Law note · Michigan
Identity Theft Protection Act, personal information and personal identifying information defined
MCL 445.63 defines two distinct terms that must not be conflated. "Personal information," MCL 445.63(r), is a name combined with a Social Security number, driver's license or state ID number, or financial account or card number with an access code; it does not include biometric data.
"Personal identifying information," MCL 445.63(q), is a broader term, used for the Act's identity-theft-prevention and criminal provisions elsewhere in the chapter, that does include biometrics among many other data elements such as address, employer, government passport number, and account passwords. Only the narrower "personal information" term is the breach-notice trigger at MCL 445.72.
What it asks of an app
- Do not assume Michigan's broader "personal identifying information" term (MCL 445.63(q)), which includes biometrics, is the breach-notice trigger. The trigger is the narrower "personal information" term (MCL 445.63(r)), which excludes biometrics.
When LexLint raises it
Declared activities: processes_biometrics
Primary source: official Michigan Compiled Laws text, Michigan Legislature