Engineering and architecture
PFAS investigation data held by consultants: confidentiality and disclosure
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Environmental consultants usually hold PFAS investigation data, but the client usually controls its disclosure. Sampling results, lab reports, site models and drafts can be released only as the client contract, any regulatory reporting duty and any litigation hold allow. The working rule: exclude PFAS investigation data from any outside use, including data licensing, unless counsel clears it in writing.
Key takeaways
- Holding PFAS files and controlling their disclosure are different questions, and the client contract usually decides the second.
- Reporting duties generally fall on the site owner or permittee, but some professional and program rules can reach the consultant.
- A litigation hold overrides retention schedules, system migrations and any plan to reuse the data.
- Removing the client's name rarely anonymizes a PFAS site, because location and results identify it.
- Exclude PFAS projects from any data license by default, and document the exclusion.
Who controls PFAS investigation data?#
The client usually controls disclosure of PFAS investigation data, even though the consultant collected the samples, manages the database and holds the files. Ownership of documents and control over disclosure are separate questions, and the contract usually answers both.
Standard engineering forms show the split. EJCDC E-500 language states that the engineer retains an ownership and property interest in its documents, including copyright and the right of reuse, yet the same projects typically carry confidentiality obligations that limit what the engineer may disclose. Many environmental master services agreements go further and define all site data and results as the client's confidential information.
| Record | Who usually controls disclosure | Why |
|---|---|---|
| Sampling results and lab reports | Client | Generated for the client's site and usually defined as confidential information |
| Field notes, chain-of-custody forms, photos | Client, with the consultant as custodian | They document the client's site and support the reported results |
| Conceptual site model, figures, interpretations | Client for disclosure, consultant for authorship | Consultant work product that describes the client's site |
| Data validation reports and database exports | Client | Derived directly from the client's results |
| Reports filed with a regulator | The agency's rules once filed | Submitted documents may become public records |
| Drafts and internal correspondence | Consultant, subject to confidentiality and any privilege | May be protected if prepared at counsel's direction |
Why PFAS files carry more disclosure risk than routine site data#
PFAS files carry more disclosure risk because they often connect to litigation, cost recovery, insurance claims, property transactions and community concern at the same time. A single result released without its context, reporting limit or validation qualifiers can be read very differently from what it means.
Federal and state PFAS requirements have also been changing, and results collected under one set of screening levels may be reinterpreted under another. That makes clients and their counsel cautious about any use of the data beyond the purpose it was collected for, even with names removed.
Preliminary results deserve particular care. Unvalidated data, draft figures and early interpretations are often revised as sampling continues, and a draft that leaves the firm can outlive the corrected version. Keep drafts inside the project team and release only validated deliverables the client has approved.
Contract clauses to check before any disclosure#
The contract clauses to check are those that define confidential information, ownership of data and permitted use, because together they decide what the consultant may do with the files. Read the master services agreement, the project task order and any access agreement signed with a neighboring property owner.
Where these documents conflict, the order-of-precedence clause usually decides which one controls. Note every clause that survives termination, because confidentiality duties for a PFAS site often outlast the project itself.
- Definition of confidential information, and whether it covers results, field data and drafts.
- Ownership of documents and data, and any license back to the consultant.
- Permitted use, including research, benchmarking or internal tools.
- Publicity and qualifications clauses that govern naming the client or the project.
- Notice requirements before responding to a subpoena or records request.
- Return or destruction obligations at the end of the engagement, and their survival.
- Access agreements with property owners whose wells or soils were sampled.
When reporting duties or professional rules can override confidentiality#
Reporting duties can override a confidentiality clause, but they usually belong to the site owner, operator or permittee rather than to the consultant. Permits, state cleanup programs and drinking water rules may require results to be submitted, and the client's counsel normally manages that process.
Some duties can reach the consultant directly. In some states, licensed site professionals carry their own notification obligations in defined situations, and engineering and geology licensing rules generally put public health and safety ahead of client confidentiality. A consultant who finds a condition that may require notice should involve its own counsel promptly.
| Trigger | Who usually acts | What to check |
|---|---|---|
| Permit or cleanup program reporting | Site owner or permittee | Program rules, deadlines and who signs submittals |
| Results affecting neighboring water supplies | Client and regulator, sometimes the consultant | State notification rules and professional duties |
| Subpoena or discovery request | Client's counsel, with the consultant as custodian | Contract notice clause and any privilege claims |
| Public records request for filed reports | The agency holding the filing | Which documents were submitted, and when |
| Property sale or lender inquiry | Client | Disclosure terms and any reliance letters |
Litigation holds and privilege#
A litigation hold on PFAS data overrides the firm's retention schedule, its system migrations and any plan to reuse the data. Once a client or its counsel issues a hold, the consultant should preserve the relevant databases, lab reports, emails and field records in their current form, including metadata.
Some PFAS investigations are commissioned through the client's outside counsel so the work supports legal advice. Those files may be claimed as privileged or as attorney work product, and sharing them outside the engagement could weaken that protection. Treat any file labeled privileged, and any project set up through counsel, as excluded until counsel says otherwise.
Illustrative: a request to reuse PFAS results#
Illustrative: a fictional environmental consulting firm manages groundwater investigations for several industrial clients, with results in EQuIS, lab EDDs on a project server and field forms captured in a mobile app. A university research group asks to use the firm's PFAS results, with client names removed, for a regional study.
The principal checks the master services agreements and finds that site data is defined as each client's confidential information. One site is also under a litigation hold issued by the client's counsel. The firm declines the request and refers the researchers to the clients, who can decide for themselves.
The request prompts a wider step. The firm tags every PFAS project by project number in EQuIS and in its project accounting system, so any future export, research request or licensing review excludes them automatically, and it files the tag list with its general counsel.
How SourceX treats PFAS projects in a data license#
SourceX treats PFAS investigation data as excluded by default. In the Rights step of the SourceX five-step transaction, projects with client-controlled results, litigation holds or privilege claims are carved out before any preparation begins, and the exclusion is recorded in the SourceX Evidence Packet alongside provenance, permitted use and release authorization.
What may remain in scope are records the firm controls outright, such as internal procedures, training material and project management records that reveal no site results, and only after the firm's own counsel reviews them. Nothing is shared during the initial assessment, and the supplier approves each step.
Frequently asked questions
Does removing the client's name make PFAS results safe to share?
Rarely. Coordinates, well identifiers, sampling dates, analyte patterns and nearby features can identify a site without a name, and many PFAS sites are already publicly known. The contract may also restrict derived uses of the data. Client permission, reviewed by counsel, is the safer basis for any reuse.
Can we describe PFAS experience in proposals?
Describing the type of work in general terms is common, but naming the client, the site or any results usually requires permission. Check the publicity and qualifications clauses in each agreement, and ask the client before using a project as a reference or a written case description.
What happens to PFAS data if the client sells the site or closes?
Rights and obligations may pass to a buyer of the site or to a successor entity, depending on the contract and the transaction documents. Keep the records under your retention policy and any hold, and ask counsel who now controls disclosure before responding to requests from new parties.
Do laboratories keep their own copies of PFAS results?
Yes. Laboratories typically keep raw data, reports and quality records under their own retention practices and accreditation requirements. Your subcontract with the lab and the client's agreement both affect who can request or release those copies, so check both before treating the lab as a source.
Should PFAS records be kept longer than other project files?
Often, given the long tail of litigation, cost recovery and regulatory change around PFAS. The right period depends on contracts, insurer requirements, state rules and any holds, so set it with counsel and record it in your retention schedule rather than deciding project by project.
Sources
- EJCDC E-500 Owner-Engineer agreement language (2014 edition excerpt) states that all Documents are instruments of service and the Engineer retains an ownership and property interest therein, including the copyright and the right of reuse at the Engineer's discretion, whether or not the Project is completed. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.