(a) Licensees and other entities that collect personal information about an individual for the purpose of complying with this subpart must establish and maintain a system of files and procedures to prevent unauthorized disclosure.

(b) Licensees and other entities must obtain a signed consent that documents the individual's acceptance of being subject to the FFD program and authorizes the disclosure of the personal information collected and maintained under this subpart, except for disclosures to the individuals and entities specified in § 26.37(b)(1) through (6) and (8), and persons deciding matters under review in § 26.613. This signed and dated consent must be obtained before making the individual subject to the FFD program.