Who else gets to see what a company told the FDA

Withheld from the public is not the same as sealed

The agency publishes a list of things it may keep out of a public file. Sitting right after that list is a second set of rules about when those protections stop applying.

The opening section is blunt about the effect. "a record that is ordinarily exempt from public disclosure" becomes available to the extent it falls within one of these limits.

Some of those limits release a document to everyone. Others release it to one named recipient and nobody else.

The regulation draws that line explicitly. Where a record goes out under the previously-disclosed rule, the discretionary rule or a court order, the whole public may then ask for it.

Where it goes only to a special government employee, another federal agency, a court proceeding, Congress, a state official, a foreign official or a contractor, that public-access rule is not triggered.

So a document can travel a long way and still not be public. That distinction runs through everything below.

The recipient inherits the duty

The most important sentence in this area is short and easy to skip.

Disclosing an exempt record to government employees and special government employees "shall subject those persons to the same restrictions with respect to the disclosure of such records as any Food and Drug Administration employee."

That is the design of the whole scheme. Access moves, and the confidentiality obligation moves with it.

The same idea reappears for consultants, advisory committee members and commissioned state and local officials. Data otherwise exempt may go to them "for use only in their work with the Food and Drug Administration."

Afterwards they carry the same restrictions as any agency employee. The word afterwards matters, because the duty outlasts the assignment.

A court order overrides a published withholding rule

Records the Commissioner has determined are not available for disclosure, in a published or cross-referenced regulation, are not immune from a court.

They "shall nevertheless be made available for public disclosure in compliance with a final court order requiring such disclosure."

One protection survives for individuals. Where the ordered record is about a person and would otherwise be withheld as a personal-privacy file, the agency has to try to notify that person by writing to their last known address.

That notice duty falls away if identifying information is deleted before release. Redaction removes the reason for the warning.

Other federal agencies, and the paper that has to exist first

Any agency record otherwise exempt may be disclosed to other federal departments and agencies, with a carve-out for trade secrets and confidential commercial or financial information that specific statutes protect.

The condition is procedural and firm. "Any disclosure under this section shall be pursuant to a written agreement that the record shall not be further disclosed by the other department or agency except with the written permission of FDA."

So the receiving agency does not become an independent source. It holds the material under a promise not to pass it on.

A separate section covers proceedings. Exempt data may be revealed in agency administrative proceedings or in court where it is relevant, and the rule names the parts those proceedings run under.

A restraint is written into the same sentence. "FDA will take appropriate measures, or request that appropriate measures be taken, to reduce disclosure to the minimum necessary under the circumstances."

Congress gets everything, but only through the right door

The congressional rule is the broadest sentence in this subpart.

"All records of the Food and Drug Administration shall be disclosed to Congress upon an authorized request."

The next paragraph defines authorized narrowly. Such a request "shall be made by the chairman of a committee or subcommittee of Congress acting pursuant to committee business."

And the paragraph after that closes the obvious gap. An individual member asking for their own use, or on behalf of a constituent, "shall be subject to the same rules in this part that apply to any other member of the public."

Three sentences, and they settle a question people argue about. A letter from a legislator is not a master key unless it comes from a committee chair on committee business.

State and local officials, in three different categories

This is the longest section in the subpart, and it sorts state and local officials into tiers.

A commissioned official has the same status as a special government employee. An official working under a law enforcement contract is handled under the investigatory-records rule.

Everyone else has the status of a member of the public, with exceptions that go in both directions.

Material flowing toward the agency is protected. Investigatory records and confidential commercial information gathered by state or local counterparts, and voluntarily shared as part of cooperative work, are exempt to the same extent as if the agency had made them itself.

Those state officials can also demand a longer protection period as a condition of handing anything over.

Material flowing outward is conditional. Releasing confidential commercial information to a state or local agency has a paperwork precondition. The agency must provide "a written statement establishing its authority to protect confidential commercial information from public disclosure and a written commitment not to disclose any such information" without permission.

The visiting scientist paragraph

Beyond that written commitment, the Commissioner or a designee has to make at least one of three findings.

The first is that the sponsor of the product application authorized the disclosure in writing. The second is a public health interest, either because the state holds relevant safety, effectiveness or quality information, or because it can act faster than the agency.

The third is a specific and unusually detailed scenario. It covers a state or local scientist visiting agency premises for a joint review or long-term cooperative training effort.

The conditions stack. The review must be in the public health interest, and "the Food and Drug Administration retains physical control over the information". The visitor signs a confidentiality commitment. The visitor also gives written assurance of having no disqualifying financial interest in the regulated industry.

Only with all of that in place may a visiting scientist reach trade secret material. And even then a general prohibition stands: manufacturing methods and processes protected by statute are not released to state and local officials without express written authorization from whoever submitted them.

None of this opens the file to anyone else. Disclosure under the section "does not invoke the rule established in § 20.21 that such records shall be made available to all members of the public."

Foreign regulators are handled almost identically

The foreign-official section starts from the same baseline. "Communications with foreign government officials shall have the same status as communications with any member of the public", with exceptions.

Records and confidential information gathered by foreign counterparts and shared voluntarily as part of cooperative enforcement are protected the same way state material is, including the longer-protection condition.

Outbound confidential commercial information needs the same written authority-and-commitment package, plus one of three determinations: sponsor authorization, a public health interest, or the visiting-scientist route.

A parallel paragraph covers a different kind of exchange. Nonpublic, predecisional documents about either agency's regulations may move in either direction to support global harmonization, cooperative regulatory work or international agreements.

That requires the foreign agency to have protective authority, and a determination that the exchange is reasonably necessary for those purposes. The equivalent state and local paragraph works the same way for federal-state uniformity.

The defined term is wider than it looks. It reaches employees and contracted agents of a foreign government, and of international organizations established by law, treaty or governmental action.

Contractors, and the eight-part security agreement

Contractors may receive exempt data for use only in their work for the agency, and afterwards carry the same legal restrictions and penalties as agency employees.

Nothing moves before a written agreement exists. The contractor has to agree to security precautions the agency considers necessary for proper and confidential handling.

The agreement includes, where appropriate, eight named provisions. Access restrictions, physical storage requirements, handling and accountability rules, and limits on reproduction, transmission and disclosure.

It also requires advance approval before the contractor uses subcontractors, vendors or suppliers, and procedures for time-shared computer operations.

The last two are the ones a reader should notice. "Methods of destroying source documents or related waste material", and "The period during which the contractor may retain such data and information."

The enforcement exception, and why recall notices exist

One short section keeps all of this from becoming a shield.

Nothing in the disclosure rules stops the agency using data as the basis for administrative or court enforcement action. That holds for data "whether obtained voluntarily or involuntarily and whether or not it is available for public disclosure".

More than that, exempt material becomes publicly available to the extent needed to make that action work.

The regulation gives its own example, and it is the one people actually encounter: "the brand name, code designation, and distribution information are released when a product is recalled."

That sentence explains a pattern readers see often. A company's file can be closed for years and then partly open in a week, because an enforcement action made the details necessary.

What this changes for someone reading about a company

The first practical point is that silence in a public file is not evidence that no one is looking. A record can be with a state board, a foreign regulator or another federal agency while remaining unavailable to the public.

The second is about where information becomes visible. Enforcement is the event that pushes commercial detail into the open, which is why recall and action notices carry specifics that ordinary filings never do.

The third is a caution about letters. A request from a member of Congress on behalf of a constituent gets exactly the treatment any other request would.

One limit on this article. Only subpart E of part 20 was read in full, together with the applicability section that opens it. The exemptions themselves, in subpart D, and the request procedures in subpart C were not re-read for this piece.

These are the agency's own rules about its own files. State public records laws, and the statutes cross-referenced here, set their own terms and were not examined.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. Title 21 Code of Federal Regulations section 20.80, Applicability of limitations on exemptions, read in full for which disclosures trigger public availability and which do not — Electronic Code of Federal Regulations, Office of the Federal Register, March 1977
2. Title 21 Code of Federal Regulations section 20.83, Disclosure required by court order, read in full for the override and the notice to a named individual — Electronic Code of Federal Regulations, Office of the Federal Register, May 2003
3. Title 21 Code of Federal Regulations section 20.84, Disclosure to consultants, advisory committees, State and local government officials commissioned pursuant to 21 U.S.C. 372(a), and other special government employees, read in full — Electronic Code of Federal Regulations, Office of the Federal Register, March 1977
4. Title 21 Code of Federal Regulations section 20.85, Disclosure to other Federal Government departments and agencies, read in full for the statutory carve-out and the written agreement requirement — Electronic Code of Federal Regulations, Office of the Federal Register, September 2022
5. Title 21 Code of Federal Regulations section 20.86, Disclosure in administrative or court proceedings, read in full for the minimum-necessary limit — Electronic Code of Federal Regulations, Office of the Federal Register, September 2022
6. Title 21 Code of Federal Regulations section 20.87, Disclosure to Congress, read in full for the authorized-request definition and the individual-member rule — Electronic Code of Federal Regulations, Office of the Federal Register, January 1994
7. Title 21 Code of Federal Regulations section 20.88, Communications with State and local government officials, read in full for the three tiers, the written commitment, the three determinations and the visiting scientist conditions — Electronic Code of Federal Regulations, Office of the Federal Register, September 2022
8. Title 21 Code of Federal Regulations section 20.89, Communications with foreign government officials, read in full for the baseline status, the cooperative-enforcement protections, the predecisional exchange and the breadth of the defined term — Electronic Code of Federal Regulations, Office of the Federal Register, September 2022
9. Title 21 Code of Federal Regulations section 20.90, Disclosure to contractors, read in full for the eight provisions of the required written agreement — Electronic Code of Federal Regulations, Office of the Federal Register, March 1977
10. Title 21 Code of Federal Regulations section 20.91, Use of data or information for administrative or court enforcement action, read in full for the enforcement exception and the recall illustration — Electronic Code of Federal Regulations, Office of the Federal Register, March 1977