(a) An individual seeking access to records in a Privacy Act Record System may be required to comply with reasonable requirements to enable the Food and Drug Administration to determine his identity. The identification required shall be suitable considering the nature of the records sought. No identification shall be required to receive access to information that is required to be disclosed to any member of the public under part 20 of this chapter (the public information regulations).

(b) An individual who appears in person for access to records about himself shall be required to provide at least one document to identify himself, e.g., driver's license, passport, or alien or voter registration card to verify his identity. If an individual does not have any such document or requests access to records about himself without appearing in person under circumstances in which his identity cannot be verified from the request itself, he shall be required to certify in writing that he is the individual he claims to be and that he understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.

(c) In making requests under § 21.75, a parent of a minor child or legal guardian of an incompetent individual may be required to verify his relationship to the minor child or the incompetent individual, in addition to verifying his own identity, by providing a copy of the minor's birth certificate, a court order, or other evidence of guardianship.

(d) Where an individual seeks access to particularly sensitive records, such as medical records, the individual may be required to provide additional information beyond that specified in paragraph (b) or (c) of this section, such as the individual's years of attendance at a particular educational institution, rank attained in the uniformed services, date or place of birth, names of parents, an occupation, or the specific times the individual received medical treatment.