SB 360 — Consumer protection: identity theft; identity theft protection act; modify. Amends ses. 3, 12 & 12b of 2004 PA 452 (MCL 445.63 et seq.); adds secs. 11a, 11b, 20, 20a, 20b & 20c & repeals secs. 15 & 17 of 2004 PA 452 (MCL 445.75 & 445.77).

SB-360, As Passed Senate, August 26, 2025 SENATE BILL NO.

VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 The term Agency includes an institution of higher education of this state.

(vi) Repayment of genetic testing expenses , under the VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 paternity act, 1956 PA 205, MCL 722.711 to 722.730.

(A) The consumer financial services act, 1988 PA 161, MCL VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 487.2051 to 487.2072.

VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 (m) (n) "Local registrar" means that term as defined in section 2804 of the public health code, 1978 PA 368, MCL 333.2804.

(q) (r) "Personal information", except as otherwise provided in subdivision (r), means the first name or first initial and last name linked to 1 or more of the following data elements of a VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 resident of this state:

VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 (ii) Any information that is truncated, encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable, including encryption of the data or device containing the information, unless the person or agency knows or reasonably believes that the encryption key or security credential that could render the personal information readable or usable has been accessed or acquired with the information.

VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 (w) "Third-party agent" means either of the following:

(d) Provide for assessments of the effectiveness of the VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 safeguards described in subdivision (c).

(b) The person or agency is regulated by this state, the federal government, or both, or is otherwise subject to the requirements of and reasonably conforms to the entirety of the VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 current version of any of the following laws or regulations:

(1) If, on or after the effective date of the amendatory act that amended this subsection, a third-party agent discovers a security breach that involves data that is owned or licensed by another person or agency, the third-party agent shall, VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 without unreasonable delay following discovery, provide a notice of the security breach to the person or agency, and shall provide any other information that is necessary for the person or agency to comply with the notice requirements under subsections (2) and (3).

(2) Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state, a person or agency that maintains a database that includes data that the person or agency does not own or license that discovers a breach of the security of the database VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 shall provide a notice to the owner or licensor of the information of the security breach.

(g) A description of how a resident of this state may obtain additional information about the security breach from the person or VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 agency.

(6) (5) Except as provided in subsection (11), an agency or (12), a person or an agency shall provide any a notice required under this section subsection (2) by providing 1 or more of the VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 following to the recipient:

(d) Substitute notice, if the person or agency demonstrates VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 that the cost of providing notice under subdivision (a), (b), or (c) will exceed $250,000.00 or that the person or agency has to provide notice to more than 500,000 residents of this state.

(e) If applicable, it must generally describe what the agency VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 or person providing the notice has done to protect data from further security breaches.

(9) (8) Except as provided in this subsection, and subject to subsection (8), after a person or an agency provides a notice under this section, subsection (2), the person or agency shall notify each consumer reporting agency that compiles and maintains files on VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 consumers on a nationwide basis, as that term is defined in 15 USC 1681a(p), of the security breach without unreasonable delay.

(12) (11) A public utility that sends monthly billing or account statements to the postal address of its the public VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 utility's customers may provide notice of a security breach to its customers in the manner described in subsection (5), (6), or alternatively by providing all of the following:

The attorney general or a VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 prosecuting attorney may bring an action to recover a civil fine under this section.

(2) A person shall not distribute an advertisement or make any other solicitation that is substantially similar to a notice VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 required under section 12(5) 12(2), or by federal law, if the form of that notice is prescribed by state or federal law, rule, or regulation.

(a) The voluntary payment by the person for the costs of VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 investigation and reasonable attorney fees.

VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 (c) If the demand requires the appearance of the person, the demand must also include all of the following:

(3) At any time before the return date or not later than 10 days after receiving the demand, whichever is earlier, a person subject to the demand may petition the Ingham County circuit court VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 for a protective order to do any of the following:

(7) A person subject to a demand or court order under this section, that with the intent to avoid, evade, or prevent VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 compliance with the demand or order, in whole or in part, removes, conceals, withholds, destroys, mutilates, falsifies, or by any other means alters any document or object in the possession, custody, or control of the person may be ordered to pay a civil fine of not more than $25,000.00.

(b) Knowingly avoids, evades, or prevents compliance, in whole or in part, with an investigation, including, without limitation, VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex 1 the removal from any place, concealment, destruction, mutilation, alteration, or falsification of documentary material in the possession, custody, or control of a person subject to the demand.

(2) On the petition of the attorney general, the circuit court VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex may enjoin a person from doing business in this state if the person persistently and knowingly evades or prevents compliance with an injunction issued under this act.

Final Page VMP S00878'25_SB0360_INTR_1S00878'25_SB360_APS_1 10vwoy0twaex