(a) This part establishes procedures to implement the Privacy Act of 1974 (5 U.S.C. 552a). It applies to records about individuals that are maintained, collected, used, or disclosed by the Food and Drug Administration and contained in Privacy Act Record Systems.

(b) This part does not:

(1) Apply to Food and Drug Administration record systems that are not Privacy Act Record Systems or make available to an individual records that may include references to him but that are not retrieved by his name or other personal identifier, whether or not contained in a Privacy Act Record System. part 20 of this chapter (the public information regulations) and other regulations referred to therein determine when records are made available in such cases.

(2) Make any records available to persons other than (i) individuals who are the subjects of the records, (ii) persons accompanying such individuals under § 21.43, (iii) persons provided records pursuant to individual consent under § 21.72, or (iv) persons acting on behalf of such individuals as legal guardians under § 21.75. Part 20 of this chapter (the public information regulations) and other regulations referred to therein determine when Food and Drug Administration records are disclosable to members of the public generally. Subpart G of this part limits the provisions of part 20 of this chapter with respect to disclosures of records about individuals from Privacy Act Record Systems to persons other than individuals who are the subjects of the records.

(3) Make available information compiled by the Food and Drug Administration in reasonable anticipation of court litigation or formal administrative proceedings. The availability of such information to any member of the public, including any subject individual or party to such litigation or proceeding shall be governed by applicable constitutional principles, rules of discovery, and part 20 of this chapter (the public information regulations).

(4) Apply to personnel records maintained by the Division of Human Resources Management, Food and Drug Administration, except as provided in § 21.32. Such records are subject to regulations of the Office of Personnel Management in 5 CFR parts 293, 294, and 297.

As used in this part:

(a) Individual means a natural living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. Individual does not include sole proprietorships, partnerships, or corporations engaged in the production or distribution of products regulated by the Food and Drug Administration or with which the Food and Drug Administration has business dealings. Any such business enterprise that is identified by the name of one or more individuals is not an individual within the meaning of this part. Employees of regulated business enterprises are considered individuals. Accordingly, physicians and other health professionals who are engaged in business as proprietors of establishments regulated by the Food and Drug Administration are not considered individuals; however, physicians and other health professionals who are engaged in clinical investigations, employed by regulated enterprises, or the subjects of records concerning their own health, e.g., exposure to excessive radiation, are considered individuals. Food and Drug Administration employees, consultants, and advisory committee members, State and local officials, and consumers are considered individuals.

(b) Records about individuals means items, collections, or groupings of information about individuals contained in Privacy Act Record Systems, including, but not limited to education, financial transactions, medical history, criminal history, or employment history, that contain names or personal identifiers.

(c) Privacy Act Record System means a system of records about individuals under the control of the Food and Drug Administration from which information is retrieved by individual names or other personal identifiers. The term includes such a system of records whether subject to a notice published by the Food and Drug Administration, the Department, or another agency. Where records are retrieved only by personal identifiers other than individual names, a system of records is not a Privacy Act Record System if the Food and Drug Administration cannot, by reference to information under its control, or by reference to records of contractors that are subject to this part under § 21.30, ascertain the identity of individuals who are the subjects of the records.

(d) Personal identifiers includes individual names, identifying numbers, symbols, or other identifying designations assigned to individuals. Personal identifiers does not include names, numbers, symbols, or other identifying designations that identify products, establishments, or actions.

(e) Personnel records means any personal information maintained in a Privacy Act Record System that is needed for personnel management programs or processes such as staffing, employee development, retirement, and grievances and appeals.

(f) Department means Department of Health and Human Services.

Information about individuals in Food and Drug Administration records shall be collected, maintained, used, and disseminated so as to protect the right to privacy of the individual to the fullest possible extent consistent with laws relating to disclosure of information to the general public, the law enforcement responsibilities of the agency, and administrative and program management needs.