| 1 | | - | Assembly Bill No. 1971 CHAPTER 508An act to add Chapter 22.2.3 (commencing with Section 22585.5) to Division 8 of the Business and Professions Code, relating to personal information. [ Approved by Governor September 24, 2024. Filed with Secretary of State September 24, 2024. ] LEGISLATIVE COUNSEL'S DIGESTAB 1971, Addis. Administration of standardized tests.The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to opt out of the selling or sharing of personal information about the consumer to third parties. Additionally, the CCPA prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumers personal information.The Student Online Personal Information Protection Act (SOPIPA) prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K12 school purposes and was designed and marketed for K12 school purposes from knowingly engaging in certain activities with respect to the operators site, service, or application, including selling a students information, including covered information, as defined, or using information, including persistent unique identifiers, created or gathered by the operators site, service, or application, to amass a profile about a K12 student except in furtherance of K12 school purposes.This bill would prohibit a national assessment provider, as defined, from knowingly doing certain things with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test, including selling personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test, except as prescribed. The bill would define standardized test to mean a test administered in California at the expense of the test subject that is, among other things, not a test administered for K12 purposes, as described above.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Chapter 22.2.3 (commencing with Section 22585.5) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.3. National Assessment Providers22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584.22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 1 | + | Enrolled September 03, 2024 Passed IN Senate August 28, 2024 Passed IN Assembly August 29, 2024 Amended IN Senate August 22, 2024 Amended IN Senate August 19, 2024 Amended IN Senate May 30, 2024 Amended IN Assembly March 04, 2024 CALIFORNIA LEGISLATURE 20232024 REGULAR SESSION Assembly Bill No. 1971Introduced by Assembly Member AddisJanuary 30, 2024An act to add Chapter 22.2.3 (commencing with Section 22585.5) to Division 8 of the Business and Professions Code, relating to personal information.LEGISLATIVE COUNSEL'S DIGESTAB 1971, Addis. Administration of standardized tests.The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to opt out of the selling or sharing of personal information about the consumer to third parties. Additionally, the CCPA prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumers personal information.The Student Online Personal Information Protection Act (SOPIPA) prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K12 school purposes and was designed and marketed for K12 school purposes from knowingly engaging in certain activities with respect to the operators site, service, or application, including selling a students information, including covered information, as defined, or using information, including persistent unique identifiers, created or gathered by the operators site, service, or application, to amass a profile about a K12 student except in furtherance of K12 school purposes.This bill would prohibit a national assessment provider, as defined, from knowingly doing certain things with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test, including selling personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test, except as prescribed. The bill would define standardized test to mean a test administered in California at the expense of the test subject that is, among other things, not a test administered for K12 purposes, as described above.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Chapter 22.2.3 (commencing with Section 22585.5) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.3. National Assessment Providers22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584.22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 14 | 27 | | |
|---|
| 15 | 28 | | LEGISLATIVE COUNSEL'S DIGEST |
|---|
| 16 | 29 | | |
|---|
| 17 | 30 | | ## LEGISLATIVE COUNSEL'S DIGEST |
|---|
| 18 | 31 | | |
|---|
| 19 | 32 | | AB 1971, Addis. Administration of standardized tests. |
|---|
| 20 | 33 | | |
|---|
| 21 | 34 | | The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to opt out of the selling or sharing of personal information about the consumer to third parties. Additionally, the CCPA prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumers personal information.The Student Online Personal Information Protection Act (SOPIPA) prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K12 school purposes and was designed and marketed for K12 school purposes from knowingly engaging in certain activities with respect to the operators site, service, or application, including selling a students information, including covered information, as defined, or using information, including persistent unique identifiers, created or gathered by the operators site, service, or application, to amass a profile about a K12 student except in furtherance of K12 school purposes.This bill would prohibit a national assessment provider, as defined, from knowingly doing certain things with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test, including selling personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test, except as prescribed. The bill would define standardized test to mean a test administered in California at the expense of the test subject that is, among other things, not a test administered for K12 purposes, as described above. |
|---|
| 22 | 35 | | |
|---|
| 23 | 36 | | The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to opt out of the selling or sharing of personal information about the consumer to third parties. Additionally, the CCPA prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumers personal information. |
|---|
| 24 | 37 | | |
|---|
| 25 | 38 | | The Student Online Personal Information Protection Act (SOPIPA) prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K12 school purposes and was designed and marketed for K12 school purposes from knowingly engaging in certain activities with respect to the operators site, service, or application, including selling a students information, including covered information, as defined, or using information, including persistent unique identifiers, created or gathered by the operators site, service, or application, to amass a profile about a K12 student except in furtherance of K12 school purposes. |
|---|
| 26 | 39 | | |
|---|
| 27 | 40 | | This bill would prohibit a national assessment provider, as defined, from knowingly doing certain things with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test, including selling personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test, except as prescribed. The bill would define standardized test to mean a test administered in California at the expense of the test subject that is, among other things, not a test administered for K12 purposes, as described above. |
|---|
| 28 | 41 | | |
|---|
| 29 | 42 | | ## Digest Key |
|---|
| 30 | 43 | | |
|---|
| 31 | 44 | | ## Bill Text |
|---|
| 32 | 45 | | |
|---|
| 33 | 46 | | The people of the State of California do enact as follows:SECTION 1. Chapter 22.2.3 (commencing with Section 22585.5) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.3. National Assessment Providers22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584.22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 34 | 47 | | |
|---|
| 35 | 48 | | The people of the State of California do enact as follows: |
|---|
| 36 | 49 | | |
|---|
| 37 | 50 | | ## The people of the State of California do enact as follows: |
|---|
| 38 | 51 | | |
|---|
| 39 | 52 | | SECTION 1. Chapter 22.2.3 (commencing with Section 22585.5) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.3. National Assessment Providers22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584.22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 40 | 53 | | |
|---|
| 41 | 54 | | SECTION 1. Chapter 22.2.3 (commencing with Section 22585.5) is added to Division 8 of the Business and Professions Code, to read: |
|---|
| 42 | 55 | | |
|---|
| 43 | 56 | | ### SECTION 1. |
|---|
| 44 | 57 | | |
|---|
| 45 | 58 | | CHAPTER 22.2.3. National Assessment Providers22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584.22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 46 | 59 | | |
|---|
| 47 | 60 | | CHAPTER 22.2.3. National Assessment Providers22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584.22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 48 | 61 | | |
|---|
| 49 | 62 | | CHAPTER 22.2.3. National Assessment Providers |
|---|
| 50 | 63 | | |
|---|
| 51 | 64 | | CHAPTER 22.2.3. National Assessment Providers |
|---|
| 52 | 65 | | |
|---|
| 53 | 66 | | 22585.5. For purposes of this chapter:(a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.(b) National assessment provider means a person that develops, sponsors, or administers standardized tests.(c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code.(d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria:(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.(B) The test is used for preliminary preparation for a test described in subparagraph (A).(2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584. |
|---|
| 54 | 67 | | |
|---|
| 55 | 68 | | |
|---|
| 56 | 69 | | |
|---|
| 57 | 70 | | 22585.5. For purposes of this chapter: |
|---|
| 58 | 71 | | |
|---|
| 59 | 72 | | (a) Covered information means personal information provided by an individual, or the individuals parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test. |
|---|
| 60 | 73 | | |
|---|
| 61 | 74 | | (b) National assessment provider means a person that develops, sponsors, or administers standardized tests. |
|---|
| 62 | 75 | | |
|---|
| 63 | 76 | | (c) Personal information has the same meaning as defined in Section 1798.140 of the Civil Code. |
|---|
| 64 | 77 | | |
|---|
| 65 | 78 | | (d) (1) Standardized test means a test administered in California at the expense of the test subject that meets either of the following criteria: |
|---|
| 66 | 79 | | |
|---|
| 67 | 80 | | (A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs. |
|---|
| 68 | 81 | | |
|---|
| 69 | 82 | | (B) The test is used for preliminary preparation for a test described in subparagraph (A). |
|---|
| 70 | 83 | | |
|---|
| 71 | 84 | | (2) Standardized test does not mean a test administered for K12 purposes, as defined in Section 22584. |
|---|
| 72 | 85 | | |
|---|
| 73 | 86 | | 22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:(1) (A) Except as provided in subparagraph (B), sell covered information.(B) A national assessment provider may sell covered information if either of the following apply:(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.(II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website.(3) Disclose covered information unless any of the following is true:(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid.(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.(B) The disclosure is made to ensure legal and regulatory compliance.(C) The disclosure is made to respond to, or participate in, judicial process.(D) The disclosure is made to protect personal safety or the safety of others.(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(F) The disclosure is made for legitimate research purposes required by state or federal law.(G) The disclosure is made to a state or local educational agency, including a school or school district.(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services.(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|
| 74 | 87 | | |
|---|
| 75 | 88 | | |
|---|
| 76 | 89 | | |
|---|
| 77 | 90 | | 22585.6. (a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test: |
|---|
| 78 | 91 | | |
|---|
| 79 | 92 | | (1) (A) Except as provided in subparagraph (B), sell covered information. |
|---|
| 80 | 93 | | |
|---|
| 81 | 94 | | (B) A national assessment provider may sell covered information if either of the following apply: |
|---|
| 82 | 95 | | |
|---|
| 83 | 96 | | (i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider. |
|---|
| 84 | 97 | | |
|---|
| 85 | 98 | | (ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities. |
|---|
| 86 | 99 | | |
|---|
| 87 | 100 | | (II) This clause applies only if the individual, or the individuals parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information. |
|---|
| 88 | 101 | | |
|---|
| 89 | 102 | | (2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment providers internet website. |
|---|
| 90 | 103 | | |
|---|
| 91 | 104 | | (3) Disclose covered information unless any of the following is true: |
|---|
| 92 | 105 | | |
|---|
| 93 | 106 | | (A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individuals admission, course credit, or placement in an institution or facilitating an individuals eligibility for recognition, a scholarship, or financial aid. |
|---|
| 94 | 107 | | |
|---|
| 95 | 108 | | (ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law. |
|---|
| 96 | 109 | | |
|---|
| 97 | 110 | | (B) The disclosure is made to ensure legal and regulatory compliance. |
|---|
| 98 | 111 | | |
|---|
| 99 | 112 | | (C) The disclosure is made to respond to, or participate in, judicial process. |
|---|
| 100 | 113 | | |
|---|
| 101 | 114 | | (D) The disclosure is made to protect personal safety or the safety of others. |
|---|
| 102 | 115 | | |
|---|
| 103 | 116 | | (E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following: |
|---|
| 104 | 117 | | |
|---|
| 105 | 118 | | (i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider. |
|---|
| 106 | 119 | | |
|---|
| 107 | 120 | | (ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties. |
|---|
| 108 | 121 | | |
|---|
| 109 | 122 | | (iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure. |
|---|
| 110 | 123 | | |
|---|
| 111 | 124 | | (F) The disclosure is made for legitimate research purposes required by state or federal law. |
|---|
| 112 | 125 | | |
|---|
| 113 | 126 | | (G) The disclosure is made to a state or local educational agency, including a school or school district. |
|---|
| 114 | 127 | | |
|---|
| 115 | 128 | | (H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18. |
|---|
| 116 | 129 | | |
|---|
| 117 | 130 | | (b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment providers programs and services. |
|---|
| 118 | 131 | | |
|---|
| 119 | 132 | | (c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure. |
|---|
| 120 | 133 | | |
|---|
| 121 | 134 | | (d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control. |
|---|