Law / United States / 
Michigan
Insurance Data Security Act, no private cause of action
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect the Insurance Data Security Act to be enforced by the Director of the Department of Insurance and Financial Services; the chapter expressly forecloses a private cause of action for its own violation.
These lines are LexLint's reading of the law's text. Also read by: Michigan Department of Insurance and Financial Services (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.michigan.gov/-/media/Project/Websites/difs/Bulletins/2021/Bulletin_2021-32-INS.pdf
- Guidance body
- Michigan Department of Insurance and Financial Services
- Open questions
- Does the exclusivity in MCL 500.550, under which the chapter establishes 'the exclusive standards, for this state, applicable to licensees for data security', displace the duty MCL 445.72 places on a licensee to notify affected Michigan residents of a security breach?
What it makes you log
Logging duty
The section says the chapter creates no private cause of action and sets the exclusive state standards for licensees on data security, investigating a cybersecurity event and notifying the director. It states no record duty itself. The record duty sits in section 557(3), which this row does not cite: a licensee keeps records concerning all cybersecurity events for at least 5 years from the event and produces them on demand of the director. Section 555(9) also has an insurer domiciled in the state keep the records supporting its annual compliance certificate for 5 years for examination. The section has no territorial clause of its own.
- Kind
- None
- As of
What this law does
The Insurance Data Security Act expressly does not create or imply a private cause of action for its violation, and does not curtail a private cause of action that would otherwise exist independent of the chapter. The chapter establishes the exclusive Michigan standards for a licensee's data security, cybersecurity-event investigation, and notification to the Director of the Department of Insurance and Financial Services, who enforces it.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .