Bill Summary – FastDemocracy

SENATE BILL NO. 888
     May 30, 2024, Introduced by Senator BAYER and referred to the Committee on Finance,
       Insurance, and Consumer Protection.
          A bill to amend 2004 PA 452, entitled
    "Identity theft protection act,"
    by amending sections 3, 12, and 12b (MCL 445.63, 445.72, and
72b), section 3 as amended by 2010 PA 318 and sections 12 and
    12b as amended by 2010 PA 315, and by adding sections 11a, 11b, 20,
    20a, 20b, and 20c; and to repeal acts and parts of acts.
                    THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
       Sec. 3. As used in this act:
       (a) "Agency" means a department, board, commission, office,
 agency, authority, or other unit of state government of this state.
    VMP                                                                       S05654'24
                                        2
 The term Agency includes an institution of higher education of this
 state. The term Agency does not include a circuit, probate,
 district, or municipal court.
       (b) "Breach of the security of a database" or "security
 breach" means the unauthorized access and acquisition of data that
 compromises the security or confidentiality of personal information
 maintained by a person or agency as part of a database of personal
 information regarding multiple individuals. These terms do not
 include unauthorized access to data by an employee or other
 individual if the access meets all of the following:
       (i) The employee or other individual acted in good faith in
 accessing the data.
       (ii) The access was related to the activities of the agency or
 person.
       (iii) The employee or other individual did not misuse any
 personal information or disclose any personal information to an
 unauthorized person.
       (b) (c) "Child or spousal support" means support for a child
 or spouse, paid or provided pursuant to in accordance with state or
 federal law under a court order or judgment. Support includes, but
 is not limited to, any of the following:
       (i) Expenses for day-to-day care.
       (ii) Medical, dental, or other health care.
       (iii) Child care expenses.
       (iv) Educational expenses.
       (v) Expenses in connection with pregnancy or confinement under
 the paternity act, 1956 PA 205, MCL 722.711 to 722.730.
       (vi) Repayment of genetic testing expenses , under the
 paternity act, 1956 PA 205, MCL 722.711 to 722.730.
     VMP                                                            S05654'24
                                         3
       (vii) A surcharge as provided by section 3a of the support and
 parenting time enforcement act, 1982 PA 295, MCL 552.603a.
       (c) (d) "Credit card" means that term as defined in section
 157m of the Michigan penal code, 1931 PA 328, MCL 750.157m.
       (d) (e) "Data" means computerized personal information or
 personal information contained in any other medium.
       (e) (f) "Depository institution" means a state or nationally
 chartered bank or a state or federally chartered savings and loan
 association, savings bank, or credit union.
       (f) (g) "Encrypted" means transformation of data through the
 use of an algorithmic process into a form in which there is a low
 probability of assigning meaning without use of a confidential
 process or key, or securing information by another method that
 renders the data elements unreadable or unusable.
       (g) (h) "False pretenses" includes, but is not limited to, a
 false, misleading, or fraudulent representation, writing,
 communication, statement, or message, communicated by any means to
 another person, that the maker of the representation, writing,
 communication, statement, or message knows or should have known is
 false or fraudulent. The false pretense may be a representation
 regarding a past or existing fact or circumstance or a
 representation regarding the intention to perform a future event or
 to have a future event performed.
       (h) (i) "Financial institution" means a any of the following:
       (i) A depository institution. , an
       (ii) An affiliate of a depository institution. , a
       (iii) A licensee under any of the following:
       (A) The consumer financial services act, 1988 PA 161, MCL
 487.2051 to 487.2072. ,
     VMP                                                          S05654'24
                                       4
       (B) 1984 PA 379, MCL 493.101 to 493.114. , the
       (C) The motor vehicle sales finance act, 1950 (Ex Sess) PA 27,
 MCL 492.101 to 492.141. , the
       (D) The secondary mortgage loan act, 1981 PA 125, MCL 493.51
 to 493.81. , the
       (E) The mortgage brokers, lenders, and servicers licensing
 act, 1987 PA 173, MCL 445.1651 to 445.1684. , or the
       (F) The regulatory loan act, 1939 PA 21, MCL 493.1 to 493.24.
 , a
       (iv) A seller under either of the following:
       (A) The home improvement finance act, 1965 PA 332, MCL
 445.1101 to 445.1431. , or the
       (B) The retail installment sales act, 1966 PA 224, MCL 445.851
 to 445.873. , or a
       (v) A person subject to subtitle A of title V of the Gramm-
 Leach-Bliley act, 15 USC 6801 to 6809.
       (i) (j) "Financial transaction device" means that term as
 defined in section 157m of the Michigan penal code, 1931 PA 328,
 MCL 750.157m.
       (j) (k) "Identity theft" means engaging in an act or conduct
 prohibited in section 5(1).
       (k) (l) "Interactive computer service" means an information
 service or system that enables computer access by multiple users to
 a computer server, including, but not limited to, a service or
 system that provides access to the internet or to software services
 available on a server.
       (l) (m) "Law enforcement agency" means that term as defined in
 section 2804 of the public health code, 1978 PA 368, MCL 333.2804.
       (m) (n) "Local registrar" means that term as defined in
     VMP                                                         S05654'24
                                       5
 section 2804 of the public health code, 1978 PA 368, MCL 333.2804.
       (n) (o) "Medical records or information" includes, but is not
 limited to, medical and mental health histories, reports,
 summaries, diagnoses and prognoses, treatment and medication
 information, notes, entries, and x-rays X-rays and other imaging
 records.
       (o) (p) "Person" means an individual, partnership,
 corporation, limited liability company, association, or other legal
 entity.
       (p) (q) "Personal identifying information" means a name,
 number, or other information that is used for the purpose of
 identifying a specific person or providing access to a person's
 financial accounts, including, but not limited to, a person's name,
 address, telephone number, driver license or state personal
 identification card number, social security Social Security number,
 place of employment, employee identification number, employer or
 taxpayer identification number, government passport number, health
 insurance identification number, mother's maiden name, demand
 deposit account number, savings account number, financial
 transaction device account number or the person's account password,
 any other account password in combination with sufficient
 information to identify and access the account, automated or
 electronic signature, biometrics, stock or other security
 certificate or account number, credit card number, vital record, or
 medical records or information.
       (q) (r) "Personal information", except as otherwise provided
 in subdivision (r), means the first name or first initial and last
 name linked to 1 or more of the following data elements of a
 resident of this state:
     VMP                                                         S05654'24
                                       6
       (i) A Social security Security number.
       (ii) Driver A driver license number, or state personal
 identification card number, passport number, or other unique
 identification number issued on a government document that is used
 to verify the identity of an individual.
       (iii) Demand A demand deposit or other financial account number,
 or credit card or debit card number, in combination with any
 required security code, access code, or password that would permit
 access to any of the resident's financial accounts.
       (iv) Any medical records or information.
       (v) A health insurance policy number or subscriber
 identification number and any unique identifier used by a health
 insurer to identify an individual.
       (vi) A username or email address, in combination with a
 password or security question and answer, that would permit access
 to an online account that is reasonably likely to contain or is
 used to obtain personal identifying information.
       (vii) Any genetic information or biometric information that is
 used to authenticate or ascertain the individual's identity, such
 as a fingerprint, voice print, retina, or iris image.
       (r) Personal information does not include either of the
 following:
       (i) Any information about an individual that has been lawfully
 made public by a federal, state, or local government record or
 widely distributed media.
       (ii) Any information that is truncated, encrypted, secured, or
 modified by any other method or technology that removes elements
 that personally identify an individual or that otherwise renders
 the information unusable, including encryption of the data or
     VMP                                                            S05654'24
                                        7
 device containing the information, unless the person or agency
 knows or reasonably believes that the encryption key or security
 credential that could render the personal information readable or
 usable has been accessed or acquired with the information.
       (s) "Public utility" means that term as defined in section 1
 of 1972 PA 299, MCL 460.111.
       (t) "Redact" means to alter or truncate data so that no more
 than 4 sequential digits of a driver license number, state personal
 identification card number, or account number, or no more than 5
 sequential digits of a social security Social Security number, are
 accessible as part of personal information.
       (u) "Security breach" means the unauthorized access to or
 unauthorized acquisition of data that compromises the security or
 confidentiality of personal information maintained by a person or
 agency. Security breach does not include unauthorized access to
 data by an employee or other individual if the access meets all of
 the following:
       (i) The employee or other individual acted in good faith in
 accessing the data.
       (ii) The access was related to the activities of the agency or
 person.
       (iii) The employee or other individual did not misuse any
 personal information or disclose any personal information to an
 unauthorized person.
       (v) (u) "State registrar" means that term as defined in
 section 2805 of the public health code, 1978 PA 368, MCL 333.2805.
       (w) "Third-party agent" means either of the following:
       (i) A person that maintains a database that includes personal
 information that the person does not own or license.
     VMP                                                          S05654'24
                                        8
        (ii) A person that is otherwise permitted to access personal
 information owned or licensed by another person or agency in
 connection with providing services under an agreement with the
 other person or agency.
        (x) (v) "Trade or commerce" means that term as defined in
 section 2 of the Michigan consumer protection act, 1971 1976 PA
 331, MCL 445.902.
        (y) (w) "Vital record" means that term as defined in section
 2805 of the public health code, 1978 PA 368, MCL 333.2805.
        (z) (x) "Webpage" means a location that has a uniform resource
 locator or URL with respect to the world wide web or another
 location that can be accessed on the internet.
        Sec. 11a. (1) A person or an agency that owns, possesses,
 collects, or accesses personal information shall implement and
 maintain reasonable security procedures to protect and safeguard
 personal information from unlawful use or disclosure.
        (2) The security procedures described in subsection (1) must
 do all of the following:
        (a) Identify at least 1 owner, manager, or employee that will
 coordinate the person's or agency's security procedures.
        (b) Identify internal and external risks for security
 breaches.
        (c) Include appropriate safeguards for personal information
 that are designed to address the risks identified in subdivision
 (b).
        (d) Provide for assessments of the effectiveness of the
 safeguards described in subdivision (c).
        (e) Contractually require each service provider of the person
 or agency to maintain appropriate safeguards for personal
     VMP                                                            S05654'24
                                       9
 information.
       (f) Evaluate and adjust security procedures to account for
 changes in circumstances affecting the security of personal
 information.
       (3) The reasonableness of the security procedures described in
 subsection (1) must be determined considering all of the following:
       (a) The size of the person or agency.
       (b) The amount of personal information that is owned,
 possessed, collected, or accessed by the person or agency.
       (c) The type of activities for which the personal information
 is owned, possessed, collected, or accessed by the person or
 agency.
       (d) The cost to implement and maintain the security procedures
 compared to the person's or agency's resources.
       Sec. 11b. (1) If a person or an agency determines that a
 security breach has or may have occurred, the person or agency
 shall conduct a good-faith and prompt investigation that includes
 doing all of the following:
       (a) Assessing the nature and scope of the security breach.
       (b) Identifying the personal information that was involved in
 the security breach and the identity of the individuals whose
 personal information was involved in the security breach.
       (c) Determining whether the personal information identified
 under subdivision (b) has been accessed or acquired or is
 reasonably believed to have been accessed or acquired by an
 unauthorized person.
       (d) Identifying and implementing measures to restore the
 security and confidentiality of any system compromised in the
 security breach.
     VMP                                                           S05654'24
                                      10
       (2) All of the following indicate that personal information
 has been accessed or acquired by an unauthorized person under
 subsection (1)(c):
       (a) The personal information is or could be in the physical
 possession and control of an unauthorized person, including, but
 not limited to, under circumstances where a computer or other
 device containing personal information is reported lost or stolen.
       (b) The personal information has been downloaded or copied by
 an unauthorized person.
       (c) The personal information was used in an unlawful manner by
 an unauthorized person, including, but not limited to,
 circumstances under which a fraudulent account is opened using the
 personal information or a report of identity theft.
       (d) The personal information is publicly displayed.
       Sec. 12. (1) If, on or after the effective date of the
 amendatory act that amended this subsection, a third-party agent
 discovers a security breach that involves data that is owned or
 licensed by another person or agency, the third-party agent shall,
 immediately after the discovery, provide a notice of the security
 breach to the person or agency, and shall provide any other
 information that is necessary for the person or agency to comply
 with the notice requirements under subsections (2) and (3).
       (2) (1) Unless the person or agency determines that the
 security breach has not or is not likely to cause substantial loss
 or injury to, or result in identity theft with respect to, 1 or
 more residents of this state, Subject to subsections (5) to (9), a
 person or an agency that owns or licenses data that are is included
 in a database that discovers a security breach on or after the
 effective date of the amendatory act that amended subsection (1),
     VMP                                                         S05654'24
                                      11
 or receives notice of a security breach under subsection (2), (1)
 on or after the effective date of the amendatory act that amended
 subsection (1), shall provide a notice of the security breach to
 each resident of this state who meets 1 or more of the following
 criteria, if the person or agency knows, should know, or should
 have known that the security breach has o