LexLint.ioBeta

Know the law your code answers to.

Law / United States / Michigan

Senate Bill 360 (2025-2026), Identity Theft Protection Act reasonable security procedures duty

2025 S.B. 360, proposed MCL 445.71a and 445.85c (secs. 11a and 20c), as passed by the Senate

A security baseline statutes rule binding public and private bodies.

Obligation class
Security

What it requires

  • As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.
  • Reasonableness is judged by your size, the amount and type of personal information you own, possess, collect, or access, and the cost of the procedures relative to your resources. Conforming to the current NIST Cybersecurity Framework 2.0, or already being regulated by Michigan or the federal government and reasonably conforming to Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, is deemed compliance.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Penalty structure

Proposed in Senate Bill 360 as passed by the Senate on : a civil fine of not more than $2,000 would apply to a knowing failure to implement or maintain reasonable security procedures under proposed section 11a; a separate $2,000 fine is proposed for a knowing failure to investigate a suspected breach under proposed section 11b, and the bill separately revises the Act's existing breach-notice civil fine, which is this jurisdiction's privacy-topic row.

Rule
Fixed only
As of
Currency
USD
Fixed cap
2,000

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Senate Bill 360 of the 2025-2026 Regular Session, as passed by the Senate on , would add a new Section 11a to the Identity Theft Protection Act requiring a person or agency that owns, possesses, collects, or accesses personal information to implement and maintain reasonable security procedures.

Those procedures would have to designate a coordinator, identify internal and external risks, include safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures over time.

Reasonableness would turn on the entity's size, the amount and type of personal information involved, and the cost of the procedures relative to the entity's resources. An entity that reasonably conforms to the current NIST Cybersecurity Framework 2.0, or that is regulated by Michigan or the federal government and reasonably conforms to Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, would be deemed compliant.

The bill would also add a duty to investigate a suspected breach under proposed Section 11b. Only the Attorney General could enforce this duty, by a civil action seeking injunctive relief and a fine of up to $2,000 for a knowing failure to implement or maintain reasonable security procedures under proposed section 11a.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .