What does Michigan's data breach law ask a business to do?

Who does this law apply to?

A person or agency that owns or licenses data and discovers a security breach must notify each affected Michigan resident.

The duty falls away if the person or agency decides the breach has not caused, and is not likely to cause, substantial loss or injury or identity theft for any Michigan resident.

a person or agency that owns or licenses data that are included in a database that discovers a security breach, or receives notice of a security breach under subsection (2), shall provide a notice of the security breach to each resident of this state who meets 1 or more of the following:

Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state,

What counts as personal information?

Personal information is a resident's name linked to a Social Security number, a driver licence or state ID number, or a financial account or card number together with any code or password that would open the account.

"Personal information" means the first name or first initial and last name linked to 1 or more of the following data elements of a resident of this state: (i) Social security number. (ii) Driver license number or state personal identification card number.

(iii) Demand deposit or other financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to any of the resident's financial accounts.

How fast must people be told?

The law says notice must be given without unreasonable delay.

The text allows a delay while the scope of the breach is worked out, or when a law enforcement agency says notice would impede an investigation.

A person or agency shall provide any notice required under this section without unreasonable delay.

Who else must be told?

After notifying residents, the person or agency must also tell each nationwide consumer reporting agency about the breach, without unreasonable delay.

That step does not apply when 1,000 or fewer Michigan residents are notified.

after a person or agency provides a notice under this section, the person or agency shall notify each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined in 15 USC 1681a(p), of the security breach without unreasonable delay.

(a) The person or agency is required under this section to provide notice of a security breach to 1,000 or fewer residents of this state.

Is encrypted information treated differently?

Notice is owed for information that was unencrypted and unredacted. Encrypted information also counts when the person who took it had unauthorised access to the encryption key.

(a) That resident's unencrypted and unredacted personal information was accessed and acquired by an unauthorized person. (b) That resident's personal information was accessed and acquired in encrypted form by a person with unauthorized access to the encryption key.

What if a vendor holds the data?

A person or agency that keeps a database of data it does not own or license must tell the owner or licensor when it discovers a breach.

a person or agency that maintains a database that includes data that the person or agency does not own or license that discovers a breach of the security of the database shall provide a notice to the owner or licensor of the information of the security breach.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.