Processes personal data, in Michigan

MCL 445.72 · Read the law's page

• If you own or license data in a database, give notice of a security breach to each affected Michigan resident without unreasonable delay after you discover the breach or receive notice of one, unless you determine the breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state (MCL 445.72(1), (4)).
• Do not treat a breach exposing only biometric identifiers, with no accompanying Social Security number, driver's license, or financial account number, as triggering this notice duty. Michigan's breach-notice trigger term, personal information (MCL 445.63(r)), excludes biometrics even though the Act's separate, broader personal identifying information term (MCL 445.63(q)) includes them.
• Look to MCL 445.72(17), not the definitions section, for the Act's publicly-available government-record carve-out.

MCL 445.72(13)-(15) · Read the law's page

• Expect a knowing failure to give required breach notice to be enforced by the Michigan Attorney General or a prosecuting attorney, civil fine only, capped at $750,000 in aggregate per breach; the Act does not create a private right of action.

MCL 445.72a (Sec. 12a of Act 452 of 2004, added by 2006 PA 566) · Read the law's page

• Destroy, or arrange for the destruction of, any data containing personal information about an individual once that data is removed from the database and is not being retained elsewhere for a purpose state or federal law does not prohibit; retaining the data for an investigation, audit, or internal review does not violate this duty. Destroy the data by shredding, erasing, or otherwise modifying it so it cannot be read, deciphered, or reconstructed through generally available means.
• This binds a person (a private business or other legal entity) or an agency (a Michigan state government department, board, commission, office, authority, or unit, including a public university, but not a court) that maintains a database including personal information about multiple Michigan residents.
• You are considered compliant here if you are already subject to, and in compliance with, a federal law governing the disposal of records containing personal identifying information.
• A knowing violation is a misdemeanor punishable by a fine of up to $250 for each violation; this section creates no private right of action, though it preserves whatever other civil remedy state or federal law might otherwise provide.

MCL 37.273, 37.275, 37.277, 37.278 · Read the law's page

• If you are an employer (a person, including a unit of state or local government, engaged in a business, industry, profession, trade or other enterprise in Michigan, or its agent, representative or designee), do not request an employee or an applicant for employment to grant access to, allow observation of, or disclose information that allows access to or observation of the employee's or applicant's personal internet account (MCL 37.273(a)).
• Do not discharge, discipline, fail to hire or otherwise penalize an employee or an applicant for employment for refusing to grant, allow or disclose access to a personal internet account (MCL 37.273(b)).
• If you act as an agent, representative or designee of an employer, the same prohibitions bind you, because the Act defines an employer to include its agent, representative or designee (MCL 37.272(c)).

MCL 500.553 · Read the law's page

• If you are a Michigan insurance licensee, treat a biometric record as nonpublic information requiring the chapter's data-security safeguards, alongside a Social Security number, driver's license number, or financial account number.

Motor Vehicle Dealer Data Collection Act, 2026 PA 113, ss. 5 to 17 · Read the law's page

• If you are a third party (a service provider, vendor, dealer data vendor, authorized integrator or any other person except a dealer, a government entity acting under law, an entity acting under a valid court order, a manufacturer or an affiliate), do not access, share, sell, copy, use or transmit a dealer's protected dealer data, which includes the personal and financial data of the dealer's consumers stored in its dealer data system, without the dealer's prior express written consent (2026 PA 113, section 7(1)(a)).
• Do not engage in an act of cyber ransom, and do not take any action by contract, technical means or other means that prohibits or limits a dealer's ability to protect, store, copy, share or use protected dealer data (2026 PA 113, sections 7(1)(b) and (c) and 11(3)).
• If you are a manufacturer or a third party, do not require a dealer to grant you direct or indirect access to its dealer data system (2026 PA 113, section 5(1)).
• If you are a manufacturer, do not access, share, sell, copy, use, transmit or require a dealer to share protected dealer data beyond the required manufacturer data without the dealer's prior express written consent (2026 PA 113, section 11(1)).
• If you are a dealer data vendor or an authorized integrator, access, use, store or share protected dealer data only to the extent a written agreement with the dealer allows, and make the agreement terminable not more than 90 days after the dealer's notice (2026 PA 113, section 17(1) and (2)).
• If you are a dealer data vendor or an authorized integrator and the dealer gives notice of termination, give a successor access to or an electronic copy of all protected dealer data in a commercially reasonable time and format, and delete or return all protected dealer data to the dealer before the agreement ends (2026 PA 113, section 17(3)).
• If you are a dealer data vendor or an authorized integrator, give the dealer on request a list of every entity you share protected dealer data with or have allowed to access it, and allow the dealer to audit your access to and use of protected dealer data (2026 PA 113, section 17(4) and (5)).
• If you are a dealer data vendor, adopt and make available a standardized framework for exchanging and retrieving protected dealer data with an authorized integrator, and provide access to open application programming interfaces (2026 PA 113, section 15(1) and (2)).
• If you are a manufacturer, authorized integrator or other third party, indemnify a dealer for claims or damages that directly result from your violation, your agent's violation or a violation by a vendor you required the dealer to use, in accessing, providing access to, using or disclosing protected dealer data (2026 PA 113, section 13(1)).

2025 S.B. 360, proposed MCL 445.71a and 445.85c (secs. 11a and 20c), as passed by the Senate · Read the law's page

• As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.
• Reasonableness is judged by your size, the amount of personal information you own, possess, collect, or access, the type of activities for which you handle it, and the cost of the procedures relative to your resources. Conforming to the current NIST Cybersecurity Framework 2.0, or already being regulated by Michigan or the federal government and reasonably conforming to HIPAA, Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, is deemed compliance.

MCL 333.17020 · Read the law's page

• Obtain a test subject's written, informed consent before a physician orders a presymptomatic or predictive genetic test in Michigan.
• Do not rely on this section to cover a direct-to-consumer genetic-testing company's privacy practices; no Michigan statute reaches that activity.

MCL 445.63(q), (r) · Read the law's page

• Do not assume Michigan's broader "personal identifying information" term (MCL 445.63(q)), which includes biometrics, is the breach-notice trigger. The trigger is the narrower "personal information" term (MCL 445.63(r)), which excludes biometrics.

Mich. H.B. 6098 (2026), adding section 3q to 1976 PA 331 (MCL 445.903) · Read the law's page

• As passed by the House, HB 6098 bars a person engaged in trade or commerce from using surveillance pricing, a pricing system that increases the price of a good or service based on an individual's personal identifiable data, in the sale of goods and services.
• Dynamic pricing, taxes, delivery fees and retailer loyalty programs are outside the definition, and the bar does not reach a financial institution, a price or credit decision based on a credit report used in compliance with the federal Fair Credit Reporting Act, or the pricing of insurance.

Mich. H.B. 6099 (2026), amending sections 2, 7 and 12 of 2011 PA 15 (MCL 445.312, 445.317 and 445.322) · Read the law's page

• As passed by the House, HB 6099 bars a person from using surveillance pricing, a pricing system that increases the price of a consumer item based on an individual's personal identifiable data, in the display of the total price of a consumer item offered for sale at retail.
• Dynamic pricing, taxes, delivery fees and retailer loyalty programs are outside the definition.