§ 21.20 Procedures for notice of Food and Drug Administration Privacy Act Record Systems.

(a) The Food and Drug Administration shall issue in the Federal Register on or before August 30 of each year a notice concerning each Privacy Act Record System as defined in § 21.3(c) that is not covered by a notice published by the Department, the Office of Personnel Management, or another agency. (b) The notice shall include the following information: (1) The name and location(s) of the system. (2) The categories of individuals about whom records are maintained in the system. (3) The categories of records maintained in the system. (4) The authority for the system. (5) Each routine use of the records contained in the system (i.e., use outside the Department of Health and Human Services that is compatible with the purpose for which the records were collected and described in the notice) including the categories of users and the purposes of such use. (6) The policies and practices of the Food and Drug Administration regarding storage, retrievability (i.e., how the records are indexed and what intra-agency uses are made of the records), access controls, retention, and disposal of the records in that system. (7) The title and business address of the official who is responsible for the system of records. (8) The notification procedure, i.e., the address of the FDA Privacy Act Coordinator, whom any individual can contact to seek notification whether the system contains a record about him/her. (9) The record access and contest procedures, which shall be the same as the notification procedure except that a reference shall be included to any exemption from access and contest. (10) Where any records in the system are subject to an exemption under § 21.61, a reference to this exemption. (11) The categories of sources of records in the system.