Law / United States / 
California
Student Test Taker Privacy Protection Act: proctoring services may collect only the personal information strictly necessary
Cal. Business and Professions Code section 22588
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Retention
- Audit expectation
- none
What it requires
- If you provide proctoring services in an educational setting, including a service that observes, monitors or administers an exam, collect, use, retain and disclose only the personal information strictly necessary to provide those services (section 22588(a) and (d)).
- You may go beyond that limit where it is necessary to comply with law, a court order or subpoena, or an agency inquiry, to cooperate with law enforcement or answer an emergency access request that meets the section's conditions, or to exercise or defend a legal claim (section 22588(b)).
- If a law enforcement agency directs you, under an approved investigation with an active case number, not to delete a consumer's personal information, keep it for 90 days and use or disclose it only in response to a court order or subpoena (section 22588(b)(3)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 22588 limits what a proctoring business collects, uses, retains and discloses. It names no log, no record the business keeps for the reader's use, no retention period and no reader of a record. Section 22588(b)(3)(A) tells a business that a law enforcement agency has directed not to delete personal information to hold it for 90 days, which is a hold on existing data and not a duty to create or keep a log.
- Kind
- None
- As of
What this law does
Business and Professions Code section 22588(a) requires a business providing proctoring services in an educational setting to collect, use, retain and disclose only the personal information strictly necessary to provide those services. Section 22588(d) states that proctoring services include services offered by a business to observe, monitor or administer an exam.
Section 22588(b) lifts that limit where the collection, use, retention or disclosure is necessary for one of six listed purposes, including compliance with law, compliance with a court order or subpoena, and the exercise or defense of a legal claim. Section 22588(c) gives personal information the meaning it has in section 1798.140 of the Civil Code. Section 22588 was added by Statutes 2022, chapter 720 (SB 1172), effective .
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .