(a) The Food and Drug Administration shall issue in the Federal Register on or before August 30 of each year a notice concerning each Privacy Act Record System as defined in § 21.3(c) that is not covered by a notice published by the Department, the Office of Personnel Management, or another agency.

(b) The notice shall include the following information:

(1) The name and location(s) of the system.

(2) The categories of individuals about whom records are maintained in the system.

(3) The categories of records maintained in the system.

(4) The authority for the system.

(5) Each routine use of the records contained in the system (i.e., use outside the Department of Health and Human Services that is compatible with the purpose for which the records were collected and described in the notice) including the categories of users and the purposes of such use.

(6) The policies and practices of the Food and Drug Administration regarding storage, retrievability (i.e., how the records are indexed and what intra-agency uses are made of the records), access controls, retention, and disposal of the records in that system.

(7) The title and business address of the official who is responsible for the system of records.

(8) The notification procedure, i.e., the address of the FDA Privacy Act Coordinator, whom any individual can contact to seek notification whether the system contains a record about him/her.

(9) The record access and contest procedures, which shall be the same as the notification procedure except that a reference shall be included to any exemption from access and contest.

(10) Where any records in the system are subject to an exemption under § 21.61, a reference to this exemption.

(11) The categories of sources of records in the system.

(a) The Food and Drug Administration shall notify the designated Department official, the Office of Management and Budget (Information Systems Division), and the Congress of proposals to change or establish Privacy Act Record Systems in accordance with procedures of the Department and the Office of Management and Budget.

(b) The Food and Drug Administration shall issue a notice, in accordance with paragraph (d) of this section and § 21.20(b), of any change in a Privacy Act Record System which:

(1) Increases the number or types of individuals about whom records are maintained;

(2) Expands the type or amount of information about individuals that is maintained;

(3) Increases the number of categories of agencies or other persons who may have access to those records;

(4) Alters the manner in which the records are organized so as to change the nature or scope of those records, such as the combining of two or more existing systems;

(5) Modifies the way in which the system operates or its location(s) in a manner that alters the process by which individuals can exercise their rights under this part, such as the ways in which they seek access or request amendment of a record; or

(6) Changes the equipment configuration on which the system is operated so as to create the potential for greater access, such as adding a telecommunications capability.

(c) The Food and Drug Administration shall issue a notice of its intention to establish new Privacy Act Record Systems in accordance with paragraph (d) of this section and § 21.20(b).

(d) Notices under paragraphs (b) and (c) of this section shall be published in the Federal Register for comment at least 30 days prior to implementation of the proposed changes or establishment of new systems. Interested persons shall have the opportunity to submit written data, views, or arguments on such proposed new uses or systems.