MI SB0359

Establishes consumer privacy rights including the right to access, correct, delete, and obtain copies of personal data, as well as opt out of targeted advertising, data sales, and automated profiling that produces legal or significant effects

Applies to businesses that process personal data of at least 100,000 Michigan consumers annually, or process data of at least 25,000 consumers while deriving any revenue from data sales

Requires controllers to obtain consent before processing sensitive data (including biometric data, health data, precise geolocation, and data from children), provide clear privacy notices, and conduct data protection impact assessments for high-risk processing activities

Creates a mandatory data broker registry requiring annual registration with the Attorney General by February 1 each year, with civil fines of $100 per day for failure to register

Prohibits selling sensitive data, processing data of consumers under 18 for targeted advertising or sale, and using geofences within 1,750 feet of mental health or reproductive health facilities to collect consumer health data

Grants exclusive enforcement authority to the Attorney General with civil fines up to $7,500 per violation, establishes a 30-day cure period for 18 months after the act takes effect, and creates the Consumer Privacy Fund and Data Broker Registry Fund