21 C.F.R. Subpart G—Disclosure of Records in Privacy Act Record Systems to Persons Other Than the Subject Individual
Title 21 - Food and Drugs
(a) A record about an individual which is contained in a Privacy Act Record System may be disclosed: (1) To the individual who is the subject of the record, or his legal guardian under §21.75; (2) To a third party pursuant to a written request by, or within a written consent of, the individual to whom the record pertains, or his legal guardian under §21.75; (3) To any person: (i) Where the names and other identifying information are first deleted, and under circumstances in which the recipient is unlikely to know the identity of the subject of the record; (ii) Where disclosure is required by part 20 of this chapter (the public information regulations); or (4) Within the Department of Health and Human Services to officers and employees who have a need for the record in the performance of their duties in connection with the laws administered and enforced by the Food and Drug Administration or that govern the agency. For purposes of this section, officers or employees of the Department shall include the following categories of individuals, who shall thereafter be subject to the same restrictions with respect to disclosure as any Food and Drug Administration employee: Food and Drug Administration consultants and advisory committees, State and local government employees for use only in their work with the Food and Drug Administration, and contractors and their employees to the extent that the records of such contractors are subject to the requirements of this part under §21.30. (b) No accounting is required for any disclosure or use under paragraph (a) of this section. (a) Except as provided in §21.70, a record about an individual that is contained in a Privacy Act Record System shall not be disclosed by any method of communication except under any of the following circumstances, which are subject to the limitations of paragraphs (b) and (c) of this section and to the accounting requirement of paragraph (d) of this section: (1) To those officers and employees of the agency which maintains the record who have a need for the record in the perfomance of their duties; (2) Required under section 552 of the Freedom of Information Act; (3) For a routine use as described in the routine use section of each specific system notice; (4) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the U.S. Code; (5) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and that the record is to be transferred in a form that is not individually identifiable; (6) To the National Archives and Records Administration of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or to the Archivist of the United States or his or her designee for evaluation to determine whether the record has such value; (7) To another agency or to an instrumentality of any government jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought; (8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, upon such disclosure, notification is transmitted to the last known address of such individual; (9) To either House of Congress or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (10) To the Comptroller General, or any of his or her authorized representatives in the course of the performance of the duties of the General Accounting Office; (11) Pursuant to the order of a court of competent jurisdiction; or (12) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952(d)). (This “Special Disclosure” statement does not apply to any FDA system of records.) (b) The Food and Drug Administration may in its discretion refuse to make a disclosure permitted under paragraph (a) of this section, if the disclosure would in the judgment of the agency, invade the privacy of the individual or be inconsistent with the purpose for which the information was collected. (c) The Food and Drug Administration may require any person requesting a disclosure of a record under paragraph (a) of this section to provide: (1) Information about the purposes to which the disclosed record is to be put, and (2) A written statement certifying that the record will be used only for the stated purposes and will not be further disclosed without the written permission of the Food and Drug Administration. Under 5 U.S.C. 552a(i)(3), any person who knowingly or willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000. Such person may also be subject to prosecution under the False Reports to the Government Act, 18 U.S.C. 1001. (d) An accounting shall be made, in accordance with paragraph (e) of this section, of any disclosure under paragraph (a) of this section of a record that is not a disclosure under §21.70. (e) Where an accounting is required under paragraph (d) of this section, the Food and Drug Administration shall: (1) Record the name and address of the person or agency to whom the disclosure is made and the date, nature, and purpose of the disclosure. The accounting shall not be considered a Privacy Act Record System. (2) Retain the accounting for 5 years or for the life of the record, whichever is longer, following the disclosure. (3) Notify those recipients listed in the accounting of amendments or disputes concerning the records previously disclosed to them pursuant to §21.51(d)(3), §21.53(c), or §21.54(c). (4) Except when the record is exempt from individual access and contest under §21.61 or to the extent that the accounting describes a transfer for a law enforcement purpose pursuant to paragraph (a)(7) of this section, make the accounting available to the individual to whom the record pertains, in accordance with procedures of subpart D of this part. (f) A single accounting may be used to cover disclosure(s) that consist of a continuing dialogue between two agencies over a prolonged period, such as discussion of an enforcement action between the Food and Drug Administration and the Department of Justice. In such cases, a general notation may be made that, as of a certain date, contract was initiated, to continue until resolution of the matter. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985; 54 FR 9038, Mar. 3, 1989] (a) Individuals may consent to disclosure of records about themselves to other persons in several ways, for example: (1) An individual may give consent at the time that the information is collected for disclosure for specific purposes or to specific persons. (2) An individual may give consent for disclosure of his records to a specific person. (3) An individual may request the Food and Drug Administration to transcribe a specific record for submission to another person. (b) In each case the consent shall be in writing and shall specify the individual, organizational unit, or class of individuals or organizational units to whom the record may be disclosed, which record may be disclosed, and, if applicable, for what time period. A blanket consent to release all of an individual's records to unspecified individuals or organizational units will not be honored. Verification of the identity of the individual and, where applicable, of the person to whom the record is to be disclosed shall be made in accordance with §21.44. Consent documents shall be retained for a period of at least 2 years. If such documents are used as a means of accounting for the disclosure, they shall be retained as provided in §21.71(e)(2). (a) The Food and Drug Administration shall make reasonable efforts to assure that a record about an individual in a Privacy Act Record System is accurate, relevant to a Food and Drug Administration purpose, timely, and complete before such record is disclosed under §21.71. (b) Paragraph (a) of this section shall not apply to disclosures that are required under part 20 of this chapter (the public information regulations) or made to other Federal Government departments and agencies. Where appropriate, the letter disclosing the information shall indicate that the Food and Drug Administration has not reviewed the record to assure that it is accurate, relevant, timely, and complete. Whenever an individual has filed a statement of disagreement with the Food and Drug Administration concerning a refusal to amend a record under §21.51(a)(2) or with another agency that provides the record to the Food and Drug Administration, the Food and Drug Administration shall in any subsequent disclosure under this subpart provide a copy of the statement of disagreement and a concise statement by the agency, if one has been prepared, of the reasons for not making the amendment(s) requested. For the purposes of this part, the parent of any individual who is a minor or the legal guardian of any individual who has been declared to be incompetent due to physical or mental incapacity or age by a court of competent jurisdiction may act on behalf of the individual.
Title 21: Food and Drugs
PART 21—PROTECTION OF PRIVACY
Subpart G—Disclosure of Records in Privacy Act Record Systems to Persons Other Than the Subject Individual
§ 21.70 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting required.
§ 21.71 Disclosure of records in Privacy Act Record Systems; accounting required.
§ 21.72 Individual consent to disclosure of records to other persons.
§ 21.73 Accuracy, completeness, timeliness, and relevance of records disclosed from Privacy Act Record Systems.
§ 21.74 Providing notice that a record is disputed.
§ 21.75 Rights of legal guardians.
