Legal Spotlight: Protecting CBI under REACH and CLP processes

REACH aims not only to obtain information on properties and risks posed by chemical substances from registrants and other parties involved in the various REACH processes but also to make some of that information publicly available. However, the European Chemicals Agency (ECHA) and other authorities also have a duty to protect confidential business information (CBI) submitted to them. Jean-Philippe Montfort and Giovanni Indirli outline the relevant rules and offer some initial considerations for registrants and other parties submitting information for REACH or CLP.

Registration

When filing a registration dossier, registrants can request that specific information they register be considered confidential and not be made available on the internet subject to them providing suitable justification that publication of that information could be harmful to their – or other parties’ – commercial interests.

More specifically, with respect to what information will be published, the REACH Regulation (Articles 118 and 119) classifies the information submitted for registration in three categories:

• (1) the information that will always be published on the Agency’s website, including the name of the substance, its classification and labelling, physicochemical data, the results of toxicological and eco-toxicological studies, derived no-effect level (DNEL) and predicted no-effect concentration (PNEC), guidance on safe use and in some cases analytical methods;
• (2) the information that will be published, unless requested and justified to be CBI, including degree of purity or identity of impurities and/or additives which are known to be dangerous, total tonnage band, (robust) study summaries, safety data sheet information, the trade name of the substance and its IUPAC name; and
• (3) the information that is considered inherently confidential and which will therefore not be published (unless required for urgent action to protect human health, safety or the environment), including details of the full composition of a preparation, precise use, function and application of a substance, precise tonnage and links between a manufacturer or importer and their distributors or downstream users.

Most of the information referred to in category (2) – the “may be confidential” category – is specific to each registrant and should therefore be included in the individual registration rather than the joint submission filed by the lead registrant, and justification for the request of confidential treatment should therefore be submitted by each registrant. However, this is not the case for the study summaries and robust study summaries, which therefore require a common view among the joint registrants and submission of a request by the lead registrant.

With respect to requests made individually, there may be cases where some degree of coordination between registrants may also be helpful. Indeed, if the registrants of the same substance that are in the same situation take different positions on the confidential nature of the same type of information (eg degree of purity due to a proprietary process) this may undermine their chances that the justification will be accepted by the Agency.

Importantly indeed, it is not sufficient for a company to request confidentiality. It must justify its request in writing and this must be accepted by the Agency. What happens if the Agency does not accept a given justification? This will be the subject of an Agency decision addressed to the requesting registrant. According to ECHA Decision dated 23 April 2008 taken pursuant to Article 118(3) of REACH, the Agency will notify registrants of the rejection of their confidentiality requests, giving them two months to request a review by the Agency, which shall also take place within two months. The registrant can then bring an action against that decision before the Court of First instance or complaint to the European Ombudsman, but not to the ECHA Board of Appeal.

At this stage there is little, if any, guidance available as to what the Agency will consider as CBI, but this should not prevent registrants from carefully considering each case and elaborating common sense justifications as to why and how the disclosure of the information would harm their commercial interest to justify confidential treatment.

It should also be remembered that there is a cost associated with requests for confidentiality of registration information under the REACH fees Regulation.

CLP notification

The provisions of the REACH Regulation on classification and labelling have been taken over by the CLP Regulation. This includes the obligation to notify the Agency of the classifications and labelling for all substances placed on the market by 1 December 2010 –  actually 3 January 2011 if the text of the CLP Regulation is followed precisely. The information to be notified includes the identity of the notifier(s), the identity of the substance, the classification of the substance and details thereof, specific concentration limits and M-factors as well as some labelling elements specified in Article 40 of the CLP Regulation.

The CLP Regulation specifies that this information will be published in a “classification and labelling inventory” in the form of a database. It also specifies that the notified information that corresponds to the information listed in Article 119(1) of REACH shall be publicly accessible.

This means that the information which corresponds to the “may be confidential” category (Article 119(2) of REACH) will not be published. In practice this means that the identity of the notifier(s) responsible for placing substances on the market should not be published, but according to CLP Article 42, it shall be communicated to the other notifiers and registrants so that they can discuss and harmonise their classification and labelling.

Other Agency communications

ECHA’s management board also published on 12 September 2008 a Decision on Transparency regarding the safety of substances pursuant to Article 109 of the REACH Regulation, to specify the rules for making available to the public regulatory, scientific or technical information concerning substances on their own, in preparations or in articles.

This applies to information that is not of a confidential nature other than the information included in the registration dossier, discussed above, for which Articles 118 and 119 apply. It specifies what other information the Agency will make publicly available upon receipt, unless specified as confidential by their authors. This includes decisions resulting from Member States’ evaluations of substances, as well as information provided in response to ECHA invitations to comment for example, on testing proposals, Annex XV dossiers for harmonised classification and labelling, substances of very high concern or restrictions unless the commenting party claims confidentiality.

However, the Decision does not say whether there is a need to provide justifications as to the confidential character of the information being provided and whether the Agency can overrule the confidentiality claim being made, pursuant to the ECHA Decision of April 2008, mentioned above.

Third party right of access

On the point of third parties’ right to request access to information, the CLP Regulation refers to Article 118 of REACH which provides that Regulation 1049/2001 shall apply to documents held by the Agency. As requested by REACH, this has been subject to yet another ECHA Management Board decision dated 25 March 2009.

This Decision provides how, and under what conditions, the Agency shall grant access to third parties requesting documents drawn up by the Agency or received by it, therefore including documents filed by companies under the REACH processes.

Essentially, with respect to the documents which the Agency holds but which have been submitted by external parties, for example a registrant or notifier, the Agency itself will verify if the disclosure of the document “would undermine the protection of commercial interests, court proceedings and legal advice or the purpose of inspections, investigations and audits” – as specified in Article 4 of the EU Regulation on public access to documents held by EU institutions (1049/2001) which the ECHA Decision refers to. If so, it will refuse access to that document. If not, it will have to consult the document submitter before granting access to the document. They will then have five days to respond to this request after which the Agency may decide to grant access to the documents after informing them of this decision and informing them of their available remedies.

Conclusions

The provisions summarised above seek to balance the conflicting objectives of protecting confidential business information and ensuring the public right-to-know. These provisions generally reflect a common sense approach, but they are not as straightforward as they seem and their application in practice will no doubt generate different interpretations. In particular, only practice will reveal what information the Agency and the Courts will consider to meet the confidentiality and/or transparency thresholds set forth in the legislation.

In addition to the above provisions, national provisions will apply to the information submitted to Member States as part of their enforcement activities under REACH. Another complicating factor is that the above provisions apply without prejudice to the provisions of Regulation 1367/2006 on the application of the Aarhus Convention on access to information in environmental matters, which also contain rules that are directly applicable to documents held by the Agency containing environmental information.

At this stage, what appears important is for companies to ensure that they identify which information they submit to the Agency and/or give access to national enforcement authorities during inspection is considered CBI. They should then ensure they mark this information as “confidential, business secret” and prepare justifications as to why they consider that disclosure of that information would undermine the protection of their commercial or other legitimate interests.

With respect to information submitted at registration, they may also want to convince other registrants that are in the same situation of the confidential nature of some information and to elaborate common justifications to present a united front to the Agency.