How Can We Help?
Michigan | Data Breach Laws
Notification Requirements and Fines
In the state of Michigan, businesses are required to investigate when a data breach compromises personal information. Businesses must notify affected Michigan residents as soon as possible by mail, telephone, or electronic means. When the security breach reaches more than 500,000 people, or the cost of notification exceeds $250,000, public service announcements can be used in lieu of individual notification. When breaches affect more than 1,000 people, consumer-reporting agencies must be notified, too. Failure to do so can result in fines up to $750,000.
| Name of Law / Statute | Identity Theft Protection Act |
| Definition of Protected Information | Combination of (1) name or other identifying info, PLUS (2) one or more of these “data” elements: SSN; driver’s license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes. |
| Who Is Subject to Law? | Any business that owns or licenses PI of Michigan residents |
| Notification of Consumers? | Yes, unless determination of no harm by business |
| By what means? | Written, phone, or electronic (depending on prior relationship); specific regulations re what can and cannot be included in notice |
| Substitute Notice Threshold? | If cost of notice >$250,000 or involves >500k residents |
| Notification of authorities / regulators required? | No |
| By what means? | N/A |
| Regulatory Fines | Up to $250/non-notice, cap at $750k/breach |
| Credit monitoring requirement? | No |
| Private lawsuits allowed? | No |
| Private damages cap? | N/A |
| Regulatory actions allowed? | Yes |
| HIPAA Compliance exemption? | Yes |
| Other (e.g., timeframe) | Law does not apply if PI was encrypted |
| Link to complete law | Michigan’s Data Breach Laws |
Read more on Michigan’s data breach law.