MI HB5229

Banks must use reasonable care to secure individuals' nonpublic personal financial information from unauthorized access.

Banks cannot disclose nonpublic personal financial information to third parties without prior written informed consent from the individual, unless required by law, and individuals may withdraw consent at any time.

Banks must establish and publicly disclose a privacy policy that includes implementation of data security requirements, identifies routine uses of nonpublic information, limits access on a need-to-know basis, and requires individual consent on enrollment and claim forms.

Banks are prohibited from refusing credit, closing accounts, terminating customer relationships, or retaliating against individuals who refuse to consent to disclosure of their nonpublic personal financial information.

The act takes effect 90 days after enactment and does not limit governmental agencies' investigative, examination, or record access powers.