Michigan

Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, one or more residents of this state, a person or agency that owns or licenses data that are included in a database that discovers a security breach, or receives notice of a security breach shall provide a notice of the security breach to each resident of this state who meets one or more of the following:

1. That resident's unencrypted and un-redacted personal information was accessed and acquired by an unauthorized person.
2. That resident's personal information was accessed and acquired in encrypted form by a person with unauthorized access to the encryption key.

The law covers ‘Personal Information’ which is defined as the first name or first initial and last name linked to one or more of the following data elements of a resident of this state:

1. Social Security number;
2. Driver's license number or state personal identification card number; or
3. Demand deposit or other financial account number, or credit card or debit card number, in combination with any required security code, access code, password that would permit access to any of the resident’s financial accounts.