Data Breach Notice to Residents and State Authorities in Michigan

At a glance

Requirements one by one

Covered breach and information

Under § 445.63(b), a breach requires unauthorized access and acquisition of computerized information in a database covering multiple people. Section 445.63(r) limits covered data to a name linked to a Social Security number, driver license or state ID number, or financial account number with the credential needed to reach the account. An employee's good-faith access is excluded only if business-related, without misuse or unauthorized disclosure. Under § 445.72(1), an unauthorized person acquiring encrypted information along with access to its key can also trigger notice.

Risk screen and recipients

The owner or licensee may withhold notice if it determines the breach has not caused or is not likely to cause substantial loss, injury, or identity theft to a Michigan resident. Section 445.72(3) requires the care of an ordinarily prudent person or agency in that decision. Otherwise, residents whose unencrypted, unredacted information was accessed and acquired, or whose encrypted information was accessed and acquired with the key, receive notice. A nonowner database maintainer gives the owner or licensor notice under subsection (2), subject to the same risk screen.

Timing and nationwide agencies

Under § 445.72(4), notice goes without unreasonable delay after discovery or owner notification. Scope and restoration measures can justify a delay, with notice following promptly when they end. A law-enforcement agency can also determine that notice would impede a criminal or civil investigation or jeopardize homeland or national security; notice follows its clearance.

After more than 1,000 Michigan resident notices, § 445.72(8) requires notice to nationwide consumer-reporting agencies without unreasonable delay, giving the number and timing of resident notices. That route does not apply to a person or agency subject to the cited federal Gramm-Leach-Bliley provisions.

Delivery and substitute notice

Under § 445.72(5), mail and email are allowed under the listed consent, relationship, or internet-business conditions. Telephone notice must be live, not recorded; without prior telephone consent, an unsuccessful live connection within three business days calls for mail or qualifying email as well. The letter or call gives a general breach description, affected data type, protective steps if applicable, a help number, and a fraud-vigilance reminder under subsection (6). For direct-notice cost above $250,000 or more than 500,000 Michigan residents, substitute notice combines available email, a website post if maintained, and major statewide media.

What trips people up

No routine AG report is stated in current § 445.72. Its subsection (13) lets the Attorney General or a prosecutor pursue a civil fine for a knowing notice failure. That enforcement power is separate from the recipient duties in subsections (1), (2), and (8).

Federal compliance routes are conditional. Section 445.72(9)-(10) treats specified financial-institution notification procedures or HIPAA compliance as compliance with this section. Entity type alone does not establish that the stated requirements have been met.

Common questions

Is there a 45-day current deadline? No. Current § 445.72(4) says “without unreasonable delay.” Pending S.B. 360 proposes a 45-day outside period measured from breach determination; the official action record lists it in House Government Operations.

Can a recorded phone message serve as notice? Section 445.72(5)(c) bars notice given in whole or in part by recorded message.

Statutes and sources

• Mich. Comp. Laws §§ 445.63(b), (e), (r), 445.72(1)-(10), (13) — data, trigger, risk screen, recipients, clocks, delivery, and agency notice. https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72 (accessed 2026-10-14)