J.M. v. Illuminate Education, Inc.

── J.M. v. Illuminate Education, Inc. ── Court: California Supreme Court Date: May 14, 2026 Category: General IN THE SUPREME COURT OF CALIFORNIA J.M., a Minor, etc., Plaintiff and Appellant, v. ILLUMINATE EDUCATION, INC., Defendant and Respondent. S286699 Second Appellate District, Division Six B327683 Ventura County Superior Court 56-2022-00567324-CU-MC-VTA May 14, 2026 Justice Liu authored the opinion of the Court, in which Chief Justice Guerrero and Justices Corrigan, Kruger, Groban, Evans, and Buchanan* concurred. Justice Groban filed a concurring opinion. * Associate Justice of the Court of Appeal, Fourth Appellate District, Division One, assigned by the Chief Justice pursuant to article VI, section 6 of the California Constitution.  J.M. v. ILLUMINATE EDUCATION, INC. S286699 Opinion of the Court by Liu, J. Defendant Illuminate Education, Inc. (Illuminate) is an educational technology company that collects data on individual students, including medical information, in the course of providing support and services to help school districts meet students’ educational needs. Illuminate provides such services to the Ventura County Office of Education, which serves the school district where plaintiff J.M. was a student. In 2022, Illuminate became aware of a data breach that resulted in unauthorized access to students’ medical information, including J.M.’s. J.M., through his guardian ad litem, brought a class action suit against Illuminate for violations of the Confidentiality of Medical Information Act (CMIA; Civ. Code, § 56 et seq.) and the Customer Records Act (CRA; Civ. Code, § 1798.80 et seq.). The trial court dismissed the suit for failure to state a claim; the Court of Appeal reversed. We granted review to decide whether J.M. has stated a cognizable claim under the CMIA or the CRA. We hold as follows: First, J.M. has not stated a valid claim under the CMIA because he has not sufficiently alleged that Illuminate is a “provider of health care” within the meaning of Civil Code section 56.06. (All undesignated statutory references are to the Civil Code.) Second, in order to establish a failure to preserve the confidentiality of medical information under the CMIA (§ 56.101), a plaintiff does not need to allege that the information was actually viewed by an unauthorized third 1  J.M. v. ILLUMINATE EDUCATION, INC. Opinion of the Court by Liu, J. party; confidentiality is breached when the information is exposed to a significant risk of unauthorized access or use. Third, because J.M. has not sufficiently alleged that he is Illuminate’s “customer” within the meaning of the CRA (see §§ 1798.80, subd. (c) [defining the term], 1798.84, subd. (b) [authorizing civil suits by injured “customer[s]”]), he has not stated a cause of action against Illuminate under the CRA arising from the data breach. I. “In considering whether a demurrer should have been sustained, ‘we accept as true the well-pleaded facts in the operative complaint.’ ” (Beacon Residential Community Assn. v. Skidmore, Owings & Merrill LLP (2014) 59 Cal.4th 568, 571.) The trial court granted Illuminate’s demurrer without leave to amend on the ground that J.M.’s first amended complaint was insufficient to state a claim for relief and the proposed second amended complaint would not cure the defects. The Court of Appeal held that the trial court abused its discretion by sustaining the demurrer without leave to amend because J.M. could cure the defects in the first amended complaint. (J.M. v. Illuminate Education, Inc. (2024) 103 Cal.App.5th 1125, 1129 (Illuminate).) Accordingly, we assume as true the properly pleaded facts in the second amended complaint, as described