Michigan Data Breach
Mich. Comp. Laws § 445.63, § 445.72, et seq.
SUMMARY:
EFFECTIVE. July 2, 2007
WHO DOES THIS LAW APPLY TO. (1) Any person, business or government agency that owns or licenses computerized data that includes Personal Information; and (2) any person, business, or government agency that maintains Personal Information on State residents.
WHAT IS A BREACH. Unauthorized acquisition of and access to computerized data that compromises the security or confidentiality of Personal Information maintained by a person, business, or government agency. A good faith acquisition of Personal Information by an employee or agent of the person, business or government agency for internal purposes only is not a breach, if it is not used for an unlawful purpose or subject to further unauthorized disclosure.
WHAT IS PERSONAL INFORMATION. An individual’s first name or first initial and last name in combination with any one or more of the following data elements:
- Social Security Number.
- Driver’s license number or State identification card number.
- Account number, credit card or debit card number in combination with any required security code, access code, or password that would permit access to the resident’s financial account.
Personal Information does not include publicly available information that is lawfully available from Federal, State, or local government records.
WHO TO NOTIFY OF THE BREACH. Notification of the breach must be sent to the residents affected when a person, business or government agency discovers or is notified of a security breach. No notification is required if the person, business or government agency determines that a security breach has not or is not reasonably likely to cause substantial loss or injury to a resident(s) or result in identity theft. Any notice to affected residents must clearly communicate and include all of the following:
- A general description of the security breach.
- The type of Personal Information that was accessed or used.
- A general description of what has been done to protect the Personal Information from further security breaches.
- A telephone number where additional assistance and information may be obtained.
- Advice for the need to be aware and look for incidents of fraud and identity theft.
If more than 1,000 residents are involved in a breach, the person, business, or government agency shall also notify, without unreasonable delay, all consumer reporting agencies that maintain files on consumers nationwide (as defined by 15 U.S.C. § 1618a(p)), of the number and timing of notices sent. Notice to the consumer reporting agencies does not apply to a person, business or government agency that is subject to Title V of the Federal Gramm-Leach Bliley Act, 15 U.S.C. § 6801 et seq.
EXCEPTION. This Section does not apply to the following:
- A financial institution that is subject to and has notification procedures in place that are subject to audit by its regulator for compliance with the Interagency Guidance on Response Programs for unauthorized access to Personal Information and consumer notice, or similar requirements by the National Credit Union Administration, is considered in compliance with this Section.
- A person, business or government agency that is subject to and complies with the Health Insurance Portability and Accountability Act of 1996 and related regulations to prevent unauthorized access to Personal Information, and the notice requirements, is considered in compliance with this Section.
WHEN TO NOTIFY OF THE BREACH. Notification must be sent when the person, business or government agency becomes aware of an incident of unauthorized acquisition. The disclosure shall be made without unreasonable delay consistent with measures necessary to determine the scope of the breach, and to restore the reasonable integrity of the data system. Notification may be delayed if law enforcement determines it will impede a criminal investigation or jeopardize national security, and such is requested. In that instance, notification will be made without unreasonable delay following clearance by law enforcement.
HOW TO NOTIFY OF THE BREACH. Notice may be provided by one of the following methods:
- Written (to the last known address on file with the person, business, or government agency).
- Telephonic, if all of the following are met:
- Notice does not include a recorded message;
- Express consent to telephonic notice has been provided by the resident(s); and
- Notice is also provided by written or electronic means (within 3 business days of the first attempt to reach the resident by telephone) if the resident is not reached for a live conversation
- Electronic, if any of the following are met:
- Express consent has been provided;
- It is the primary means for communication with the resident; or
- The person, business or government agency conducts business primarily on the internet.
- Substitute notice as provided below.
SUBSTITUTE NOTICE AVAILABLE. If the person, business, or government agency can demonstrate that the cost of providing notice will exceed $250,000 or the affected class of persons to be notified exceeds 500,000, substitute notice may be used. Substitute notice shall consist of all of the following:
- Email notice if the person, business, or government agency has an Email address for the individual(s) subject to notice.
- Conspicuous posting of the notice on the website of the person, business, or government agency if one is maintained.
- Notification to major statewide media, which includes a telephone number or website that may be used to obtain additional assistance and information.
NOTICE TO THIRD-PARTIES. If a person, business or government agency maintains unencrypted data that includes Personal Information that it does not own, then the person, business or government agency shall notify the owner or licensor of a security breach, unless it determines that the breach has not or is not likely to cause substantial loss or injury or result in identity theft to a resident(s). The person, business or government agency that owns or licenses the computerized data shall provide notice to the affected individual(s).
CONSEQUENCES FOR FAILING TO NOTIFY. A person or business that provides notice of a security breach that has not occurred, with the intent to defraud, is guilty of a misdemeanor punishable for up to 30 days in prison, and/or a fine of up to $250 for each violation.
A person or business that knowingly fails to give notice of a security breach, is subject to a fine of up to $250 for each failure to provide notice, not to exceed $750,000. The Attorney General or prosecuting attorney may bring an action to recover a civil fine under this Section.
PRIVATE RIGHT OF ACTION. None provided in the statute.
REQUIREMENTS OF REASONABLE SECURITY MEASURES.
DATA DISPOSAL PROVISIONS. MCL § 445.72a. (1) A person or agency that maintains a database that includes personal information regarding multiple individuals shall destroy any data that contain personal information concerning an individual when that data is removed from the database and the person or agency is not retaining the data elsewhere for another purpose not prohibited by state or federal law. This subsection does not prohibit a person or agency from retaining data that contain personal information for purposes of an investigation, audit, or internal review. (2) A person who knowingly violates this section is guilty of a misdemeanor punishable by a fine of not more than $250.00 for each violation. This subsection does not affect the availability of any civil remedy for a violation of state or federal law. (3) A person or agency is considered to be in compliance with this section if the person or agency is subject to federal law concerning the disposal of records containing personal identifying information and the person or agency is in compliance with that federal law. (4) As used in this section, "destroy" means to destroy or arrange for the destruction of data by shredding, erasing, or otherwise modifying the data so that they cannot be read, deciphered, or reconstructed through generally available means.
LEGISLATIVE UPDATES.
S.B. 309 – Signed into law on 12/30/2006, Effective 7/2/2007.
S.B. 223 – Signed into law on 12/21/2010, Effective 4/1/2011.
H.B. 6406 – Signed into law on 12/28/2018, Effective 1/20/2020.
CITATION:
IDENTITY THEFT PROTECTION ACT (EXCERPT)
Act 452 of 2004
445.63 Definitions.
Sec. 3.
As used in this act:
(a) "Agency" means a department, board, commission, office, agency, authority, or other unit of state government of this state. The term includes an institution of higher education of this state. The term does not include a circuit, probate, district, or municipal court.
(b) "Breach of the security of a database" or "security breach" means the unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained by a person or agency as part of a database of personal information regarding multiple individuals. These terms do not include unauthorized access to data by an employee or other individual if the access meets all of the following:
(i) The employee or other individual acted in good faith in accessing the data.
(ii) The access was related to the activities of the agency or person.
(iii) The employee or other individual did not misuse any personal information or disclose any personal information to an unauthorized person.
(c) "Child or spousal support" means support for a child or spouse, paid or provided pursuant to state or federal law under a court order or judgment. Support includes, but is not limited to, any of the following:
(i) Expenses for day-to-day care.
(ii) Medical, dental, or other health care.
(iii) Child care expenses.
(iv) Educational expenses.
(v) Expenses in connection with pregnancy or confinement under the paternity act, 1956 PA 205, MCL 722.711 to 722.730.
(vi) Repayment of genetic testing expenses, under the paternity act, 1956 PA 205, MCL 722.711 to 722.730.
(vii) A surcharge as provided by section 3a of the support and parenting time enforcement act, 1982 PA 295, MCL 552.603a.
(d) "Credit card" means that term as defined in section 157m of the Michigan penal code, 1931 PA 328, MCL 750.157m.
(e) "Data" means computerized personal information.
(f) "Depository institution" means a state or nationally chartered bank or a state or federally chartered savings and loan association, savings bank, or credit union.
(g) "Encrypted" means transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key, or securing information by another method that renders the data elements unreadable or unusable.
(h) "False pretenses" includes, but is not limited to, a false, misleading, or fraudulent representation, writing, communication, statement, or message, communicated by any means to another person, that the maker of the representation, writing, communication, statement, or message knows or should have known is false or fraudulent. The false pretense may be a representation regarding a past or existing fact or circumstance or a representation regarding the intention to perform a future event or to have a future event performed.
(i) "Financial institution" means a depository institution, an affiliate of a depository institution, a licensee under the consumer financial services act, 1988 PA 161, MCL 487.2051 to 487.2072, 1984 PA 379, MCL 493.101 to 493.114, the motor vehicle sales finance act, 1950 (Ex Sess) PA 27, MCL 492.101 to 492.141, the secondary mortgage loan act, 1981 PA 125, MCL 493.51 to 493.81, the mortgage brokers, lenders, and servicers licensing act, 1987 PA 173, MCL 445.1651 to 445.1684, or the regulatory loan act, 1939 PA 21, MCL 493.1 to 493.24, a seller under the home improvement finance act, 1965 PA 332, MCL 445.1101 to 445.1431, or the retail installment sales act, 1966 PA 224, MCL 445.851 to 445.873, or a person subject to subtitle A of title V of the Gramm-Leach-Bliley act, 15 USC 6801 to 6809.
(j) "Financial transaction device" means that term as defined in section 157m of the Michigan penal code, 1931 PA 328, MCL 750.157m.
(k) "Identity theft" means engaging in an act or conduct prohibited in section 5(1).
(l) "Interactive computer service" means an information service or system that enables computer access by multiple users to a computer server, including, but not limited to, a service or system that provides access to the internet or to software services available on a server.
(m) "Law enforcement agency" means that term as defined in section 2804 of the public health code, 1978 PA 368, MCL 333.2804.
(n) "Local registrar" means that term as defined in section 2804 of the public health code, 1978 PA 368, MCL 333.2804.
(o) "Medical records or information" includes, but is not limited to, medical and mental health histories, reports, summaries, diagnoses and prognoses, treatment and medication information, notes, entries, and x-rays and other imaging records.
(p) "Person" means an individual, partnership, corporation, limited liability company, association, or other legal entity.
(q) "Personal identifying information" means a name, number, or other information that is used for the purpose of identifying a specific person or providing access to a person's financial accounts, including, but not limited to, a person's name, address, telephone number, driver license or state personal identification card number, social security number, place of employment, employee identification number, employer or taxpayer identification number, government passport number, health insurance identification number, mother's maiden name, demand deposit account number, savings account number, financial transaction device account number or the person's account password, any other account password in combination with sufficient information to identify and access the account, automated or electronic signature, biometrics, stock or other security certificate or account number, credit card number, vital record, or medical records or information.
(r) "Personal information" means the first name or first initial and last name linked to 1 or more of the following data elements of a resident of this state:
(i) Social security number.
(ii) Driver license number or state personal identification card number.
(iii) Demand deposit or other financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to any of the resident's financial accounts.
(s) "Public utility" means that term as defined in section 1 of 1972 PA 299, MCL 460.111.
(t) "Redact" means to alter or truncate data so that no more than 4 sequential digits of a driver license number, state personal identification card number, or account number, or no more than 5 sequential digits of a social security number, are accessible as part of personal information.
(u) "State registrar" means that term as defined in section 2805 of the public health code, 1978 PA 368, MCL 333.2805.
(v) "Trade or commerce" means that term as defined in section 2 of the Michigan consumer protection act, 1971 PA 331, MCL 445.902.
(w) "Vital record" means that term as defined in section 2805 of the public health code, 1978 PA 368, MCL 333.2805.
(x) "Webpage" means a location that has a uniform resource locator or URL with respect to the world wide web or another location that can be accessed on the internet.
History: 2004, Act 452, Eff. Mar. 1, 2005 ;-- Am. 2006, Act 566, Eff. July 2, 2007 ;-- Am. 2010, Act 318, Eff. Apr. 1, 2011
445.72 Notice of security breach; requirements.
Sec. 12.
(1) Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state, a person or agency that owns or licenses data that are included in a database that discovers a security breach, or receives notice of a security breach under subsection (2), shall provide a notice of the security breach to each resident of this state who meets 1 or more of the following:
(a) That resident's unencrypted and unredacted personal information was accessed and acquired by an unauthorized person.
(b) That resident's personal information was accessed and acquired in encrypted form by a person with unauthorized access to the encryption key.
(2) Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state, a person or agency that maintains a database that includes data that the person or agency does not own or license that discovers a breach of the security of the database shall provide a notice to the owner or licensor of the information of the security breach.
(3) In determining whether a security breach is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state under subsection (1) or (2), a person or agency shall act with the care an ordinarily prudent person or agency in like position would exercise under similar circumstances.
(4) A person or agency shall provide any notice required under this section without unreasonable delay. A person or agency may delay providing notice without violating this subsection if either of the following is met:
(a) A delay is necessary in order for the person or agency to take any measures necessary to determine the scope of the security breach and restore the reasonable integrity of the database. However, the agency or person shall provide the notice required under this subsection without unreasonable delay after the person or agency completes the measures necessary to determine the scope of the security breach and restore the reasonable integrity of the database.
(b) A law enforcement agency determines and advises the agency or person that providing a notice will impede a criminal or civil investigation or jeopardize homeland or national security. However, the agency or person shall provide the notice required under this section without unreasonable delay after the law enforcement agency determines that providing the notice will no longer impede the investigation or jeopardize homeland or national security.
(5) Except as provided in subsection (11), an agency or person shall provide any notice required under this section by providing 1 or more of the following to the recipient:
(a) Written notice sent to the recipient at the recipient's postal address in the records of the agency or person.
(b) Written notice sent electronically to the recipient if any of the following are met:
(i) The recipient has expressly consented to receive electronic notice.
(ii) The person or agency has an existing business relationship with the recipient that includes periodic electronic mail communications and based on those communications the person or agency reasonably believes that it has the recipient's current electronic mail address.
(iii) The person or agency conducts its business primarily through internet account transactions or on the internet.
(c) If not otherwise prohibited by state or federal law, notice given by telephone by an individual who represents the person or agency if all of the following are met:
(i) The notice is not given in whole or in part by use of a recorded message.
(ii) The recipient has expressly consented to receive notice by telephone, or if the recipient has not expressly consented to receive notice by telephone, the person or agency also provides notice under subdivision (a) or (b) if the notice by telephone does not result in a live conversation between the individual representing the person or agency and the recipient within 3 business days after the initial attempt to provide telephonic notice.
(d) Substitute notice, if the person or agency demonstrates that the cost of providing notice under subdivision (a), (b), or (c) will exceed $250,000.00 or that the person or agency has to provide notice to more than 500,000 residents of this state. A person or agency provides substitute notice under this subdivision by doing all of the following:
(i) If the person or agency has electronic mail addresses for any of the residents of this state who are entitled to receive the notice, providing electronic notice to those residents.
(ii) If the person or agency maintains a website, conspicuously posting the notice on that website.
(iii) Notifying major statewide media. A notification under this subparagraph shall include a telephone number or a website address that a person may use to obtain additional assistance and information.
(6) A notice under this section shall do all of the following:
(a) For a notice provided under subsection (5)(a) or (b), be written in a clear and conspicuous manner and contain the content required under subdivisions (c) to (g).
(b) For a notice provided under subsection (5)(c), clearly communicate the content required under subdivisions (c) to (g) to the recipient of the telephone call.
(c) Describe the security breach in general terms.
(d) Describe the type of personal information that is the subject of the unauthorized access or use.
(e) If applicable, generally describe what the agency or person providing the notice has done to protect data from further security breaches.
(f) Include a telephone number where a notice recipient may obtain assistance or additional information.
(g) Remind notice recipients of the need to remain vigilant for incidents of fraud and identity theft.
(7) A person or agency may provide any notice required under this section pursuant to an agreement between that person or agency and another person or agency, if the notice provided pursuant to the agreement does not conflict with any provision of this section.
(8) Except as provided in this subsection, after a person or agency provides a notice under this section, the person or agency shall notify each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined in 15 USC 1681a(p), of the security breach without unreasonable delay. A notification under this subsection shall include the number of notices that the person or agency provided to residents of this state and the timing of those notices. This subsection does not apply if either of the following is met:
(a) The person or agency is required under this section to provide notice of a security breach to 1,000 or fewer residents of this state.
(b) The person or agency is subject to 15 USC 6801 to 6809.
(9) A financial institution that is subject to, and has notification procedures in place that are subject to examination by the financial institution's appropriate regulator for compliance with, the interagency guidance on response programs for unauthorized access to customer information and customer notice prescribed by the board of governors of the federal reserve system and the other federal bank and thrift regulatory agencies, or similar guidance prescribed and adopted by the national credit union administration, and its affiliates, is considered to be in compliance with this section.
(10) A person or agency that is subject to and complies with the health insurance portability and accountability act of 1996, Public Law 104-191, and with regulations promulgated under that act, 45 CFR parts 160 and 164, for the prevention of unauthorized access to customer information and customer notice is considered to be in compliance with this section.
(11) A public utility that sends monthly billing or account statements to the postal address of its customers may provide notice of a security breach to its customers in the manner described in subsection (5), or alternatively by providing all of the following:
(a) As applicable, notice as described in subsection (5)(b).
(b) Notification to the media reasonably calculated to inform the customers of the public utility of the security breach.
(c) Conspicuous posting of the notice of the security breach on the website of the public utility.
(d) Written notice sent in conjunction with the monthly billing or account statement to the customer at the customer's postal address in the records of the public utility.
(12) A person that provides notice of a security breach in the manner described in this section when a security breach has not occurred, with the intent to defraud, is guilty of a misdemeanor punishable as follows:
(a) Except as otherwise provided under subdivisions (b) and (c), by imprisonment for not more than 93 days or a fine of not more than $250.00 for each violation, or both.
(b) For a second violation, by imprisonment for not more than 93 days or a fine of not more than $500.00 for each violation, or both.
(c) For a third or subsequent violation, by imprisonment for not more than 93 days or a fine of not more than $750.00 for each violation, or both.
(13) Subject to subsection (14), a person that knowingly fails to provide any notice of a security breach required under this section may be ordered to pay a civil fine of not more than $250.00 for each failure to provide notice. The attorney general or a prosecuting attorney may bring an action to recover a civil fine under this section.
(14) The aggregate liability of a person for civil fines under subsection (13) for multiple violations of subsection (13) that arise from the same security breach shall not exceed $750,000.00.
(15) Subsections (12) and (13) do not affect the availability of any civil remedy for a violation of state or federal law.
(16) This section applies to the discovery or notification of a breach of the security of a database that occurs on or after July 2, 2006.
(17) This section does not apply to the access or acquisition by a person or agency of federal, state, or local government records or documents lawfully made available to the general public.
(18) This section deals with subject matter that is of statewide concern, and any charter, ordinance, resolution, regulation, rule, or other action by a municipal corporation or other political subdivision of this state to regulate, directly or indirectly, any matter expressly set forth in this section is preempted.
History: Add. 2006, Act 566, Eff. July 2, 2007 ;-- Am. 2010, Act 315, Eff. Apr. 1, 2011
445.72a Destruction of data containing personal information required; violation as misdemeanor; fine; compliance; "destroy" defined.
Sec. 12a.
(1) Subject to subsection (3), a person or agency that maintains a database that includes personal information regarding multiple individuals shall destroy any data that contain personal information concerning an individual when that data is removed from the database and the person or agency is not retaining the data elsewhere for another purpose not prohibited by state or federal law. This subsection does not prohibit a person or agency from retaining data that contain personal information for purposes of an investigation, audit, or internal review.
(2) A person who knowingly violates this section is guilty of a misdemeanor punishable by a fine of not more than $250.00 for each violation. This subsection does not affect the availability of any civil remedy for a violation of state or federal law.
(3) A person or agency is considered to be in compliance with this section if the person or agency is subject to federal law concerning the disposal of records containing personal identifying information and the person or agency is in compliance with that federal law.
(4) As used in this section, "destroy" means to destroy or arrange for the destruction of data by shredding, erasing, or otherwise modifying the data so that they cannot be read, deciphered, or reconstructed through generally available means.
History: Add. 2006, Act 566, Eff. July 2, 2007
445.72b Misrepresentation by advertisement or solicitation prohibited; violation as misdemeanor; penalty; civil remedy.
Sec. 12b.
(1) A person shall not distribute an advertisement or make any other solicitation that misrepresents to the recipient that a security breach has occurred that may affect the recipient.
(2) A person shall not distribute an advertisement or make any other solicitation that is substantially similar to a notice required under section 12(5) or by federal law, if the form of that notice is prescribed by state or federal law, rule, or regulation.
(3) A person who knowingly or intentionally violates this section is guilty of a misdemeanor punishable as follows:
(a) Except as otherwise provided in subdivisions (b) and (c), by imprisonment for not more than 93 days or a fine of not more than $1,000.00 for each violation, or both.
(b) For a second violation, by imprisonment for not more than 93 days or a fine of not more than $2,000.00 for each violation, or both.
(c) For a third or subsequent violation, by imprisonment for not more than 93 days or a fine of not more than $3,000.00 for each violation, or both.
(4) Subsection (3) does not affect the availability of any civil remedy for a violation of this section or any other state or federal law.
History: Add. 2006, Act 566, Eff. July 2, 2007 ;-- Am. 2010, Act 315, Eff. Apr. 1, 2011
445.73 Verification of information; use of vital record.
Sec. 13.
(1) A law enforcement agency or victim of identity theft may verify information from a vital record from a local registrar or the state registrar in the manner described in section 2881(2) of the public health code, 1978 PA 368, MCL 333.2881.
(2) A state registrar or local registrar that verifies information from a vital record under section 2881(2) of the public health code, 1978 PA 368, MCL 333.2881, for a law enforcement agency investigating identity theft may provide that law enforcement agency with all of the following information about any previous requests concerning that public record that is available to the registrar:
(a) Whether or not a certified copy or copies of the record were requested.
(b) The date or dates a copy or copies of the record were issued.
(c) The name of each applicant who requested the record.
(d) The address, e-mail address, telephone number, and other identifying information of each applicant who requested the record.
(e) Payment information regarding each request.
(3) A state registrar or local registrar that verifies information from a vital record under section 2881(2) of the public health code, 1978 PA 368, MCL 333.2881, for an individual who provides proof that he or she is a victim of identity theft may provide that individual with all of the following information about any previous requests concerning that public record that is available to the registrar:
(a) Whether or not a certified copy or copies of the record were requested.
(b) The date or dates a copy or copies of the record were issued.
(4) For purposes of subsection (3), it is sufficient proof that an individual is a victim of identity theft for a state registrar or local registrar to provide the information described in that subsection if he or she provides the registrar with a copy of a police report evidencing the claim that he or she is a victim of identity theft; and, if available, an affidavit of identity theft, in a form developed by the state registrar in cooperation with the attorney general for purposes of this subsection.
(5) A law enforcement agency may request an administrative use copy of a vital record from the state registrar in the manner described in section 2891 of the public health code, 1978 PA 368, MCL 333.2891.
(6) A law enforcement agency may request an administrative use copy of a vital record from a local registrar in the manner described in section 2891 of the public health code, 1978 PA 368, MCL 333.2891, if the request for the administrative use copy is in writing and contains both of the following:
(a) A statement that the law enforcement agency requires information from a vital record beyond the information the local registrar may verify under subsections (1) and (2).
(b) The agreement of the law enforcement agency that it will maintain the administrative use copy of the vital record in a secure location and will destroy the copy by confidential means when it no longer needs the copy.
History: 2004, Act 452, Eff. Mar. 1, 2005
For more information, see here: https://www.legislature.mi.gov/(S(a2jdr2cfyczs5a0hg02f2vhe))/mileg.aspx?page=getobject&objectname=mcl-445-63
AND
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.