Michigan Senate Bill SB0549

Michigan 2025-2026 Regular Session

• Introduced: 9/17/25
• Refer: 9/17/25
• Report Pass: 10/15/25
• Refer: 10/15/25
• Report Pass: 2/11/26

Caption

Insurance: other; data security enforcement; modify. Amends secs. 553, 561 & 563 of 1956 PA 218 (MCL 500.553 et seq.) & adds secs. 564 & 564a.

Impact

If passed, SB 549 will strengthen the legal obligations of insurers to notify affected individuals expeditiously when their data has been compromised due to cybersecurity events. This signifies a move toward more robust consumer protections in an increasingly digital landscape where data breaches are becoming common. Licensees will also be required to implement comprehensive information security programs that include administrative, technical, and physical safeguards to protect nonpublic information, which may fundamentally change operational practices within the insurance industry.

Summary

Senate Bill 549 aims to amend the Insurance Code of 1956 to enhance protections concerning data security and privacy for consumers in the state of Michigan. The bill outlines definitions and responsibilities of licensees – those licensed to provide insurance – regarding how they manage nonpublic information and respond to cybersecurity events. Key provisions include notifications to consumers when their personal data has been compromised and requirements for maintaining an information security program designed to protect consumer data from unauthorized access.

Contention

Some points of contention surrounding the bill include concerns from industry representatives about the financial burden of implementing comprehensive security measures and the potential for increased liability stemming from data breaches. There is a debate on the balance between enforcing stringent data protection requirements and the costs and challenges that this could impose on insurers, particularly smaller firms that may struggle to meet these enhanced standards. Furthermore, the bill preempts local regulations, leading to discussions about the loss of local control over specific data protection measures that municipalities might wish to impose.