September 28, 2011

VIA EMAIL and U.S. Mail U.S. EPA Headquarters Ariel Rios Building 1200 Pennsylvania Avenue, N. W. Mail Code: 5304P Wa shington, DC 20460 Re: Privacy Issue in RCRA Contingency Plan Regulations Dear Mr. James O’Leary: The American Petroleum Institute (API) would like to bring to the attention of the U.S. Environmental Protection Agency (EPA) a specific personal privacy concern of our member companies related to Resource Conservation and Recovery Act (RCRA) contingency plan regulations. API is the primary trade association of America’s oil and natural gas industry and represents over 480 member companies involved in all aspects of the industry. API’s members operate a number of facilities in the U.S. that generate and manage solid and hazardous wastes. The regulations we would like to bring to your attention are at 40 CFR 264.52(d), 265.52(d), and 267.52(a)(3).

• Regulations at 40 CFR Part 265, Subpart D include requirements for contingency planning and emergency procedures applicable to large quantity generators of hazardous waste [by reference in 40 CFR 262.34(a)(4)] and interim status facilities. Wi thin that subpart, the regulation at 40 CFR 265.52(d) states that the contingency plan must list “names, addresses, a nd phone numbers (office and home) of all persons qualified to act as emergency coordinator.”

• Similarly, regulations at 40 CFR Part 264 Subpart D and Part 267, Subpart D include requirements for contingency planning and emergency procedures at permitted h azardous waste facilities. W ithin those subparts, the regulations at 40 CFR 264.52(d) and 267.52(a)(3) state that the **Derek D. Swick** Senior Policy Advisor **Regulatory and Scientific Affairs** 1220 L Street, NW Washington, DC 20005

- 4070 USA Telephone 202

- 682

- 8341 Email swickd@api.org www.api.orgcontingency plan must list “names, addresses, and phone numbers (office and home) of all persons qualified to act as emergency coordinato r.” Mr. James O’Leary Page 2 of 2 September 28, 2011

Our concern with the regulatory language is the requirement to provide employees’ **home** addresses and **home** phone numbers in the contingency plan. The regulatory language raises valid privacy and security concerns by requiring the home addresses and phone numbers of employees in the contingency plan, which is available to a wide variety of individuals outside the company (such as unknown hospital staff and various emergency response team members). The requirement to provide employees’ **home** addresses and **home** phone numbers in the contingency plan is inappropriate and also unnecessary. The regulations at 4 0 CFR 264.55, 265.55, and 267.55 already require that at all times there must be at least one employee (i.e., an emergency coordinator) either on the premises or on call (i.e., available to respond to an emergency by reaching the facility within a short pe riod of time). To meet this requirement, companies have systems in place for ensuring that an emergency coordinator is readily available at any and all times. As such, though it may be appropriate for the contingency plan to describe the facility’s emerg ency coordinator availability and on call procedures, there is no need to have the home address and phone number of the employee in the RCRA contingency plan, nor any demonstrated value from including those home addresses and phone numbers that would outwe igh the potential privacy and security risks.
Weappreciate your consideration of this issue and are happy to discuss it with you. The privacy issue is real for our member companies and their employees and we would appreciate a technical correction to the regulations (i.e., removal of the home address and phone number requirement) that would enable us to protect employee privacy while still maintaining proper emergency coordinator access at all times. Feel free to contact me with any questions or sho uld you require additional information from API. Sincerely,cc: API Waste and Remediation Group