LexLint

Know the law your code answers to.

Law / United States / Michigan

Identity Theft Protection Act, breach of security notice duty

MCL 445.72

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 2 July 2006.

A breach notification rule binding public and private bodies.

As of 28 August 2026.

What it requires

  • Give breach notice without unreasonable delay unless you determine the breach has not caused and is not likely to cause substantial loss, injury, or identity theft to affected Michigan residents.
  • Do not treat a breach exposing only biometric identifiers, with no accompanying Social Security number, driver's license, or financial account number, as triggering this notice duty. Michigan's breach-notice trigger term, personal information (MCL 445.63(r)), excludes biometrics even though the Act's separate, broader personal identifying information term (MCL 445.63(q)) includes them.
  • Look to MCL 445.72(17), not the definitions section, for the Act's publicly-available government-record carve-out.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Identity Theft Protection Act (Act 452 of 2004) requires a person or agency to provide breach notice without unreasonable delay, unless the entity determines the breach has not caused and is not likely to cause substantial loss, injury, or identity theft.

The notice trigger turns on the narrower personal information term at MCL 445.63(r), which does not include biometric data; a breach exposing only biometric identifiers, with no accompanying Social Security number, driver's license, or financial account number, does not trigger this notice duty. The publicly-available carve-out for this notice duty is placed in MCL 445.72(17), not in the definitions section, MCL 445.63. This section applies to a breach discovered or noticed on or after July 2, 2006.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

official Michigan Compiled Laws text, Michigan Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app