Michigan's Breach Notice Law: MCL 445.72, the Risk-of-Harm Test and the Identity Theft Protection Act

The Breach Duty in MCL 445.72

Michigan's breach notice requirement is not a freestanding statute. It is section 12 of the Identity Theft Protection Act, 2004 PA 452, which took effect March 1, 2005 and is mostly about identity theft crimes and credit practices. The history line for MCL 445.72 shows it was added by 2006 PA 566, effective July 2, 2007, and amended by 2010 PA 315, effective April 1, 2011. Subsection (16) of the section itself provides that it applies to "the discovery or notification of a breach of the security of a database that occurs on or after July 2, 2006."

Subsection (1) puts the duty on "a person or agency that owns or licenses data that are included in a database that discovers a security breach, or receives notice of a security breach." Notice goes to each Michigan resident whose "unencrypted and unredacted personal information was accessed and acquired by an unauthorized person," or whose personal information "was accessed and acquired in encrypted form by a person with unauthorized access to the encryption key." Subsection (2) requires a person or agency that maintains a database it does not own or license to notify the owner or licensor.

The definitions in MCL 445.63 shape the duty in ways the section does not repeat:

• A "security breach" is "the unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained by a person or agency as part of a database of personal information regarding multiple individuals." Both access and acquisition are required, and the data must sit in a multi-person database.
• "Data" means "computerized personal information," so paper records are outside the section.
• "Personal information" is a first name or first initial and last name linked to a Social Security number, a driver license or state ID number, or a demand deposit or other financial account number or card number with any required code or password.
• "Redact" means altering data so that no more than four sequential digits of a license, state ID or account number, or no more than five sequential digits of a Social Security number, are accessible.
• "Encrypted" means transformation by an algorithmic process into a form with "a low probability of assigning meaning without use of a confidential process or key," or another method rendering the elements unreadable or unusable.
• "Agency" means a unit of state government and includes state institutions of higher education, but not circuit, probate, district or municipal courts.

Read with subsection (1)(a), an entity's duty to residents arises where personal information was unencrypted and unredacted, which means data that was either encrypted or redacted falls outside that clause, subject to the encryption-key clause in (1)(b). Good faith employee access related to the entity's activities, without misuse or onward disclosure, is excluded from the breach definition.

The Risk-of-Harm Determination

Both notice duties open with the same exception: "Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state." Subsection (3) sets the standard for that determination: the entity "shall act with the care an ordinarily prudent person or agency in like position would exercise under similar circumstances."

The text places the determination with the breached entity itself. It does not require the determination to be written down, reported to anyone or retained. It does not define "substantial loss or injury." The exception also applies to the maintainer's duty to tell the data owner under subsection (2), so a vendor that determines harm is unlikely is not required by the section to notify its client.

Neither of the other two statutes in this batch has an equivalent. Minnesota requires notice whenever unencrypted personal information was or is reasonably believed to have been acquired (see the post on § 325E.61), and Tennessee applies a materiality test inside the breach definition and a fixed 45-day deadline (see the post on § 47-18-2107).

Timing and Content of Notice

Subsection (4) requires notice "without unreasonable delay" and sets no day count. Delay is permitted in two situations: while the entity takes measures "necessary to determine the scope of the security breach and restore the reasonable integrity of the database," after which notice is due without unreasonable delay; or where a law enforcement agency "determines and advises" that notice "will impede a criminal or civil investigation or jeopardize homeland or national security." The reference to civil investigations and national security is broader than the criminal-investigation delay in the Minnesota and Tennessee statutes.

Subsection (5) is unusually specific about delivery. Written notice goes to the postal address on record. Electronic notice is permitted only if the recipient expressly consented, the entity has an existing relationship with periodic email from which it reasonably believes it has a current address, or it conducts business primarily online. Telephone notice must be given by a live individual, not "in whole or in part by use of a recorded message," and if the recipient has not consented to telephone notice and no live conversation occurs "within 3 business days after the initial attempt," written or electronic notice must also be sent. Substitute notice is available above $250,000 in cost or 500,000 Michigan residents and requires email where available, website posting, and notice to major statewide media including a telephone number or website for assistance.

Subsection (6) prescribes the content. Every notice must describe the breach in general terms, describe the type of personal information involved, "if applicable, generally describe what the agency or person providing the notice has done to protect data from further security breaches," include a telephone number for assistance, and "remind notice recipients of the need to remain vigilant for incidents of fraud and identity theft." Subsection (7) allows notice under an agreement with another person, and subsection (11) gives a public utility that mails monthly statements an alternative combining media notice, website posting and a notice in the billing envelope.

Subsection (8) requires notice, after the resident notices, to each nationwide consumer reporting agency "without unreasonable delay," including "the number of notices that the person or agency provided to residents of this state and the timing of those notices." It does not apply if 1,000 or fewer residents are notified, or if the entity is subject to the Gramm-Leach-Bliley Act. The section contains no notice to the Attorney General. Subsections (9) and (10) deem compliant a financial institution following the federal interagency response-program guidance and an entity that complies with HIPAA.

Civil Fines and the Per-Breach Cap

Subsection (13) provides that a person "that knowingly fails to provide any notice of a security breach required under this section may be ordered to pay a civil fine of not more than $250.00 for each failure to provide notice," and that "the attorney general or a prosecuting attorney may bring an action to recover a civil fine." Subsection (14) caps aggregate fines for multiple violations arising from the same breach at $750,000. Subsection (15) states that these provisions "do not affect the availability of any civil remedy for a violation of state or federal law." The fine requires a knowing failure, and the section names county prosecutors as enforcers alongside the Attorney General.

Subsection (12) runs the other way, punishing false notices. A person who sends a breach notice "when a security breach has not occurred, with the intent to defraud" commits a misdemeanor punishable by up to 93 days in jail and a fine rising from $250 to $750 for repeat violations. Subsection (18) preempts local ordinances on any matter expressly set out in the section.

No action by the Attorney General or a prosecuting attorney to recover a fine under subsection (13) was located for this post, so the enforcement record under the section stands at zero. The Attorney General has participated in multistate data-security settlements, including the 2019 Equifax settlement, in which Michigan's share was stated as $4,639,248, but that release does not identify the state statutes relied on. In an August 5, 2026 consumer alert, the office cited breaches at Munson Healthcare, 700Credit, TransUnion and Corewell Health and stated that "at least 34 other states currently require that entities notify the state Attorney General."

Insurers: A Parallel Regime Under the Insurance Code

MCL 445.64, added by 2018 PA 649 and effective January 20, 2020 according to its history line, provides that an entity "subject to or regulated under the insurance code of 1956" is "exempt from this act," as is an affiliate under common ownership that "maintains the same cybersecurity procedures." The exemption covers the whole Identity Theft Protection Act, not only section 12.

Licensees under the Insurance Code instead follow chapter 5A, added by 2018 PA 690. MCL 500.561 reproduces the structure of section 445.72 for licensees, including the same risk-of-harm exception, content list, 1,000-resident credit bureau threshold and $250 per failure fine. MCL 500.559 adds a regulator notice that section 445.72 lacks: a licensee must notify the director "as promptly as possible but not later than 10 business days" after determining that a cybersecurity event involving nonpublic information has occurred, where Michigan is its home state and the event is reasonably likely to cause material harm, or where it involves 250 or more Michigan residents and meets other conditions. MCL 500.550 states that the chapter creates no private cause of action and sets "the exclusive standards, for this state, applicable to licensees for data security, the investigation of a cybersecurity event, and notification to the director."

Other Duties in the Identity Theft Protection Act

Several neighboring sections impose duties that apply whether or not a breach occurs:

• MCL 445.72a requires a person or agency maintaining a database of personal information about multiple individuals to "destroy any data that contain personal information concerning an individual when that data is removed from the database" and not retained for another lawful purpose. A knowing violation is a misdemeanor with a fine of up to $250 per violation, and compliance with federal disposal law counts as compliance.
• MCL 445.72b bars advertisements or solicitations that misrepresent that a breach affecting the recipient has occurred, or that are "substantially similar" to a legally prescribed breach notice, with misdemeanor penalties of up to $1,000, $2,000 and $3,000 for first, second and later violations.
• MCL 445.71 prohibits denying credit or utility service solely because a consumer was an identity theft victim (with a presumption based on a police report and FTC affidavit), sending unsolicited checks or credit cards to some consumers, and extending credit without reasonable identity verification.

Senate Bills 360 to 364

A five-bill package would rewrite section 12. Senate Bill 360, introduced June 5, 2025 by Senator Rosemary Bayer, passed the Senate on August 26, 2025 by a vote of 19 to 15 and was referred the same day to the House Committee on Government Operations, where the legislature's bill page shows it as of October 19, 2026. Senate Bills 361 to 364 update cross-references in other statutes and are tie-barred to it.

According to the Senate Fiscal Agency's summary as passed by the Senate, Senate Bill 360 would:

• Extend "data" to personal information in any medium and add passport numbers, medical and health insurance information, online credentials and biometric or genetic identifiers to the definition of personal information
• Replace the risk-of-harm exception with a duty to notify residents where the entity "knew, should know, or should have known" the breach had or could have resulted in identity theft or fraud, after a required good-faith investigation
• Require written notice to the Attorney General when 100 or more residents must be notified, with a synopsis, numbers, timing and remediation details
• Require 24 months of free identity theft prevention services where Social Security or taxpayer identification numbers were involved
• Require reasonable security procedures, with compliance presumed for programs conforming to the NIST Cybersecurity Framework 2.0 or listed federal regimes, and give the Attorney General investigative demands, assurances of discontinuance and fines of up to $2,000 for knowingly failing to maintain security or investigate, alongside a retained $250 per failure notice fine capped at $750,000 per breach

None of these changes is law. Until the House acts and the governor signs, MCL 445.72 as amended in 2010 remains the operative text.

Frequently Asked Questions