§21.71. Disclosure of records in Privacy Act Record Systems; accounting required. — Inbound Citations

(d) Under § 21.71 of this chapter, a statement of the purposes to which the record requested is to be put, and a certification that the record will be so used, may be requested when:

(1) The requested record is contained in a Privacy Act Record System as defined in § 21.3(c) of this chapter;

(2) The requester is a person other than the individual who is the subject of the record that is so retrieved or a person acting on his behalf; and

(3) The disclosure is one that is discretionary; i.e., not required under this part.

(a) Systems of records that are required to be operated, or as a matter of practical necessity must be operated, by contractors to accomplish Food and Drug Administration functions, from which information is retrieved by individual names or other personal identifiers, may be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5 U.S.C. 552a(i) are applicable to such contractor, and any employee of such contractor, for disclosures prohibited in § 21.71 or for maintenance of a system of records without notice as required in § 21.20.

(a) The Food and Drug Administration shall make reasonable efforts to assure that a record about an individual in a Privacy Act Record System is accurate, relevant to a Food and Drug Administration purpose, timely, and complete before such record is disclosed under § 21.71.

(3) If an accounting was made under § 21.71(d) of a disclosure of the record under § 21.71(a), provide a copy of the record as amended, to all previous recipients of the record.

(b) In any subsequent disclosure under § 21.70 or § 21.71(a), provide a copy of the statement of disagreement and, if the Food and Drug Administration deems it appropriate, a concise statement of the agency's reasons for not making the amendment(s) requested. While the individual shall have access to any such statement, it shall not be subject to a request for amendment under § 21.50.

(c) If an accounting was made under § 21.71 (d) and (e) of the disclosure of the record under § 21.71(a), inform all previous recipients of the record about the amendment or provide to them the statement of disagreement and the agency statement, if any.

(3) If an accounting was made under § 21.71(d) of a disclosure of the record under § 21.71(a), provide a copy of the record as amended, to all previous recipients of the record.

(c) If an accounting was made under § 21.71(d) and (e) of a disclosure of the record under § 21.71(a), provide to all previous recipients of the record a copy of the statement of disagreement and the agency statement, if any.

(c) If an accounting was made under § 21.71 (d) and (e) of the disclosure of the record under § 21.71(a), inform all previous recipients of the record about the amendment or provide to them the statement of disagreement and the agency statement, if any.

(c) If an accounting was made under § 21.71(d) and (e) of a disclosure of the record under § 21.71(a), provide to all previous recipients of the record a copy of the statement of disagreement and the agency statement, if any.

(c) If an accounting was made under § 21.71 (d) and (e) of the disclosure of the record under § 21.71(a), inform all previous recipients of the record about the amendment or provide to them the statement of disagreement and the agency statement, if any.

(b) In each case the consent shall be in writing and shall specify the individual, organizational unit, or class of individuals or organizational units to whom the record may be disclosed, which record may be disclosed, and, if applicable, for what time period. A blanket consent to release all of an individual's records to unspecified individuals or organizational units will not be honored. Verification of the identity of the individual and, where applicable, of the person to whom the record is to be disclosed shall be made in accordance with § 21.44. Consent documents shall be retained for a period of at least 2 years. If such documents are used as a means of accounting for the disclosure, they shall be retained as provided in § 21.71(e)(2).

(1) Such records are exempt from 5 U.S.C. 552a(c)(3) and § 21.71(e)(4), requiring that an individual be provided with the accounting of disclosures of records about himself from a Privacy Act Record System.