Law / United States / 
Michigan
Identity Theft Protection Act, breach of security notice duty
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- If you own or license data in a database, give notice of a security breach to each affected Michigan resident without unreasonable delay after you discover the breach or receive notice of one, unless you determine the breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state (MCL 445.72(1), (4)).
- Do not treat a breach exposing only biometric identifiers, with no accompanying Social Security number, driver's license, or financial account number, as triggering this notice duty. Michigan's breach-notice trigger term, personal information (MCL 445.63(r)), excludes biometrics even though the Act's separate, broader personal identifying information term (MCL 445.63(q)) includes them.
- Look to MCL 445.72(17), not the definitions section, for the Act's publicly-available government-record carve-out.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- When may a person or agency determine under MCL 445.72(1) that a security breach 'has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to' a resident, so that it need not notify, given the standard in subsection (3) that it act with the care an ordinarily prudent person or agency in like position would exercise?
What it makes you log
Logging duty
The section requires notice of a security breach to each affected Michigan resident without unreasonable delay, notice to the owner or licensor of data the person maintains, and, after residents are notified, notice to each nationwide consumer reporting agency stating the number of notices and their timing. These are notifications triggered by an event; none requires a log or record to be kept, and none names an audit or a right to read a record. Both prongs of the reach clause turn on residents of this state; the section has no conducts-business-in-the-state clause.
- Kind
- None
- As of
What this law does
The Identity Theft Protection Act (Act 452 of 2004) requires a person or agency to provide breach notice without unreasonable delay, unless the entity determines the breach has not caused and is not likely to cause substantial loss, injury, or identity theft.
The notice trigger turns on the narrower personal information term at MCL 445.63(r), which does not include biometric data; a breach exposing only biometric identifiers, with no accompanying Social Security number, driver's license, or financial account number, does not trigger this notice duty. The publicly-available carve-out for this notice duty is placed in MCL 445.72(17), not in the definitions section, MCL 445.63. This section applies to a breach discovered or noticed on or after .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .