A data breach at an education-technology company gave the California Supreme Court its first occasion to define how far two privacy statutes reach. The decision is a split outcome: the company escapes these particular claims because the plaintiff did not adequately plead that it was a covered entity, but in getting there the Court rejected a defense-friendly rule that had governed medical-privacy breach cases for over a decade – holding that a plaintiff need not prove anyone “actually viewed” the stolen data.
Illuminate Education, Inc. is an education-technology company that maintains a nationwide platform storing K–12 student data – including medical information such as diagnoses and treatment plans – to help educators evaluate students, monitor progress, and build educational plans. It contracts with the Ventura County Office of Education, which serves plaintiff J.M.’s school district. J.M. provided his medical information to the district, which in turn passed it to Illuminate.
In January 2022, Illuminate discovered suspicious activity and later confirmed that databases containing student information had been subject to unauthorized access. It notified families in June 2022, stating there was no evidence of actual or attempted misuse. J.M. alleged he subsequently received solicitations at an address he had given only to Illuminate, plus odd calls about “phantom Amazon accounts.” Through his guardian ad litem, he brought a putative class action under two statutes: the Confidentiality of Medical Information Act (CMIA; Civ. Code, § 56 et seq.) and the Customer Records Act (CRA; Civ. Code, § 1798.80 et seq.).
The Trial court sustained Illuminate’s demurrer without leave to amend, finding J.M. failed to adequately allege that Illuminate was a “provider of health care,” “contractor,” or “administrator” under the CMIA, failed to allege a qualifying “disclosure” or “release,” and could not sue under the CRA because Illuminate’s customer was the County Office of Education, not J.M.
The Court of Appeal reversed, holding that Illuminate fell within both statutes, that J.M. had stated causes of action, and that denying leave to amend was an abuse of discretion. It treated students like J.M. as the “ultimate ‘customers,’ consumers, and beneficiaries” of Illuminate’s services and found a five-month notice delay supported the CRA claim.
The California Supreme Court reversed the Court of Appeal and remanded in the case of J.M. v. Illuminate Education, Inc, No. S286699 (May 2026) reaching three holdings. J.M. did not sufficiently allege that Illuminate is a “provider of health care” under section 56.06, so his Confidentiality of Medical Information Act claims fail. A plaintiff need not allege that medical information was actually viewed by an unauthorized party. Confidentiality is breached when information is exposed to a significant risk of unauthorized access or use. J.M. did not sufficiently allege that he is Illuminate’s “customer,” so his Customer Records Act claim fails. The Supreme Court left it to the lower courts to decide whether J.M. may amend his complaint in light of these holdings.
Section 56.06 of the Confidentiality of Medical Information Act covers businesses that maintain medical information in order to make it available to an individual or health care provider upon request, for the purpose of letting the individual manage that information or for diagnosis and treatment. J.M.’s allegations described a tool for educators to assess and plan – not a service that lets individuals manage their own records or that supplies information to clinicians for diagnosis. The Court noted the Legislature has specified that school dyslexia screening is “a flag for potential risk,” not a diagnosis (Ed. Code, § 53008, subd. (l)). Legislative history confirmed the reading: the statute was built around services like MedicAlert and personal-health-record companies (e.g., WebMD-style tools that let consumers build and share their own records), which Illuminate is not. The Court stressed the statute is broad and technology-adaptive but still has limits – it does not sweep in any entity that stores medical information.
The Court took aim at a line of authority requiring proof that an unauthorized person actually viewed the data – Regents of the University of California v. Superior Court (2013) 220 Cal.App.4th 549, Sutter Health v. Superior Court (2014) 227 Cal.App.4th 1546, and Vigil v. Muir Medical Group IPA, Inc. (2022) 84 Cal.App.5th 197. Reading section 56.101 together with section 56.36, subdivision (b) – which allows $1,000 in nominal damages even when a plaintiff suffered no actual or threatened harm – the Court concluded liability turns on the entity’s negligent conduct, not on whether harm materialized.
An “actually viewed” rule would be nearly impossible to plead or prove (breach victims rarely know what a hacker did, and AI-driven cybercrime can misuse data without anyone reading it), and would gut a remedial statute that must be construed broadly (Pulliam v. HNL Automotive Inc. (2022) 13 Cal.5th 127). The proper test, the Court held, is whether information was exposed to a significant risk of unauthorized access or use – a flexible standard that distinguishes “smash-and-grab” hardware theft from data-targeted breaches and accounts for factors like the form, duration, and extent of the breach and any mitigation. Loss of possession is relevant but neither necessary nor automatically sufficient. The Court disapproved Regents, Sutter Health, and Vigil to the extent inconsistent.
The Customer Records Act (CRA) authorizes suit only by a “customer” – defined as someone who provides personal information to a business to purchase, lease, or obtain a service from that business (§ 1798.80, subd. (c)). The County Office of Education, not J.M., bought Illuminate’s services; J.M. sought educational services from his school district. The Court rejected the Court of Appeal’s “intended beneficiary” theory, noting the Legislature deliberately limited suit to an injured “customer” rather than any “consumer” or “individual” (Ferra v. Loews Hollywood Hotel, LLC (2021) 11 Cal.5th 858), and observed that other laws (e.g., the California Consumer Privacy Act) offer broader avenues for residents.