Education Matters: July 2026

Education Matters

Allison Berquist

Associate | Los Angeles

Amy Conway (Brandt)

Partner | San Francisco

Jordan Carman

Associate | San Francisco

Christopher Fallon

Partner | Los Angeles

Stephanie J. Lowe

Senior Counsel | San Diego

U.S. Supreme Court Issues Decision On Transgender Athletes.

On June 30, 2026, the U.S. Supreme Court issued a significant decision addressing transgender student participation in school athletics. In West Virginia v. B.P.J. and Little v. Hecox, the Court held that Title IX and the Equal Protection Clause permit states to restrict participation on girls’ and women’s athletic teams based on biological sex. You can read more about the decisions in LCW’s Special Bulletin available here

TITLE IX CONFIDENTIAL RECORDS

California Supreme Court Clarifies Scope Of CMIA And CRA Liability For Education Technology Vendors.

On May 14, 2026, the California Supreme Court issued its decision in J.M. v. Illuminate Education, Inc., addressing the circumstances under which education technology vendors may be subject to liability under the Confidentiality of Medical Information Act (CMIA) and the Customer Records Act (CRA). The Court held that not every entity that stores or processes medical information qualifies as a “provider of health care” under the CMIA, and not every individual whose information is maintained by a business qualifies as a statutory “customer” under the CRA. The Court also clarified that a plaintiff asserting a CMIA confidentiality claim need not allege that confidential medical information was actually viewed by an unauthorized person.

The decision reverses a prior Court of Appeal ruling that had interpreted both statutes broadly and allowed the plaintiff’s claims against Illuminate Education, Inc. (Illuminate) to proceed.

Background

The case arose from a class action lawsuit filed by J.M., an 11-year-old student, through his guardian ad

litem, against Illuminate, an education consulting and technology company that provides data management and student assessment services to school districts and county offices of education.

According to the complaint, Illuminate received J.M.’s personal and medical information from his school and county office of education to assist in evaluating his educational progress. Illuminate’s platform allegedly maintained student medical records and monitored student performance, including “social-emotional behavior.” Illuminate later experienced a data breach but allegedly did not notify affected individuals until approximately five months after the incident.

J.M. further alleged that, after the breach, he began receiving third-party solicitations at an address that had only been provided through educational records shared with Illuminate. Based on these allegations, J.M. asserted claims under the CMIA and CRA, alleging that Illuminate negligently maintained its database and failed to provide timely notice of the breach.

Illuminate demurred, arguing that it was not subject to either statute and that the complaint failed to state viable causes of action. The trial court agreed, sustained the demurrer without leave to amend, and entered judgment in Illuminate’s favor.

Court of Appeal Decision

The Court of Appeal reversed. It concluded that Illuminate fell within the scope of the CMIA because the statute broadly applies to entities that maintain medical information, provide related software or hardware, receive medical information, or otherwise handle protected health information. The court held that J.M. sufficiently alleged a CMIA claim by asserting that Illuminate had a duty to safeguard medical information, breached that duty through negligent data security practices, and failed to timely notify affected individuals of the breach.

The Court of Appeal also held that Illuminate could be subject to the CRA, which requires businesses maintaining personal information to disclose data breaches “in the most expedient time possible and without unreasonable delay.” The court concluded that J.M. adequately stated a claim because his personal information was disclosed to Illuminate for educational purposes and allegedly compromised in the breach.

Supreme Court Decision

The California Supreme Court reversed the Court of Appeal’s decision and adopted a narrower interpretation of both statutes.

CMIA

The Supreme Court held that the Court of Appeal interpreted the CMIA too broadly by extending the statute to entities that merely possess or store medical information for educational purposes. The Court concluded that Illuminate was not sufficiently alleged to be a “provider of health care” under Civil Code section 56.06 because its platform primarily supported educational functions, including dyslexia screening, student progress monitoring, and educational planning for school districts and educators, rather than medical diagnosis, treatment, or patient-controlled health record management.

The Court also rejected alternative arguments that Illuminate qualified as a covered entity under other CMIA provisions, finding that the complaint did not sufficiently allege that Illuminate received medical information pursuant to a qualifying authorization or otherwise fell within the statute’s coverage.

CRA

The Court similarly concluded that the Court of Appeal interpreted the CRA too expansively. The Supreme Court

held that J.M. was not a statutory “customer” under the CRA because the Ventura County Office of Education, not J.M., contracted with Illuminate and provided the student information at issue. As a result, J.M. lacked standing in pursuing a CRA claim against Illuminate.

CMIA Confidentiality Standard

Although the Court narrowed the scope of entities and individuals covered under the CMIA and CRA, it also clarified the standard for pleading a CMIA confidentiality violation under Civil Code section 56.101.

Rejecting prior appellate decisions that required plaintiffs to show confidential medical information was “actually viewed” by an unauthorized person, the Court held that a breach of confidentiality may occur when medical information is exposed to a significant risk of unauthorized access or use, regardless of whether anyone viewed the information.

The Court explained that relevant considerations may include:

• the nature, duration, and extent of the breach;

• whether the data was specifically targeted;

• the likelihood of unauthorized access or misuse; and

• mitigation efforts undertaken following the incident.

The Court further emphasized that negligent loss of possession alone is neither automatically sufficient nor automatically insufficient to establish liability, and that courts must evaluate the totality of the circumstances.

J.M. v. Illuminate Education, Inc. (2026) 19 Cal.5th 705 [344 Cal. Rptr.3d 178].

Note:

Although the Supreme Court narrowed the categories of entities and individuals that may pursue claims under the CMIA and CRA, the decision also clarified that plaintiffs need not allege that confidential medical information was viewed by an unauthorized person to state a CMIA confidentiality claim. Whether a school, educational institution, or third-party vendor falls within the scope of these statutes may depend on the nature of the services provided and the entity’s role in collecting, maintaining, or using medical information. Schools, school districts, and organizations that contract with educational technology providers should continue to protect confidential medical information and comply with applicable breach notification

requirements. Educational institutions should also ensure that contracts with third-party providers expressly require compliance with applicable data privacy laws, including the CMIA and CRA, and clearly allocate responsibility for data security, incident response, and breach notification obligations.

FOURTH AMENDMENT

U.S. Supreme Court Holds Accessing Google Location History Through Geofence Warrant Constitutes A Fourth Amendment Search.

In May 2019, a man robbed a credit union in Midlothian, Virginia. Surveillance footage showed the robber approaching the credit union while appearing to talk on a cell phone, but investigators were unable to identify him. Approximately one month later, police obtained a geofence warrant directing Google to disclose information about devices located within a 150-meter radius of the credit union during the time of the robbery.

Google’s Location History service records users’ locations approximately every two minutes. At the time of the investigation, Google stored that information on its own servers. The geofence warrant required Google to disclose the information in three stages. First, Google produced anonymous location data for every device within the geofence 30 minutes before and 30 minutes after the robbery. After reviewing that data, police narrowed the list of devices. Google then produced additional anonymous location data for the remaining devices, covering two hours and showing their movements both inside and outside the geofence. After further narrowing the list, police obtained identifying information, including names and phone numbers, for the remaining users. One of those users was Okello Chatrie, whose location data showed him near the credit union shortly before the robbery. A federal grand jury later charged Chatrie with robbery and related firearms offenses.

Chatrie moved to suppress the evidence obtained through the geofence warrant, arguing that law enforcement conducted an unconstitutional search in violation of the Fourth Amendment. The district court concluded that the warrant violated the Fourth Amendment but denied Chatrie’s motion to suppress because the officers reasonably relied on the warrant.

A divided panel of the Fourth Circuit affirmed on different grounds, concluding that no Fourth Amendment search occurred because Chatrie lacked a reasonable expectation of privacy in two hours of Google Location History data. The Fourth Circuit later granted rehearing en banc and affirmed by an equally divided court. The United States Supreme Court granted certiorari to decide whether law enforcement conducted a Fourth Amendment search when it obtained Chatrie’s Google Location History data.

The Supreme Court held that law enforcement had conducted a Fourth Amendment search. The Supreme Court explained that individuals have a reasonable expectation of privacy in historical cell-phone location information because it provides a detailed record of their physical movements. The Supreme Court reasoned that Google’s Location History is even more precise than the cell-site location since it records a user’s location approximately every two minutes, often within about 20 meters, and sometimes identifying the floor of a building where the user was located. The Supreme Court rejected the government’s arguments that the search fell outside the Fourth Amendment because it involved only two hours of location data or because users voluntarily enabled Google’s Location History feature.

The Supreme Court declined to decide whether the geofence warrant itself satisfied the Fourth Amendment’s probable cause and particularity requirements. It remanded the case to the Fourth Circuit to determine whether each stage of the warrant complied with those constitutional requirements. The Supreme Court vacated the Fourth Circuit’s judgment and remanded the case for further proceedings.

Chatrie v. United States (2026) ___U.S.___ [___L.Ed.2d___].

Note:

In this decision, the Supreme Court ruled that law enforcement conducts a Fourth Amendment search when it compels a technology company to disclose a user’s historical Google Location History. The decision has implications for public colleges and universities that maintain digital location information through campus technologies. The decision may affect campus law enforcement investigations involving location data. Public colleges and universities also should consider the decision and consult with counsel when responding to law enforcement requests for location data generated through campus mobile applications, Wi-Fi networks, campus ID card and electronic access systems, and other technologies that track the movements of students, employees, and visitors.

Litigation

Premature Government Claims Act Filing Cannot Be Cured By Refiling Later.

Before a person can file a lawsuit against a public entity, the California Government Claims Act requires a person seeking damages to present a government claim within six months of the injury. They must then wait 45 days for the public entity to accept or reject the claim before they can file a lawsuit. The Act refers to these as the claim-presentation requirement. They provide the public entity an opportunity to investigate the claim and, if appropriate, resolve it without the expense of litigation.

On October 8, 2022, Michelle Harland tripped and fell while walking in West Hollywood. Harland’s counsel mailed a claim to the City requesting damages and claiming that Harland suffered physical and emotional distress as a result of the City’s failure to maintain the sidewalk in safe condition. Harland mailed the claim on April 5, 2023, two days before the six-month deadline.

Two days later, before the City received the claim and before the 45-day response period expired, Harland filed a personal injury lawsuit against the City. The complaint alleged that before filing suit, Harland “presented a claim to [the City] … [and] believes in good faith that these claims have been denied, or have not been acted upon, acknowledged, or responded to in any way, or will be denied in due course.” The City received Harland’s claim on April 10 and received service of the complaint on April 25.

The City demurred, arguing Harland failed to comply with the Government Claims Act because she filed suit before the City had an opportunity to act on her claim. On the same day the City filed its demurrer, Harland served a first amended complaint alleging that more than 45 days had passed without a response from the City. The City again demurred on the same ground.

The trial court overruled the demurrer but stated it would likely grant summary judgment in favor of the City because Harland served the summons and complaint before the City’s 45-day response period expired, defeating the purpose of the statutory waiting period. Harland voluntarily dismissed the action without prejudice.

On February 26, 2024, Harland filed a second lawsuit based on the same accident. The complaint was virtually identical to the amended complaint in the first action, except that it alleged the City denied her government claim in September 2023. The City demurred again, arguing the second lawsuit could not cure the defect created by the prematurely filed

first action. The trial court sustained the demurrer without leave to amend and dismissed the action with prejudice. The trial court concluded that Harland’s initial failure to comply with the Government Claims Act barred the action and that dismissing and refiling did not cure the defect.

Harland appealed the judgment. She argued that the City’s eventual denial of her government claim cured her premature filing of the first lawsuit, making the second lawsuit valid. She also argued that the City failed to adequately meet and confer before filing its first demurrer and therefore waived its objection that the first lawsuit violated the Government Claims Act. The City asked the Court of Appeal to affirm the trial court’s judgment. It argued that Harland’s premature filing permanently violated the Act’s claim-presentation requirements and that dismissing and refiling the action did not cure the defect. The City also argued Harland forfeited her meet-andconfer argument by failing to raise it in the trial court.

The Court of Appeal held that compliance with the Government Claims Act’s claim-presentation requirements is a mandatory condition precedent to suing a public entity. Harland violated those requirements by filing suit before the City received her claim and before the 45-day waiting period expired. The Court of Appeal explained that Harland’s premature filing deprived the City of the opportunity to investigate and potentially resolve the claim before litigation began. The Court of Appeal stated that the fact that the City later denied Harland’s claim was immaterial. The City had already been forced into litigation and “time spent on litigation is gone forever and can never be recovered.”

The Court of Appeal also rejected Harland’s argument that the City waived its objection to her premature filing by failing to adequately meet and confer before filing its first demurrer. The Court of Appeal held Harland forfeited that argument by failing to raise it in the trial court.

The Court of Appeal affirmed the trial court’s judgment and awarded costs to the City.

Harland v. City of West Hollywood (2026) 120 Cal.App.5th 1166.

Note:

Community College Districts, school districts, and public universities are public entities subject to the Government Claims Act. This case demonstrates that courts will strictly enforce the Act’s claim-presentation requirements.

LEGAL UPDATES

Proposed Changes To Title 5 Regulations: California Postsecondary Education Commission Reference Removal.

The California Community Colleges, Chancellor’s Office posted a notice of proposed rulemaking titled “California Postsecondary Education Commission Reference Removal.” You can review the proposed updates here. A public hearing will be held during the next regularly scheduled Board of Governors meeting on July 21, 2026. Comments must be received by the Regulations Coordinator before 4:00 p.m. on August 27, 2026.

E.E.O.C. Rescinds Guidance On Affirmative Action In The Workplace.

On June 30, 2026, the U.S. Equal Employment Opportunity Commission (EEOC) announced that it has rescinded several longstanding guidance documents addressing voluntary workplace affirmative action plans, concluding that the guidance no longer reflects current interpretations of Title VII of the Civil Rights Act or Supreme Court precedent.

The EEOC withdrew a 1979 interpretive rule explaining how employers could voluntarily implement affirmative action plans consistent with Title VII. It also withdrew

section 607 of the EEOC Compliance Manual (adopted in 1981), which provided detailed guidance on the lawful use of affirmative action. According to the agency, these materials had become obsolete and were inconsistent with more recent Supreme Court decisions and developments in the lower courts. As part of its rationale for rescinding the guidance, the EEOC cited the Supreme Court’s 2025 decision in Ames v. Ohio Department of Youth Services, which held that majoritygroup plaintiffs are not subject to a heightened evidentiary standard in workplace discrimination claims.

The EEOC emphasized that the rescission is intended to align its guidance with the text of Title VII and current judicial precedent. The agency’s action does not amend Title VII itself, but it removes longstanding guidance that employers have historically relied upon when developing voluntary affirmative action programs.

I.R.S. Increases Standard Mileage Rate.

On July 13, 2026, the Internal Revenue Service (IRS) issued Announcement 2026-11, 2026-29 I.R.B. 49, which amended the standard mileage rates for 2026 to reflect the rise in fuel costs.

For January 1, 2026 through June 30, 2026, the standard mileage rate for business miles was 72.5 cents per mile. From July 1, 2026 through December 31, 2026, the standard business mileage rate is increased to 76 cents per mile.

Districts that reimburse employees based on the IRS standard mileage rate should review their policies, procedures, and collective bargaining agreements to determine whether this mid-year increase applies automatically.

LCW In The News

To view this article and the most recent LCW attorney-authored articles, please visit: www.lcwlegal.com/news

• LCW Associate Jenny Denny was recently featured in The 74, where she discusses the U.S. Supreme Court’s decision upholding state laws that restrict transgender athletes from participating on girls’ and women’s sports teams. Jenny explains that while the ruling allows states to impose these restrictions, it leaves unresolved broader questions about whether Title IX requires schools to permit transgender students to compete consistent with their gender identity, meaning legal and policy developments are likely to continue. Read more here: https://www.the74million.org/article/ supreme-court-sides-with-red-states-over-bans-on-trans-athletes/

7, 2026 10:00 a.m. - 11:00 a.m.

Benefits Compliance Question

Question:

A Community College District client asked LCW whether Board of Trustees members are required to complete AB 2821 training and Workplace Violence Prevention Training.

Answer:

AB 2821 training requires that college personnel take part in disability training during onboarding and does not expressly include Board of Trustees members. Labor Code section 6401.9(e) requires workplace violence prevention training for employees, and elected trustees are not generally employees. The applicable statutory definition of “employee” is found in Labor Code section 6301.4(a): “every person who is required or directed by an employer, to engage in any employment, or to go to work or be at any time in any place of employment.” (Lab. Code, section 6304.1(a); see also 8 CCR section 347(o) (same definition).) Therefore, neither AB 2821 nor Labor Code section 6401.9 requires trustees to complete either training.

For more information on some of our

and trainings, click on the icons: