ILMN ILLUMINA, INC.

Price Chart

Executive Summary

The California Supreme Court reversed the Court of Appeal in J.M. v. Illuminate Education, holding that plaintiff J.M. failed to state a claim under the Confidentiality of Medical Information Act (CMIA) because Illuminate Education is not a 'provider of health care' under the statute, and failed to state a claim under the Customer Records Act (CRA) because J.M. is not Illuminate's 'customer.' The ruling significantly limits Illuminate's exposure in this data-breach class action, removing the risk of statutory damages under the CMIA and CRA for this case, though the court left open the possibility of amendment on remand.

Court Ruling Details

Actionable Insight

Key Facts

• California Supreme Court unanimously reversed the Court of Appeal, holding that Illuminate Education is not a 'provider of health care' under the CMIA (Civ. Code § 56.06) because it does not make medical information available for individual health management or medical diagnosis/treatment.
• Plaintiff J.M. also failed to state a claim under the CRA because he is not Illuminate's 'customer' — the customer is the Ventura County Office of Education, not the individual student.
• The court established a new statewide standard for CMIA breach-of-confidentiality claims: a plaintiff need not allege information was 'actually viewed' by an unauthorized party; it is sufficient to allege exposure to a 'significant risk of unauthorized access or use.'
• The court disapproved three prior Court of Appeal decisions (Regents, Sutter Health, Vigil) to the extent they required actual viewing.
• The case was remanded to the Court of Appeal to determine whether J.M. may be granted leave to amend his complaint.
• Justice Groban's concurrence argued that the trial court's demurrer without leave to amend should be affirmed, noting J.M. had already amended twice and could not cure the defects.

Financial Impact

Removes risk of statutory damages under CMIA ($1,000 per class member) and CRA for this putative class action; potential class size is all California students whose data was breached (not quantified in opinion).

Risk Factors

• Remand allows J.M. to seek leave to amend; if granted, litigation continues under a narrower theory.
• The new 'significant risk of unauthorized access or use' standard could still expose Illuminate to CMIA claims if plaintiff can replead that Illuminate is a 'provider of health care' — though the court's reasoning makes this unlikely.
• Other data-breach class actions against Illuminate or similar ed-tech companies could still proceed under the new standard, but this ruling sharply limits the statutory framework available.

Market Snapshot

Documents Analyzed

This report is based on 1 court opinion from CourtListener.

US Market Status