Unless it has actual knowledge of a vendor’s employee’s propensity to engage in such conduct, a regional center administering services for developmentally disabled persons does not owe a duty of care to the “consumer” of those services to protect the consumer from the vendor’s employee’s sexual assault and hence cannot be held liable for such an assault. Even though the regional center exercises sufficient control over its “consumers” to create a special relationship that might otherwise give rise to a duty to protect the consumers, public policy considerations counsel against imposition of such a duty.