Chapter 22.2.3National Assessment Providers

Section § 22585.5

Explanation

This law defines key terms related to standardized testing in California. 'Covered information' refers to personal details given by an individual or their guardian to a test provider for scoring or administering a standardized test. A 'national assessment provider' is any entity that creates or runs standardized tests. 'Standardized test' refers to exams given for college admissions or placement, but not K-12 tests. 'Personal information' has the same definition as another state law.

For purposes of this chapter:
(a)CA Business and Professions Code § 22585.5(a) “Covered information” means personal information provided by an individual, or the individual’s parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.
(b)CA Business and Professions Code § 22585.5(b) “National assessment provider” means a person that develops, sponsors, or administers standardized tests.
(c)CA Business and Professions Code § 22585.5(c) “Personal information” has the same meaning as defined in Section 1798.140 of the Civil Code.
(d)Copy CA Business and Professions Code § 22585.5(d)
(1)Copy CA Business and Professions Code § 22585.5(d)(1) “Standardized test” means a test administered in California at the expense of the test subject that meets either of the following criteria:
(A)CA Business and Professions Code § 22585.5(d)(1)(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.
(B)CA Business and Professions Code § 22585.5(d)(1)(B) The test is used for preliminary preparation for a test described in subparagraph (A).
(2)CA Business and Professions Code § 22585.5(d)(2) “Standardized test” does not mean a test administered for K–12 purposes, as defined in Section 22584.
covered information personal information national assessment provider standardized test college admission tests class placement tests California testing test subject expense postsecondary education testing definitions test preparation K-12 exclusion Section 1798.140 Civil Code administering tests publishing scores
(Added by Stats. 2024, Ch. 508, Sec. 1. (AB 1971) Effective January 1, 2025.)

Section § 22585.6

Explanation

This law says that national assessment providers (like companies that give standardized tests) can't sell or share personal information from test-takers, also known as "covered information," unless specific exceptions apply. They can sell the information if they're acquired by another entity that follows the same rules or if it's to certain educational or government organizations—if the person, or their guardian, agrees. They can share the information only for specific purposes, like furthering educational opportunities, complying with laws, or ensuring safety, and they must have consent unless it's an emergency or required by law. These providers are also required to protect the information with strong security measures. If this law conflicts with another, the one providing greater privacy protection prevails.

(a)CA Business and Professions Code § 22585.6(a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:
(1)Copy CA Business and Professions Code § 22585.6(a)(1)
(A)Copy CA Business and Professions Code § 22585.6(a)(1)(A) Except as provided in subparagraph (B), sell covered information.
(B)CA Business and Professions Code § 22585.6(a)(1)(A)(B) A national assessment provider may sell covered information if either of the following apply:
(i)CA Business and Professions Code § 22585.6(a)(1)(A)(B)(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.
(ii)Copy CA Business and Professions Code § 22585.6(a)(1)(A)(B)(ii)
(I)Copy CA Business and Professions Code § 22585.6(a)(1)(A)(B)(ii)(I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.
(II) This clause applies only if the individual, or the individual’s parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.
(2)CA Business and Professions Code § 22585.6(a)(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment provider’s internet website.
(3)CA Business and Professions Code § 22585.6(a)(3) Disclose covered information unless any of the following is true:
(A)Copy CA Business and Professions Code § 22585.6(a)(3)(A)
(i)Copy CA Business and Professions Code § 22585.6(a)(3)(A)(i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individual’s admission, course credit, or placement in an institution or facilitating an individual’s eligibility for recognition, a scholarship, or financial aid.
(ii)CA Business and Professions Code § 22585.6(a)(3)(A)(i)(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.
(B)CA Business and Professions Code § 22585.6(a)(3)(B) The disclosure is made to ensure legal and regulatory compliance.
(C)CA Business and Professions Code § 22585.6(a)(3)(C) The disclosure is made to respond to, or participate in, judicial process.
(D)CA Business and Professions Code § 22585.6(a)(3)(D) The disclosure is made to protect personal safety or the safety of others.
(E)CA Business and Professions Code § 22585.6(a)(3)(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:
(i)CA Business and Professions Code § 22585.6(a)(3)(E)(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.
(ii)CA Business and Professions Code § 22585.6(a)(3)(E)(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.
(iii)CA Business and Professions Code § 22585.6(a)(3)(E)(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.
(F)CA Business and Professions Code § 22585.6(a)(3)(F) The disclosure is made for legitimate research purposes required by state or federal law.
(G)CA Business and Professions Code § 22585.6(a)(3)(G) The disclosure is made to a state or local educational agency, including a school or school district.
(H)CA Business and Professions Code § 22585.6(a)(3)(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.
(b)CA Business and Professions Code § 22585.6(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment provider’s programs and services.
(c)CA Business and Professions Code § 22585.6(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.
(d)CA Business and Professions Code § 22585.6(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control.
national assessment provider covered information selling personal data consent for data sale educational institutions privacy protection data security acquisition exceptions judicial process regulatory compliance personal safety disclosure service provider contracts legitimate research parental consent privacy law conflict
(Added by Stats. 2024, Ch. 508, Sec. 1. (AB 1971) Effective January 1, 2025.)