Source: https://datamatters.sidley.com/michigan-adopts-national-association-of-insurance-commissioners-naic-insurance-data-security-model-law/
Timestamp: 2019-04-19 01:14:37+00:00

Document:
Michigan’s Act, which adds chapter 5A to Michigan’s Insurance Code, seeks to establish “the exclusive standards applicable to licensees for data security, the investigation of a cybersecurity event” and certain regulatory notifications. MCL § 500.550. The Act defines licensees as persons authorized, registered, or licensed under Michigan insurance laws or required to be so. MCL § 500.553(g). This means all insurers, agencies, and brokers doing business in Michigan are covered. By contrast, reinsurers domiciled outside of Michigan as well as risk retention groups and purchasing groups chartered and licensed in another state are excluded from the Act. Id.
Report data breaches to the Superintendent within ten (10) business days after determination that a cybersecurity event has occurred.
The Act expressly forecloses the possibility that its adoption creates or implies a private cause of action for violation of its provisions, but does not “curtail a private cause of action that would otherwise exist” under Michigan law. MCL § 500.550.
The Act specifies that any documents provided to NAIC or other third-party consultant are not subject to the state’s freedom of information act, subpoena, or discovery in a private action. MCL § 500.664(6).
Similar to Ohio’s law, the Act “establishes the exclusive standards, for this state, applicable to licensees for data security, the investigation of a cybersecurity event, and notification to the director.” Id. The Act provides further protection for reinsurers, stating that they do not have state notice obligations outside of those specified under the Act. MCL § 500.560(6). The Act does not, of course, supersede federal privacy or data security laws, such as HIPAA.
While the Model Act assumes that customer notice obligations will be equivalent to those required under the state’s general data breach notification law, the Act creates industry-specific requirements. MCL § 500.561. In particular, the Act requires notice of a cybersecurity event to any state resident unless there is a reasonable determination that the event “has not or is not likely to cause substantial loss or injury” or result in identity theft. Id. Such notice must be provided “without unreasonable delay.” MCL § 500.561(b)(4).
It provides a safe harbor for licensees subject to and who comply with the customer notice requirements of HIPAA and regulations promulgated thereunder.
The Act excludes from its definition of cybersecurity event the unauthorized access to data by a person acting in “good faith” and in a manner “related to the activities of the person.” MCL § 500.553(c)(ii)(A-B). The Act thus focuses on those breaches caused by third parties most likely to be targeting sensitive data for nefarious purposes. Like the Model Law, the Act excludes from the definition of cybersecurity event any nonpublic information that was encrypted. MCL § 500.553(c)(i).
In a move that is more generous than the 72-hour requirement of the Model Law and the three business days requirement of Ohio’s law, the Act requires a licensee to report a cybersecurity incident to the Department within “ten business days” after a determination that one has occurred. MCL § 500.559(1).
Compared to the Model Act, the Act provides an additional safe harbor for Michigan-based licensees, requiring a report only where the cybersecurity event has a reasonable likelihood of materially harming a consumer or the licensee’s operations. MCL § 500.559(a)(i-ii). The Model Act provides this safe harbor only for out-of-state licensees.
Licensees with fewer than 25 employees including independent contractors are excluded from certain requirements of the Act. MCL § 500.565(2).

References: § 500
 § 500
 § 500
 § 500
 § 500
 § 500
 § 500
 § 500
 § 500
 § 500
 § 500
 § 500