(a) Except as provided in § 21.70, a record about an individual that is contained in a Privacy Act Record System shall not be disclosed by any method of communication except under any of the following circumstances, which are subject to the limitations of paragraphs (b) and (c) of this section and to the accounting requirement of paragraph (d) of this section:

(1) To those officers and employees of the agency which maintains the record who have a need for the record in the perfomance of their duties;

(2) Required under section 552 of the Freedom of Information Act;

(3) For a routine use as described in the routine use section of each specific system notice;

(4) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the U.S. Code;

(5) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and that the record is to be transferred in a form that is not individually identifiable;

(6) To the National Archives and Records Administration of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or to the Archivist of the United States or his or her designee for evaluation to determine whether the record has such value;

(7) To another agency or to an instrumentality of any government jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought;

(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, upon such disclosure, notification is transmitted to the last known address of such individual;

(9) To either House of Congress or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee;

(10) To the Comptroller General, or any of his or her authorized representatives in the course of the performance of the duties of the General Accounting Office;

(11) Pursuant to the order of a court of competent jurisdiction; or

(12) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952(d)). (This “Special Disclosure” statement does not apply to any FDA system of records.)

(b) The Food and Drug Administration may in its discretion refuse to make a disclosure permitted under paragraph (a) of this section, if the disclosure would in the judgment of the agency, invade the privacy of the individual or be inconsistent with the purpose for which the information was collected.

(c) The Food and Drug Administration may require any person requesting a disclosure of a record under paragraph (a) of this section to provide:

(1) Information about the purposes to which the disclosed record is to be put, and

(2) A written statement certifying that the record will be used only for the stated purposes and will not be further disclosed without the written permission of the Food and Drug Administration.

Under 5 U.S.C. 552a(i)(3), any person who knowingly or willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000. Such person may also be subject to prosecution under the False Reports to the Government Act, 18 U.S.C. 1001.

(d) An accounting shall be made, in accordance with paragraph (e) of this section, of any disclosure under paragraph (a) of this section of a record that is not a disclosure under § 21.70.

(e) Where an accounting is required under paragraph (d) of this section, the Food and Drug Administration shall:

(1) Record the name and address of the person or agency to whom the disclosure is made and the date, nature, and purpose of the disclosure. The accounting shall not be considered a Privacy Act Record System.

(2) Retain the accounting for 5 years or for the life of the record, whichever is longer, following the disclosure.

(3) Notify those recipients listed in the accounting of amendments or disputes concerning the records previously disclosed to them pursuant to § 21.51(d)(3), § 21.53(c), or § 21.54(c).

(4) Except when the record is exempt from individual access and contest under § 21.61 or to the extent that the accounting describes a transfer for a law enforcement purpose pursuant to paragraph (a)(7) of this section, make the accounting available to the individual to whom the record pertains, in accordance with procedures of subpart D of this part.

(f) A single accounting may be used to cover disclosure(s) that consist of a continuing dialogue between two agencies over a prolonged period, such as discussion of an enforcement action between the Food and Drug Administration and the Department of Justice. In such cases, a general notation may be made that, as of a certain date, contract was initiated, to continue until resolution of the matter.

[42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985; 54 FR 9038, Mar. 3, 1989]