J.M.

facts to state causes of action under the CMIA and CRA; and 3) the trial court abused its discretion by sustaining the demurrer without leave to amend. We reverse and remand. J.M. may file an amended complaint in which he alleges additional facts.

FACTS

J.M., an 11-year-old student, filed a class action lawsuit by his guardian ad litem Jean Paul Magallanes, against Illuminate, an education consulting business. He alleged Illuminate obtained possession of his personal and medical information from his school and its office of education so that it could assist the school and evaluate his educational progress at the school. Illuminate promised to maintain that information confidentially, but it negligently maintained its database. Because of a data breach, a cyber hacker gained access to that personal information. Illuminate did not promptly notify J.M. and other victims about the breach. It provided specific notice about the breach involving his personal information five months after the breach. After the data breach, J.M. started receiving “solicitations by mail from third parties” that were sent to “an address [J.M.] only provided to [Illuminate] through the Office of Education.”…