1

MEMORANDUM

TO: Public Record for the NPDES Electronic Reporting Rule

EPA Docket Number EPA-HQ-OECA-2009-0274 (www.regulations.gov)

FROM: Carey A. Johnston, P.E.

USEPA/OECA/OC

ph: (202) 566 1014

johnston.carey@epa.gov

DATE: 14 September 2015

SUBJECT: Description of EPA’s Enforcement and Compliance History Online (ECHO) 

Website [DCN 0201]

The NPDES Electronic Reporting Rule changes the mode of transmission of NPDES 

information that regulated entities are already required to report to authorized NPDES programs 

or EPA under existing regulations. It does not address or affect EPA’s processes for managing 

this data and making information available to the public. Comments regarding EPA’s practices 

for making NPDES information publicly available or what data may be posted online subsequent 

to this rulemaking are therefore outside the scope of this rule. Concerns with EPA’s public 

access procedures and existing Enforcement and Compliance History Online (ECHO) website

should be raised to the agency in a separate proceeding so that they can be addressed apart from 

this narrow rulemaking.

EPA has the discretion to address how it will display NPDES information in a separate 

proceeding later in time, rather than determining whether and how ECHO should be changed as 

part of this rulemaking. This rule is a reasonable step in EPA’s NPDES program administration, 

even if another step may be considered in the future. The U.S. Court of Appeals for the D.C. 

Circuit has held that “agencies have great discretion to treat a problem partially.” City of Las 

Vegas v. Lujan, 891 F.2d 927 (D.C. Cir. 1989) (“we [sh]ould not strike down [a regulation] if it 

[is] a first step toward a complete solution.”).

However, because EPA received may comments about its ECHO website, some of which 

reflected misconceptions about how ECHO works and how it might change in the future, EPA 

has provided this informational essay regarding existing practices regarding public access to 

NPDES information under the Clean Water Act.

1. Background on ECHO

EPA’s ECHO website dates back to 2002. ECHO currently provides online access to 

compliance monitoring and enforcement data for approximately 800,000 regulated facilities 

across the United States. The information is pulled from a variety of federal databases and 

provides integrated compilation of federal and authorized program environmental inspections, 

violation determinations, enforcement actions, and other environmental records collected 
2

pursuant to the Clean Water Act, Clean Air Act, and the Resource Conservation and Recovery

Act. ECHO can be accessed at https://echo.epa.gov/. 

ECHO currently displays NPDES information for facilities that are already reporting 

electronically or whose data is being shared electronically with EPA by authorized state 

programs.

EPA’s ECHO website and the NPDES Electronic Reporting Rule reflect this 

Administration’s longstanding commitment to releasing and leveraging data in support of 

enhanced transparency and accountability, improved government services, and a stronger 

economy. President Obama’s Open Data Policy and Executive Order, “Making Open and 

Machine Readable the New Default for Government Information” (9 May 2014), encourage 

agencies to make newly generated or acquired government data freely available in open, 

machine-readable formats. See DCN 0068.

2. Public Participation Is An Important Goal Under The Clean Water Act

The Clean Water Act has a number of provisions emphasizing the importance of public 

access to and engagement with the NPDES program. Communities have an interest in 

understanding activities in their area that may be contributing to water pollution and how local 

facilities are performing. As the U.S. Court of Appeals for the Second Circuit stated in

Waterkeeper Alliance v. EPA, “Congress clearly intended to guarantee the public a meaningful 

role in the implementation of the Clean Water Act.” 399 F.3d 486, 503 (2d Cir. 2005). The Clean 

Water Act “unequivocally and broadly declares” in its “Congressional declaration of goals and 

policy” that “Public participation in the . . . enforcement of any regulation, standard, effluent 

limitation, plan, or program established by the Administrator or any State under this chapter shall 

be provided for, encouraged, and assisted by the Administrator and the States.” Waterkeeper, 

399 F.3d at 503; CWA 101(e). As the Supreme Court noted in Costle v. Pacific Legal 

Foundation, “Passages in the FWPCA's legislative history indicate that this general policy of 

encouraging public participation is applicable to the administration of the NPDES permit 

program.” 445 U.S. 198, 216 (1980) (“The Report of the Committee on Public Works 

accompanying the Senate bill emphasized that an essential element of the NPDES program is 

public participation, and that ‘[the] public must have a genuine opportunity to speak on the issue 

of protection of its waters.’”) (citing S. Rep. No. 92-414, p. 72 (1971)). CWA section 304(i), 

which directs EPA to establish minimum procedural requirements for authorized NPDES 

programs, also directs EPA to establish reporting requirements “including procedures to make 

information available to the public.” Finally, the CWA envisioned an important role for citizen 

suits in section 505(a), providing that “any citizen” may bring a civil suit for violations of the 

Act. 

The Clean Water Act’s public participation goals are reflected in EPA’s regulations. 

EPA’s permitting regulations require public notice, a public comment period, and the 

opportunity for a public hearing for permit actions beyond minor modifications. 40 CFR 124.10, 

124.11. These regulatory requirements are applicable to authorized state programs. 40 CFR 

123.25. Failure to comply with public participation requirements is also among the criteria for 
3

withdrawal of state programs. 40 CFR 123.63. EPA’s information sharing requirements specify

that “If EPA obtains from a State information that is not claimed to be confidential, EPA may 

make that information available to the public without further notice.” 40 CFR 123.41(a). EPA’s 

regulations also require that authorized state programs “provide for public enforcement in the 

State enforcement process.” 40 CFR 123.27(d).

3. The CWA Requires Mandatory Disclosure Of NPDES Information. This Information Is 

Already Available on ECHO.

As explained above, ECHO has been available since 2002, well before EPA promulgated 

this rule. ECHO displays NPDES information that is public pursuant to existing legal 

requirements. ECHO provides facility information such as permit number, facility name, permit 

type, industrial category, location, inspection and enforcement history, and local environmental 

conditions and demographics. As described below, the Clean Water Act specifically directs that 

broad categories of NPDES information must be made available to the public. 

First, information that NPDES permitted facilities submit on their permit applications is 

required to be publicly available. CWA section 402(j) requires that “[a] copy of each [NPDES] 

permit application and each [NPDES] permit . . . be available to the public. Such permit 

application or permit, or portion thereof, shall further be available on request for the purpose of 

reproduction.” 33 U.S.C. 1342(j). Section 402(j) applies to all NPDES permit applications. 

ECHO is consistent with EPA’s statutory obligations because it provides a facility’s permit 

application and permit information to the public. In addition, CWA section 402(b) requires that 

states, tribes, and territories implementing NPDES programs provide for “public . . . notice of 

each application for a permit and provide an opportunity for public hearing before a ruling on 

each such application.” 33 U.S.C. 1342(a)(1), (b)(3). EPA’s existing regulations implement 

section 402 and specify what information regulated entities must provide in their permit 

applications. 40 CFR 122.21(f). 

Second, CWA section 308(b), which governs monitoring, reporting, and inspections,

specifies that all information collected under that provision shall be made available to the public 

unless entitled to protection as a trade secret. 33 U.S.C. 1318(b). In particular, effluent data is 

required to be made available to the public without any exceptions for privacy. Effluent data is 

defined in EPA’s existing regulations at 40 C.F.R 2.302. ECHO implements section 308(b) by

making effluent data publicly available today. 

In the Clean Water Act, Congress determined that the value of public access to certain 

NPDES information outweighed any potential privacy interests. As a result, all of the categories 

of information identified in the final rule (Appendix A to 40 CFR 127) are already publicly 

available today and already required to be submitted to authorized NPDES programs and EPA 

under existing regulations.

One commenter cites Campaign for Family Farms v. Glickman, 200 F.3d 1180 (8th Cir. 

2000) to support the assertion of a privacy interest in NPDES information. As explained above, 

EPA’s practices for making NPDES information publicly available or what data may be posted 

online subsequent to this rulemaking are therefore outside the scope of the NPDES Electronic 
4

Reporting Rule. Furthermore, this case is distinguishable from the NPDES facility information 

found in ECHO. The Glickman case pertains to secret ballot on a controversial issue and a

petition to the U.S. Department of Agriculture. The court found that disclosing the petition 

would reveal the individuals’ position (i.e., their secret ballot vote) on the controversial issue.

Thus, the court found the privacy interest implicated by a secret ballot, not any privacy interest in 

the petitioners’ names, addresses, or other farm information. Also, unlike the petition signatures 

at issue in Glickman, CAFO NPDES data permit application information, effluent data, and 

enforcement history that are available on ECHO are public by operation of the Clean Water Act, 

as explained above. 

4. ECHO Does Not Implicate The Privacy Act

EPA received comments claiming that ECHO is “a group of records . . . from which 

information is retrieved by the name of the individual” and a “system of records” under the 

Privacy Act. The commenters stated that EPA needed to follow Privacy Act procedures prior to 

collecting the personal information of farmers. ECHO, however, is not a data collection system

of records. The website draws from various data resources across EPA that are not affected by

this rule, such as the Federal Registry Service, aggregates that information, and provides the 

ability to search it on certain, limited fields. EPA disagrees that a Privacy Act system of records 

notice is required for ECHO. 

The Privacy Act does not apply to ECHO for two basic reasons. First, the Privacy Act 

only applies to the records of individuals, which is defined narrowly in the Act as “citizens of the 

United States or aliens lawfully admitted for permanent residence.” 5 U.S.C. 552a(a)(2); 

compare with Section 552(a)(3) (FOIA reference to “any person”). Based on this narrow 

definition of individual, the Privacy Act does not apply to an agency’s handling of facility

records that are limited to information pertaining to an entrepreneurial capacity. See Office of 

Management and Budget’s Privacy Act Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975) 

(quoting legislative history and stating that it “suggests that a distinction can be made between 

individuals acting in a personal capacity and individuals acting in an entrepreneurial capacity 

(for example,, as sole proprietors) and that th[e] definition [of ‘individual’] (and, therefore, the 

Act) was intended to embrace only the former”); Dresser Indus. v. United States, 596 F.2d 1231

(5th Cir. 1979); St. Michael’s Convalescent Hosp. v. State of Cal., 643 F.2d 1369 (9th Cir. 1981); 

SAE Productions, Inv. v. FBI, 589 F. Supp. 2d 76, 83 (D.D.C. 2008) (“[I]t is equally established 

that corporations and other organizations do not generally have any Privacy Act rights.”). There 

is no personally identifiable information collected in the Federal Registry Service system with 

the exception of name and associated business-related information. If a farmer’s data such as 

name and address are in the system, it would be in an entrepreneurial capacity and therefore 

would not be covered by the Privacy Act. One commenter, the National Pork Producers Council,

points to a district court case for the proposition that the protections conferred by the Privacy Act 

are not diminished simply because the information pertains to individuals acting in an 

entrepreneurial capacity. Scarborough v. Harvey, 493 F. Supp. 2d 1 (D.D.C. 2007). 

Scarborough, however, dealt with descriptive Criminal Alert Notices created by the Department 

of Defense. In contrast, ECHO shares permit information and effluent data submitted by

regulated parties that the Clean Water Act already requires to be made available to the public as 
5

described in above. ECHO does not currently display individuals’ names or phone numbers

though it provides links to FRS which has additional information. Furthermore, in Scarborough,

the court ruled on several motions but did not resolve the Privacy Act claims. 

Second, in order for ECHO to qualify as a “system of records” under the Privacy Act, it 

must retrieve records by an individual’s name or other personal identifier. Henke v. U.S. Dept. of 

Commerce, 83 F.3d 1453, 1460 (D.C. Cir. 1996); see Doe v. Dep’t of Veterans Affairs, 519 F.3d 

456, 461 (8th Cir. 2008); 5 U.S.C. 552a(a)(5). The searchable fields on ECHO are the NPDES 

permit number, permit status, permit type, industrial category, permit facility name, location 

address, primary permit code and description, latitude and longitude coordinates, and component 

type description. See https://echo.epa.gov/facilities/facility-search. Any personal name that is 

searchable in ECHO data systems is incidental as a result of the owner choosing to include his or 

her personal name in the facility name.

5. EPA Discretion Regarding ECHO

As a separate matter apart from this rulemaking, EPA has agreed to mask on ECHO 

facility-specific information for unpermitted CAFOs that are not in violation of the Clean Water 

Act in response to particular privacy concerns that have been raised regarding operators living in 

close proximity to these facilities. EPA worked with USDA and OMB on this approach.

6. Questions About How ECHO Works

Several commenters asked questions about how ECHO works today. While these 

comments are outside the scope of this rulemaking as described above, EPA is providing 

additional details about ECHO because it wants this existing public access website to be a useful 

and reliable resource. 

ECHO’s CWA data is updated with the latest available facility data from EPA’s national 

NPDES data system (the Integrated Compliance Information System-NPDES) on a weekly 

schedule. The Integrated Compliance Information System-NPDES contains NPDES information 

that authorized NPDES programs and facilities in direct implementation states share with EPA. 

EPA has a robust error reporting and correction system along with robust quality control 

measures to ensure the accuracy of NPDES program data. EPA works hard to eliminate errors 

and the potential for inaccurately identifying noncompliance on ECHO (for example, EPA and 

states regularly review effluent violations.) EPA has an accountable method, the Integrated Error 

Correction Process, for any user of ECHO or any other EPA website, to report potential data 

errors. This error reporting system logs and tracks these error correction requests and routes 

these requests to the appropriate EPA and state water data steward. These data stewards 

investigate these error correction requests and fix the errors in the Integrated Compliance 

Information System-NPDES. These data corrections are then brought into ECHO at the next 

weekly data re-fresh. EPA, as well as numerous state and local government agencies, are 

involved in preparing and maintaining the facility-level enforcement and compliance data found 

on ECHO. These agencies are committed to providing the public with the highest possible 

quality of information related to each facility’s compliance record.
6

After giving states a considerable amount of time to review and correct any facility data 

errors, EPA freezes data as part of its State Review Framework. These data freezes allow EPA to 

chart trends from year to year against a number of metrics that gauge the effectiveness of 

authorized NPDES programs.

As a matter of good practice, EPA works with stakeholders during the development and 

testing of new features for ECHO. EPA provides states with an opportunity to provide input on 

new ECHO updates and enhancements to ensure that ECHO users have the proper facility data 

with the proper context for meaningful and accurate interpretations. This testing and user 

feedback helps accurately present the data in ways that can be meaningful understood by the 

public and reduces the potential for “software glitches.” ECHO currently differentiates between

Discharge Monitoring Report data with and without permit effluent limits so that DMR 

information can be accurately interpreted by the public. This allows ECHO users to identify and 

assess pollutant discharges from facilities and whether these pollutant discharges have effluent 

limits.

Some commenters expressed concern about the potential for data on ECHO to be 

misused. Speculation about illegal actions by third parties is not a reason for EPA never to 

present information electronically.

7. Confidential Business Information (CBI)

EPA’s Confidential Business Information (CBI) regulations are outside the scope of the 

NPDES Electronic Reporting Rule and remain unchanged. None of the information that is made 

publicly available on ECHO is CBI. Under existing regulations and consistent with Clean Water 

Act section 308, the information required by an NPDES application form may not be claimed as 

confidential. Pursuant to the applicable regulations, “[c]laims of confidentiality . . . will be 

denied” for “(1) The name and address of any permit applicant or permittee” or “(2) Permit 

applications, permits, and effluent data”; and “[i]nformation required by NPDES application 

forms provided by the Director under §122.21 may not be claimed confidential. This includes 

information submitted on the forms themselves and any attachments used to supply information 

required by the forms.” 40 CFR 122.7(b)-(c); see also 40 CFR 123.25 (applicability to state 

programs). Clean Water Act section 308(b) does not allow effluent data to be withheld from 

disclosure as CBI. EPA’s Clean Water Act CBI regulation defines “effluent data” as “A general 

description of the location and/or nature of the source to the extent necessary to identify the 

source and to distinguish it from other sources...” 40 CFR 2.302(a)(2)(C).

Regarding CAFO Annual Program Reports, EPA explained how it will handle CBI 

claims for such data in its 2003 CAFO rulemaking:

EPA expects that the permitting authority will make this information 

available to the public upon request. This should foster public confidence 

that CAFOs are complying with the requirements of the rule. In particular, 

the information in the annual report will confirm that CAFOs have 

obtained coverage under an NPDES permit, are appropriately controlling 

discharges from the production area, and have developed and are 
7

implementing a nutrient management plan. . . . Under the existing 

regulations at 40 CFR part 2, subpart B, a facility may make a claim of 

confidentiality for information it must submit and EPA must evaluate this 

claim if it receives a request for the information from the public . . . .

Claims of confidentiality with respect to information submitted to the 

State will be processed and evaluated under State regulations.

See 60 Fed. Reg. 7176, 7233 (Feb. 12, 2003). 

8. Critical Infrastructure Security Information

Under the National Defense Authorization Act of 2012, the Secretary of Defense may

exempt Department of Defense-designated “critical infrastructure security information” from 

disclosure under FOIA. 10 U.S.C. Section 130e. The Department of Defense will make a caseby-case determination of whether a particular facility is designated as critical infrastructure in 

response to a FOIA request. NPDES information designated as critical infrastructure security 

information in response to a FOIA request will be withheld from the public. In the instance 

where an NPDES program data element for a particular facility is designated as critical 

infrastructure security information under this process, a separate, filtered set of data without the 

protected information will be shared with the public on ECHO. 

Comments regarding critical infrastructure under Homeland Security Presidential 

Directive 9 were addressed in Issue Code 6.i.ii because it was not clear whether those comments 

concerned the electronic transmittal of data to EPA (within the scope of the rule) or the posting 

of that data on ECHO (outside the scope of the rule). Comments regarding privacy

considerations under the Paperwork Reduction Act were addressed at Issue Code 6.i for the same 

reason.

9. Comments From Other Sectors

While many comments regarding ECHO came from the CAFO sector, one commenter 

questioned the need for public access to stormwater information. Again, what information EPA 

presents in ECHO is outside the scope of this rule.

The reason EPA currently provides the public with site-specific stormwater information it 

that it gives meaningful insights on the measures being employed to control stormwater. This 

information can be used by public citizens concerned about water quality in their area, drinking 

water treatment professionals that are assessing their source water protection areas, and local, 

state, and Federal government professions that are estimating potential impacts to surface waters 

from industrial and construction stormwater.

10. Commenters Seeking Improved And Expanded Public Access 

While some commenters raised concerns with EPA’s current ECHO website, other 

commenters praised ECHO and lauded the importance of public access to NPDES information 

for communities. The New York Rural Water Association (NYRWA) asked how EPA intends to 
8

educate the general public on where to find the electronically reported data. NYRWA 

specifically recommended using social media to educate the public about the availability of 

NPDES data. Washington State Department of Ecology recommends that to improve public 

accessibility, EPA consider sending an announcement out to national business organizations and 

national organizations of local governments. Another commenter pointed out that not all 

communities have access to the Internet and some rely on their print newspaper for information 

about their violations causing environmental or health impacts. 

These comments regarding how data may make NPDES data available to the public after 

the promulgation of the electronic reporting rule are outside the scope of this rulemaking as 

explained above. EPA may consider changes to or outreach about ECHO in the future. EPA 

notes that newspapers can avail themselves of this information to more broadly disseminate 

information on CWA violations and environmental or health impacts to communities that do not 

have access to the Internet.