(a) A record about an individual which is contained in a Privacy Act Record System may be disclosed:

(1) To the individual who is the subject of the record, or his legal guardian under § 21.75;

(2) To a third party pursuant to a written request by, or within a written consent of, the individual to whom the record pertains, or his legal guardian under § 21.75;

(3) To any person:

(i) Where the names and other identifying information are first deleted, and under circumstances in which the recipient is unlikely to know the identity of the subject of the record;

(ii) Where disclosure is required by part 20 of this chapter (the public information regulations); or

(4) Within the Department of Health and Human Services to officers and employees who have a need for the record in the performance of their duties in connection with the laws administered and enforced by the Food and Drug Administration or that govern the agency. For purposes of this section, officers or employees of the Department shall include the following categories of individuals, who shall thereafter be subject to the same restrictions with respect to disclosure as any Food and Drug Administration employee: Food and Drug Administration consultants and advisory committees, State and local government employees for use only in their work with the Food and Drug Administration, and contractors and their employees to the extent that the records of such contractors are subject to the requirements of this part under § 21.30.

(b) No accounting is required for any disclosure or use under paragraph (a) of this section.