Assembly Bill 801 (AB 801) and Assembly Bill 1971 (AB 1971) focus on increased student privacy protections.
Current law prohibits operators of websites, online services, applications, or mobile applications with actual knowledge that the website, service, or application is used, designed and marketed primarily for preschool, prekindergarten or K–12 school purposes (Online Operators) from engaging in certain activities including selling information of a preschool, prekindergarten or K–12 student’s information or using information to amass a profile about a student, except in furtherance of school purposes. Online Operators must take actions to protect a student’s Covered Information (defined below), including implementing and maintaining reasonable security procedures and practices and deleting a student’s Covered Information if the school or district requests deletion of data under the control of the school or district.
“Covered Information” is defined as personally identifiable information or materials, in any media or format that, among other things, is created or provided by the preschool, prekindergarten or K–12, a pupil, a pupil’s parent or legal guardian, or an employee or agent of the school, or gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.
AB 801 mandates that Online Operators delete Student Covered Information at the request of the student’s parent or guardian when the student is no longer attending the school or school district. Online Operators also must delete Student Covered Information if a student has not been enrolled for at least 60 days, but first must require documentation that the pupil is no longer enrolled. The Online Operators’ obligation to delete Covered Information does not require it to delete pupil records that only include standardized test results held by a national assessment provider.
Assembly Bill 1971 (AB 1971) prohibits a person that develops, sponsors, or administers standardized tests (National Assessment Provider) from knowingly selling or disclosing personal information provided by an individual, or the individual’s parent or legal guardian, for the purposes of administering, or publishing or distributing the scores with respect to a standardized test (Testing Covered Information), unless an exception is applicable. “Standardized test” means a test administered in California at the expense of the test subject that is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs or is used for preliminary preparation for such tests.
With authorization, National Assessment Providers may sell the Testing Covered Information to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities. National Assessment Providers may also disclose the Testing Covered Information in certain instances, including but not limited to, to protect personal safety or the safety of others, as part of the judicial process. National Assessment Providers may also disclose the Testing Covered Information to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individual’s admission, course credit, or placement in an institution or facilitating an individual’s eligibility for recognition, a scholarship, or financial aid.
(AB 801 amends sections 22584 and 22586 of and amends the heading of Chapter 22.2 (commencing with section 22584) of Division 8 of, the Business and Professions Code; AB 1971 adds Chapter 22.2.3 (commencing with section 22585.5) to Division 8 of the Business and Professions Code.)