Data Breach Notification Statutes – Michigan
Last Updated: 02/28/2024
- Applicable Statute: Mich. Comp. Laws §§ 445.61, 445.63, 444.64, 445.72
- Attorney General Notice Required: No.
- Consumer Notice Requirements:
- Timing: Must be made without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the database.
- Method:
- Written notice sent to the recipient at the recipient’s postal address in the records of the Entity;
- Telephonic notice given by an individual who represents the Entity if (i) the notice is not given in whole or in part by use of a recorded message, (ii) the recipient has expressly consented to receive notice by telephone, or if the recipient has not expressly consented to receive notice by telephone, the Entity also provides notice pursuant to the above methods if the notice by telephone does not result in a live conversation between the individual representing the Entity and the recipient within 3 business days after the initial attempt to provide telephonic notice; or
- Written notice sent electronically to the recipient if (i) the recipient has expressly consented to receive electronic notice, (ii) the Entity has an existing business relationship with the recipient that includes periodic email communications and based on those communications the Entity reasonably believes that it has the recipient’s current email address, or (iii) the Entity conducts its business primarily through Internet account transactions or on the Internet.
- Content: The security breach notification must be written in a clear and conspicuous manner and include:
- A description of the breach in general terms;
- The of types of personal information accessed;
- A description of what the entity has done to protect against further breaches;
- A telephone number where a recipient may obtain additional information;
- A reminder to stay vigilant and watch for fraud and identity theft.
- Consumer Reporting Agency Obligations: If more than 1,000 residents must be notified, must notify each nationwide consumer reporting agency of the breach without unreasonable delay. The notification must include the number of residents who received notices and the timing of those notices.