Michigan Senate Bill SB0360

Michigan 2025-2026 Regular Session

• Introduced: 6/5/25
• Refer: 6/5/25
• Report Pass: 6/12/25
• Refer: 6/12/25
• Report Pass: 6/26/25

Caption

Consumer protection: identity theft; identity theft protection act; modify. Amends ses. 3, 12 & 12b of 2004 PA 452 (MCL 445.63 et seq.); adds secs. 11a, 11b, 20, 20a, 20b & 20c & repeals secs. 15 & 17 of 2004 PA 452 (MCL 445.75 & 445.77).

Impact

If passed, SB0360 would significantly impact state laws concerning consumer protection and data privacy by imposing clear obligations on entities that handle personal information. Organizations would be required to implement reasonable security measures to protect personal data and to promptly notify individuals in the case of a data breach. The amendments would bolster consumer rights, providing them with more immediate access to information about potential threats to their identity. Additionally, the legislation aims to enhance the capacity of the Attorney General's office to enforce compliance and to take legal action against entities that fail to adhere to the regulations set forth in the bill.

Summary

Senate Bill 360 seeks to amend the Identity Theft Protection Act, originally enacted in 2004, to enhance protections against identity theft and security breaches. The bill includes provisions to redefine terms related to security breaches, establish stricter requirements for notifying affected individuals, and empower the Attorney General to impose civil penalties for non-compliance. Notably, the legislation also repeals certain outdated sections of the original act, which reflects an effort to modernize the law in response to evolving cybersecurity threats and consumer protection needs.

Contention

Despite the positive reception surrounding the bill's objectives of protecting consumers, some stakeholders have raised concerns about the heavy burden it may impose on businesses, especially smaller enterprises that may find compliance costly or complex. There are discussions about the balance between consumer privacy and the operational capacity of businesses to manage these new regulations effectively. Additionally, opponents of strict compliance measures argue that some existing protections are sufficient and that further regulations may stifle innovation within the tech and data management industries.