Protection of privacy (21 CFR 21.1-21.75)

281 Food and Drug Administration, HHS Pt. 21 (b) The following records are avail able at the Division of Freedom of In formation Public Reading Room: (1) A guide for making requests for records or information from the Food and Drug Administration; (2) Administrative staff manuals and instructions to staff that affect a mem ber of the public; (3) Food and Drug Administration records which have been released to any person in response to a Freedom of Information request and which the agency has determined have become or are likely to become the subject of sub sequent requests for substantially the same records; (4) Indexes of records maintained in the Division of Freedom of Information Public Reading Room; and (5) Such other records and informa tion as the agency determines are ap propriate for inclusion in the public reading room. (c) The following records are avail able in the Division of Dockets Man agement’s Public Reading Room: (1) Final opinions, including concur ring and dissenting opinions, as well as orders, made in the adjudication of cases; (2) Statements of policy and interpre tation adopted by the agency that are still in force and not published in the FEDERAL REGISTER; (3) Indexes of records maintained in the Division of Dockets Management’s Public Reading Room; and (4) Such other records and informa tion as the agency determines are ap propriate for inclusion in the public reading room. (d) The agency will make reading room records created by the Food and Drug Administration on or after No vember 1, 1996, available electronically through the Internet at the agency’s World Wide Web site which can be found at http://www.fda.gov. At the agency’s discretion, the Food and Drug Administration may also make avail able through the Internet such addi tional records and information it be lieves will be useful to the public. [68 FR 25287, May 12, 2003; 68 FR 65392, Nov. 20, 2003, as amended at 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014] PART 21—PROTECTION OF PRIVACY Subpart A—General Provisions Sec. 21.1 Scope. 21.3 Definitions. 21.10 Policy concerning records about indi viduals. Subpart B—Food and Drug Administration Privacy Act Record Systems 21.20 Procedures for notice of Food and Drug Administration Privacy Act Record Systems. 21.21 Changes in systems and new systems. Subpart C—Requirements for Specific Categories of Records 21.30 Records of contractors. 21.31 Records stored by the National Ar chives and Records Administration. 21.32 Personnel records. 21.33 Medical records. Subpart D—Procedures for Notification of and Access to Records in Privacy Act Record Systems 21.40 Procedures for submitting requests for notification and access. 21.41 Processing of requests. 21.42 Responses to requests. 21.43 Access to requested records. 21.44 Verification of identity. 21.45 Fees. Subpart E—Procedures for Requests for Amendment of Records 21.50 Procedures for submitting requests for amendment of records. 21.51 Responses to requests for amendment of records. 21.52 Administrative appeals of refusals to amend records. 21.53 Notation and disclosure of disputed records. 21.54 Amended or disputed records received from other agencies. Subpart F—Exemptions 21.60 Policy. 21.61 Exempt systems. 21.65 Access to records in exempt systems. Subpart G—Disclosure of Records in Pri vacy Act Record Systems to Persons Other Than the Subject Individual 21.70 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting required. VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00291 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 282 21 CFR Ch. I (4–1–16 Edition) § 21.1 21.71 Disclosure of records in Privacy Act Record Systems; accounting required. 21.72 Individual consent to disclosure of records to other persons. 21.73 Accuracy, completeness, timeliness, and relevance of records disclosed from Privacy Act Record Systems. 21.74 Providing notice that a record is dis puted. 21.75 Rights of legal guardians. AUTHORITY: 21 U.S.C. 371; 5 U.S.C. 552, 552a. SOURCE: 42 FR 15626, Mar. 22, 1977, unless otherwise noted. Subpart A—General Provisions § 21.1 Scope. (a) This part establishes procedures to implement the Privacy Act of 1974 (5 U.S.C. 552a). It applies to records about individuals that are maintained, col lected, used, or disclosed by the Food and Drug Administration and con tained in Privacy Act Record Systems. (b) This part does not: (1) Apply to Food and Drug Adminis tration record systems that are not Privacy Act Record Systems or make available to an individual records that may include references to him but that are not retrieved by his name or other personal identifier, whether or not con tained in a Privacy Act Record Sys tem. part 20 of this chapter (the public information regulations) and other reg ulations referred to therein determine when records are made available in such cases. (2) Make any records available to persons other than (i) individuals who are the subjects of the records, (ii) per sons accompanying such individuals under § 21.43, (iii) persons provided records pursuant to individual consent under § 21.72, or (iv) persons acting on behalf of such individuals as legal guardians under § 21.75. Part 20 of this chapter (the public information regula tions) and other regulations referred to therein determine when Food and Drug Administration records are disclosable to members of the public generally. Subpart G of this part limits the provi sions of part 20 of this chapter with re spect to disclosures of records about in dividuals from Privacy Act Record Sys tems to persons other than individuals who are the subjects of the records. (3) Make available information com piled by the Food and Drug Adminis tration in reasonable anticipation of court litigation or formal administra tive proceedings. The availability of such information to any member of the public, including any subject indi vidual or party to such litigation or proceeding shall be governed by appli cable constitutional principles, rules of discovery, and part 20 of this chapter (the public information regulations). (4) Apply to personnel records main tained by the Division of Human Re sources Management, Food and Drug Administration, except as provided in § 21.32. Such records are subject to reg ulations of the Office of Personnel Management in 5 CFR parts 293, 294, and 297. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985] § 21.3 Definitions. As used in this part: (a) Individual means a natural living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. Individual does not include sole proprietorships, partnerships, or corporations engaged in the production or distribution of products regulated by the Food and Drug Administration or with which the Food and Drug Administration has business dealings. Any such business enterprise that is identified by the name of one or more individuals is not an individual within the meaning of this part. Employees of regulated busi ness enterprises are considered individ uals. Accordingly, physicians and other health professionals who are engaged in business as proprietors of establish ments regulated by the Food and Drug Administration are not considered in dividuals; however, physicians and other health professionals who are en gaged in clinical investigations, em ployed by regulated enterprises, or the subjects of records concerning their own health, e.g., exposure to excessive radiation, are considered individuals. Food and Drug Administration employ ees, consultants, and advisory com mittee members, State and local offi cials, and consumers are considered in dividuals. VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00292 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 283 Food and Drug Administration, HHS § 21.20 (b) Records about individuals means items, collections, or groupings of in formation about individuals contained in Privacy Act Record Systems, includ ing, but not limited to education, fi nancial transactions, medical history, criminal history, or employment his tory, that contain names or personal identifiers. (c) Privacy Act Record System means a system of records about individuals under the control of the Food and Drug Administration from which informa tion is retrieved by individual names or other personal identifiers. The term in cludes such a system of records wheth er subject to a notice published by the Food and Drug Administration, the De partment, or another agency. Where records are retrieved only by personal identifiers other than individual names, a system of records is not a Pri vacy Act Record System if the Food and Drug Administration cannot, by reference to information under its con trol, or by reference to records of con tractors that are subject to this part under § 21.30, ascertain the identity of individuals who are the subjects of the records. (d) Personal identifiers includes indi vidual names, identifying numbers, symbols, or other identifying designa tions assigned to individuals. Personal identifiers does not include names, num bers, symbols, or other identifying des ignations that identify products, estab lishments, or actions. (e) Personnel records means any per sonal information maintained in a Pri vacy Act Record System that is needed for personnel management programs or processes such as staffing, employee development, retirement, and griev ances and appeals. (f) Department means Department of Health and Human Services. § 21.10 Policy concerning records about individuals. Information about individuals in Food and Drug Administration records shall be collected, maintained, used, and disseminated so as to protect the right to privacy of the individual to the fullest possible extent consistent with laws relating to disclosure of in formation to the general public, the law enforcement responsibilities of the agency, and administrative and pro gram management needs. Subpart B—Food and Drug Ad ministration Privacy Act Record Systems § 21.20 Procedures for notice of Food and Drug Administration Privacy Act Record Systems. (a) The Food and Drug Administra tion shall issue in the FEDERAL REG ISTER on or before August 30 of each year a notice concerning each Privacy Act Record System as defined in § 21.3(c) that is not covered by a notice published by the Department, the Of fice of Personnel Management, or an other agency. (b) The notice shall include the fol lowing information: (1) The name and location(s) of the system. (2) The categories of individuals about whom records are maintained in the system. (3) The categories of records main tained in the system. (4) The authority for the system. (5) Each routine use of the records contained in the system (i.e., use out side the Department of Health and Human Services that is compatible with the purpose for which the records were collected and described in the no tice) including the categories of users and the purposes of such use. (6) The policies and practices of the Food and Drug Administration regard ing storage, retrievability (i.e., how the records are indexed and what intra agency uses are made of the records), access controls, retention, and disposal of the records in that system. (7) The title and business address of the official who is responsible for the system of records. (8) The notification procedure, i.e., the address of the FDA Privacy Act Co ordinator, whom any individual can contact to seek notification whether the system contains a record about him/her. (9) The record access and contest pro cedures, which shall be the same as the notification procedure except that a reference shall be included to any ex emption from access and contest. VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00293 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 284 21 CFR Ch. I (4–1–16 Edition) § 21.21 (10) Where any records in the system are subject to an exemption under § 21.61, a reference to this exemption. (11) The categories of sources of records in the system. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981] § 21.21 Changes in systems and new systems. (a) The Food and Drug Administra tion shall notify the designated De partment official, the Office of Man agement and Budget (Information Sys tems Division), and the Congress of proposals to change or establish Pri vacy Act Record Systems in accord ance with procedures of the Depart ment and the Office of Management and Budget. (b) The Food and Drug Administra tion shall issue a notice, in accordance with paragraph (d) of this section and § 21.20(b), of any change in a Privacy Act Record System which: (1) Increases the number or types of individuals about whom records are maintained; (2) Expands the type or amount of in formation about individuals that is maintained; (3) Increases the number of cat egories of agencies or other persons who may have access to those records; (4) Alters the manner in which the records are organized so as to change the nature or scope of those records, such as the combining of two or more existing systems; (5) Modifies the way in which the sys tem operates or its location(s) in a manner that alters the process by which individuals can exercise their rights under this part, such as the ways in which they seek access or request amendment of a record; or (6) Changes the equipment configura tion on which the system is operated so as to create the potential for greater access, such as adding a telecommuni cations capability. (c) The Food and Drug Administra tion shall issue a notice of its intention to establish new Privacy Act Record Systems in accordance with paragraph (d) of this section and § 21.20(b). (d) Notices under paragraphs (b) and (c) of this section shall be published in the FEDERAL REGISTER for comment at least 30 days prior to implementation of the proposed changes or establish ment of new systems. Interested per sons shall have the opportunity to sub mit written data, views, or arguments on such proposed new uses or systems. Subpart C—Requirements for Specific Categories of Records § 21.30 Records of contractors. (a) Systems of records that are re quired to be operated, or as a matter of practical necessity must be operated, by contractors to accomplish Food and Drug Administration functions, from which information is retrieved by indi vidual names or other personal identi fiers, may be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5 U.S.C. 552a(i) are applicable to such con tractor, and any employee of such con tractor, for disclosures prohibited in § 21.71 or for maintenance of a system of records without notice as required in § 21.20. (b) A contract is considered to ac complish a Food and Drug Administra tion function if the proposal or activity it supports is principally operated on behalf of and is under the direct man agement of the Food and Drug Admin istration. Systems of records from which information is retrieved by indi vidual names or other personal identi fiers and that are operated under con tracts to accomplish Food and Drug Administration functions are deemed to be maintained by the agency and shall be subject to the procedures and requirements of this part. (c) A contract is not considered to ac complish a Food and Drug Administra tion function if the program or activity it supports is not principally operated on behalf of, or is not under the direct management of, the Food and Drug Ad ministration. For example, this part does not apply to systems of records: (1) Operated under contract with the Food and Drug Administration by State or local government agencies, or organizations representing such agen cies, when such agencies or organiza tions are also performing State or local government functions. VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00294 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 285 Food and Drug Administration, HHS § 21.32 (2) Operated by contractors with the Food and Drug Administration by indi viduals or organizations whose primary function is delivery of health services, such as hospitals, physicians, phar macists, and other health profes sionals, and that report information concerning products, e.g., injuries or product defects, to the Food and Drug Administration. Before such contrac tors submit information to the Food and Drug Administration, the names and other personal identifiers of pa tients or research subjects in any med ical or similar report, test, study, or other research project shall be deleted, unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made. (3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and services to the Food and Drug Administration. (4) Operated under grants. (d) The requirements of this part shall apply when a contractor who op erates a system of records not subject to this part reports to the Food and Drug Administration information that is a system of records about individuals from which personal information is re trieved by names or other personal identifiers. Where the information would be a new Privacy Act Record System, or a change in an existing Pri vacy Act Record System of a type de scribed in § 21.21, the Food and Drug Administration shall comply with the requirements of § 21.21. (e) The Food and Drug Administra tion will review all contracts before award to determine whether operation of a system from which information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or as a matter of practical ne cessity. If such operation will be re quired, the solicitation and contract shall include the following clause, or a clause of similar effect: Whenever the contractor or any of his em ployees is required by this contract to oper ate a system of records from which informa tion is retrieved by individual names or other personal identifiers in order to accom plish a Food and Drug Administration func tion, the contractor and every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with the Privacy Act of 1974 (5 U.S.C. 552a), regu lations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to Food and Drug Administration em ployees who work with such systems of records. The contractor and his employees are subject to the criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act. § 21.31 Records stored by the National Archives and Records Administra tion. (a) Food and Drug Administration records that are stored, processed, and serviced by the National Archives and Records Administration in accordance with 44 U.S.C. 3103 shall be considered to be maintained by the Food and Drug Administration. The National Archives and Records Administration shall not disclose the record except to author ized Food and Drug Administration employees. (b) Each Food and Drug Administra tion record pertaining to an identifi able individual that was transferred to the National Archives of the United States as a record determined by the National Archives to have sufficient historical or other value to warrant its continued preservation shall be consid ered to be maintained by the National Archives and shall not be subject to the provisions of this part. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985] § 21.32 Personnel records. (a) Present and former Food and Drug Administration employees desir ing access to personnel records about themselves should consult system no tices applicable to the agency’s per sonnel records that are published by the Office of Personnel Management and the Department as well as any no tice issued by the Food and Drug Ad ministration. (b)(1) The procedures of the Office of Personnel Management at 5 CFR parts 293, 294, and 297 rather than the proce dures in § 21.33 and subparts D through F of this part, govern systems of per sonnel records about Food and Drug VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00295 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 286 21 CFR Ch. I (4–1–16 Edition) § 21.32 Administration employees that are subject to notice published by the Of fice of Personnel Management, i.e., systems that: (i) The Office of Personnel Manage ment maintains. (ii) Are maintained by the Division of Human Resources Management, Food and Drug Administration. (iii) Are maintained by Department Regional Offices, concerning field em ployees. (2) The Office of Personnel Manage ment’s procedures may, if necessary, be supplemented in the Food and Drug Administration Staff Manual Guide. Current Food and Drug Administration employees should mail or deliver writ ten requests under the Privacy Act for access to personnel records described in this paragraph to the Office of Per sonnel Management in accordance with 5 CFR 297.106, the Director, Division of Human Resources Management HR– BETHPL RM7114, HFA–705, 7700 Wis consin Ave., 7th & 8th floors, Bethesda, MD 20814, or the personnel officer in the servicing HHS Regional Personnel Office. An employee may consult with or direct his or her request to the FDA Privacy Act Coordinator (the Privacy Act Coordinator is part of the Freedom of Information Staff, the address for which is located on the Agency Web site at http://www.fda.gov). Requests for access to personnel records of former employees that are located in Federal Records Centers should be directed to the Office of Personnel Management. Requests under the Privacy Act for amendment of personnel records should be directed to these same officials who are responsible for access to personnel records under this paragraph. (3) With respect to records subject to paragraph (b)(1) of this section: (i) Refusal to grant access to a record, or refusal to amend a record upon request of an employee, shall only be made by the Associate Commis sioner for Management and Operations or his or her designate; and (ii) Appeals of refusals under para graph (b)(3)(i) of this section may be made to the Office of Personnel Man agement in accordance with 5 CFR 297.108(g)(3) and 297.113(b). (c) Any other Privacy Act Record Systems that contain personnel records, or records that otherwise con cern agency employees, that are main tained by offices of the Food and Drug Administration rather than the Divi sion of Human Resources Management but which are not subject to the De partment’s notice for personnel records in operating offices are subject to this part, except that refusals under this part to grant access to or amend records about present or former em ployees shall be made by the Associate Commissioner for Management and Op erations rather than the Associate Commissioner for Public Affairs. (d) The following procedures shall govern requests under the Privacy Act for personnel records that are main tained by the operating offices of the Food and Drug Administration in which employees work: (1) An employee shall upon request be told whether records about him are maintained. An employee shall be given access to records about himself that are subject to this paragraph in response to an oral or written request and through informal procedures, rath er than the procedures specified in §§ 21.40 through 21.43. (2) Employee identity may be verified, if necessary, by an FDA ID card rather than in accordance with § 21.44. (3) Generally no fee shall be charged for records requested under this para graph. However, in cases where the records requested are voluminous, a fee may be charged in accordance with § 21.45. (4) Records that are subject to this paragraph shall be available for access to an individual, except to the extent that access is refused by the Associate Commissioner for Management and Op erations or his or her designate on the grounds that the record is subject to an exemption under § 21.61 or 5 CFR 297.111. (5) Requests under the Privacy Act for amendment of records subject to this paragraph should be directed to the Director, Division of Human Re sources Management (HFA–400). Such requests shall be reviewed in accord ance with subpart E of this part. Re fusal to amend a record subject to this paragraph (d)(5) shall only be made by VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00296 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 287 Food and Drug Administration, HHS § 21.40 the Associate Commissioner for Man agement and Operations or his or her designate. (6) Appeals of refusals under para graph (d) (4) or (5) of this section may be made to the Commissioner of Food and Drugs, except where the Associate Commissioner for Management and Op erations or his or her designate indi cates with his or her refusal that the appeal should be made to the Office of Personnel Management. (7) Disclosures of records subject to this paragraph are subject to subpart G of this part. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014] § 21.33 Medical records. (a) In general, an individual is enti tled to have access to any medical records about himself in Privacy Act Record Systems maintained by the Food and Drug Administration. (b) The Food and Drug Administra tion may apply the following special procedures in disclosing medical records to an individual: (1) The agency may review the records to determine whether disclo sure of the record to the individual who is the subject of the records might have an adverse effect on him. If it is deter mined that disclosure is not likely to have an adverse effect on the indi vidual, the record shall be disclosed to him. If it is determined that disclosure is very likely to have an adverse effect on the individual, he may be requested to designate, in writing, a representa tive to whom the record shall be dis closed. Such representative may be a physician, other health professional, or other responsible person who would be willing to review the record and discuss it with the individual. (2) The availability of the record may be subject to any procedures for disclo sure to an individual of medical records about himself under part 20 of this chapter, in addition to or in lieu of the procedures in paragraph (b)(1), that are not inconsistent with § 21.41(f). Subpart D—Procedures for Notifi cation of and Access to Records in Privacy Act Record Systems § 21.40 Procedures for submitting re quests for notification and access. (a) An individual may request that the Food and Drug Administration no tify him whether a Privacy Act Record System contains records about him that are retrieved by reference to his name or other personal identifier. An individual may at the same time, or after receiving notification that such a record about him exists, requests that he be given access to the record. (b) An individual desiring notifica tion or access to records shall mail or deliver a request for records in any Food and Drug Administration Privacy Act Records System to the FDA Pri vacy Act Coordinator (address is lo cated on the agency web site at http:// www.gov.fda). (c) Requests shall be in writing and shall name the Privacy Act Record System or Systems concerning which the individual requests notification of whether there are records about him that are retrieved by reference to his name or other personal identifier. To help assure a prompt response, an indi vidual should indicate that he is mak ing a ‘‘Privacy Act Request’’ on the en velope and in a prominent manner in the letter. (d) An individual who merely wishes to be notified whether a Privacy Act Record System contains a record about him ordinarily need not provide any verification of his identity other than his name. The mere fact that the Food and Drug Administration has a record about an individual in any of its Pri vacy Act Records Systems would not be likely to constitute a clearly unwar ranted invasion of personal privacy. Where mere disclosure of the fact that a record about the individual exists would be a clearly unwarranted inva sion of personal privacy, further verification of the identity of the indi vidual shall be required. (e) An individual who requests that he be given access to a copy of records about himself, if any exist, should indi cate whether he prefers (1) to have cop ies of any such records mailed to him VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00297 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 288 21 CFR Ch. I (4–1–16 Edition) § 21.41 in accordance with § 21.43(a)(1), which may involve a fee under § 21.45, includ ing information to verify his identity under § 21.44 or (2) to use the procedures for access in person under § 21.43(a)(2). (f) A request for notification and ac cess may be submitted under this sub part concerning any Privacy Act Record System that is exempt under § 21.61, as indicated in the notice for the system. An individual seeking access to records under § 21.65(b)(2) to inves tigatory records compiled for law en forcement purposes other than crimi nal law enforcement purposes should submit a description of the right, ben efit, or privilege that he believes he was denied as the result of the Food and Drug Administration’s mainte nance of the records. Where the system is exempt under § 21.61, and access to the requested records is not granted under § 21.65, the request shall be han dled under the provisions of part 20 of this chapter (the public information regulations). [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014] § 21.41 Processing of requests. (a) An individual or his guardian under § 21.75 shall not be required to show any justification or need to ob tain notification under § 21.42 or access to a record under § 21.43. (b) The Food and Drug Administra tion will determine whether a request by an individual for records about him self is appropriately treated as a re quest under this subpart, or under the provision of part 20 of this chapter (the public information regulations), or both. Where appropriate, the Food and Drug Administration will consult with the individual concerning the appro priate treatment of the request. (c) The FDA Privacy Act Coordinator in the Division of Freedom of Informa tion (address is located on the agency web site at http://www.gov.fda) shall be responsible for the handling of Privacy Act requests received by the Food and Drug Administration. Requests mailed or delivered to any other office shall be promptly redirected to the FDA Pri vacy Act Coordinator. Where this pro cedure would unduly delay the agen cy’s response, however, the agency em ployee who received the request should consult with the FDA Privacy Act Co ordinator and obtain advice as to whether the employee can respond to the request directly. (d) Upon receipt of a request by the FDA Privacy Act Coordinator, a record shall promptly be made that a request has been received and the date. (e) A letter in accordance with § 21.42 responding to the request for notifica tion shall issue as promptly as possible after receipt of the request by the Food and Drug Administration. Upon deter mination by the Division of Freedom of Information (address is located on the agency web site at http://www.gov.fda) that a request for access to records is appropriately treated as a request under part 20 of this chapter rather than part 21, or under both parts, the time limitations prescribed in § 21.41 shall apply. In any case, access to available records shall be provided as promptly as possible. (f) Except as provided in § 21.32, an in dividual’s access to records about him/ herself that are retrieved by his/her name or other personal identifiers and contained in any Privacy Act Record System may only be denied by the As sociate Commissioner for Public Af fairs or his or her designate. An indi vidual shall not be denied access to any record that is otherwise available to him/her under this part except on the grounds that it is exempt under § 21.65(a)(2), that it was compiled in rea sonable anticipation of court litigation of formal administrative proceedings, or to the extent that it is exempt or prohibited from disclosure because it includes a trade secret or commercial or financial information that is privi leged or confidential information the disclosure of which would constitute a clearly unwarranted invasion of per sonal privacy of another individual. (g) The FDA Privacy Act Coordinator shall ensure that records are main tained of the number, status, and dis position of requests under this subpart, including the number of requests for records exempt from access under this subpart and other information required for purposes of the annual report to Congress under the Privacy Act. These temporary administrative management VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00298 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 289 Food and Drug Administration, HHS § 21.42 records shall not be considered to be Privacy Act Record Systems. All records required to be kept under this paragraph shall only include request ing individuals’ names or personal identifiers for so long as any request for notification, access, or amendment is pending. The identity of individuals making request under this subpart shall be regarded as confidential and shall not be disclosed under part 20 of this chapter (the public information regulations) to any other person or agency except as is necessary for the processing of requests under this sub part. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014] § 21.42 Responses to requests. (a) The FDA shall respond to an indi vidual’s request for notification as to whether a Privacy Act Record System contains records about him that are re trieved by his name or other personal identifier by sending a letter under this paragraph. (1) If there are no records about the individual that are retrieved by his name or other personal identifier in the named Privacy Act Record System, or the requester is not an ‘‘individual’’ under § 21.3(a), the letter shall so state. Where appropriate, the letter shall in dicate that the Food and Drug Admin istration’s public information regula tions in part 20 of this chapter pre scribe general rules governing the availability of information to members of the public, and that a request may be made in accordance with part 20 of this chapter for records that are not re trieved by the requester’s name or other personal identifier from a Pri vacy Act Record System. (2) If there are records about the indi vidual that are retrieved by his name or other personal identifier and the named Privacy Act Record System is not exempt from individual access and contest under § 21.61, or the system is exempt but access is allowed or re quired under § 21.65, the letter shall in form him that the records exist and shall either: (i) Enclose a copy of the records under § 21.43(a)(1) or indicate that the records will be sent under separate cover, where there has been adequate verification of the identity of the indi vidual under § 21.44 and the fees under § 21.45 do not exceed $25, or (ii) Inform the individual of the pro cedures to obtain access to the records by mail or in person under § 21.43(a)(2), as well as the approximate dates by which the requested records can be pro vided (if the records are not then avail able), the locations at which access in person may be had, and the informa tion needed, if any, to verify the iden tity of the individual under § 21.44. (3) If the named Privacy Act Record System contains records about the in dividual that are retrieved by his name or other personal identifier, and the system is exempt from individual ac cess and contest under § 21.61 and ac cess is not allowed or required under § 21.65, the letter should inform him that the records are exempted from ac cess and contest by § 21.61. The letter shall also inform him if the records sought are not available because they were compiled in reasonable anticipa tion of court litigation or formal ad ministrative proceedings or are other wise not available under § 21.41(b). Where appropriate, the letter shall also indicate whether the records are avail able under part 20 of this chapter (the public information regulations), and it may disclose the records in accordance with part 20. (4) If the named Privacy Act Record System contains records about the in dividual that are retrieved by his name or other personal identifier, but a final determination has not yet been made with respect to disclosure of all of the records covered by the request, e.g., be cause it is necessary to consult another person or agency having an interest in the confidentiality of the records, the letter shall explain the circumstances and indicate when a final answer will be given. (b) Except as provided in § 21.32, ac cess to a record may only be denied by the Associate Commissioner for Public Affairs or his or her designate. If access to any record is denied wholly or in substantial part, the letter shall state the right of the individual to appeal to the Commissioner of Food and Drugs. (c) If a request for a copy of the records will result in a fee of more than VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00299 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 290 21 CFR Ch. I (4–1–16 Edition) § 21.43 $25, the letter shall specify or estimate the fee involved. Where the individual has requested a copy of any records about him and copying the records would result in a fee of over $50, the Food and Drug Administration shall require advance deposit as well as pay ment of any amount not yet received as a result of any previous request by the individual for a record about him self, under this subpart or part 20 of this chapter (the public information regulations) before the records are made available. If the fee is less than $50, prepayment shall not be required unless payment has not yet been re ceived for records disclosed as a result of a previous request by the individual for a record about himself under this subpart or part 20 of this chapter. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981] § 21.43 Access to requested records. (a) Access may be granted to re quested records by: (1) Mailing a copy of the records to the requesting individual, or (2) Permitting the requesting indi vidual to review the records in person between 9 a.m. and 4 p.m. at the office of the FDA Privacy Act Coordinator, at the Division of Freedom of Informa tion Public Reading Room (address is located on the agency’s web site at http://www.fda.gov), or at any Food and Drug Administration field office, listed in part 5, subpart M of this chapter, or at another location or time upon which the Food and Drug Administration and the individual agree. Arrangement for such review can be made by consulta tion between the FDA Privacy Act Co ordinator and the individual. An indi vidual seeking to review records in per son shall generally be permitted access to the file copy, except that where the records include nondisclosable infor mation, a copy shall be made of that portion of the records, with the nondisclosable information blocked out. Where the individual is not given a copy of the record to retain, no charge shall be made for the cost of copying a record to make it available to an individual who reviews a record in person under this paragraph. (b) An individual may request that a record be disclosed to or discussed in the presence of another individual, such as an attorney. The individual may be required to furnish a written statement authorizing the disclosure or discussion in such other individual’s presence. (c) The Food and Drug Administra tion will make every reasonable effort to assure that records made available under this section can be understood by the individual, such as by providing an oral or written explanation of the records. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 69 FR 17290, Apr. 2, 2004; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014] § 21.44 Verification of identity. (a) An individual seeking access to records in a Privacy Act Record Sys tem may be required to comply with reasonable requirements to enable the Food and Drug Administration to de termine his identity. The identifica tion required shall be suitable consid ering the nature of the records sought. No identification shall be required to receive access to information that is required to be disclosed to any member of the public under part 20 of this chap ter (the public information regula tions). (b) An individual who appears in per son for access to records about himself shall be required to provide at least one document to identify himself, e.g., driver’s license, passport, or alien or voter registration card to verify his identity. If an individual does not have any such document or requests access to records about himself without ap pearing in person under circumstances in which his identity cannot be verified from the request itself, he shall be re quired to certify in writing that he is the individual he claims to be and that he understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal of fense subject to a $5,000 fine. (c) In making requests under § 21.75, a parent of a minor child or legal guard ian of an incompetent individual may be required to verify his relationship to the minor child or the incompetent in dividual, in addition to verifying his own identity, by providing a copy of VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00300 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 291 Food and Drug Administration, HHS § 21.50 the minor’s birth certificate, a court order, or other evidence of guardian ship. (d) Where an individual seeks access to particularly sensitive records, such as medical records, the individual may be required to provide additional infor mation beyond that specified in para graph (b) or (c) of this section, such as the individual’s years of attendance at a particular educational institution, rank attained in the uniformed serv ices, date or place of birth, names of parents, an occupation, or the specific times the individual received medical treatment. § 21.45 Fees. (a) Where applicable, fees for copying records shall be charged in accordance with the schedule set forth in this sec tion. Fees may only be charged where an individual has requested that a copy be made of a record to which he is granted access. No fee may be charged for making a search of a Privacy Act Record System whether the search is manual, mechanical, or electronic. Where a copy of the record must be made to provide access to the record, e.g., computer printout where no screen reading is available, the copy shall be made available to the indi vidual without cost. Where a medical record is made available to a represent ative designated by the individual under § 21.33, no fee will be charged. (b) The fee schedule is as follows: (1) Copying of records susceptible to photocopying—$.10 per page. (2) Copying of records not susceptible to photocopying, e.g., punch cards or magnetic tapes—at actual cost to the determined on a case-by-case basis. (3) No charge will be made if the total amount of copying for an indi vidual does not exceed $25. (c) When a fee is to be assessed, the individual shall be notified prior to the processing of the copies, and be given an opportunity to amend his request. Payment shall be made by check or money order made payable to the ‘‘Food and Drug Administration,’’ and shall be sent to the Accounting Branch (HFA–120), Food and Drug Administra tion, 5600 Fishers Lane, Rockville, MD 20857. Advance deposit shall be required where the total amount exceeds $50. [42 FR 15626, Mar. 22, 1977, as amended at 54 FR 9038, Mar. 3, 1989] Subpart E—Procedures for Re quests for Amendment of Records § 21.50 Procedures for submitting re quests for amendment of records. (a) An individual who received access to a record about himself under sub part D of this part may request that the record be amended if he believes that the record or an item of informa tion is not accurate, relevant to a Food and Drug Administration purpose, timely, or complete. (b) Amendments under this subpart shall not violate existing statute, regu lation, or administrative procedure. (1) This subpart does not permit al teration of evidence presented in the course of judicial proceedings or Food and Drug Administration adjudicatory or rule making proceedings or collat eral attack upon that which has al ready been the subject of any such pro ceedings. (2) If the accuracy, relevancy, timeli ness, or completeness of the records may be contested in any other pending or imminent agency proceeding, the Food and Drug Administration may refer the individual to the other pro ceeding as the appropriate means to obtain relief. If the accuracy, rel evance, timeliness, or completeness of a record is, or has been, an issue in an other agency proceeding, the request under this section shall be disposed of in accordance with the decision in the other proceeding, absent unusual cir cumstances. (c) Requests to amend records shall be submitted, in writing, to the FDA Privacy Act Coordinator in accordance with § 21.40(b). Such requests shall in clude information sufficient to enable the Food and Drug Administration to locate the record, a brief description of the items of information requested to be amended, and the reasons why the record should be amended together with any appropriate documentation or arguments in support of the requested amendment. An edited copy of the VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00301 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 292 21 CFR Ch. I (4–1–16 Edition) § 21.51 record showing the described amend ment may be included. Verification of identity should be provided in accord ance with § 21.44. (d) Written acknowledgement of the receipt of a request to amend a record shall be provided within 10 working days to the individual who requested the amendment. Such acknowledge ment may request any additional infor mation needed to verify identity or make a determination. No acknowl edgement need be made if the request can be reviewed, processed, and the in dividual notified of the agency’s agree ment with the request or refusal within the 10-day period. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981] § 21.51 Responses to requests for amendment of records. (a) The Food and Drug Administra tion shall take one of the following ac tions on a request for amendment of records as promptly as possible: (1) Amend any portion of the record which the agency has determined, based upon a preponderance of the evi dence, is not accurate, relevant to a Food and Drug Administration pur pose, timely, or complete, and, in ac cordance with paragraph (d)(3) of this section, inform the individual and pre vious recipients of the record that has been amended of the amendment. (2) Inform the individual of its re fusal to amend any portion of the record in the manner requested, the reason for the refusal, and the oppor tunity for administrative appeal to the Commissioner of Food and Drugs. Ex cept as provided in § 21.32, such refusal may only be issued by the Associate Commissioner for Public Affairs or his or her designate. (3) Where another agency was the source of and has control of the record, refer the request to that agency. (b) The agency may, for good cause, extend the period for taking action an additional 30 working days if notice is provided to the individual explaining the circumstances of the delay. (c) The officials charged with review ing a record to determine how to re spond to a request to amend it, shall assess its accuracy, relevance to a Food and Drug Administration pur pose, timeliness, or completeness. The determination shall be made in the light of the purpose for which the records or system is used, the agency’s need for the record, and the possible adverse consequences to the individual from the record if not amended. When ever the Food and Drug Administration receives a request for deletion of a record, or portions of a record, it shall consider anew whether the contested information in the record is relevant and necessary to a Food and Drug Ad ministration purpose. (d) If the Food and Drug Administra tion agrees with an individual’s re quest, it shall take the following ac tions: (1) So inform the individual in writ ing. (2) In accordance with statute, regu lation, or procedure, amend the record to make it accurate, relevant to a Food and Drug Administration purpose, timely, or complete, making note of the date and fact of the amendment. (3) If an accounting was made under § 21.71(d) of a disclosure of the record under § 21.71(a), provide a copy of the record as amended, to all previous re cipients of the record. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981] § 21.52 Administrative appeals of re fusals to amend records. (a) If an individual disagrees with a refusal under § 21.51(a)(2) to amend a record, he or she may appeal that re fusal to the Commissioner of Food and Drugs,(see the address on the agency’s web site at http://www.fda.gov). (b) If, upon appeal, the Commissioner upholds the refusal to amend the record as requested, he shall inform the individual: (1) Of his decision and the reasons for it. (2) Of the individual’s right to file with the Food and Drug Administra tion a concise statement of the individ ual’s reasons for disagreeing with the agency’s decision not to amend the record as requested. (3) That the statement of disagree ment will be made available to all per sons listed in an accounting as having previously received the record and any VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00302 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 293 Food and Drug Administration, HHS § 21.61 person to whom the record is subse quently disclosed together with, in the discretion of the Food and Drug Ad ministration, a brief statement sum marizing its reasons for refusing to amend the record. Any individual who includes false information in the state ment of disagreement filed with the Food and Drug Administration may be subject to penalties under 18 U.S.C. 1001, the False Reports to the Govern ment Act. (4) That the individual has a right to seek judicial review of the refusal to amend the record. (c) If the Commissioner on adminis trative appeal or a court on judicial re view determines that the record should be amended in accordance with the in dividual’s request, the Food and Drug Administration shall proceed in ac cordance with § 21.51(d). (d) A final determination on the indi vidual’s administrative appeal of the initial refusal to amend the record shall be concluded within 30 working days of the request for such review under paragraph (a) of this section, un less the Commissioner extends such pe riod for good cause and informs the in dividual in writing of the reasons for the delay and of the approximate date on which a decision of the appeal can be expected. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985; 79 FR 68115, Nov. 14, 2014] § 21.53 Notation and disclosure of dis puted records. When an individual has filed a state ment of disagreement under § 21.52(b)(2), the Food and Drug Admin istration shall: (a) Mark any portion of the record that is disputed to assure that the record will clearly show that portion is disputed whenever the record is dis closed. (b) In any subsequent disclosure under § 21.70 or § 21.71(a), provide a copy of the statement of disagreement and, if the Food and Drug Administration deems it appropriate, a concise state ment of the agency’s reasons for not making the amendment(s) requested. While the individual shall have access to any such statement, it shall not be subject to a request for amendment under § 21.50. (c) If an accounting was made under § 21.71(d) and (e) of a disclosure of the record under § 21.71(a), provide to all previous recipients of the record a copy of the statement of disagreement and the agency statement, if any. § 21.54 Amended or disputed records received from other agencies. Whenever the Food and Drug Admin istration is notified that a record that it received from another agency was amended or is the subject of a state ment of disagreement, the Food and Drug Administration shall: (a) Discard the record, or clearly note the amendment or the fact of disagree ment in its copy of the record, and (b) Refer persons who subsequently request the record to the agency that provided it. (c) If an accounting was made under § 21.71 (d) and (e) of the disclosure of the record under § 21.71(a), inform all previous recipients of the record about the amendment or provide to them the statement of disagreement and the agency statement, if any. Subpart F—Exemptions § 21.60 Policy. It is the policy of the Food and Drug Administration that record systems should be exempted from the Privacy Act only to the extent essential to the performance of law enforcement func tions under the laws that are adminis tered and enforced by the Food and Drug Administration or that govern the agency. § 21.61 Exempt systems. (a) Investigatory records compiled for law enforcement purposes, includ ing criminal law enforcement purposes, in the Food and Drug Administration Privacy Act Record Systems listed in paragraph (b) of this section are ex empt from the following provisions of the Privacy Act (5 U.S.C. 552a) and of this part: (1) Such records are exempt from 5 U.S.C. 552a(c)(3) and § 21.71(e)(4), requir ing that an individual be provided with the accounting of disclosures of records VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00303 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 294 21 CFR Ch. I (4–1–16 Edition) § 21.65 about himself from a Privacy Act Record System. (2) Except where access is required under 5 U.S.C. 552a(k)(2) and § 21.65(a)(2), (such records are exempt from 5 U.S.C. 552a(d)(1) through (4) and (f)) and §§ 21.40 through 21.54, requiring procedures for an individual to be given notification of and access to records about himself in a Privacy Act Record System and to be allowed to challenge the accuracy, relevance, timeliness, and completeness of such records. (3) Such records are exempt from 5 U.S.C. 552a(e)(4)(G) and (H) and § 21.20(b)(1) requiring inclusion in the notice for the system of information about agency procedures for notifica tion, access, and contest. (4) Such records are exempt from 5 U.S.C. 552a(e)(3) requiring that individ uals asked to supply information be provided a form outlining the author ity for the request, the purposes for which the information will be used, the routine uses in the notice for the Pri vacy Act Record System, and the con sequences to the individual of not pro viding the information, but only with respect to records compiled by the Food and Drug Administration in a criminal law enforcement investiga tion where the conduct of the inves tigation would be prejudiced by such procedures. (b) Records in the following Food and Drug Administration Privacy Act Record Systems that concern individ uals who are subject to Food and Drug Administration enforcement action and consist of investigatory records compiled for law enforcement purposes, including criminal law enforcement purposes, are exempt under 5 U.S.C. 552a(j)(2) and (k)(2) from the provisions enumerated in paragraph (a) of this section: (1) Bio-research Monitoring Informa tion System—HHS/FDA/09–10–0010. (2) Regulated Industry Employee En forcement Records—HHS/FDA/ACMO/ 09–10–002. (3) Employee Conduct Investigative Records—HHS/FDA/ACMO/09–10–0013. (c) The system described in para graph (b)(3) of this section includes in vestigatory records compiled solely for the purpose of determining suitability, eligibility, or qualification for Federal civilian employment, military service, Federal contracts, and access to classi fied information. These records are ex empt from disclosure under 5 U.S.C. 552a(k)(5) to the extent that the disclo sure would reveal the identity of a source who furnished information to the Government under a promise of confidentiality, which must be an ex press promise if the information was furnished after September 27, 1975. Any individual who is refused access to a record that would reveal a confidential source shall be advised in a general way that the record includes informa tion that would reveal a confidential source. (d) Records in the following Food and Drug Administration Privacy Act Records Systems are exempt under 5 U.S.C. 552a(k)(2) and (k)(5) from the provisions enumerated in paragraph (a)(1) through paragraph (a)(3) of this section: FDA Records Related to Re search Misconduct Proceedings, HHS/ FDA/OC, 09–10–0020. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985; 78 FR 39186, July 1, 2013] § 21.65 Access to records in exempt systems. (a) Where a Privacy Act Record Sys tem is exempt and the requested records are unavailable under § 21.61, an individual may nevertheless make a re quest under § 21.40 for notification con cerning whether any records about him exist and request access to such records where they are retrieved by his name or other personal identifier. (b) An individual making a request under paragraph (a) of this section; (1) May be given access to the records where available under part 20 of this chapter (the public information regula tions) or the Commissioner may, in his discretion, entertain a request under any or all of the provisions of §§ 21.40 through 21.54; and (2) Shall be given access upon request if the records requested are subject to 5 U.S.C. 552a(k)(2) and not to 5 U.S.C. 552a(j)(2) (i.e., because they consist of investigatory material compiled for law enforcement purposes other than criminal law enforcement purposes) and maintenance of the records re sulted in denial to the individual of VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00304 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 295 Food and Drug Administration, HHS § 21.71 any right, benefit, or privilege to which he would otherwise be entitled by Fed eral law, or for which he would other wise be eligible. An individual given access to a record under this paragraph (b)(2) is not entitled to seek amend ment under subpart E of this part. The FDA may refuse to disclose a record that would reveal the identity of a source who furnished information to the Government under a promise of confidentiality, which must be an ex press promise if the information was furnished on or after September 27, 1975. Any individual refused access to a record that would reveal a confidential source shall be advised in a general way that the record contains informa tion that would reveal a confidential source. (c) The Commissioner shall not make available any record that is prohibited from public disclosure under § 20.82(b) of this chapter. (d) Discretionary disclosure of a record pursuant to paragraph (b)(1) of this section shall not set a precedent for discretionary disclosure of a simi lar or related record and shall not obli gate the Commissioner to exercise his discretion to disclose any other record in a system that is exempt under § 21.61. Subpart G—Disclosure of Records in Privacy Act Record Systems to Persons Other Than the Subject Individual § 21.70 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting re quired. (a) A record about an individual which is contained in a Privacy Act Record System may be disclosed: (1) To the individual who is the sub ject of the record, or his legal guardian under § 21.75; (2) To a third party pursuant to a written request by, or within a written consent of, the individual to whom the record pertains, or his legal guardian under § 21.75; (3) To any person: (i) Where the names and other identi fying information are first deleted, and under circumstances in which the re cipient is unlikely to know the iden tity of the subject of the record; (ii) Where disclosure is required by part 20 of this chapter (the public infor mation regulations); or (4) Within the Department of Health and Human Services to officers and em ployees who have a need for the record in the performance of their duties in connection with the laws administered and enforced by the Food and Drug Ad ministration or that govern the agen cy. For purposes of this section, offi cers or employees of the Department shall include the following categories of individuals, who shall thereafter be subject to the same restrictions with respect to disclosure as any Food and Drug Administration employee: Food and Drug Administration consultants and advisory committees, State and local government employees for use only in their work with the Food and Drug Administration, and contractors and their employees to the extent that the records of such contractors are sub ject to the requirements of this part under § 21.30. (b) No accounting is required for any disclosure or use under paragraph (a) of this section. § 21.71 Disclosure of records in Pri vacy Act Record Systems; account ing required. (a) Except as provided in § 21.70, a record about an individual that is con tained in a Privacy Act Record System shall not be disclosed by any method of communication except under any of the following circumstances, which are subject to the limitations of para graphs (b) and (c) of this section and to the accounting requirement of para graph (d) of this section: (1) To those officers and employees of the agency which maintains the record who have a need for the record in the perfomance of their duties; (2) Required under section 552 of the Freedom of Information Act; (3) For a routine use as described in the routine use section of each specific system notice; (4) To the Bureau of Census for pur poses of planning or carrying out a cen sus or survey or related activity pursu ant to the provisions of title 13 of the U.S. Code; VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00305 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 296 21 CFR Ch. I (4–1–16 Edition) § 21.71 (5) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and that the record is to be transferred in a form that is not individually identifiable; (6) To the National Archives and Records Administration of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or to the Archivist of the United States or his or her designee for evaluation to determine whether the record has such value; (7) To another agency or to an instru mentality of any government jurisdic tion within or under the control of the United States for a civil or criminal law enforcement activity if the activ ity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion de sired and the law enforcement activity for which the record is sought; (8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, upon such disclosure, notification is transmitted to the last known address of such individual; (9) To either House of Congress or, to the extent of matter within its juris diction, any committee or sub committee thereof, any joint com mittee of Congress or subcommittee of any such joint committee; (10) To the Comptroller General, or any of his or her authorized representa tives in the course of the performance of the duties of the General Accounting Office; (11) Pursuant to the order of a court of competent jurisdiction; or (12) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952(d)). (This ‘‘Special Disclo sure’’ statement does not apply to any FDA system of records.) (b) The Food and Drug Administra tion may in its discretion refuse to make a disclosure permitted under paragraph (a) of this section, if the dis closure would in the judgment of the agency, invade the privacy of the indi vidual or be inconsistent with the pur pose for which the information was col lected. (c) The Food and Drug Administra tion may require any person requesting a disclosure of a record under para graph (a) of this section to provide: (1) Information about the purposes to which the disclosed record is to be put, and (2) A written statement certifying that the record will be used only for the stated purposes and will not be fur ther disclosed without the written per mission of the Food and Drug Adminis tration. Under 5 U.S.C. 552a(i)(3), any person who knowingly or willfully requests or obtains any record concerning an indi vidual from an agency under false pre tenses shall be guilty of a misdemeanor and fined not more than $5,000. Such person may also be subject to prosecu tion under the False Reports to the Government Act, 18 U.S.C. 1001. (d) An accounting shall be made, in accordance with paragraph (e) of this section, of any disclosure under para graph (a) of this section of a record that is not a disclosure under § 21.70. (e) Where an accounting is required under paragraph (d) of this section, the Food and Drug Administration shall: (1) Record the name and address of the person or agency to whom the dis closure is made and the date, nature, and purpose of the disclosure. The ac counting shall not be considered a Pri vacy Act Record System. (2) Retain the accounting for 5 years or for the life of the record, whichever is longer, following the disclosure. (3) Notify those recipients listed in the accounting of amendments or dis putes concerning the records pre viously disclosed to them pursuant to § 21.51(d)(3), § 21.53(c), or § 21.54(c). (4) Except when the record is exempt from individual access and contest under § 21.61 or to the extent that the accounting describes a transfer for a law enforcement purpose pursuant to paragraph (a)(7) of this section, make the accounting available to the indi vidual to whom the record pertains, in accordance with procedures of subpart D of this part. (f) A single accounting may be used to cover disclosure(s) that consist of a VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00306 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B 297 Food and Drug Administration, HHS Pt. 25 continuing dialogue between two agen cies over a prolonged period, such as discussion of an enforcement action be tween the Food and Drug Administra tion and the Department of Justice. In such cases, a general notation may be made that, as of a certain date, con tract was initiated, to continue until resolution of the matter. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985; 54 FR 9038, Mar. 3, 1989] § 21.72 Individual consent to disclo sure of records to other persons. (a) Individuals may consent to disclo sure of records about themselves to other persons in several ways, for ex ample: (1) An individual may give consent at the time that the information is col lected for disclosure for specific pur poses or to specific persons. (2) An individual may give consent for disclosure of his records to a spe cific person. (3) An individual may request the Food and Drug Administration to tran scribe a specific record for submission to another person. (b) In each case the consent shall be in writing and shall specify the indi vidual, organizational unit, or class of individuals or organizational units to whom the record may be disclosed, which record may be disclosed, and, if applicable, for what time period. A blanket consent to release all of an in dividual’s records to unspecified indi viduals or organizational units will not be honored. Verification of the identity of the individual and, where applicable, of the person to whom the record is to be disclosed shall be made in accord ance with § 21.44. Consent documents shall be retained for a period of at least 2 years. If such documents are used as a means of accounting for the disclo sure, they shall be retained as provided in § 21.71(e)(2). § 21.73 Accuracy, completeness, timeli ness, and relevance of records dis closed from Privacy Act Record Systems. (a) The Food and Drug Administra tion shall make reasonable efforts to assure that a record about an indi vidual in a Privacy Act Record System is accurate, relevant to a Food and Drug Administration purpose, timely, and complete before such record is dis closed under § 21.71. (b) Paragraph (a) of this section shall not apply to disclosures that are re quired under part 20 of this chapter (the public information regulations) or made to other Federal Government de partments and agencies. Where appro priate, the letter disclosing the infor mation shall indicate that the Food and Drug Administration has not re viewed the record to assure that it is accurate, relevant, timely, and com plete. § 21.74 Providing notice that a record is disputed. Whenever an individual has filed a statement of disagreement with the Food and Drug Administration con cerning a refusal to amend a record under § 21.51(a)(2) or with another agen cy that provides the record to the Food and Drug Administration, the Food and Drug Administration shall in any sub sequent disclosure under this subpart provide a copy of the statement of dis agreement and a concise statement by the agency, if one has been prepared, of the reasons for not making the amend ment(s) requested. § 21.75 Rights of legal guardians. For the purposes of this part, the par ent of any individual who is a minor or the legal guardian of any individual who has been declared to be incom petent due to physical or mental inca pacity or age by a court of competent jurisdiction may act on behalf of the individual. PART 25—ENVIRONMENTAL IMPACT CONSIDERATIONS Subpart A—General Provisions Sec. 25.1 Purpose. 25.5 Terminology. 25.10 Policies and NEPA planning. Subpart B—Agency Actions Requiring Environmental Consideration 25.15 General procedures. 25.16 Public health and safety emergencies. 25.20 Actions requiring preparation of an environmental assessment. VerDate Sep<11>2014 14:18 Apr 18, 2016 Jkt 238070 PO 00000 Frm 00307 Fmt 8010 Sfmt 8010 Q:\21\21V1.TXT 31lp o w e ll o n D S K 5 4 D X V N 1 O F R w ith $ $ JO B