Cal. Health & Safety Code § 120398

Each public and private postsecondary educational institution shall maintain the confidentiality of information obtained pursuant to Section 120396 or 120397 in the same manner as other confidential student information is maintained by the institution. Each institution is subject to civil action and criminal penalties for the wrongful disclosure of the information, in accordance with other provisions of law.