WeVote
Log In

Bill

Bill

HB 5330

AN ACT RELATING TO PROPERTY -- CONDOMINIUM LAW

2025 Regular Session Introduced by Greg Costantino and 4 co-sponsors

Michigan public entities and contractors must use only small UAS that meet strict cybersecurity, data-residency (US), and privacy standards, with annual audits and certifications.

03/04/2025 Committee recommended measure be held for further study
0
WeVote Research Nonpartisan
Bill Summary · HB 5330

Summary — HB 5330 (2025): Cybersecurity and Data Protection Requirements for Small Unmanned Aircraft Systems

Status: House Introduced Bill (filed Mar 14, 2025; electronically reproduced Dec 2, 2025)
Companion: SB 1699

Purpose / Intent

HB 5330 would require public entities and their contractors in Michigan to procure and operate only small unmanned aircraft systems (small UAS/drones) that meet specified cybersecurity, data-protection, and privacy standards. The intent is to reduce cyber risks, protect personally identifiable information (PII), and ensure vendor and operator accountability for government-used drones.

Scope

  • Applies to "public entity" as defined in 1968 PA 317 (MCL 15.321) and to persons contracting with public entities.
  • Applies to "small unmanned aircraft system": powered, operates without direct human intervention from within/on the aircraft, and weighs less than 55 pounds (including attachments).
  • Compliance required beginning 1 year after the act’s effective date.

Key provisions

  1. Data residency and legal compliance

    • All video, photos, telemetry, and PII (e.g., names, addresses) must be collected, transmitted, and stored only within the United States.
    • Data management must follow federal and state privacy laws and guidance from CISA and the FBI.

  2. Technical security requirements (must meet all)

    • End-to-end encryption for data at rest and in transit using AES-256 and TLS.
    • Operation on secured, segmented networks.
    • Multifactor authentication and role-based access control.
    • Tamper-proof hardware to prevent unauthorized modifications.
    • Automatic deletion policies: data removed within 45 days unless retention is authorized by law enforcement or public safety agencies.
    • Real-time monitoring for unauthorized access, cyber threats, or anomalies, with automated countermeasures as needed.

  3. Compliance, audits, and certifications

    • Annual security audits.
    • Required certifications demonstrating compliance with:
      • NIST Cybersecurity Framework 2.0
      • ISO 27001
      • SOC 2

  4. Regulatory implementation and enforcement

    • Michigan State Police (department of state police) to issue regulations or guidance covering required security assessments, privacy protections and verification, network security and intrusion detection standards, cybersecurity training for operators, and enforcement mechanisms (including disqualification of noncompliant systems).

Who would be affected

  • Primary: State and local government agencies and any contractors that operate or supply small UAS for public entities.
  • Secondary: Drone manufacturers, integrators, cloud/data-hosting providers, and public-safety users who may request longer retention.
  • Potential impacts: procurement compliance costs, limits on available vendors, increased cybersecurity posture and privacy protections for citizens.

Procedural / timeline notes

  • Compliance triggers: 1 year after the law’s effective date (effective date not specified in bill text).
  • Legislative actions recorded include filing (Mar 14, 2025), first reading (Apr 7, 2025), referrals to committees (Ways & Means; Transportation & Infrastructure), and electronic reproduction (Dec 2, 2025).

Practical considerations

  • Vendors may need to change data hosting, encryption, hardware designs, and obtain certifications, potentially increasing cost/time to market.
  • The 45-day automatic deletion requirement has an explicit exception for authorized law enforcement/public safety retention.
  • State-level guidance and enforcement details will be defined by Michigan State Police regulations.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.