Michigan | Data Breach Laws

January 15, 2018

How Can We Help?

Michigan | Data Breach Laws

You are here:
< Back

Notification Requirements and Fines

In the state of Michigan, businesses are required to investigate when a data breach compromises personal information. Businesses must notify affected Michigan residents as soon as possible by mail, telephone, or electronic means. When the security breach reaches more than 500,000 people, or the cost of notification exceeds $250,000, public service announcements can be used in lieu of individual notification. When breaches affect more than 1,000 people, consumer-reporting agencies must be notified, too. Failure to do so can result in fines up to $750,000.

Name of Law / Statute Identity Theft Protection Act
Definition of Protected Information Combination of (1) name or other identifying info, PLUS (2) one or more of these “data” elements: SSN; driver’s license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes.
Who Is Subject to Law? Any business that owns or licenses PI of Michigan residents
Notification of Consumers? Yes, unless determination of no harm by business
By what means? Written, phone, or electronic (depending on prior relationship); specific regulations re what can and cannot be included in notice
Substitute Notice Threshold? If cost of notice >$250,000 or involves >500k residents
Notification of authorities / regulators required? No
By what means? N/A
Regulatory Fines Up to $250/non-notice, cap at $750k/breach
Credit monitoring requirement? No
Private lawsuits allowed? No
Private damages cap? N/A
Regulatory actions allowed? Yes
HIPAA Compliance exemption? Yes
Other  (e.g., timeframe) Law does not apply if PI was encrypted
Link to complete law Michigan’s Data Breach Laws

Read more on Michigan’s data breach law.