California Supreme Court Watch

#24-211 J.M. v. Illuminate Education, Inc., S286699. (B327683; 103 Cal.App.5th 1125; Ventura County Superior Court; 56-2022-00567324-CU-MC-VTA.) Petition for review after the Court of Appeal reversed the judgment in a civil action and remanded for further proceedings. This case presents the following issue: Is a company that stores students’ confidential personal and medical information through its work providing software to school districts subject to liability to these students under the Confidentiality of Medical Information Act (Civ. Code, § 56 et seq.) and the Customer Records Act (Civ. Code, § 1798.80 et seq.) following disclosure of such information through a data breach?

Petition for review granted: 10/30/2024

Case fully briefed: 5/05/2025

Cause argued and submitted: 3/04/2026

Opinion filed: Judgment reversed: 5/14/2026

See the Court of Appeal Opinion.

See the Petition for Review.

See the Oral Argument.

See the California Supreme Court Opinion.  (J.M. v. Illuminate Education, Inc. (2026) 19 Cal.5th 705.)

“We hold as follows: First, J.M. has not stated a valid claim under the CMIA because he has not sufficiently alleged that Illuminate is a ‘provider of health care’ within the meaning of Civil Code section 56.06…. Second, in order to establish a failure to preserve the confidentiality of medical information under the CMIA (§ 56.101), a plaintiff does not need to allege that the information was actually viewed by an unauthorized third party; confidentiality is breached when the information is exposed to a significant risk of unauthorized access or use. Third, because J.M. has not sufficiently alleged that he is Illuminate’s ‘customer’ within the meaning of the CRA (see §§ 1798.80, subd. (c) [defining the term], 1798.84, subd. (b) [authorizing civil suits by injured ‘customer[s]’]), he has not stated a cause of action against Illuminate under the CRA arising from the data breach.”

Justice Liu authored the opinion of the Court, in which Chief Justice Guerrero and Justices Corrigan, Kruger, Groban, Evans, and Buchanan* concurred.

Justice Groban filed a concurring opinion.

In the news: Brown, Illuminate Education Spared by Top State Court Over Data Breach, Bloomberg Law (May 14, 2026).

In the news: Grande, Calif. High Court Releases EdTech Co. From Data Breach Suit, Law360 (May 15, 2026).