Michigan’s data breach notification law, MCL 445.72 of the Identity Theft Protection Act, requires any business or state agency that owns or licenses computerized personal information of Michigan residents to notify affected residents “without unreasonable delay” after discovering a security breach, unless it determines the breach is not likely to cause substantial loss or injury or result in identity theft. If more than 1,000 residents receive notice, the business must also notify the nationwide consumer reporting agencies. Knowing failures to notify can bring civil fines of up to $250 per failure, capped at $750,000 per breach.
The law applies based on where affected people live, not where the business is located. A company in another state that suffers a breach involving Michigan residents’ data must follow Michigan’s rules for those residents. As of this writing, the Michigan Legislature’s website shows the statute was last amended by 2010 PA 315, effective April 1, 2011.
What Counts as “Personal Information”
The definitions are in MCL 445.63. “Personal information” means a Michigan resident’s first name or first initial and last name, linked to one or more of:
- Social Security number
- Driver license number or state personal identification card number
- Demand deposit or other financial account number, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to any of the resident’s financial accounts
Two limits narrow the definition. First, the act defines “data” as computerized personal information, so the notice statute is aimed at electronic records. Second, the duty is triggered only for data that is unencrypted and unredacted, or encrypted data acquired by someone with unauthorized access to the encryption key. “Redact” means truncating so that no more than four sequential digits of a driver license, state ID, or account number, or no more than five sequential digits of a Social Security number, are accessible.
“Encrypted” means transforming data through an algorithmic process so there is a low probability of assigning meaning without a confidential process or key, or securing it by another method that renders the data unreadable or unusable. If an attacker takes both the encrypted data and the key, the encryption safe harbor does not apply.
What Counts as a “Security Breach”
A “security breach” is the unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained as part of a database of personal information about multiple individuals. Both access and acquisition are required.
The definition excludes good-faith access by an employee or other individual if the access was related to the business’s activities and the person did not misuse or disclose the personal information to an unauthorized person.
The Risk-of-Harm Exception
Under MCL 445.72(1), notice is required unless the business “determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state.” Subsection (3) sets the standard for that decision: the business must act with the care an ordinarily prudent person in a similar position would exercise under similar circumstances.
This is a real exception, but it requires an informed judgment. Document the forensic findings, what data was involved, whether it was encrypted, and why you concluded harm was unlikely. If the facts later change, revisit the decision.
Who Must Give Notice
The statute sets two duties:
- A business or agency that owns or licenses the data must notify each affected Michigan resident (MCL 445.72(1)).
- A business that maintains data it does not own or license, such as a vendor or processor, must notify the owner or licensor of the data (MCL 445.72(2)).
Service contracts should spell out how quickly a vendor must report an incident and who will handle resident notices. Section 445.72(7) allows notice to be given under an agreement between the parties, as long as it does not conflict with the statute. Our post on data breach liability discusses how these responsibilities are allocated.
Timing: “Without Unreasonable Delay”
Michigan does not set a fixed number of days. Notice must be given without unreasonable delay, with two permitted delays under MCL 445.72(4):
- Investigation and containment. A business may delay while it takes the measures needed to determine the scope of the breach and restore the reasonable integrity of the database, but must then notify without unreasonable delay.
- Law enforcement. A business may delay if a law enforcement agency determines and advises that notice would impede a criminal or civil investigation or jeopardize homeland or national security. Notice must follow without unreasonable delay once the agency determines that notice will no longer cause that harm.
How to Deliver Notice
Under MCL 445.72(5), notice may be given by one or more of these methods:
- Written notice to the resident’s postal address in the business’s records
- Electronic notice, if the resident expressly consented to electronic notice, the business has an existing relationship with periodic email communications and reasonably believes it has a current address, or the business conducts its business primarily through internet account transactions or on the internet
- Telephone notice by a live individual (not a recorded message), if the resident has consented to telephone notice, or if the business also sends written or electronic notice when no live conversation occurs within three business days after the first attempt
Substitute notice is available if the business shows that notice by those methods would cost more than $250,000 or that it must notify more than 500,000 Michigan residents. Substitute notice requires all three of the following: email to residents whose addresses the business has, a conspicuous posting on the business’s website if it has one, and notice to major statewide media that includes a phone number or website address for more information.
Public utilities that send monthly bills by mail have an alternative method under MCL 445.72(11).
What the Notice Must Say
A written or electronic notice must be clear and conspicuous, and every notice must:
- Describe the security breach in general terms
- Describe the type of personal information involved
- If applicable, generally describe what the business has done to protect data from further breaches
- Include a telephone number where recipients can get assistance or more information
- Remind recipients to remain vigilant for incidents of fraud and identity theft
Notice to Consumer Reporting Agencies
After notifying residents, a business must notify each nationwide consumer reporting agency (as defined in 15 U.S.C. § 1681a(p)) without unreasonable delay, including the number of Michigan notices sent and their timing (MCL 445.72(8)). This duty does not apply if the business notified 1,000 or fewer Michigan residents, or if the business is subject to the Gramm-Leach-Bliley Act privacy provisions, 15 U.S.C. §§ 6801 to 6809.
Michigan’s statute does not require notice to the Michigan Attorney General. Other states’ laws may require regulator notice for their own residents, so a multistate breach needs a state-by-state review.
HIPAA, Financial Institution, and Other Carve-Outs
- HIPAA. A business subject to and complying with HIPAA and its regulations at 45 C.F.R. parts 160 and 164 is considered in compliance with the Michigan statute (MCL 445.72(10)).
- Financial institutions. A financial institution subject to federal interagency guidance on response programs for unauthorized access to customer information, with notice procedures subject to examination by its regulator, is considered in compliance (MCL 445.72(9)). Similar guidance adopted by the National Credit Union Administration also qualifies.
- Public records. The statute does not apply to access or acquisition of government records lawfully made available to the public (MCL 445.72(17)).
- Local laws. Local ordinances regulating the same subject matter are preempted (MCL 445.72(18)).
Penalties
- Failure to notify. A person that knowingly fails to provide a required notice may be ordered to pay a civil fine of not more than $250 for each failure. The Attorney General or a prosecuting attorney may sue to recover it. Aggregate fines for violations arising from the same breach cannot exceed $750,000 (MCL 445.72(13)-(14)).
- Fake notices. Sending a breach notice when no breach occurred, with intent to defraud, is a misdemeanor punishable by up to 93 days in jail and fines of up to $250, $500, or $750 per violation for first, second, and third or later offenses (MCL 445.72(12)).
- Other liability. These penalties do not affect other civil remedies under state or federal law (MCL 445.72(15)).
Responding to a Michigan Breach
A practical sequence: contain the incident and preserve evidence, determine what data and which residents were affected, decide whether the risk-of-harm exception applies and document why, prepare notices that meet the content rules, send consumer reporting agency notices if more than 1,000 Michigan residents are notified, and check other states’ laws for residents elsewhere. Our guides to when companies must give breach notice, responding to a customer data breach, the Illinois data breach law, and California’s notification law cover related requirements. Revision Legal’s data breach attorneys advise businesses on notification decisions and breach response.
Frequently Asked Questions
How long do I have to notify Michigan residents of a data breach?
Michigan does not set a fixed deadline. MCL 445.72(4) requires notice without unreasonable delay. A business may delay while it determines the scope of the breach and restores the reasonable integrity of its database, or when law enforcement advises that notice would impede an investigation, but it must then notify without unreasonable delay.
Does Michigan’s breach law apply to businesses outside Michigan?
Yes. The notice duty depends on whether a Michigan resident’s personal information was involved, not where the business is located. A company based in another state that owns or licenses computerized personal information of Michigan residents must follow MCL 445.72 for those residents.
Do I have to notify the Michigan Attorney General of a data breach?
The Michigan statute does not require notice to the Attorney General. It requires notice to affected residents and, if more than 1,000 Michigan residents are notified, notice to the nationwide consumer reporting agencies. Other states where affected people live may have regulator notice requirements.
What are the penalties for violating Michigan’s data breach law?
A person that knowingly fails to give required notice may be ordered to pay a civil fine of up to $250 per failure, with a $750,000 cap for violations arising from the same breach. The Attorney General or a prosecuting attorney may bring the action. Sending a fake breach notice with intent to defraud is a misdemeanor.
Is encrypted data covered by Michigan’s breach law?
Generally no. Notice is triggered by access to and acquisition of unencrypted and unredacted personal information. Encrypted data is covered if it was acquired by a person with unauthorized access to the encryption key. Truncated numbers that meet Michigan’s redaction definition also fall outside the notice duty.
