(a) An individual or his guardian under §21.75 shall not be required to show any justification or need to obtain notification under §21.42 or access to a record under §21.43.

(b) The Food and Drug Administration will determine whether a request by an individual for records about himself is appropriately treated as a request under this subpart, or under the provision of part 20 of this chapter (the public information regulations), or both. Where appropriate, the Food and Drug Administration will consult with the individual concerning the appropriate treatment of the request.

(c) The FDA Privacy Act Coordinator in the Division of Freedom of Information (address is located on the agency web site at http://www.gov.fda) shall be responsible for the handling of Privacy Act requests received by the Food and Drug Administration. Requests mailed or delivered to any other office shall be promptly redirected to the FDA Privacy Act Coordinator. Where this procedure would unduly delay the agency's response, however, the agency employee who received the request should consult with the FDA Privacy Act Coordinator and obtain advice as to whether the employee can respond to the request directly.

(d) Upon receipt of a request by the FDA Privacy Act Coordinator, a record shall promptly be made that a request has been received and the date.

(e) A letter in accordance with §21.42 responding to the request for notification shall issue as promptly as possible after receipt of the request by the Food and Drug Administration. Upon determination by the Division of Freedom of Information (address is located on the agency web site at http://www.gov.fda) that a request for access to records is appropriately treated as a request under part 20 of this chapter rather than part 21, or under both parts, the time limitations prescribed in §21.41 shall apply. In any case, access to available records shall be provided as promptly as possible.

(f) Except as provided in §21.32, an individual's access to records about him/herself that are retrieved by his/her name or other personal identifiers and contained in any Privacy Act Record System may only be denied by the Associate Commissioner for Public Affairs or his or her designate. An individual shall not be denied access to any record that is otherwise available to him/her under this part except on the grounds that it is exempt under §21.65(a)(2), that it was compiled in reasonable anticipation of court litigation of formal administrative proceedings, or to the extent that it is exempt or prohibited from disclosure because it includes a trade secret or commercial or financial information that is privileged or confidential information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy of another individual.

(g) The FDA Privacy Act Coordinator shall ensure that records are maintained of the number, status, and disposition of requests under this subpart, including the number of requests for records exempt from access under this subpart and other information required for purposes of the annual report to Congress under the Privacy Act. These temporary administrative management records shall not be considered to be Privacy Act Record Systems. All records required to be kept under this paragraph shall only include requesting individuals' names or personal identifiers for so long as any request for notification, access, or amendment is pending. The identity of individuals making request under this subpart shall be regarded as confidential and shall not be disclosed under part 20 of this chapter (the public information regulations) to any other person or agency except as is necessary for the processing of requests under this subpart.

[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014]