SB 0888 Summary

• Requires persons and agencies that own or access personal information to implement and maintain reasonable security procedures, with compliance assessed based on organization size, data volume, activities, and resources; entities following National Institute of Standards and Technology's Cybersecurity Framework 2.0 or equivalent federal regulations are deemed compliant.

• Mandates investigation of security breaches to assess scope, identify affected individuals, determine if unauthorized access occurred, and implement remedial measures; third-party agents must notify data owners without unreasonable delay upon discovery of breaches.

• Requires notification to affected Michigan residents within 45 days if security breach compromises personal information and could result in identity theft or fraud; notice must include breach description, types of data affected, protective steps taken, and contact information; if 100+ residents affected, must notify attorney general.

• Requires free identity theft prevention and mitigation services for at least 24 months for residents whose Social Security or taxpayer identification numbers were compromised; notice must include information on credit freezes and service enrollment.

• Creates civil enforcement mechanisms allowing the attorney general to seek injunctive relief and civil fines up to $2,000 for failure to implement security procedures or investigate breaches, and up to $250 per violation (capped at $750,000 per breach) for failure to provide required notice.