Michigan Could Become State No. 21 to Pass a Data Privacy Law

In a Perspectives from FSF Scholars on privacy legislation in 2024 published just last week, I wrote that seven additional states adopted comprehensive data privacy statutes this year, bringing the total to twenty. But did I speak too soon? The very same day, Michigan Senator Rosemary Bayer (D) announced via press release that the Personal Data Privacy Act (Senate Bill 659) had passed the Senate.

Should Senate Bill 659 clear the House before the current legislative session ends on December 23, the Wolverine State could become the eighth state in 2024, and the twenty-first overall, to forge a unique data privacy path.

Senate Bill 659 would establish familiar consumer rights including: the right to know that personal data is being processed, the right to access that personal data, the right to correct inaccuracies, the right to delete, and the right to obtain a portable copy. Consumers also would be able to opt out of the sale of personal data, targeted advertising, and "[p]rofiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer."

As is the case with the Maryland Online Data Privacy Act of 2024, which I summarized in a February post to the Free State Foundation blog, Senate Bill 659 includes "data minimization" provisions that "limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a product or service requested by the consumer … consistent with the consumer's reasonable expectations" (emphases added) and place similarly subjective limits on the processing of personal data. Sensitive data may be collected and/or processed only where "strictly necessary."

Senate Bill 659 would not create a private right of action. Instead, the state attorney general would have exclusive enforcement authority. It would go into effect a year from the date of enactment.