Bill > SB0360

This bill amends the Identity Theft Protection Act to strengthen requirements for protecting personal information and responding to security breaches. The bill introduces several key provisions: First, it requires persons and agencies that own, possess, collect, or access personal information to implement and maintain reasonable security procedures, including identifying a security coordinator, assessing risks, implementing safeguards, and contractually requiring service providers to maintain appropriate cybersecurity standards. Second, it mandates that if a security breach occurs, the affected person or agency must conduct a prompt investigation to assess the breach's scope, identify compromised personal information, and implement measures to restore system security. Third, the bill significantly expands notification requirements, stipulating that if a security breach potentially affects Michigan residents, the organization must provide detailed written notice within 45 days, including offering free identity theft prevention services for at least 24 months if Social Security numbers were compromised. The bill also grants the Attorney General expanded investigative powers, including the ability to serve written demands for information, conduct investigations, and impose civil fines for non-compliance, with potential fines ranging from $250 to $25,000 depending on the violation. Additionally, the bill provides legal mechanisms for the Attorney General to seek injunctive relief and potentially prevent persistent violators from doing business in the state.

Budget and Finance, Government Affairs

https://legislature.mi.gov/Bills/Bill?ObjectName=2025-SB-0360