ROACH, et al. vs CALIFORNIA STATE TEACHERS’ RETIREMENT SYSTEM (CALSTRS), et al.

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

Tentative Ruling

NO APPEARANCE REQUIRED

Defendant California State Teachers’ Retirement System’s (“CalSTRS” or “Defendant”) Demurrer to Plaintiffs Marilyn Roach (“Plaintiff Roach”), Monica Prats, William Prats, and Richard Vonkonsky’s (collectively, “Plaintiffs”) Amended Consolidated Class Action Complaint is ruled upon as follows.

Request for Judicial Notice

The Parties’ respective requests for judicial notice are unopposed and GRANTED. The Court takes judicial notice of the existence of the documents but not the truth of the statements contained therein. (Sosinsky v. Grant (1992) 6 Cal.App.4th 1548, 1564- 70; Kilroy v. State of California (2004) 119 Cal.App.4th 140, 145-148.)

Background/Factual Allegations

This is a consolidated putative class action brought against CalSTRS by Plaintiffs who are pensioners and beneficiaries of CalSTRS. On July 13, 2023, Plaintiff Roach filed her Class Action Complaint against CalSTRS alleging causes of action for negligence, breach of fiduciary duty, violation of the California Consumer Privacy Act (Civil Code section 1798.150), violation of the Customer Records Act (“CRA”) (Civil Code section 1798.82); and unfair competition.

On January 31, 2024, Plaintiffs Monica Prats, William Prats, and Richard Vonkonsky filed their Complaint against CalSTRS (Case No. 24CV001811).

On June 26, 2024, the Court signed and filed the Parties’ “Stipulation to Consolidate Actions for All Purposes and Set Case Schedule,” and consolidated Roach v. CalSTRS, Case No. 23CV004850, and Prats et al. v. CalSTRS, Case No. 24CV001811. (Stipulation and Order, filed 6/26/24.)

On August 23, 2024, Plaintiffs filed their Consolidated Class Action Complaint. On October 29, 2025, Plaintiffs filed the operative Amended Consolidated Class Action Complaint (“1ACC”). Plaintiffs allege six causes of action: (1) negligence; (2) breach of fiduciary duty; (3) breach of implied contract; (4) breach of contract; (6) breach of confidence; (7) breach of implied or express covenant of good faith and fair dealing; (8) declaratory and injunctive relief.[1]

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

Plaintiffs bring their class action against Defendant CalSTRS for its alleged failure to properly secure and safeguard Plaintiffs’ and Class Members’ personally identifiable information (“PII” or “Private Information”). (1ACC, ¶ 1.) Plaintiffs allege that CalSTRS experienced a data breach on or around May 30, 2023 (the “Data Breach”), in which unauthorized third-parties were able to access certain files that CalSTRS shared with PBI Research Services/Berwyn Group (“PBI”). (1ACC, ¶ 3.) Specifically, Plaintiffs allege that in May 2023, “a malicious actor, who is on information and belief, the cybercriminal group Cl0p, gained unauthorized access to CalSTRS’ network and servers purportedly using a vulnerability in the MOVEit file transfer software . . . gained access to the sensitive personal of CalSTRS’ current and former customers . . .[and] exfiltrated substantial amounts of Plaintiffs’ and the Class’s PII.” (1ACC, ¶ 42.)

Considering the occurrence of the Data Breach, Plaintiffs allege that Defendant failed to comply with Federal Trade Commission (“FTC”) guidelines, failed to comply with industry standards, and was negligent. (1ACC, ¶¶ 95-111.) According to the 1ACC, as a result of Defendant’s unreasonable and inadequate data security practices that resulted in the Data Breach, “Plaintiffs and Class Members are at a current and ongoing risk of identity theft and have suffered numerous actual and concrete injuries and damages[.]” (1ACC, ¶ 20.)

Plaintiffs allege they complied with the California Government Claims Act: “Plaintiffs have complied with the government claim presentation requirement under Government Code section 945.4, each having presented a written claim in accordance with the requirements of Government Code section 910 on behalf of themselves and the Class, which have been acted upon or deemed rejected.” (1ACC, ¶ 34.)

The 1ACC also alleges the following class allegations:

Plaintiffs bring this class action on behalf of themselves and on behalf of others similarly situated pursuant to Section 382 of the Code of Civil Procedure. Plaintiffs seek certification of a Class (the “Class”) as defined below:

All California citizens whose PII was compromised in the data breach disclosed by Defendant on June 26, 2023. (1ACC, ¶ 152.)

Defendant hereby demurs to the 1ACC on the grounds that the 1ACC does not state sufficient facts to constitute the causes of action therein. Plaintiffs oppose the demurrer.

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

Legal Standard

The function of a demurrer is to test the sufficiency of the pleading it challenges by raising questions of law. (Salimi v. State Comp. Ins. Fund (1997) 54 Cal.App.4th 216, 219; Nordlinger v. Lynch (1990) 225 Cal.App.3d 1259, 1271.) A demurrer “tests the pleadings alone and not the evidence or other extrinsic matters.” (SKF Farms v. Superior Court (1984) 153 Cal.App.3d 902, 905.) The purpose of a demurrer is to test the legal sufficiency of a claim. (Donabedian v. Mercury Ins. Co. (2004) 116 Cal.App.4th 968, 994.) For the purpose of determining the effect of a complaint, its allegations are liberally construed, with a view toward substantial justice. (Code Civ. Proc., §452; Amarel v. Connell (1988) 202 Cal.App.3d 137, 140-141; Quelimane Co. v. Stewart Title Guaranty Co. (1998) 19 Cal.4th 26, 43, fn. 7.)

In this respect, the Court treats the demurrer as admitting all material facts properly pleaded, but not contentions, deductions or conclusions of fact or law, and considers matters which may be judicially noticed. (Blank v. Kirwan (1985) 39 Cal.3d 311, 318; Poseidon Development, Inc. v. Woodland Lane Estates, LLC (2007) 152 Cal.App.4th 1106, 1111-1112.) Extrinsic evidence may not properly be considered on demurrer or on a motion to strike. (Ion Equipment Corp. v. Nelson (1980) 110 Cal.App.3d 868, 881; Hibernia Savings & Loan Soc. v. Thornton (1897) 117 Cal. 481, 482.)

A demurrer may be sustained only if the complaint lacks any sufficient allegations to entitle the plaintiff to relief. (Financial Corp. of America v. Wilburn (1987) 189 Cal.App.3d 764, 778.) “Plaintiff need only plead facts showing that he may be entitled to some relief we are not concerned with plaintiff's possible inability or difficulty in proving the allegations of the complaint.” (Highlanders, Inc. v. Olsan (1978) 77 Cal.App.3d 690, 696-697.)

Discussion

CalSTRS demurs to the 1ACC as follows:

1. Plaintiffs’ First Cause of Action (Negligence) fails to state sufficient facts to constitute a cause of action because CalSTRS, as a public entity, is immune from liability, and Plaintiffs fail to allege any exceptions from the doctrine of governmental immunity. In addition, Plaintiff’s First Cause of Action fails to state sufficient facts to constitute a cause of action because Plaintiffs fail to allege a cognizable injury. (Civ. Proc. Code, § 430.10(e)).

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

2. Plaintiffs’ Second Cause of Action (Breach of Fiduciary Duty) fails to state sufficient facts to constitute a cause of action because CalSTRS, as a public entity, is immune from liability, and Plaintiffs fail to allege any exceptions from the doctrine of governmental immunity. In addition, Plaintiff’s Second Cause of Action fails to state sufficient facts to constitute a cause of action because Plaintiffs fail to allege that CalSTRS owed any fiduciary duty with respect to Plaintiffs’ data, how CalSTRS breached any such duty, or how Plaintiffs suffered any damages from any such breach. (Civ. Proc. Code, § 430.10(e)).

3. Plaintiffs’ Third Cause of Action (Breach of Implied Contract) fails to state sufficient facts to constitute a cause of action because CalSTRS, as a public entity, is immune from liability, and Plaintiffs fail to allege any exceptions from the doctrine of governmental immunity. Moreover, Plaintiffs do not allege that any implied contract between CalSTRS and Plaintiffs existed. Additionally, Plaintiffs fail to allege that CalSTRS' breached any such contract, and/or that they were damaged by any such breach. (Code Civ. Proc., § 430.10(e)). Furthermore, Plaintiffs' implied contract claim also fails because it cannot be ascertained from the pleadings whether the purported contract Plaintiffs allege is oral or implied by conduct. (Civ. Proc. Code, § 430.10(g)).

4. Plaintiffs’ Fourth Cause of Action (Breach of Contract) fails to state sufficient facts to constitute a cause of action because Plaintiffs do not allege any contract between CalSTRS and Plaintiffs. Additionally, Plaintiffs fail to allege that CalSTRS breached any such contract, and/or that they were damaged by any such breach. (Code Civ. Proc. § 430.10(e)). Furthermore, Plaintiffs’ express contract claim also fails because it cannot be ascertained from the pleadings whether the purported contract that Plaintiffs allege is written, oral, or implied by conduct. (Civ. Proc. Code, § 430.10(g).

5. Plaintiffs’ Sixth Cause of Action (Breach of Confidence) fails to state sufficient facts to constitute a cause of action because CalSTRS, as a public entity, is immune from liability, and Plaintiffs fail to allege any exceptions from the doctrine of governmental immunity. Moreover, Plaintiffs’ claim fails because they do not allege that any information they disclosed to CalSTRS was “novel,” or that CalSTRS’s disclosed any such information. (Civ. Proc. Code, § 430.10(e)).

6. Plaintiffs’ Seventh Cause of Action (Breach of Implied Covenant of Good Faith and Fair Dealing) fails to state sufficient facts to constitute a cause of action because CalSTRS, as a public entity, is immune from liability. Moreover,

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

Plaintiffs’ claim fails to state sufficient facts to constitute a cause of action because Plaintiffs do not allege any contract between CalSTRS and Plaintiffs which would impose a covenant of good faith and fair dealing, or how any such contract was breached by CalSTRS. Additionally, Plaintiffs fail to allege that they were damaged by any such breach. (Code Civ. Proc., § 430.10(e).)

7. Plaintiffs’ Eighth Cause of Action (Declaratory and Injunctive Relief) fails to state sufficient facts to constitute a cause of action because Plaintiffs fail to allege that a justiciable controversy exists (for declaratory relief) and because Plaintiffs seek legal remedy for past harms, not correction for any future or ongoing harms (for injunctive relief). (Civ. Proc. Code, § 430.10(e)). Additionally, because Plaintiffs’ remaining claims fail, Plaintiffs’ declaratory and injunctive relief claims, which derive from and rely on these other claims, must fail as a result. Ball v. FleetBoston Fin. Corp., 164 Cal. App. 4th 794, 800 (2008) (“[A] demurrer is also properly sustained as to a claim for declaratory relief which is ‘wholly derivative,’ of [another] claim.”). (Ntc. Demurrer [footnotes omitted].)

The Court will address each of these arguments, in turn, below.

1. First Cause of Action – Negligence

Government Code section 815 provides that a public entity such as Defendant is not liable for any injury, “whether such injury arises out of an act or omission of the public entity or a public employee or any other person,” unless as otherwise provided by statute. (Gov. Code, § 815(a).) This statute operates to abolish all common law or judicially declared forms of liability for public entities except when provided by statute or the state or federal constitutions. (See, e.g., Becerra v. County of Santa Cruz (1988) 68 Cal.App.4th 1450, 1457.)

CalSTRS argues it is a public entity, and under the Government Claims Act it is entitled to broad immunity – the plaintiff must identify “a specific statute declaring them to be liable, or at least creating some specific duty of care.” (Mov. MPA, p. 10:12-19 [citing San Mateo Unified High School Dist. v. County of San Mateo (2013) 213 Cal.App.4th 418,428].) Defendant contends that the 1ACC does not “mention any statute which directly authorizes suit against CalSTRS.” (Id. at p. 10:25.) Defendant argues, while Plaintiff alleges exceptions to immunity – i.e., mandatory duties and vicarious liability – each exception is inadequately pled.[2]

Mandatory Duty

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

Under Government Code section 815.6, “[w]here a public entity is under a mandatory duty imposed by an enactment that is designed to protect against the risk of a particular kind of injury, the public entity is liable for an injury of that kind proximately caused by its failure to discharge the duty unless the public entity establishes that it exercised reasonable diligence to discharge the duty.” (Gov. Code, § 815.6.) “First and foremost, application of 815.6 requires that the enactment at issue be obligatory, rather than merely discretionary or permissive; it must require, rather than merely authorize or permit, that a particular action be taken or not taken.” (Haggis v City of Los Angeles (2000) 22 Cal.4th 490, 498.)

Regarding mandatory duty, Plaintiffs identify various statutory bases in the 1ACC – 15 U.S.C. § 6809(3)(A), the Gramm-Leach Bliley Act (“GLBA”); Civil Code section 1798, et seq., the Information Practices Act (“IPA”); and Education Code section 22306(a). Plaintiffs allege:

At all times relevant, CalSTRS, and its supervisory and/or administration employees responsible for data security and keeping member data confidential (i.e., Mr. Tirapelle and DOES 1 – 10), had an obligation and a duty to conform to a certain standard of conduct for the protection of Plaintiffs and each of the members of the Class against unreasonable risks of their PII that CalSTRS receives from or on behalf of retiree members, from being downloaded by an unauthorized third party primarily because of the foreseeability of the harm from failing to do so and the sum total of those considerations of policy which lead the law to say that the particular plaintiff or class of persons is entitled to protection here give rise to a duty, and its statutory duties under the Information Practices Act of 1977 (IPA) (Cal.

Civ. Code § 1798 et seq.) and Education Code § 22306(a) (confidential character of data and individual records of CalSTRS members) which are the statutes that provide a basis for governmental liability under Government Code section 815. (1ACC, ¶¶ 355, 376.)

CalSTRS contends that none the identified statutes would impose a mandatory duty or otherwise provide a basis for governmental liability against Defendant.

In opposition, Plaintiffs argue that, (1) the IPA imposes an independent, mandatory duty on CalSTRS to safeguard members’ most sensitive personal information, including SSNs, using reasonable security procedures appropriate to the risk; and (2) Education Code section 22306 imposes a mandatory confidentiality duty on CalSTRS, requiring that member, participant, and beneficiary records— including personally identifiable

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

information—be kept confidential and prohibiting disclosure except in narrowly defined circumstances. (Opp’n, p. 3:10-5:15.)[3]

In reply, regarding the IPA and Education Code section 22306(a), Defendant contends that neither supports the imposition of a mandatory duty as the language in the respective statutes is not phrased in “explicit and forceful language.” (Reply, p. 3:11-18 [citing Guzman v. County of Monterey (2009) 46 Cal.4th 887, 898-899].)

As Defendant aptly notes, in this context, the critical issue is whether the mandatory nature of the duty is “phrased in explicit and forceful language,” requiring a “particular action be taken or not taken.” (Guzman, supra, 46 Cal.4th at pp. 894, 898.) The IPA generally prohibits disclosure of personal information, by any state agency except under certain circumstances. (Civ. Code, § 1798.24). The IPA permits an individual to bring a civil action for damages against a state agency if the agency fails to comply with the IPA and the individual is adversely affected (Id. at § 1798.45).

However, while this statute utilizes mandatory language, requiring agencies to issue breach notifications and meet specific requirements, the Court does not agree that the IPA would impose a mandatory duty under these specific circumstances – the Court is not persuaded that the IPA was designed to prevent data breaches or protect against the specific injury of unauthorized access to personal information, which is the underlying issue here.

Education Code section 22306(a) prohibits an official or employee of the State Teachers’ Retirement System (“the System”), who has access to the individual records of a member, participant, or beneficiary to divulge any confidential information concerning those records to any person except in certain circumstances. Similarly, the Court is not persuaded that Education Code section 22306 would impose a mandatory duty in this context. From its plain language, the provision is administrative in nature, and appears to be designed to protect the privacy of retirement system information rather than to prevent tort-related harms related to the Data Breach as Plaintiffs seemingly suggest.

Defendant’s demurrer to the first cause of action is SUSTAINED on this ground. As this is the first challenge to the pleadings, leave to amend is GRANTED. Because the Court has sustained the demurrer to the first cause of action it is not necessary to address vicarious liability.

2. Second Cause of Action – Breach of Fiduciary Duty

“The elements of a cause of action for breach of fiduciary duty are: (1) existence of a

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

fiduciary duty; (2) breach of the fiduciary duty; and (3) damage proximately caused by the breach.” (Stanley v. Richmond (1995) 35 Cal.App.4th 1070, 1086.)Whether a fiduciary duty exists is generally a question of law, while whether the defendant breached that duty is a question of fact. (Green Valley Landowners Assn. v. City of Vallejo (2015) 241 Cal.App.4th 425, 441.) A fiduciary duty can arise from a recognized legal relationship or from a “confidential relationship,” which can be described as containing the following essential elements: “ ‘1) The vulnerability of one party to the other which 2) results in the empowerment of the stronger party by the weaker which 3) empowerment has been solicited or accepted by the stronger party and 4) prevents the weaker party from effectively protecting itself.’ ” (Thomas v. Regents of University of California (2023) 97 Cal.App.5th 587, 629.)

In addition to the issues regarding immunity as addressed above, Defendant also argues that the second cause of action is subject to demurrer on the ground that Plaintiffs “cannot and do not cite any law which states a retirement fund owes a fiduciary duty of care to its members to specifically keep its PII secure.” (Mov. MPA, p. 16:3-11 [citing City of Hope Nat’l Med. Ctr. (2008) 43 Cal.4th 375, 386].) Defendant contends that while CalSTRS may owe a fiduciary duty to its beneficiaries with respect to managing funds in their retirement accounts, that duty is not at issue in this action, as Plaintiffs allege no facts showing this duty was breached.[4]

In opposition, Plaintiffs argue to the contrary: “Plaintiffs allege facts sufficient to support express and implied contracts between CalSTRS and its members, which independently give rise to fiduciary obligations. Even assuming arguendo that no contract exists, Plaintiffs also allege a fiduciary duty arising from the nature of the relationship and CalSTRS’ superior control over members’ sensitive information.” (Opp’n, p. 11:14-20.)

Pursuant to the 1ACC, Plaintiffs allege the following:

364. Under the California Constitution (Article XVI, Section 17) and the Teachers’ Retirement Law (Education Code §§ 22250), a fiduciary must discharge its duties: solely in the interest of, and for the exclusive purposes of providing benefits to, participants and their beneficiaries.

365. Under both constitutional and statutory law, at all times relevant to this litigation, including all times relevant to CalSTRS’ collection, maintenance, custody, and transfer of Plaintiffs’ and Class Members’ PII, CalSTRS operated as a fiduciary with respect to Plaintiffs and Class Members.

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

366. Under both constitutional and statutory law, a fiduciary’s duty to its participants and beneficiaries “shall take precedence over any other duty.” In trust law, this is referred to as the “primary duty” rule. (1ACC, ¶¶ 364-366.)

Notably, California Constitution Article XVI, section 17 expressly provides that public pension boards have “sole and exclusive fiduciary responsibility over the assets of the public pension or retirement system” and must discharge their duties “solely in the interest of, and for the exclusive purposes of providing benefits to, participants and their beneficiaries.” (Cal Const, Art. XVI § 17(a).)

However, as is further discussed above, an important limitation remains – governmental immunity. As Defendant argues in its demurrer, even if Plaintiffs can allege the existence of a fiduciary duty, based on provisions in the State Constitution, Plaintiffs must still allege an exception to immunity. (Mov. MPA, p. 11:1-2 [citing Krolikowski v. San Diego City Employees' Retirement System (2018) 24 Cal.App.5th 537, 554-557].)

Indeed, as the Krolikowski court noted, “the plain language of [California Constitution Article XVI, section 17] says nothing about creating liability for money damages against public pension plan members in instances when such liability would otherwise be barred by statutory governmental immunity.” (Id. at p. 553.) “In sum, we conclude that based on the Government Claims Act, SDCERS is immune from the tort-based causes of action for breach of fiduciary duty and conversion asserted by Krolikowski and Van Putten, despite the fact that the breach of fiduciary cause of action was based on duties set forth in the California Constitution.” (Id. at pp. 556-557.)

Considering the allegations in the 1ACC, involving a Data Breach and resulting damages, the Court is not persuaded that Plaintiffs have alleged the discharge of a duty “in the interest of, and for the exclusive purposes of providing benefits to, participants and their beneficiaries,” as set forth in California Constitution Article XVI, section 17, to sufficiently assert this cause of action against Defendant.

Defendant’s demurrer to the second cause of action is SUSTAINED on this ground. As this is the first challenge to the pleadings, leave to amend is GRANTED.

3. Third, Fourth, & Seventh Causes of Action – Breach of Implied Contract; Breach of Contract; Breach of Implied Covenant of Good Faith and Fair Dealing

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

The elements of a cause of action for breach of contract are (1) existence of the contract, (2) plaintiff's performance or excuse for nonperformance, (3) defendant's breach, and (4) resulting damages to plaintiff. (Reichert v. General Ins. Co. (1968) 68 Cal.2d 822, 830; Oasis West Realty LLC v. Goldman (2011) 51 Cal.4th 811, 821.) As to the existence of a contract, there are four essential elements: (1) parties capable of contracting, (2) their consent, (3) a lawful object, and (4) sufficient cause or consideration. (Civ.

Code, § 1550.) The elements of a claim for breach of an express or implied contract are the same. (Gomez v. Lincare, Inc. (2009) 173 Cal.App.4th 508, 525.) In an implied contract, the existence and terms of the contract are manifested by the parties’ conduct. (Civ. Code, § 1621.) The existence of an implied contract is generally a question of fact. (Gorlach v. Sports Club Co. (2012) 209 Cal.App.4th 1497, 1508.)

A claim for breach of the implied covenant of good faith and fair dealing requires the existence of a contract, whether express or implied. (Alameda Health System v. Alameda County Employees' Retirement Assn. (2024) 100 Cal.App.5th 1159, 1190.) “The prerequisite for any action for breach of the implied covenant of good faith and fair dealing is the existence of a contractual relationship between the parties, since the covenant is an implied term in the contract.” (Spinks v. Equity Residential Briarwood Apartments (2009) 171 Cal.App.4th 1004, 1033.) Without an underlying contract, there can be no breach of the implied covenant, as “there is no obligation to deal fairly or in good faith absent an existing contract.” (Alameda, supra, 100 Cal.App.5th at p. 1190.)

With respect to the cause of action for breach of implied contract, Plaintiffs allege, the following:

384. In connection with receiving retirement benefit services, Plaintiffs and Class Members entered into implied contracts with Defendant.

385. Pursuant to these implied contracts, Plaintiffs and Class Members performed a benefit for Defendant by directly or indirectly paying monies to Defendant and providing Defendant with their sensitive PII. In exchange for this benefit, Defendant agreed to, among other things, provide retirement benefit services to Plaintiffs and Class Members, take reasonable measures to protect the security and confidentiality of Plaintiffs’ and Class Members’ PII, protect Plaintiffs’ and Class Members’ PII in compliance with federal and state laws and regulations and industry standards, and implement and maintain reasonable measures to protect the security and confidentiality of Plaintiffs’ and Class Members’ PII. (1ACC, ¶¶ 384-385.)

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

With respect to the cause of action for breach of contract, Plaintiffs allege:

396. Plaintiffs and Class Members allege they entered into valid and enforceable express contracts, or were third-party beneficiaries of valid and enforceable express contracts, with Defendant for the provision of retirement benefit services.

397. Specifically, Plaintiffs and Class Members entered into a valid and enforceable express contract with Defendant when Plaintiffs first received retirement benefit services from Defendant.

398. The valid and enforceable express contracts to provide retirement benefit services that Plaintiffs and Class Members entered into with Defendant include Defendant’s promise to protect nonpublic, Private Information given to Defendant or that Defendant gathers on their own from disclosure.

399. Under these express contracts, Defendant and/or their affiliated service providers, promised and were obligated to: (a) provide retirement benefit services to Plaintiffs and Class Members; and (b) protect Plaintiffs and the Class Members’ PII: (i) provided to obtain such retirement benefit services; and/or (ii) created as a result of providing such retirement benefit services. In exchange, Plaintiffs and Members of the Class agreed to pay money for these services, and to turn over their Private Information.

...

401. The express contracts for the provision of retirement benefit services – contracts that include the contractual obligations to maintain the privacy of Plaintiffs’ and Class Members’ Private Information—are formed and embodied in multiple documents, including (among other documents) Defendant’s Conditions of Use, Security Policy, and Privacy Policy.

402. For example, upon registering with Defendant’s online platform, “myCalSTRS,” to manage their retirement benefits information, Plaintiffs were required to agree to certain policies, terms and conditions in which Defendant made representations and promises in exchange for the receipt of Plaintiffs’ information, earnings, and other good and valuable consideration.

403. At all relevant times, those policies, terms and conditions were contained in

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

the myCalSTRS “Conditions of Use,” which stated as follows: “By using myCalSTRS you are agreeing to the policies, terms and conditions contained herein.”

404. At all relevant times, among those policies was the “Security Policy,” which made the following representations and promises to Plaintiffs and Class Members, in the following language or substantially similar language: “Your CalSTRS account information is protected on myCalSTRS. Multiple layers of security are in place to ensure your personal information is kept secure and confidential. In addition, CalSTRS security protection is in place to reduce the risk of identity theft and fraud while using myCalSTRS.”

405. At all relevant times, Defendant also expressly represented to Plaintiffs and Class Members in its Conditions of Use that “myCalSTRS is bound by CalSTRS Internet Privacy Principles and Policy.” At all relevant times, that Privacy Policy made the following representations and promises to Plaintiffs and Class Members, in the following language or substantially similar language: “CalSTRS is committed to responsible information handling practices,” that “CalSTRS has a responsibility to protect its computing resources[,]” and that information submitted to CalSTRS through the myCalSTRS website “will be transmitted to CalSTRS using industry-standard encryption.”

406. Defendant’s express representations, including, but not limited to, express representations found in its Conditions of Use, Security Policy, and Privacy Policy, formed and embodied an express contractual obligation requiring Defendant to implement data security adequate to safeguard and protect the privacy of Plaintiffs’ and Class Members' Private Information. (1ACC, ¶¶ 396- 399, 401-406 [emphasis and footnotes omitted].)

Regarding the cause of action for breach of the implied covenant of good faith and fair dealing, Plaintiffs allege the following:

432. Defendant solicited and invited Plaintiffs and Class Members to provide their PII as part of Defendant’s regular business practices. Plaintiffs and the Class Members accepted Defendant’s offers and provided their PII to Defendant.

433. As a condition of being customers of Defendant, Plaintiffs and Class Members provided and entrusted their PII to Defendant. In so doing, Plaintiffs and Class Members entered into implied or express contracts with Defendant by

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

which Defendant agreed to safeguard and protect such non-public information, to keep such information secure and confidential, and to timely and accurately notify Plaintiffs and Class Members if their data had been breached and compromised or stolen. (1ACC, ¶¶ 432-433.)

Defendant argues that the third and seventh causes of action (breach of implied contract and breach of the implied covenant of good faith and fair dealing) would fail on the basis of governmental immunity.[5] Defendant argues that while express contract claims are not subject to governmental immunity, implied contract claims are. (Reply, p. 7:18-21 [citing Pasadena Live v. City of Pasadena (2004) 114 Cal. App. 4th 1089, 1094].) In this regard, Defendant contends that Plaintiffs do not address this authority nor are they able to state any exception to immunity. For reasons further explained above, the Court agrees with Defendant. Defendant’s demurrer to the third and seventh causes of action is SUSTAINED on this ground. As this is the first challenge to the pleadings, leave to amend is GRANTED.

With respect to the cause of action for breach of contract, Defendant contends that beyond “bald conclusions,” for both their alleged express and implied contract claims, “rather than identifying the specific contract they claim, the specific date it was entered, or its specific terms, Plaintiffs plead only boilerplate conclusions.” (Mov. MPA, p. 15:2- 4.) For this reason, Defendant contends that the 1ACC fails to sufficiently allege the existence of a contract between Plaintiffs and CalSTRS to safeguard Plaintiffs’ data, and thus these contract-based causes of action would fail. (Id. at p. 15:21-23.)

In opposition, pointing to the allegations in the 1ACC, Plaintiffs argue that they have sufficiently alleged these contract-based causes of action because they have alleged CalSTRS’ Privacy and Security Policy set forth specific, concrete security commitments. (Opp’n, pp. 8:17-9:7 [citing In re Yahoo! Inc. Customer Data Sec. Breach Litig. (N.D.Cal. 2017) 2017 WL 3727318, at p. *26; Calhoun v. Google, LLC (9th Cir. 2024) 113 F.4th 1141, 1147–48].) Plaintiffs argue that they allege Defendant expressly represented to Plaintiffs and the Class Members in its Conditions of Use that “myCalSTRS is bound by CalSTRS Internet Privacy Principles and Policy,” and further, the Privacy Policy made detailed measurable commitments. (Id. at p. 9:8-16.)

In reply, Defendant contends that these allegations, as presently framed, constitute unilateral and broad language, and further, much of what Plaintiffs quote are “general principles” – “your. . . information is protected” and “multiple layers of security are in place,” (Reply, p. 8:7-16 [citing 1ACC, ¶¶ 404-405].) For this reason, according to Defendant, Plaintiffs fail to articulate with any specificity the relevant contracts and their

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

terms that CalSTRS allegedly breached.

While pleading a cause of action for breach of a written contact can be accomplished by setting out the terms verbatim in the body of the complaint, or by attaching a copy of the written instrument (e.g., by attachment and/or incorporating by reference); it can also be accomplished by pleading the legal effect of the instrument. (See Miles v. Deutsche Bank National Trust Co. (2015) 236 Cal.App.4th 394, 401-402; McKell v. Washington Mutual Inc. (2006) 142 Cal.App.4th 1457, 1489; Otworth v. Southern Pac. Transportation Co. (1985) 166 Cal.App.3d 452, 459.) In order to plead a contract by its legal effect, plaintiff must “allege the substance of its relevant terms. This is more difficult, for it requires a careful analysis of the instrument, comprehensiveness in statement, and avoidance of legal conclusions.” (McKell, supra, 142 Cal.App.4th at p. 1489.)

The Court does not find that Plaintiffs have sufficiently alleged the legal effect of the purported agreement(s), and thus, fails to allege the breach of the same. Defendant’s demurrer to the fourth cause action is SUSTAINED on this ground. As this is the first challenge to the pleadings, leave to amend is GRANTED.

4. Sixth Cause of Action – Breach of Confidence

Among other things, Defendant argues that the sixth cause of action would be subject to the same issues regarding governmental immunity. [6] The Court agrees. Defendant’s demurrer to the sixth is SUSTAINED on this ground. As this is the first challenge to the pleadings, leave to amend is GRANTED.

5. Eighth Cause of Action – Declaratory and Injunctive Relief

Defendant argues that the eight cause of action for declaratory/injunctive relief fails as it is derivative of the other causes of action, and thus, this cause of action should fail as well.

In opposition, Plaintiffs contend that Code of Civil Procedure section 1060 authorizes declaratory relief to resolve actual controversies about rights and duties “under a contract,” even “before there has been any breach.” Thus, as Plaintiffs argue, a present controversy exists about whether CalSTRS' current security measures satisfy its contractual obligations.

Code of Civil Procedure section 1060 provides:

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

Any person interested under a written instrument, excluding a will or a trust, or under a contract, or who desires a declaration of his or her rights or duties with respect to another, or in respect to, in, over or upon property, or with respect to the location of the natural channel of a watercourse, may, in cases of actual controversy relating to the legal rights and duties of the respective parties, bring an original action or cross-complaint in the superior court for a declaration of his or her rights and duties in the premises, including a determination of any question of construction or validity arising under the instrument or contract.

He or she may ask for a declaration of rights or duties, either alone or with other relief; and the court may make a binding declaration of these rights or duties, whether or not further relief is or could be claimed at the time. The declaration may be either affirmative or negative in form and effect, and the declaration shall have the force of a final judgment. The declaration may be had before there has been any breach of the obligation in respect to which said declaration is sought.

While it is true that a party make seek declaratory relief prior to a breach, it still requires the existence of a written instrument. Having sustained the demurrer to the contractrelated causes of action, the demurrer to the eighth cause of action is also SUSTAINED. As this is the first challenge to the pleadings, leave to amend is GRANTED.

Disposition

Defendant’s demurrer is SUSTAINED with leave to amend as set forth herein.

Plaintiffs may file and serve an amended pleading no later than 20 days after this ruling.

Although not required by statute or court rule, Plaintiffs are directed to present the clerk a copy of this ruling at the time of filing the amended pleading. Defendant may file and serve a response within 30 days of service of amended pleading, 35 days if served by mail.

To request oral argument on this matter, you must call Department 8a at 916-874-5754 by 4:00 p.m., the court day before this hearing and notification of oral argument must be made to the opposing party/counsel. If no call is made, the tentative ruling becomes the order of the court. (Local Rule 1.06.)

Please check your tentative ruling prior to the next Court date at

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

www.saccourt.ca.gov prior to the above referenced hearing date.

If oral argument is requested, the parties may appear by Zoom with the links below:

To join by Zoom Link - https://saccourt-ca-gov.zoomgov.com/j/16108301121 To join by phone dial (833) 568-8864, ID 16108301121

Parties requesting services of a court reporter will need to arrange for private court reporter services at their own expense, pursuant to Government code section 68086 and California Rules of Court, Rule 2.956. Requirements for requesting a court reporter are listed in the Policy for Official Reporter Pro Tempore available on the Sacramento Superior Court website at https://www.saccourt.ca.gov/court-reporters/docs/crtrp- 6a.pdf. Parties may contact Court-Approved Official Reporters Pro Tempore by utilizing the list of Court Approved Official Reporters Pro Tempore available at https://www.saccourt.ca.gov/court-reporters/docs/crtrp-13.Pdf

A Stipulation and Appointment of Official Reporter Pro Tempore (CV/E-206) is required to be signed by each party, the private court reporter, and the Judge prior to the hearing, if not using a reporter from the Court’s Approved Official Reporter Pro Tempore list. Once the form is signed it must be filed with the clerk.

If a litigant has been granted a fee waiver and requests a court reporter, the party must submit a Request for Court Reporter by a Party with a Fee Waiver (CV/E-211) and it must be filed with the clerk at least 10 days prior to the hearing or at the time the proceeding is scheduled if less than 10 days away. Once approved, the clerk will be forward the form to the Court Reporter’s Office and an official reporter will be provided.

This minute order is effective immediately. Pursuant to California Rules of Court, rule 3.1312(a), no further written order or further notice is necessary.

[1] The Court notes that the numbering for the causes of action in the 1ACC, provided in

the caption, does not match the numbering provided in the body/text of the 1ACC. Further, pursuant to the numbering in the body/text of the 1ACC, there does not appear to be any fifth cause of action. As Defendant has utilized the numbering from the text/body of the 1ACC in its moving and reply papers (causes of action 1-4 and 6-8), the Court will utilize the same numbering in its ruling herein. [2] As an additional ground for its demurrer, Defendant also argues that this cause of

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 06/05/2026 Hearing on Demurrer in Department 8A

action fails because Plaintiffs do not allege any cognizable injury was suffered. Having sustained the demurrer as stated below, the Court need not rule on Defendant’s separate basis of cognizable injury. [3] In opposition, Plaintiffs do not address Defendant’s arguments regarding the GLBA,

which the Court construes as a concession on the merits. (See D.I. Chadbourne, Inc. v. Superior Court (1964) 60 Cal.2d 723, 728, fn.4.) Further, to the extent that Plaintiffs appear to raise an argument based on Civil Code section 1798.81.5, this is not supported by any allegations in the 1ACC. (Opp’n, p. 4:9-14.) [4] Defendant also argues that this cause of action fails because Plaintiffs do not allege

any cognizable injury was suffered. Having sustained the demurrer as stated herein, the Court need not rule on Defendant’s separate basis of cognizable injury. [5] Defendant also argues that these causes of action fails because Plaintiffs do not

allege any cognizable injury was suffered. Having sustained the demurrer as stated herein, the Court need not rule on Defendant’s separate basis of cognizable injury.

[6] Defendant also argues that this cause of action fails because Plaintiffs do not allege

any cognizable injury was suffered, and further, that Defendant argues that the sixth cause of action fails because Plaintiffs do not allege that the personal information given to CalSTRS was an “idea” or “novel” in any way. (Mov. MPA, p. 16:13-18 [citing Faris v. Enberg (1979) 97 Cal. App. 3d 309, 323].) Having sustained the demurrer as herein, the Court need not rule on these separate bases.