Upon completion of a research or statistical project the security of identifiable research or statistical information shall be protected by:
(a) Complete physical destruction of all copies of the materials or the identifiable portion of such materials after a three-year required recipient retention period or as soon as authorized by law, or
(b) Removal of identifiers from data and separate maintenance of a name-code index in a secure location.
The Privacy Certificate shall indicate the procedures to be followed and shall, in the case of paragraph (b) of this section, describe procedures to secure the name index.
authority: Secs. 801(a), 812(a), Omnibus Crime Control and Safe Streets Act of 1968,
42 U.S.C. 3701,
source: 41 FR 54846, Dec. 15, 1976, unless otherwise noted.
cite as: 28 CFR 22.25