Michigan Privacy Act SB 309 requires a state agency or a private company that maintains computerized data with personalized information on individuals to notify those individuals if a breach of security allows unencrypted personal identifying information to be acquired by an unauthorized person. Failure to comply with the notification requirements would be punishable by civil fines up to a maximum of $2.5 million. The policy detects combinations of Personally Identifiable Information (PII) like social security numbers, Michigan driver license, credit card numbers, and DNA.