Key Points

• California's Supreme Court has clarified that CMIA breach claims do not require proof that an unauthorized person actually viewed exposed medical information.
• The same ruling narrows who counts as a covered provider and limits Customer Records Act standing in school-vendor breach cases.
• Illuminate Education remains the key defendant for student-data breach liability and statutory interpretation in California.
• A separate enforcement track targets 23andMe's handling of genetic data, with the California Attorney General alleging weak security, delayed detection, and misleading breach communications.
• The 23andMe matter involves large-scale exposure of identity-linked genetic and health information, including allegations of dark-web resale and account-takeover risk.
• Bankruptcy proceedings add another layer of uncertainty in the 23andMe dispute by challenging whether California claims can proceed outside the plan process.
• The cluster is dominated by litigation and enforcement rather than new privacy legislation, suggesting a steady focus on how existing laws apply to breach events.