40 C.F.R. § 2.208

Determinations issued under §§ 2.204 through 2.207 shall hold that business information is entitled to confidential treatment for the benefit of a particular business if—

(a) The business has asserted a business confidentiality claim which has not expired by its terms, nor been waived nor withdrawn;

(b) The business has satisfactorily shown that it has taken reasonable measures to protect the confidentiality of the information, and that it intends to continue to take such measures;

(c) The information is not, and has not been, reasonably obtainable without the business's consent by other persons (other than governmental bodies) by use of legitimate means (other than discovery based on a showing of special need in a judicial or quasi-judicial proceeding);

(d) No statute specifically requires disclosure of the information; and

(e) Either—

(1) The business has satisfactorily shown that disclosure of the information is likely to cause substantial harm to the business's competitive position; or

(2) The information is voluntarily submitted information (see § 2.201(i)), and its disclosure would be likely to impair the Government's ability to obtain necessary information in the future.