiality and data security. The commenter states that underlying sensitive health data cannot be released without obtaining individual patient consent, or consent from the next responsible party for study participants who have died.
Response: The final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedure and does not direct or require any outside entity or the EPA to establish data sharing mechanisms.
Comment: Commenter (11496) states that the EPA has not explained how GLP2 studies will be addressed by this rule, particularly those that are conducted through a process that follows HIPAA rules. The commenter provides that King County is concerned that pivotal regulatory decisions will increasingly be made based on rodent and other guideline studies rather than peer-reviewed science that describes the direct impacts of chemical exposures on people's lives.
Response: The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. Under the final rule, the EPA is not categorically excluding any studies from consideration with promulgating significant regulatory actions or developing influential scientific information. Rather, the Agency will continue to evaluate the quality of all relevant studies, consistent with the intended use of the information.
As described in the preamble to the final rule, the transparency provisions of the final rule apply to dose-response data underlying pivotal science. Under this rule, the EPA will give greater consideration to pivotal science for which the underlying dose-response data are either publicly available in a manner sufficient for independent validation or, in the case of PII, CBI, or proprietary data, available through restricted access that affords privacy in a manner sufficient for independent validation. In cases where dose-response data underlying pivotal science are not available in a manner sufficient for independent validation, the EPA may still use the pivotal science after either giving it lesser consideration or receiving an exemption from the requirements of this rule under 40 CFR 30.7.
<IP_ADDRESS>.2 Deidentification
General
Comment: Commenter (11900) states that a primary concern about data transparency is that study participants will be re-identified when identifiable information sufficient to contact a person (such as name or address) is matched to "de-identified" data. The commenter states that the supplemental proposal defines PII by reference to the "requirements of the Common Rule, the HIPPA [sic], the 21st Century Cures Act, the Privacy Act, and other relevant laws and regulations, and EPA privacy policies." The commenter states that this definition of PII does not capture all of the data types that can contribute to re-identification risk.
Response: The final rule does not require the de-identification of PII. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Adverse Consequences of Deidentification
Comment: Commenter (9372) contends that, if employers, colleges or others found out about people's health, it could cause them to get fired or suffer in other ways. Commenter (11576) asserts that the potential consequences of reidentification are severe.
Commenter (11479) re-identifying people from an anonymized database could prove particularly damaging for research on issues like child abuse, sexual assault, and mental illness. And data that include genetic information could reveal sensitive information about the relatives of the research participants, including those not yet been born.
Commenter (11480) states that the release of private health data that could be used to identify individual workers serving as subjects in a study puts those workers at risk of discrimination or retaliation by their employers, insurers, and others.
Commenter (11576) refers to a study which identifies a number of adverse consequences due to re-identification and expresses concern that these consequences have not been addressed by the EPA. The commenter identifies the following adverse consequences:
      Loss of privacy from re-ID could result in stigma for individuals and communities; affect property values, insurance, employability, and legal obligations; or reveal embarrassing or illegal activity.... It could damage trust in research, harming the study and research more generally. Because ... [environmental health] studies often focus on groups with the highest exposures, privacy risks potentially compound harms faced by the most vulnerable communities. Entities that might be motivated to re-identify ... [environmental-health] data include, for example, employers or insurance companies (who may wish to discriminate against individuals or properties on the basis of environmental exposures) and corporations affected by environmental regulations (who may wish to discredit litigants or studies demonstrating ... [environmental-health] harms, or to discourage participation in ... [environmental-health research). Other parties might leverage the environmental variables to gain access to other parts of the data set, such as
sensitive health information.
Commenter (11920) states that, because public disclosure of sensitive biological data can cause irreparable harm to imperiled species populations, there are established norms for the application and use of such data without full disclosure. The commenter states that applying the proposed rule regarding public disclosure of data would severely limit the ability of the agency to properly address endangered species and wildlife issues in its work, including pesticide labeling and use restrictions under FIFRA, and Section 7 consultations under the Endangered Species Act. The commenter states that access to raw data at the stage described in the supplemental proposal is typically not a requirement even for peer-review, as scientists can evaluate the robustness and accuracy of findings based on the presentation of processed data and description of the methods and analysis used.
Commenter (11926) states that the uses of sensitive personal data in the wrong hands can range from personal embarrassment through release of identified information on social media, to impacts on an individual's employment and insurance when health data are involved.
Response: The final rule does not require the de-identification of PII. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Deidentifying and Reidentifying Data
Comment: Several commenters (9372, 11360, 11396, 11186, 11192, 11361, 11395, 11473, 11479, 11576, 11900, 11921, 12405, 12464, 12546, 12715, 12720, 12727) express concern that the deidentification of PII required by the proposed rule is infeasible due to issues of cost, the type of data essential to health studies, identification technology, and/or the risk of identification. Other commenters (10042, 11381, 11899) contend the anonymization process maintains the privacy of the individual.
Response: The final rule does not require the de-identification of PII. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Commenters (11192, 11361) state that the EPA fails to acknowledge the substantial costs of data de-identification. Commenter (11192) states that thorough data de-identification is not trivial, and if it was not included in an original project scope and budget, it is highly unlikely any academic researcher would have the capacity to undertake the de-identification process. The commenter states that, for existing studies, it is likely to be financially impracticable to de-identify data to make any sort of public access possible, thus excluding them or devaluing them in Agency consideration, except through the sole discretion of the Administrator.
Response: The EPA disagrees that this rule would impose costs on third-party researchers. This is a rule of internal procedure that does not impose requirements on any party other than the EPA. This rule imposes no costs on researchers or their institutions, and the EPA will consider and evaluate all relevant and appropriate science in its significant regulatory actions and influential scientific information. If dose-response data underlying pivotal science contains PII or CBI, the EPA will evaluate whether these data are available through restricted access in a manner sufficient for independent validation. For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
Comment: Commenter (11921) asserts that it is not possible to conduct a high-quality air pollution and health study without knowing the locations of those being studied, i.e. where they live, the sources and levels of their air pollution exposure, as well as their specific covariates, and specific health outcomes. The commenter states that, should such information be made available at smaller spatial scale, it is possible to disclose extensive personal and medical information for individual study subjects, raising privacy and ethical concerns. The commenter states that taken together, these characteristics  -  which have in general enhanced the quality and the sensitivity of the studies  -  increase the difficulty of providing a fully "de-identified" data set while also enabling a different investigator to conduct a full replication and sensitivity analysis of the original study results. The commenter states that analyses using more limited data sets may well therefore result in incomplete and misleading results. The commenter states that, since the goal should be to find ways to share data that enables full replication and sensitivity analysis of original studies, it is valuable to consider several aspects of large population air pollution studies that have moved them towards utilizing data at smaller spatial scales:
      First, in response to valid criticisms that earlier air pollution studies relied only on central air quality monitoring data to estimate exposure, investigators have increasingly sought to improve exposure estimates by employing land use regression and other methods that can account for the distance of a subject's home from roadways, industrial facilities, and other sources of air pollution. They have also applied increasingly finer-grained community-level covariates (e.g. at the zip code level). While in the largest locations the application of these finer-grained data may not allow for identification of individuals, the national analyses in some of these studies include subjects from a range of community sizes, including smaller communities where identification could be possible.
      Second, as these types of studies have been reviewed intensively by the HEI Review Committee, the Committee has identified two potentially significant sources of uncertainty in their results: the so-called "ecological confounding" and "spatial
autocorrelation." To address both of these issues, one of the first steps that investigators have taken has been to use data at smaller scales which, while enhancing their ability to address these two sources of uncertainties, also poses the potential in smaller communities for individuals and their personal information to be identified.
Response: The final rule does not require the release of PII or sensitive information. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Commenters (9372, 10040, 11360, 11396, 11186, 11395, 11473, 11479, 11576, 11900, 12405, 12464, 12715, 12720, 12727) assert that, although "publicly available data" would be anonymized, it is now possible to re-identify people in these datasets. Commenter (9372) states that with new machine learning techniques it is easier and easier to identify people in data even when the data is anonymized.
Commenter (11186) states that newer and more advanced technological methods are being developed to re-identify participants from small and large studies which were once thought "fully de-identifiable". Commenter (11473) states that even anonymized personal data can be subject to reidentification. Commenter (11479) contends that a simple anonymization process is inadequate to protect personal data. Commenter (12727) states that advances in computing have made it possible to identify participants in studies and details about their personal and medical histories, even where researchers have taken steps to mask that information or otherwise "de-identify" the data before disclosing it. As described below, these commenters cite various studies that have documented that de-identification techniques to render data anonymous is not "simple," despite what the Proposal suggests, and can lead to the publication of protected confidential or private data.
Commenters (11360, 11396) state that stripping out personal identifiers does not solve the problem as the identity of individuals often can be inferred by using data sets from multiple sources.
Commenters (11576, 11479, 11900, 12464) refer to the Boronow et al. study that discusses how even limited information made available from multiple studies involving the same dataset allowed researchers to successfully re-identify study participants. Commenter (11576) states that researchers in the study were able to re-identify study participants despite the exclusion and redaction of information that could not be shared under the safe-harbor provision of the HIPAA. Commenter (12464) states that the study demonstrates that it is possible to successfully re-identify environmental health study participants using information that is publicly or commercially available such as voter lists, tax and real estate information, or information that is available from data brokers.
Commenter (11900) states that the Boronow et al. study shows that linkage re-identification can occur when de-identified data is matched to externally available, identifiable data using data fields that overlap between both datasets. The commenter states that examples of external public or commercial datasets that can be used in linkage re-identification include tax assessor data, registries of licensed professionals, hospital discharge records, or advertising lists. The commenter states that because environmental health studies often link protected health information and non-protected fields, seemingly non-sensitive data can compromise the security of the entire dataset and lead to breaches of sensitive personal information. The commenter states that the study also demonstrated how chemical exposure measurements, a distinguishing data type of environmental health studies, could pose an unanticipated privacy risk. The commenter states that this analysis demonstrated that chemical data could be used to infer a characteristic of people in a study, even if that characteristic is excluded when the study data are shared.
Commenters (11395, 12715) assert that the issue of protecting confidentiality of data has been well recognized. Commenters refer t NAS report which states that, "[i]n an experiment to discover whether confidentiality could be preserved while opening the data for public review, the study investigators attempted to disguise the identity of the study participants. They deleted as many features as possible from the questionnaires, such as the name, the state file number, the mother's maiden name, and the name of the person providing the information. However, the investigators needed to retain a minimum set of features if other scientists were to be able to replicate the basic findings of the study... and found that even this minimum set of features could allow for identification of research participants." Commenter (12715) contends this demonstrates that, even after going through an arduous, time consuming process, the removal of personal identifying information would be difficult to achieve.
Commenters (11473, 11479, 12727) refer to the Rocher et al., study in which 99.98% of Americans could be correctly re-identified using a combination of just 15 demographic attributes. The commenters assert that the study demonstrates that anonymized personal data can be subject to reidentification. Commenter (12727) notes that the authors state, their results "reject the claims that, first, re-identification is not a practical risk and, second, sampling or releasing partial datasets provide plausible deniability."
Commenters (12464, 12727) refer to the Science Advisory Board (SAB) report on the risk of re-identification and state that "[a]lthough the Proposed Rule suggests that privacy and confidentiality issues can be addressed through anonymization or de-identification, this is not always the case;" anonymization is not always effective because "even de-identified datasets present significant risks of reidentification given modern techniques for combining these datasets with other sources of individual information (also known as a `mosaic effect')." Commenter (12464) asserts that, in general, the supplemental proposal expresses too much confidence that de-identification can adequately address privacy and confidentiality concerns.
Commenters (11186, 11395, 11900) refer to the 2017 Sweeney et al., study which tested the ability to re-identify participants from a small de-identified environmental health study on air pollution. The commenters state that in the study, using data considered by the HIPAA to be sufficiently de-identified to be made public and which involved far fewer variables than would be required for the reanalysis proposed by EPA, the researchers were able to correctly identify over 25% of the study participants.
Commenter (11473) refers to three studies and states that even anonymized personal data can be subject to reidentification, and it has been a longstanding practice for agencies and journals to acknowledge the value of data privacy adjustments.
Commenter (11479) refers to four studies and states that a simple anonymization process is inadequate to protect personal data. The commenter states that simple steps like an Internet search or database query search can re-identify research participants. The commenter states that research using 1990 census data found that around 87 percent of Americans can be identified with just three data points: their zip code, gender, and date of birth. The commenter states that one paper found that with just 15 characteristics (like age, gender, and marital status), a machine learning program could reidentify 99.98 percent of Americans from an anonymized database.
Commenter (12405) states that de-identified does not mean unidentifiable. The commenter states that there are many studies where it is impossible to de-identify data to a level where both the data is usable and participants are properly protected. The commenter states that environmental exposure data often must be specific to a particular house, street or neighborhood. The commenter states that, for example, a 2009 study showed that consuming water from a private well located in an area with historical pesticide use is associated with an increased risk of Parkinson's disease. The commenter states that due to the nature of wells  --  typically serving a relatively limited number of people within a very small radius  --  the detail needed to perform the study renders proper deidentification impossible as all one needs to know is that a certain person lives near a particular well coupled with a demographic detail such as their age, gender, race, etc., and that person's privacy is at great risk.
Commenter (12720) states that one study explained that "[b]y linking demographics to public records such as voter lists, and mining for names hidden in attached documents, we correctly identified 84 to 97 percent of the profiles for which we provided names." The commenter states that another explained that "87% (216 of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on [5-digit ZIP, gender, date of birth]." The commenter states that another explains that "any data that is even minutely useful can never be perfectly anonymous."
Response: The final rule does not require the release or de-identification of PII or sensitive information. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Commenters (11360, 11396, 11480, 11576, 11900, 12464, 12546, 12720, 12727) contend that the proposal overlooks the risks to privacy. Commenters (11360, 11396) state that the risks to privacy are well recognized in the research and public health professions.
Commenters (11576, 12720) conclude that the EPA's proposal poses significant threats to personal privacy and express concern that these are threats the EPA has yet to acknowledge and address. Commenter (12464) asserts that the supplemental proposal says virtually nothing about the risk of re-identification from supposedly anonymized data sets and that, in general, the supplemental proposal expresses too much confidence that de-identification can adequately address privacy and confidentiality concerns.
Commenter (11480) states that the Department of Health and Human Services guidance on De-identification Protected Health Information in Accordance with the HIPAA Privacy Rule acknowledges that, even when properly done, de-identification of data does not eliminate the risk of identification of an individual.
Commenter (12710) states that the absence of a classification system for statistical and administrative data based on sensitivity of the data limits the government's ability to describe access restrictions and data security and privacy protocols appropriate for each level of sensitivity, in a way similar to the well-known classification and handling schedules for national security information.
Commenter (12546) asserts that it is implausible for these records to be publicized without risk of re-identification of individuals even if the most current techniques of de-identification are applied; ensuring that even the most pivotal and groundbreaking studies underpinning our current regulations will be downgraded or eliminated.
Commenter (11900) states that this level of privacy risk is not ethically acceptable. The commenter states that, although certain data types pose known threats to privacy, privacy is a moving target: as new data types are collected and new analytical methods are developed, novel privacy risks emerge that cannot always be anticipated. The commenter states that mobility traces (high-resolution location information) are one example of an emerging data type in environmental health studies. The commenter states that these data are increasingly being used to infer co-located environmental data as technological and cost barriers have decreased. These data are known to be extremely vulnerable to re-ID. Additionally, the commenter states that their research shows that it is not feasible to distinguish between data types that pose re-identification risk and those that do not. The commenter urges the EPA to treat all data associated with human study participants and their homes as potentially containing PII.
Response: The final rule does not require the de-identification of PII. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Other commenters (10042, 11381, 11899) contend the anonymization process maintains the privacy of the individual.
Commenter (10042) states that claims that transparency is not possible because of potential or actual violations of privacy of human health information are not true; the claims are readily falsifiable. The commenter states that the privacy argument against transparency is specious because human clinical data are made public without any violations of individual privacy through a widely accepted process called "anonymization". The commenter states that the anonymization process maintains the privacy of the individual so that the information can be made public and shared various entities for analyses. The commenter states that the practice of anonymization is used by pharmaceutical companies and contractors such as Privacy Analytics, Novartis, and Otsuka where clinical data that are made public are kept private. The commenter states that some regulatory agencies, such as European Medicines Agency require submitted clinical data to support drug registrations to be anonymized. The commenter states that avoiding transparency because of potential violations of privacy rights regarding health information and data of individuals is a clear misrepresentation.
Commenter (11381) states that the EPA should adopt by rule performance standards used elsewhere in the government and private sector to protect the privacy of PII. The commenter states that this information already must be disclosed to comply with the IQGs, so there is no marginal burden involved. The commenter states that this will require tradeoffs in some cases, such as circumstances in which data cannot be fully protected from deidentification, but the protection of privacy, a worthy goal, comes at the opportunity cost of forgone reproducibility and validation, and hence, public legitimacy. The commenter states that this is not a new problem, nor is it unique to EPA.
Commenter (11899) states that, while some have claimed the transparency rule would force researchers to reveal personal or confidential information about participants in health studies, in reality, such information is not needed and can easily be redacted; only the health data, and location by city and state, is required for these studies.
Response: The final rule does not require the de-identification of PII. The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. If dose-response data underlying pivotal science contains PII, the EPA will evaluate whether these data are available in a manner sufficient for independent validation (potentially through restricted access). For pivotal science where there is no access to dose-response data, or access is limited, the Agency may still consider these studies but will give them lesser consideration unless the Administrator grants an exemption under 40 CFR 30.7.
The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Commenter (12692) does not agree with critics who warn that, due to potential hacking, confidential data may not be protected under the proposed rule. The commenter states that, if hacking is the problem, that applies to original investigators no less than to those who audit published studies.
Response: The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to establish data sharing mechanisms. Further, the final rule does not require the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
<IP_ADDRESS>.3 Participation in Studies
Comment: Commenters (11184, 11377, 11395, 11404, 11479, 11496, 11890, 11900, 12458, 12474, 12540, 12716, 12720, 12727, 12731, 13549) express concern that the proposal will deter individuals from participation in research studies due to the risk of publication of personal health data.
Commenters (11184, 11377, 12435, 12457) express concern that the proposal disadvantages study subjects whose participation and data would be prevented from informing public policy. Commenter (12457) states that the lack of participation by low-income communities and communities of color may impact the long-term accessibility of beneficial treatments or interventions because researchers are unable to understand how these treatments impact low-income communities and communities of color.
Commenter (11377) states that effectively mandating fully-public data leaves potential human subjects of research with an uncomfortable choice: take part in studies that may compromise their privacy and confidentiality, or lose the opportunity to participate in science for the betterment of human health altogether. The commenter states that undermining potential subjects' confidence that their information will be protected skews the already unfavorable ratio of risk to benefit of participation in research. The commenter states that this will likely reduce the population of people willing to participate in research, which will severely hamper the conduct of science.
Commenters (12474, 13549) contend that the proposal will reduce research and data collection needed to protect the health of Tribal communities as individuals are deterred from participation based on the fear their personal information will be released and researchers avoid seeking such information.
Commenter (12540) provides that the SNPRM does not recognize the rigorous process for conducting environmental health research. The commenter notes that when environmental health studies are proposed and conducted, there is close attention paid to privacy of personal information and protected health data. The commenter asserts that without protections for the subjects in these studies, EPA is well aware that there would be little, if any participation, and academics would not be allowed to conduct these high quality research studies because of the stringency of the IRB Protections for Human Subjects.
Commenter (12720) contends that the Supplemental Proposal does not consider the negative effects it would have on recruitment for future epidemiological studies if members of the public had to permit access to sensitive personal and health information as a condition for study participation. The commenter provides that many of the peer-reviewed studies EPA uses to set and revise the national ambient air quality standards (NAAQS) through the CAA analyze the relationship between exposure to polluted air over many years and a range of adverse health effects. The commenter notes that these comprehensive studies have enrolled thousands of American volunteers over periods ranging from several years to decades, in order to understand exactly how pollution harms us. According to the commenter, the Supplemental Proposal would have a chilling effect on the study recruitment process because of the onerous data release requirements. The commenter states that EPA's actual creation of these harmful consequences, and failure to consider and account for these harmful consequences, render the Proposal arbitrary and capricious and an abuse of Agency discretion.
Response: This rule does not require any disclosure of PII. The EPA would also like to emphasize that the final rule does not impose requirements on any entity outside of the EPA. This is a rule of internal procedures and does not direct or require any outside entity or the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Commenter (12692) does not agree with critics who warn that the rule could deter people from participating in important studies out of fear that they could be identified. The commenter states that, just like epidemiologists, there is no reason why auditors of such studies would not be similarly bound and liable for breaches of confidentiality.
Response: The EPA thanks the commenter.
<IP_ADDRESS> Intellectual Property
Comment: Commenter (12430) expresses concern that the proposed rule does not address intellectual property rights. The commenter states that, for scientists at academic and research institutions, intellectual property protections for innovative analytical tools, models, and computer code are important to the research process. The commenter states that 40 CFR 30.5(c) of the proposed rule, however, would require the publication of the details of such original models and code. The commenter states that the proposal only allows for restricted access to the information if it contains "CBI, proprietary information or personally identifiable information." The commenter states that the intellectual property rights of academic or governmental researchers do not clearly fall into any of these categories.
Response: The purpose of the final rule is to codify internal procedural requirements for how the EPA will consider the availability of the underlying dose-response data that it relies upon to promulgate significant regulatory actions and develop influential scientific information. The EPA would like to emphasize that the final rule does not impose requirements on any entity outside of the EPA and does not direct or require any outside entity or the EPA to collect, store, or publicly disseminate dose-response data underlying pivotal science.
Comment: Commenter (12430) states that industry research might still be protected as CBI, while academic or public interest research would not be entitled to rely on intellectual property protections. The commenter states that the absence of publication exceptions or exemptions for protected intellectual property makes it far more likely that industry research, rather than academic or public interest research, would form the basis of regulatory decision-making. The commenter states that this could build an industry preference into EPA's regulatory process and disseminated information.
Response: The EPA does not agree that the approach included in the final rule will lead to systematic bias towards certain types of stakeholder goals because the EPA is not categorically excluding any studies from consideration with promulgating significant regulatory actions or developing influential scientific information.
 Chapter 12: Administrator's Exemptions
The 2018 notice of proposed rulemaking (NPRM) included a provision at 40 CFR 30.9 allowing the Administrator to grant exemptions from the rule on a case-by-case basis if he or she determines that compliance is impracticable because it is not feasible to conduct independent peer review on all pivotal regulatory science because it is not feasible to ensure that dose response data and models underlying pivotal regulatory science are publicly available in a fashion that is consistent with law, protects privacy and confidentiality, and is sensitive to national and homeland security.
In the supplemental notice of proposed rulemaking (SNPRM) the EPA proposed deleting the proposed exemption because EPA does not believe that independent peer review of pivotal regulatory science or pivotal science would be infeasible. The EPA specifically requested comment on whether these exemptions are appropriate, and on whether there are other situations in which specific significant regulatory actions, or specific categories of significant regulatory actions should be exempted.
The SNPRM also proposed to modify the scope of the data and models that can be considered when determining whether to grant an exemption. The EPA proposed to use the age of data and models as a factor in the determination that compliance with the rule is impracticable. The EPA also proposed in the supplemental that a study or studies would be eligible for consideration whether they contain confidential business information (CBI), proprietary information, or personally identifiable information (PII), if the underlying data or models were collected, completed or updated before the effective date of this rule.
The supplemental notice solicited comment on the modified text of 40 Code of Federal Regulations (CFR) 30.9, the applicability of the rule to all data and models, retrospective application of the rule, and whether there are factors other than the age of data and models that should be considered when granting exemptions.
Several comments were received regarding Administrator exemptions. In this section the public comments are organized according to the following topics under sections 12.1 (Exemptions (40 CFR 30.9)(NPRM Comments)) and 12.2 Administrator Exemptions (SNPRM Comments):
Section 12.1: Exemptions (40 CFR 30.9)(NPRM Comments)
       Legality of Proposed Exemption Provision in 40 CFR 30.9 of the Rule
       Case-by-Case Administrator Exemption Authority
       Criteria for Granting Case-by-Case Exemptions
       Requests for Specific Rule Exemptions
       Define "Reasonable Effort"
       Exemption Process Costs
       Notice-and-Comment Principles Should Inform EPA's Implementation of the Exemption Process
Section 12.2: Administrator Exemptions (SNPRM Comments)
       Granting of Exemptions is Subject to Bias
       Rule Would Preclude Consideration of Best Available Science
       Areas Needing Additional Clarity/Specificity
       Transparency
       Retroactivity
       Support for Exemptions
       Other Comments
The specific comments provided in this Chapter reflect the comment letters that provide arguments supported by detailed rationale, examples, and references/documentation. The Docket ID numbers for these commenters are cited throughout this Chapter. In addition, some general comment letters may also include comments related to comments included and responded to in this Chapter. These comments are summarized in Appendix B. Note that points and issues raised in these general comment letters may also be raised by the more detailed comments summarized in this Chapter. The responses provided in this Chapter adequately address these more general comments.
12.1 Exemptions (40 CFR 30.9) (NPRM Comments)
12.1.1 Legality of Proposed Exemption Provision in 40 CFR 30.9 of the Rule
Comment: Commenters (6125, 9227) contend that it is well established that existence of a waiver or exemption mechanism cannot be used to justify a provision otherwise beyond an agency's legal authority. Dimension Financial Corp. v. Board of Governors of Federal Reserve System, 744 F.2d 1402, 1410 (10th Cir. 1984) ("The possible exception to the initial impact of Regulation Y (Part 225.21(B)(4)) contains requirements with no objective standard and thus unbounded agency discretion. A device to meet objections to the new regulation cannot cure the exercise of powers denied by Congress or not provided for by Congress. Public Utilities Comm. of Calif. v. United States, 355 U.S. 534 (1958); In re Surface Mining Regulation Litigation, 627 F.2d 1346 (D.C. Cir. 1980). Commenter (9227) adds ALLTEL Corp. v. FCC, 838 F.2d 551, 561 (D.C. Cir. 1988) ("The [Federal Communications Commission] FCC cannot save an irrational rule by tacking on a waiver procedure. `The very essence of waiver is the assumed validity of the general rule . . . .')(citing WAIT Radio v. FCC, 418 F.2d 1153, 1158 (D.C. Cir. 1969)); United States Telecom Ass'n v. FCC, 359 F.3d 554, 571 (D.C. Cir. 2004) ("Moreover, even if the FCC had adopted some lawful mechanism for making exemptions from its general national rule, it could not necessarily rely on the existence of that mechanism as the sole justification for not adopting a more narrowly tailored rule. . . . [T]he mere existence of a safety valve does not cure an irrational rule.")
Commenter (9277) provides the following points to support their position:
      First, while the statutory provisions described above require EPA to consider best available science and other relevant information when making regulatory decisions, see, e.g., Safe Drinking Water Act, 42 U.S.C Section 300g-1(b)(3)(A)(i) ("The Administrator shall use the best available, peer reviewed science."), the Administrator has discretion over whether to grant an exception. See Proposed § 30.9 ("The Administrator may grant an exemption to this subpart on a case-by-case basis...")(emphasis added).[128] Where a statute requires that the agency consider certain information in reaching a decision, EPA cannot promulgate a rule that gives the Administrator discretion over whether to allow such consideration.
      Second, the only basis on which the Administrator may grant an exemption under Proposed §30.9 is that it "is not feasible" to "ensure that all dose response data and models underlying pivotal regulatory science is publicly available" as the rule requires. However, the Proposal does not explain how "feasibility" is to be determined in this context -- or even whether the term encompasses practical feasibility, cost-effectiveness, or other considerations. Moreover, there can easily be situations where it is theoretically "feasible" to make underlying data publicly available, but this information is nonetheless not publicly available. For example, a scientist who intends to rely on the same data to publish multiple papers may be disinclined to make that data available to competitors. Yet, because it is technically "feasible" to make the underlying data publicly available, the proposed rule would not even provide the Administrator with authority to grant an exemption authorizing such consideration, thus forcing the Administrator to violate the law.
      Third, even if it were lawful for EPA to ignore relevant science, the exemption provision is arbitrary, as it does not define enough criteria or process steps by which the Administrator may decide to exempt a study. The provision instructs the Administrator to rely on a handful of broad (and highly manipulable) policy considerations in determining whether it would be infeasible to make data and methods publicly available. These factors could be applied broadly to give the Administrator nearly absolute discretion. From the face of the Proposal, it is not even clear that the Administrator would be required to provide a public, written explanation of his decision to grant (or deny) a waiver. This lack of accountability could lead to the arbitrary exclusion of studies the Administrator unilaterally chooses to not exempt.
      Finally, the exemption provision is impractical and likely could not be implemented effectively. According to the Congressional Budget Office, EPA "relies on about 50,000 scientific studies annually to perform its mission," and at times, relies on thousands of studies for one action. Many of the studies that would be affected by this rule are complex and include large datasets that would lead to an extensive decision-making process under the exemption provision. EPA does not include any rationale in the proposal justifying how the Administrator could reasonably decide to exempt studies on a case-by-case basis given the tens of thousands of studies EPA considers each year. This provision could create a large backlog, which would result in important studies being effectively removed from EPA consideration because of the need to finalize a regulation before an exemption for every relevant study is granted. Accordingly, the exemption provision fails to safeguard against the unlawful exclusion of valid science from EPA's regulatory process.
Commenter (6117) states that well-established legal precedent frowns upon case-by case determinations where, as here, a general rule would be appropriate.
Commenter (6373) asserts that the ability of the Administrator to apply the Rule arbitrarily is an inherent legal deficiency and renders the exemption process ripe for exploitation.
Response: The EPA is authorized to promulgate this procedural rule under its authority to promulgate housekeeping regulations governing its internal affairs.
EPA notes that the final rule does not categorically exclude studies. The EPA does not agree with the comments regarding the role of the Administrator in determining whether to grant an exemption under 40 CFR 30.7 in the final rule and finds that the Administrator is the appropriate decision maker in this context. To ensure that the Administrator's decision is appropriately transparent and supported, the EPA has included a provision in 40 CFR 30.7 that requires the Agency to document the rationale for any exemptions granted by the Administrator in the significant regulatory action or influential scientific information. Finally, as is normal Agency practice, the quality of all pivotal science is evaluated prior to its use and thus before the need for a possible exemption under this final rule. The exemption factors listed in Part 30.7 contained additional science-based criteria.
40 CFR 30.7 lists the circumstances under which an exemption may be warranted. Specifically, the final rule states the Administrator may grant an exemption to this part for a study on a case-by-case basis if he or she determines that greater consideration of studies for which the underlying data are not publicly available in a manner sufficient for independent validation is nevertheless warranted because: