PERSPECTIVES

My Morning Breakfast: When Private Records Become Tools of Harassment

By Sally Vazquez Castellanos


Perspectives: Technology, Global Privacy & Data Protection


Publication date and time: October 23, 2026, at 4:07 a.m.

You used “tools” on me, coordinated political doxxing that infiltrated my homes and vehicles. This is how I fight back.

Over my morning breakfast, a chat with generative AI turned to a not-so-simple question:

What happens when information entrusted to protect our health, educate our children, or support our families becomes a tool for harassment?

For me, this is where discussions about data breaches require a more human perspective. A medical record concerns someone seeking care. A child’s educational record concerns a young person whose needs, vulnerabilities, and future deserve protection. When that information is exposed or deliberately obtained for misuse, the potential consequences extend into homes, classrooms, workplaces, and communities.

My concern is the possibility that sensitive information could be used to identify vulnerabilities, pressure parents, humiliate children, or mobilize others against a family. Those risks deserve serious attention. Establishing that a particular breach supplied information for harassment, however, requires evidence connecting the disclosure to its subsequent use.

California’s legal protections address different parts of this problem: unauthorized access, improper disclosure, stalking, electronic harassment, coercive control, and the misuse of legal proceedings.

Medical records: the vulnerability behind the information

Medical records may contain diagnoses, treatment histories, medications, mental-health information, reproductive-health information, and contact details. Misusing that information could expose a person to humiliation, discrimination, impersonation, or threats tailored to private circumstances.

A breach can involve an outside intrusion, but improper access or disclosure can also occur within an organization. The relevant questions include who accessed the records, whether access was authorized, what was disclosed, and what happened afterward.

HIPAA’s Privacy, Security, and Breach Notification Rules impose obligations on covered entities and their business associates. HIPAA does not govern every person or organization holding health-related information. California’s Confidentiality of Medical Information Act provides additional protections, subject to its coverage requirements and exceptions. 45 C.F.R. pts. 160, 164; Cal. Civ. Code §§ 56–56.37. (hhs.gov⁠, hhs.gov⁠)

California also requires notification of qualifying breaches under statutes governing businesses and public agencies. A breach notice establishes what the organization reports; it does not, by itself, establish who later used the information or why. Cal. Civ. Code §§ 1798.29, 1798.82. (oag.ca.gov⁠)

Children’s educational records: exposure can reach an entire household

Educational records can contain much more than grades. Depending on the records maintained, they may reveal disability-related services, disciplinary matters, family contacts, attendance, or information about a child’s support needs.

My concern is particularly acute when a child’s information could become leverage in an adult dispute. Children should not have their educational needs or private circumstances circulated to punish a parent, influence a community, or invite unwanted attention.

The Family Educational Rights and Privacy Act generally restricts disclosure of personally identifiable information from education records at covered institutions without the required consent, while permitting specified exceptions. Those exceptions have conditions; access for an authorized educational purpose does not create unrestricted permission to redistribute information. 20 U.S.C. § 1232g; 34 C.F.R. §§ 99.30–99.33. (studentprivacy.ed.gov⁠, studentprivacy.ed.gov⁠)

The applicable rules depend on the institution, the record, and the disclosure. Medical and educational confidentiality laws must be examined separately rather than assuming every sensitive record receives identical protection.

Coordinated political doxxing in communities

“Doxxing” generally describes exposing identifying or sensitive information without permission, often to facilitate harassment or intimidation. Political doxxing may target someone because of actual or perceived views, advocacy, public statements, or associations.

The concern becomes especially serious when personal information is assembled and distributed to mobilize others. A hypothetical example would be circulating a resident’s address and family details in a community group, identifying the resident as a political opponent, and directing others to intimidate the household.

Medical or educational information could compound the harm by exposing private vulnerabilities. A disclosure affecting several people could place multiple families at risk. Even accurate information can become a means of intimidation when used in that context.

Coordination must nevertheless be established. Similar posts, shared political views, or several unpleasant encounters do not alone prove an organized effort. Instructions, agreements, communications arranging conduct, or other reliable records may help establish participation.

What California’s electronic-harassment statute requires

Penal Code section 653.2 addresses electronically distributing identifying information or harassing messages without consent, with the specified intent to cause reasonable fear and for the purpose of imminently causing unwanted physical contact, injury, or harassment by third parties, where the material would likely incite or produce that unlawful action.

The requirements are specific. A disclosure does not automatically constitute this offense merely because it is upsetting or politically motivated. The content, context, intent, and other statutory elements matter. Cal. Penal Code § 653.2(a). (law.justia.com⁠)

Political criticism, peaceful protest, advocacy, and lawful complaints remain protected activities. California’s civil harassment statute expressly excludes constitutionally protected activity from its definition of a harassing course of conduct. Cal. Civ. Proc. Code § 527.6(b)(1). (tuolumne.courts.ca.gov⁠)

Private investigators, security personnel, and those who hire them

Private investigators and security professionals perform legitimate work. Hiring them does not establish misconduct, and their licenses do not authorize unlawful methods. California’s licensing bureau expressly explains that private investigators have no law-enforcement authority, even when hired by law enforcement. (bsis.ca.gov⁠)

If evidence shows that someone hired personnel to obtain records unlawfully, intercept communications, or facilitate actionable harassment, the inquiry should examine both the acts performed and the instructions given.

Penal Code section 631 expressly reaches specified participation in unlawful interception, including employing or aiding others to commit prohibited acts. Section 502 addresses specified unauthorized access to computers, systems, and data. Liability depends on each participant’s conduct and the applicable legal requirements. Cal. Penal Code §§ 502, 631(a). (leginfo.legislature.ca.gov⁠)

An investigative assignment, corporate contract, or litigation-related purpose does not itself authorize access to confidential medical or educational records.

Families, coercive control, and litigation pressure

Family Code section 6320 recognizes that disturbing someone’s peace can occur indirectly, through third parties and electronic technologies. Where the relationship and statutory requirements are satisfied, misuse of sensitive information may warrant examination as part of an alleged pattern of intimidation or coercive control. Cal. Fam. Code § 6320(c). (law.justia.com⁠)

Litigation presents separate questions. California’s vexatious-litigant statutes address defined patterns of litigation conduct; an unsuccessful claim or self-represented party is not automatically vexatious. Courts may impose qualifying prefiling restrictions, and separate sanctions provisions address specified misuse of court papers. Cal. Civ. Proc. Code §§ 128.7, 391–391.8. (lassen.courts.ca.gov⁠, courts.ca.gov⁠)

People must remain free to report abuse, seek protection, and pursue legitimate claims. California’s anti-SLAPP statute separately protects qualifying speech and petitioning activity through its prescribed procedures. Id. § 425.16.

Accountability begins with reliable records

Preserve breach notices, original messages, complete threads, URLs, timestamps, and relevant institutional correspondence. Appropriate requests for access or disclosure records may help clarify what occurred, subject to the governing law.

Distinguish the initial exposure from subsequent misuse. Who obtained the information? Who distributed it? What instructions accompanied it? What evidence connects those events?

My personal concern remains the human cost: a patient becoming reluctant to seek care, a parent worrying about a child’s privacy, or a family withdrawing from community life because sensitive information has been exposed. Protecting confidentiality helps preserve trust in the institutions people depend on.

Communities need room for disagreement and civic participation. Families also need protection from unlawful intrusion and intimidation.

Sources and further reading

Legal disclaimer: This article provides general educational information only. It does not constitute legal advice or create an attorney-client relationship. “Coordinated political doxxing” is used descriptively, not as the name of a standalone California offense. A breach or disclosure does not by itself establish harassment, coordination, or liability. Medical privacy, student privacy, restraining orders, sanctions, and constitutional protections involve distinct standards and remedies. Hypothetical examples do not allege misconduct by an identified person or organization. Consult qualified counsel regarding a particular situation.

This article is for general informational and educational purposes only. It does not constitute legal advice or create an attorney-client relationship. 

Accuracy notice: Laws and judicial interpretations may change. Verify statutory language, coverage, exceptions, effective dates, and subsequent developments before relying on any authority.

Generative AI disclosure: This article was prepared with assistance from ChatGPT.