21 CFR § 21.42 - Responses to requests.
(a) The FDA shall respond to an individual's request for notification as to whether a Privacy Act Record System contains records about him that are retrieved by his name or other personal identifier by sending a letter under this paragraph.
(1) If there are no records about the individual that are retrieved by his name or other personal identifier in the named Privacy Act Record System, or the requester is not an “individual” under § 21.3(a), the letter shall so state. Where appropriate, the letter shall indicate that the Food and Drug Administration's public information regulations in part 20 of this chapter prescribe general rules governing the availability of information to members of the public, and that a request may be made in accordance with part 20 of this chapter for records that are not retrieved by the requester's name or other personal identifier from a Privacy Act Record System.
(2) If there are records about the individual that are retrieved by his name or other personal identifier and the named Privacy Act Record System is not exempt from individual access and contest under § 21.61, or the system is exempt but access is allowed or required under § 21.65, the letter shall inform him that the records exist and shall either:
(i) Enclose a copy of the records under § 21.43(a)(1) or indicate that the records will be sent under separate cover, where there has been adequate verification of the identity of the individual under § 21.44 and the fees under § 21.45 do not exceed $25, or
(ii) Inform the individual of the procedures to obtain access to the records by mail or in person under § 21.43(a)(2), as well as the approximate dates by which the requested records can be provided (if the records are not then available), the locations at which access in person may be had, and the information needed, if any, to verify the identity of the individual under § 21.44.
(3) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, and the system is exempt from individual access and contest under § 21.61 and access is not allowed or required under § 21.65, the letter should inform him that the records are exempted from access and contest by § 21.61. The letter shall also inform him if the records sought are not available because they were compiled in reasonable anticipation of court litigation or formal administrative proceedings or are otherwise not available under § 21.41(b). Where appropriate, the letter shall also indicate whether the records are available under part 20 of this chapter (the public information regulations), and it may disclose the records in accordance with part 20.
(4) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, but a final determination has not yet been made with respect to disclosure of all of the records covered by the request, e.g., because it is necessary to consult another person or agency having an interest in the confidentiality of the records, the letter shall explain the circumstances and indicate when a final answer will be given.
(b) Except as provided in § 21.32, access to a record may only be denied by the Associate Commissioner for Public Affairs or his or her designate. If access to any record is denied wholly or in substantial part, the letter shall state the right of the individual to appeal to the Commissioner of Food and Drugs.
(c) If a request for a copy of the records will result in a fee of more than $25, the letter shall specify or estimate the fee involved. Where the individual has requested a copy of any records about him and copying the records would result in a fee of over $50, the Food and Drug Administration shall require advance deposit as well as payment of any amount not yet received as a result of any previous request by the individual for a record about himself, under this subpart or part 20 of this chapter (the public information regulations) before the records are made available. If the fee is less than $50, prepayment shall not be required unless payment has not yet been received for records disclosed as a result of a previous request by the individual for a record about himself under this subpart or part 20 of this chapter.