Makes credit decisions, in Michigan

MCL 37.2101 to 37.2804 · Read the law's page

• It reaches you if you operate as a place of public accommodation or public service, meaning a business, facility or institution whose goods, services, facilities, privileges, advantages, or accommodations are made available to the public (section 301): do not deny an individual the full and equal enjoyment of them because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, or marital status (section 302(a)).
• Do not print, circulate, post, mail, or otherwise publish a statement, advertisement, notice, or sign indicating that the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of a place of public accommodation or public service will be refused, withheld, or denied on those grounds (section 302(b)).
• If an application is made to you for financial assistance or financing in connection with a real estate transaction, or in connection with the construction, rehabilitation, repair, maintenance, or improvement of real property, do not discriminate against the applicant because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, familial status, or marital status of the applicant or an individual residing with the applicant (section 504(1)(a)).
• Do not use a form of application for financial assistance or financing, or make or keep a record or inquiry in connection with an application, that indicates, directly or indirectly, a preference, limitation, specification, or discrimination on those grounds, unless the form is one prescribed for the use of a lender regulated as a mortgagee under the national housing act or by a regulatory board or officer acting under the statutory authority of this state or the United States (section 504(1)(b) and (3)).
• If your business includes engaging in real estate transactions, do not discriminate on those grounds in purchasing loans for acquiring, constructing, improving, repairing, or maintaining a dwelling, or in making or purchasing loans or providing other financial assistance secured by residential real estate (section 504(2)).

MCL 445.72a (Sec. 12a of Act 452 of 2004, added by 2006 PA 566) · Read the law's page

• Destroy, or arrange for the destruction of, any data containing personal information about an individual once that data is removed from the database and is not being retained elsewhere for a purpose state or federal law does not prohibit; retaining the data for an investigation, audit, or internal review does not violate this duty. Destroy the data by shredding, erasing, or otherwise modifying it so it cannot be read, deciphered, or reconstructed through generally available means.
• This binds a person (a private business or other legal entity) or an agency (a Michigan state government department, board, commission, office, authority, or unit, including a public university, but not a court) that maintains a database including personal information about multiple Michigan residents.
• You are considered compliant here if you are already subject to, and in compliance with, a federal law governing the disposal of records containing personal identifying information.
• A knowing violation is a misdemeanor punishable by a fine of up to $250 for each violation; this section creates no private right of action, though it preserves whatever other civil remedy state or federal law might otherwise provide.

2025 S.B. 360, proposed MCL 445.71a and 445.85c (secs. 11a and 20c), as passed by the Senate · Read the law's page

• As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.
• Reasonableness is judged by your size, the amount of personal information you own, possess, collect, or access, the type of activities for which you handle it, and the cost of the procedures relative to your resources. Conforming to the current NIST Cybersecurity Framework 2.0, or already being regulated by Michigan or the federal government and reasonably conforming to HIPAA, Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, is deemed compliance.