Michigan Data Breach Notification Law

Notification deadline: Without unreasonable delay

Enforcement: Michigan Attorney General

Overview

Michigan requires businesses to notify affected residents "without unreasonable delay" after discovering a breach. The Identity Theft Protection Act also mandates security procedures and proper disposal of personal information.

Who Must Be Notified

• • Affected Michigan residents
• • Consumer reporting agencies (if significant number affected)

Covered Data Types

Social Security number, Driver's license number, State ID number, Demand deposit account number, Savings account number, Financial account number with access code, Credit/debit card number

Notification Requirements

• • Written or electronic notice without unreasonable delay
• • May use telephonic notice in some circumstances
• • Describe the breach and types of data involved
• • Provide contact information
• • Substitute notice allowed if cost exceeds $250,000 or 500,000+ affected
• • Notify consumer reporting agencies if significant number affected

Exemptions

• • Encrypted data (if key not compromised)
• • Good faith acquisition by employee
• • Entities in compliance with GLBA
• • Publicly available information

Penalties

Civil fines up to $250 per individual affected. AG can seek injunctions. Actual damages recoverable.