Does EPA protect Confidential Business Information?

Under existing RCRA statutes, sites may claim that certain items of information submitted as part of their Hazardous Waste Report contain Confidential Business Information (CBI). The procedures for handling CBI can be found in Procedures for Handling RCRA Confidential Business Information (available from the EPA HQ RCRA Document Control Officer). A subset of these procedures is documented in Procedures for Handling RCRA Confidential Business Information Submitted for the Biennial Report.

In brief, it is not allowable to mingle CBI data with non-CBI data. In addition, CBI data must be handled on a secure computer (either a computer that is kept in a secure environment or a computer that uses removable media where the media is kept in a secure environment).

CBI data must be submitted separately from non-CBI data using data handling methods outlined in the Procedures for Handling RCRA Confidential Business Information documentation. In previous Biennial Report cycles, some states/regions that have received CBI have masked the CBI data (in other words, changed the CBI data so it no longer is CBI). This practice is not a requirement of EPA, but as long as the masking is acceptable to the site and the implementer, and the data meets the minimum edit standards as detailed in the appendices, EPA says the solution is acceptable.