Bill Text: CA AB1971 | 2023-2024 | Regular Session | Chaptered

California Assembly Bill 1971 (Prior Session Legislation)

CA State Legislature page for AB1971

Bill Title: Administration of standardized tests.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Passed) 2024-09-24 - Chaptered by Secretary of State - Chapter 508, Statutes of 2024. [AB1971 Detail]

Download: California-2023-AB1971-Chaptered.html

Assembly Bill No. 1971

CHAPTER 508

An act to add Chapter 22.2.3 (commencing with Section 22585.5) to Division 8 of the Business and Professions Code, relating to personal information.

[ Approved by Governor September 24, 2024. Filed with Secretary of State September 24, 2024. ]

LEGISLATIVE COUNSEL'S DIGEST

AB 1971, Addis. Administration of standardized tests.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to opt out of the selling or sharing of personal information about the consumer to third parties. Additionally, the CCPA prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information.

The Student Online Personal Information Protection Act (SOPIPA) prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes from knowingly engaging in certain activities with respect to the operator’s site, service, or application, including selling a student’s information, including covered information, as defined, or using information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a K–12 student except in furtherance of K–12 school purposes.

This bill would prohibit a national assessment provider, as defined, from knowingly doing certain things with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test, including selling personal information provided by an individual, or the individual’s parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test, except as prescribed. The bill would define “standardized test” to mean a test administered in California at the expense of the test subject that is, among other things, not a test administered for K–12 purposes, as described above.

Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO

The people of the State of California do enact as follows:

SECTION 1.

Chapter 22.2.3 (commencing with Section 22585.5) is added to Division 8 of the Business and Professions Code, to read:

CHAPTER 22.2.3. National Assessment Providers

22585.5.

For purposes of this chapter:

(a) “Covered information” means personal information provided by an individual, or the individual’s parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.

(b) “National assessment provider” means a person that develops, sponsors, or administers standardized tests.

(d) (1) “Standardized test” means a test administered in California at the expense of the test subject that meets either of the following criteria:

(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.

(B) The test is used for preliminary preparation for a test described in subparagraph (A).

(2) “Standardized test” does not mean a test administered for K–12 purposes, as defined in Section 22584.

22585.6.

(a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:

(1) (A) Except as provided in subparagraph (B), sell covered information.

(B) A national assessment provider may sell covered information if either of the following apply:

(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.

(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.

(II) This clause applies only if the individual, or the individual’s parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.

(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment provider’s internet website.

(3) Disclose covered information unless any of the following is true:

(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individual’s admission, course credit, or placement in an institution or facilitating an individual’s eligibility for recognition, a scholarship, or financial aid.

(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.

(B) The disclosure is made to ensure legal and regulatory compliance.

(D) The disclosure is made to protect personal safety or the safety of others.

(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:

(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.

(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.

(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(F) The disclosure is made for legitimate research purposes required by state or federal law.

(G) The disclosure is made to a state or local educational agency, including a school or school district.

(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.

(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment provider’s programs and services.

(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control.