BREACH NOTIFICATION – Mandated Timeframe
Without unreasonable delay
FINES & PENALTIES – Violations
$250 per failed notice
Vendor Contract Required
PRIVACY AND SECURITY LAWS
Laws related to personal information and privacy and security.
Michigan Privacy Law Information
Michigan’s laws have a wide-ranging definition of what is considered personal identifying information relating to financial accounts, which includes biometric data, account numbers and passwords.
Organizations must have in place measures to destroy or arrange for the destruction of consumer’s personal identifying records so that the records are made unreadable or indecipherable.
Breach reporting for cases involving 1,000 or more residents of Michigan must be made without unreasonable delay to each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis.
There are specific requirements for consumer notification. If a breach affects residents of other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.
Michigan passed the Insurance Data Security Law, which includes requirements for insurance licensees to protect personal information and investigate and respond to breaches of security. Effective January 20, 2021, licensees must comply with the breach notification requirements, including Commissioner notification within 10 business days.
Failure to provide any notice of a security breach as required may result in a civil fine of up to $250 for each failure to provide notice (with the collective liability for civil fines that arise from the same security breach up to $750,000). The Attorney General or a prosecuting attorney may bring an action to recover a civil fine. Violations of data disposal requirements have a misdemeanor penalty punishable by a fine of up to $250 for each violation.
Michigan Statutes and Laws
Medical Records Access Act
Protection of pupil privacy
Notice of security breach; requirements
Identity theft protection act
Prohibited use of social security number of employee, student, or other individual
Destruction of data containing personal information required
Insurance Code: Privacy of financial information
Insurance Code; Data security
The information provided is not legal guidance or recommendations and are for informational purposes only.