Truck Drivers, Students Get Extra California Privacy Protections

Privacy protections for certain groups of Californians, like student test takers or workers who drive as part of their jobs, go into effect Jan. 1.

The laws are less far reaching than the changes to California’s biggest privacy law, which also are effective in the new year, but they fill a need for certain more vulnerable groups that state lawmakers deemed needed an extra shield.

Test Proctoring

The Student Test Taker Privacy Protection Act will require businesses that provide proctoring services in educational settings to collect, use, and disclose only personal information that is strictly necessary for proctoring.

Federal and state protections are already in place for online services targeted at youth. The growth in online test-taking during the Covid-19 pandemic prompted new privacy concerns. Privacy advocates filed complaints against five online proctoring companies in 2020 for “forcibly collecting” personal information such as biometric data with no meaningful way for students to opt out.

The proctoring industry argued that students don’t have control over collected information because it’s the schools, not the students, who are consumers of the proctoring service. The new law closes that loophole, said the bill’s author, state Sen. Richard Pan (D), in past comments.

Digital License Plates

California will be on the path to issuing digital license plates under Assembly Bill 984.

Privacy groups feared GPS-enabled plates could be abused by domestic violence perpetrators or the government. In response, lawmakers added a provision to the law barring vehicle location technology except for fleet vehicles such as trucks or taxis.

The truck and taxi exemption comes with caveats that could be important for employers looking to track their workers’ vehicle movements. The new law says the location technology must have the capability to be disabled by the user, and there has to be a clear sign indicating to the driver that the tracking is in use.

Employers can use GPS-enabled license plates to monitor only during work hours and only for job performance. They must provide the worker with advance notice of the monitoring process, how gathered data will be used, where the data is stored, and who the data gets shared with.

Mental Health Apps

Health records are protected by the federal Health Insurance Portability and Accountability Act, and California law already prohibits businesses using medical information for any purposes not necessary for health care.

Assembly Bill 2089 revises state law to explicitly include information collected by mental health applications under that same protection. Privacy advocates say this will plug a gap in state law.

TechNet, a trade group for tech companies, said current rules already protect any sensitive personal information collected by mental health application developers.

Sexual Assault

Under Senate Bill 1228, DNA collected from victims of sexual assault and their intimate partners can only be used by police for the active case and can’t be compared to other DNA samples in unrelated cases. Such DNA profiles can’t be put into a searchable database for comparisons with genetic evidence from a crime scene.

The legislation stemmed from a case where the San Francisco Police Department had been placing DNA profiles of sexual assault victims into a searchable local DNA database.

“The sexual assault survivors—including children—who voluntarily provided their DNA samples as part of the investigation into the assault they experienced were not informed and did not consent to this use of their DNA profiles,” said ACLU California Action in a past comment.

California police question whether the new law will hurt their efforts to identify criminals.