Michigan Senate Bill SB0360

Michigan 2025-2026 Regular Session

• Introduced: 6/5/25
• Refer: 6/5/25
• Report Pass: 6/12/25
• Refer: 6/12/25
• Report Pass: 6/26/25
• Engrossed: 8/26/25
• Refer: 8/26/25

Caption

Consumer protection: identity theft; identity theft protection act; modify. Amends ses. 3, 12 & 12b of 2004 PA 452 (MCL 445.63 et seq.); adds secs. 11a, 11b, 20, 20a, 20b & 20c & repeals secs. 15 & 17 of 2004 PA 452 (MCL 445.75 & 445.77).

Impact

If enacted, SB0360 would significantly strengthen the legal framework around data protection and identity theft in Michigan. The bill establishes clear expectations for timely notifications to residents whose data may have been compromised, thereby enhancing consumer trust in entities that handle sensitive information. With penalties for noncompliance, such as fines for failing to notify affected individuals appropriately, the legislation increases accountability among data handlers, which could lead to more rigorous data protection practices across the state.

Summary

Senate Bill 360 aims to amend the 2004 Identity Theft Protection Act in Michigan to improve consumer protections against identity theft. The bill introduces new definitions and provisions regarding security breaches, requiring agencies and individuals who own or license consumer data to notify affected residents promptly in the event of a data breach. By amending existing sections and adding new sections, the bill seeks to clarify the responsibilities of agencies in terms of data handling and breach notification procedures.

Sentiment

Discussions around SB0360 appear to be supportive, particularly among consumer advocacy groups and lawmakers who prioritize consumer rights and data security. However, some concerns have been raised regarding the burdens placed on smaller organizations to comply with stringent notification requirements. Proponents argue that the benefits of protecting consumers outweigh the operational challenges faced by businesses, indicating a general sentiment of positive governance aimed at consumer welfare.

Contention

One notable point of contention is the potential impact on smaller entities, which may struggle with the cost and logistics of implementing the required data security measures and timely notifications in the wake of a breach. Additional concerns revolve around the definitions of what constitutes a security breach, which may lead to confusion or misinterpretation in practice. The bill preempts local regulations, centralizing authority at the state level and prompting debates about the balance of power between state regulations and local governance.