(a) Licensees and other entities who collect personal information about an individual for the purpose of complying with this subpart shall establish and maintain a system of files and procedures to protect the personal information. FFD programs must maintain and use such records with the highest regard for individual privacy.

(b) Licensees and other entities shall obtain a signed consent that authorizes the disclosure of the personal information collected and maintained under this subpart before disclosing the personal information, except for disclosures to the individuals and entities specified in § 26.37(b)(1) through (b)(6), (b)(8), and persons deciding matters under review in § 26.413.