Law / United States / 
Michigan
Insurance Data Security Act, nonpublic information including biometric records
In force since .
A sensitive categories rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- If you are a Michigan insurance licensee, treat a biometric record as nonpublic information requiring the chapter's data-security safeguards, alongside a Social Security number, driver's license number, or financial account number.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P6Data elements within the data actions are inventoried.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does 'Biometric records' in MCL 500.553(i)(ii)(E) reach a faceprint or voiceprint derived from a video or audio recording, a term the chapter does not define?
What it makes you log
Logging duty
The section only defines terms used in the chapter, among them cybersecurity event, information security program, licensee and nonpublic information, including biometric records. It requires no log or record to be kept. The record duty sits in section 557(3), which this row does not cite: a licensee keeps records concerning all cybersecurity events for at least 5 years from the event and produces them on demand of the director. Section 555(9) also has an insurer domiciled in the state keep the records supporting its annual compliance certificate for 5 years for examination. The only territorial element in the definitions is that a consumer is a resident of this state.
- Kind
- None
- As of
What this law does
Michigan adopted the NAIC Insurance Data Security Model Law as Chapter 5A of the Insurance Code (MCL 500.550 to 500.565), effective . Nonpublic information (MCL 500.553(i)) includes electronic information that is not publicly available and that, combined with an identifying element such as a name or number, includes a Social Security number, driver's license or state ID number, financial account or card number, a financial-account access code, or biometric records.
Biometric records appears as a bare, undefined term with no elaboration anywhere in the chapter's definitions and no photograph, video, or audio-recording exclusion or clawback clause of any kind, so whether it excludes a recording-derived identifier cannot be tested against this text. This chapter binds insurance licensees only, not a general private-sector actor.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .