This article suggests that the owner of SAT and ACT should consider purging test takers' personal information, including scores, after a certain amount of time elapsed since the registration in order to protect data breach.
http://www.bloomberg.com/news/2011-08-15/sat-test-owner-should-delete-data-after-time-congressman-says.html