Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

Data Breach Requirements: Mich.C.L.A. § 445.63 and 445.72..

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

The term “personal information” means the first name or first initial and last name linked to 1 or more of the following data elements of a resident of this state: (i) Social Security number. (ii) Driver’s license number or state personal identification card number. (iii) Demand deposit or other financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to any of the resident’s financial accounts.

The term “breach of the security of a database” or “security breach” means the unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained by a person or agency as part of a database of personal information regarding multiple individuals.

core/separator

A “security breach” does not include unauthorized access to data by an employee or other individual if the access meets all of the following: (i) The employee or other individual acted in good faith in accessing the data. (ii) The access was related to the activities of the agency or person. (iii) The employee or other individual did not misuse any personal information or disclose any personal information to an unauthorized person.

A breach notice is not required if a person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, one or more residents of this state.

In determining whether a security breach is not likely to cause substantial loss or injury to, or result in identity theft with respect to, one or more residents of this state, a person or agency shall act with the care an ordinarily prudent person or agency in like position would exercise under similar circumstances.

A person or agency shall provide the breach notice without unreasonable delay.

A person or agency may delay providing a breach notification if either of the following is met: (a) A delay is necessary in order for the person or agency to take any measures necessary to determine the scope of the security breach and restore the reasonable integrity of the database. However, the agency or person shall provide the notice required under this subsection without unreasonable delay after the person or agency completes the measures necessary to determine the scope of the security breach and restore the reasonable integrity of the database. (b) A law enforcement agency determines and advises the agency or person that providing a notice will impede a criminal or civil investigation or jeopardize homeland or national security. However, the agency or person shall provide the notice required under this section without unreasonable delay after the law enforcement agency determines that providing the notice will no longer impede the investigation or jeopardize homeland or national security.

A breach notice shall do all of the following: (a) For a notice provided under subsection (5)(a) or (b) (postal and electronic notice), be written in a clear and conspicuous manner and contain the content required under subdivisions (c) to (g). (b) For a notice provided under subsection (5)(c) (telephone), clearly communicate the content required under subdivisions (c) to (g) to the recipient of the telephone call. (c) Describe the security breach in general terms. (d) Describe the type of personal information that is the subject of the unauthorized access or use. (e) If applicable, generally describe what the agency or person providing the notice has done to protect data from further security breaches. (f) Include a telephone number where a notice recipient may obtain assistance or additional information. (g) Remind notice recipients of the need to remain vigilant for incidents of fraud and identity theft.

5) Except as provided in subsection (11) (a public utilities exception), an agency or person shall provide any notice required under this section by providing one or more of the following to the recipient: (a) Written notice sent to the recipient at the recipient’s postal address in the records of the agency or person. (b) Written notice sent electronically to the recipient if any of the following are met: (i) The recipient has expressly consented to receive electronic notice. (ii) The person or agency has an existing business relationship with the recipient that includes periodic email communications and, based on those communications, the person or agency reasonably believes that it has the recipient’s current email address. (iii) The person or agency conducts its business primarily through internet account transactions or on the internet. (c) If not otherwise prohibited by state or federal law, notice given by telephone by an individual who represents the person or agency if all of the following are met: (i) The notice is not given in whole or in part by use of a recorded message. (ii) The recipient has expressly consented to receive notice by telephone, or if the recipient has not expressly consented to receive notice by telephone, the person or agency also provides notice under subdivision (a) or (b) if the notice by telephone does not result in a live conversation between the individual representing the person or agency and the recipient within three business days after the initial attempt to provide telephonic notice. (d) Substitute notice, if the person or agency demonstrates that the cost of providing notice under subdivision (a), (b), or (c) will exceed $250,000 or that the person or agency has to provide notice to more than 500,000 residents of this state.

A person or agency provides substitute notice under this subdivision by doing all of the following: (i) If the person or agency has electronic mail addresses for any of the residents of this state who are entitled to receive the notice, providing electronic notice to those residents. (ii) If the person or agency maintains a website, conspicuously posting the notice on that website. (iii) Notifying major statewide media. A substitute notification shall include a telephone number or a website address that a person may use to obtain additional assistance and information.

Except as provided in this subsection, after a person or agency provides a notice under this section, the person or agency shall notify each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis of the security breach without unreasonable delay. A notification under this subsection shall include the number of notices that the person or agency provided to residents of this state and the timing of those notices. This subsection does not apply if either of the following is met: (a) The person or agency is required under this section to provide notice of a security breach to 1,000 or fewer residents of this state. (b) The person or agency is subject to <a>15 USC 6801 </a>to 6809 (Gramm-Leach-Bliley Act).

A financial institution that is subject to, and has notification procedures in place that are subject to examination by the financial institution’s appropriate regulator for compliance with, the interagency guidance on response programs for unauthorized access to customer information and customer notice prescribed by the board of governors of the federal reserve system and the other federal bank and thrift regulatory agencies, or similar guidance prescribed and adopted by the national credit union administration, and its affiliates, is considered to be in compliance with this section.

A person or agency that is subject to and complies with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and with regulations promulgated under that act for the prevention of unauthorized access to customer information and customer notice is considered to be in compliance with this section.

Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, one or more residents of this state, a person or agency that maintains a database that includes data that the person or agency does not own or license that discovers a breach of the security of the database shall provide a notice to the owner or licensor of the information of the security breach.

A person that provides notice of a security breach when a security breach has not occurred, with the intent to defraud, is guilty of a misdemeanor punishable as follows: (a) Except as otherwise provided under subdivisions (b) and (c), by imprisonment for not more than 93 days or a fine of not more than $250 for each violation, or both. (b) For a second violation, by imprisonment for not more than 93 days or a fine of not more than $500 for each violation, or both. (c) For a third or subsequent violation, by imprisonment for not more than 93 days or a fine of not more than $750 for each violation, or both.

Data Disposal and Security: Mich.C.L.A. §§ 445.63 and 445.72a.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal identifying information” means a name, number, or other information that is used for the purpose of identifying a specific person or providing access to a person’s financial accounts, including, but not limited to, a person’s name, address, telephone number, driver license or state personal identification card number, Social Security number, place of employment, employee identification number, employer or taxpayer identification number, government passport number, health insurance identification number, mother’s maiden name, demand deposit account number, savings account number, financial transaction device account number or the person’s account password, any other account password in combination with sufficient information to identify and access the account, automated or electronic signature, biometrics, stock or other security certificate or account number, credit card number, vital record, or medical records or information.

The term “personal information” means the first name or first initial and last name linked to one or more of the following data elements of a resident of this state: (i) Social Security number. (ii) Driver license number or state personal identification card number. (iii) Demand deposit or other financial account, credit, or debit card number, in combination with any required security code, access code, or password that would permit access to any of the resident’s financial accounts.

The term “destroy” means to destroy or arrange for the destruction of data by shredding, erasing, or otherwise modifying the data so that they cannot be read, deciphered, or reconstructed through generally available means.

A person or agency that maintains a database that includes personal information regarding multiple individuals shall destroy any data that contain personal information concerning an individual when that data is removed from the database and the person or agency is not retaining the data elsewhere for another purpose not prohibited by state or federal law.

The data disposal requirements shall not prohibit a person or agency from retaining data that contain personal information for purposes of an investigation, audit, or internal review.

A person or agency is considered to be in compliance with this section if the person or agency is subject to federal law concerning the disposal of records containing personal identifying information and the person or agency is in compliance with that federal law.

Michigan