Michigan Data Breach Notification Law: Triggers, Timing, and Penalties

Michigan’s data breach notification law, the Identity Theft Protection Act (Act 452 of 2004, codified primarily at MCL 445.72), requires any person or agency that holds personal information about Michigan residents to notify those residents when a security breach exposes that information. Notice has to go out without unreasonable delay once the breach is discovered, and the statute spells out what the notice must say, how it can be delivered, and the narrow circumstances in which an organization can skip it.¹

Who the Law Applies To

MCL 445.72 reaches any “person or agency” that owns or licenses data containing residents’ personal information. That covers private businesses of every size, nonprofits, and state and local government agencies. Location does not matter; an out-of-state company holding data on Michigan residents is bound by the same rules.¹

Third-party service providers that merely maintain a database they do not own have a parallel duty: when they discover a breach, they must notify the data owner or licensee, who then handles the public disclosure. Ultimate responsibility for getting notice to residents rests with the owner.¹

Two groups fall outside the statute. HIPAA-covered entities that comply with federal breach notification rules are exempt, and so are financial institutions regulated under the Gramm-Leach-Bliley Act (15 USC 6801–6809). Those organizations already answer to federal regulators on breach notice and do not run a parallel Michigan process.¹

What Personal Information Triggers Notice

The statute is triggered by a resident’s name (first name or initial plus last name) paired with one or more sensitive identifiers. Those identifiers include a Social Security number, a driver’s license or state ID number, and a financial account number (such as a credit or debit card number) combined with a security code, password, or access credential that would permit use of the account.

Online account credentials also count when a username or email address appears with a password or security question that would unlock the account. Information that is lawfully available through government records or the public media does not qualify as protected personal information for breach-notification purposes.

Michigan’s statute does not explicitly cover biometric identifiers such as fingerprints or retina scans, so a breach limited to that kind of data may not trigger notification under state law.

What Counts as a Reportable Breach

A reportable breach happens when a resident’s unencrypted and unredacted personal information is both accessed and acquired by an unauthorized person. The statute draws a line between someone viewing data and someone taking possession of it. If an unauthorized party looked at records but did not copy, download, or otherwise obtain them, notification may not be required.¹

The Encryption Carve-Out

Encrypted data is treated differently. If the compromised information was encrypted and the intruder did not get the key, no notice is required. If the intruder obtained both the data and the key needed to read it, the carve-out disappears and the usual rules apply.¹

The Risk-of-Harm Determination

Even when unencrypted information is accessed and acquired, the statute allows the organization to skip notice if the breach is “not likely to cause substantial loss or injury to, or result in identity theft” for affected residents. The organization makes that call using the judgment of an “ordinarily prudent person” in the same position. No outside agency signs off, but a self-serving assessment can draw an enforcement action from the Attorney General.²

When Notice Has to Go Out

Notice is required “without unreasonable delay” after discovery. Michigan sets no hard calendar deadline, which other states often do, so the reasonableness of any delay is judged after the fact. Two situations justify holding the notice:²

Time taken to determine the scope of the breach and restore the integrity of the database. Once that work is done, the clock starts again.
A law enforcement request. If an agency advises that notice would impede a criminal or civil investigation or jeopardize homeland or national security, the organization waits until law enforcement gives the all-clear, then sends notice without unreasonable delay.

Neither reason is open-ended. Dragging out an investigation to avoid sending bad news will be hard to defend.

What the Notice Must Say

A compliant notice must include five elements: a general description of the breach, the categories of personal information that were accessed or acquired, a summary of what the organization has done to protect data from further unauthorized access (if anything), a working telephone number where the recipient can get more information, and a reminder that the recipient should stay vigilant for signs of identity theft.

Written notices sent by mail or email must be “clear and conspicuous.” Telephone notice must deliver the same five elements during the call.¹

How Notice Can Be Delivered

Organizations can use several channels:

Written notice mailed to the resident’s last known postal address.
Email, if the resident previously consented to receive electronic communications.
Telephone, with all five content elements communicated in the call.
Substitute notice, available when the cost of individual notice would exceed $250,000 or the breach affects more than 500,000 Michigan residents. Substitute notice requires all three of the following: email to residents whose addresses the organization has, a conspicuous posting on the organization’s website, and notification to major statewide media outlets.

Substitute notice is a safety valve for massive breaches, not a convenience; it demands more work than picking one of the direct channels.¹

Notice to the Credit Bureaus

When a breach affects more than 1,000 Michigan residents, the organization must also notify each nationwide consumer reporting agency without unreasonable delay. The notice to the agencies has to state the number of resident notices sent and the timing of those notices. Entities subject to the Gramm-Leach-Bliley Act are exempt from this step.²

Penalties for Noncompliance

The Michigan Attorney General enforces the Identity Theft Protection Act. The dollar amounts set out in the statute itself are more modest than many people assume. Sending a fraudulent breach notice (claiming a breach occurred when it did not, with intent to defraud) is a misdemeanor carrying fines from $250 per violation for a first offense up to $750 per violation for a third or subsequent offense, plus up to 93 days of imprisonment.¹

A separate section, MCL 445.72b, covers anyone who knowingly misrepresents a security breach or distributes a solicitation designed to look like an official breach notice. Fines there run from $1,000 per violation for a first offense to $3,000 for a third or subsequent offense, again with up to 93 days imprisonment. The statute preserves civil remedies, so the Attorney General can also pursue action under Michigan’s broader consumer protection authority.³

Michigan does not provide an explicit private right of action under this statute. Residents generally cannot sue an organization directly for failing to send timely notice under Act 452 alone, though claims may be available under other theories such as negligence or Michigan’s broader consumer protection laws.

If You Received a Breach Notice

If a Michigan business or agency has sent you a notice, the strongest immediate step is a credit freeze with all three nationwide credit bureaus: Equifax, Experian, and TransUnion. A freeze blocks new credit accounts from being opened in your name until you lift it. Freezes are free and stay in place until you remove them.⁴

If you think your information has already been misused, you can place an initial fraud alert by contacting just one of the three bureaus; that bureau has to notify the other two. An initial alert lasts one year and tells businesses to verify your identity before opening accounts. If you have confirmed identity theft and filed a report at IdentityTheft.gov or with local police, you can request an extended fraud alert that lasts seven years.⁴

Watch your bank and credit card statements closely for unfamiliar transactions in the weeks and months after the breach. The notice itself has to include a phone number for further assistance; use it if you want specifics on what data of yours was exposed and what the organization is doing in response.

1
Michigan Legislature. Michigan Compiled Laws 445.72 – Notice of Security Breach
2
Michigan Legislature. Michigan Compiled Laws 445.72 – Notice of Security Breach; Requirements
3
Michigan Legislature. Michigan Compiled Laws 445.72b
4
Federal Trade Commission. Credit Freezes and Fraud Alerts