§21.20. Procedures for notice of Food and Drug Administration Privacy Act Record Systems. — Inbound Citations

(a) Systems of records that are required to be operated, or as a matter of practical necessity must be operated, by contractors to accomplish Food and Drug Administration functions, from which information is retrieved by individual names or other personal identifiers, may be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5 U.S.C. 552a(i) are applicable to such contractor, and any employee of such contractor, for disclosures prohibited in § 21.71 or for maintenance of a system of records without notice as required in § 21.20.

(b) The Food and Drug Administration shall issue a notice, in accordance with paragraph (d) of this section and § 21.20(b), of any change in a Privacy Act Record System which:

(1) Increases the number or types of individuals about whom records are maintained;

(2) Expands the type or amount of information about individuals that is maintained;

(3) Increases the number of categories of agencies or other persons who may have access to those records;

(4) Alters the manner in which the records are organized so as to change the nature or scope of those records, such as the combining of two or more existing systems;

(5) Modifies the way in which the system operates or its location(s) in a manner that alters the process by which individuals can exercise their rights under this part, such as the ways in which they seek access or request amendment of a record; or

(6) Changes the equipment configuration on which the system is operated so as to create the potential for greater access, such as adding a telecommunications capability.

(3) Such records are exempt from 5 U.S.C. 552a(e)(4)(G) and (H) and § 21.20(b)(1) requiring inclusion in the notice for the system of information about agency procedures for notification, access, and contest.