Public Relations Firms in Michigan: A Breach Notice Written to MCL 445.72

Updated November 2026 · Written and maintained by the Progression Agency strategy team

A company learns that customer names and Social Security numbers left its database, and the first draft to customers says only that it acted out of an abundance of caution. Michigan’s Identity Theft Protection Act asks for more: section 445.72 lists five things every notice must do, the routes a notice may travel and the point at which major statewide media must hear about it. Public relations firms in Michigan write that notice beside counsel, so the letter, the call script and the press statement agree. Progression’s team works from New York, drafts Michigan notices remotely and joins counsel and staff on site when asked.

Out of an abundance of caution, and nothing else

A hypothetical company writes a short statement. It says the company acted out of an abundance of caution. It does not say what happened, what kind of data was involved or where to call, and it does not remind anyone to stay watchful.

Subsection (6) of the Michigan statute asks for five things in a notice. The draft carries none of the five, and the argument about tone has not started yet. A public relations firm drafts from the statute first and from the tone second.

• The statute names the lines. A draft that lacks them is unfinished.
• Counsel decides whether notice is required at all.
• Counsel also decides whether HIPAA or bank rules apply.
• The firm drafts only after counsel has spoken.
• The tone comes after the content is settled.
• Everyone who speaks for the company uses the same text.
• The phone number in the draft is a number someone answers.
• The reminder to stay vigilant is one plain sentence.

What public relations firms in Michigan draft under section 445.72

Section 12 of the Identity Theft Protection Act is posted as MCL 445.72 on the Michigan Legislature’s site. Unless the person or agency determines that the breach has not caused and is not likely to cause substantial loss or injury to, or identity theft for, one or more Michigan residents, a person or agency that owns or licenses the data and discovers a security breach notifies each Michigan resident whose personal information was taken.

Two details shape the drafting. A resident’s information counts when it was unencrypted and unredacted, or when it was encrypted and the person had the key. A business that only maintains data it does not own or license notifies the owner or licensor instead. The determination is made with the care an ordinarily prudent person or agency in like position would use, and counsel makes it.

Who decides whether notice is required?

Counsel does, after applying the prudent person test. The firm does not make that call and does not need to.

• Ask counsel for the decision in writing.
• Draft in parallel, so the words are ready if counsel says notice is required.
• Keep the draft out of circulation until counsel confirms.
• Date each version of the draft.

A public relations firm in Michigan starts after that decision. Counsel decides whether notice is required, and the firm drafts the words.

Five lines every Michigan notice carries

Subsection (6) says a written notice is clear and conspicuous and a phone notice clearly communicates the same content. Every notice carries the content in subdivisions (c) to (g), in this order.

General terms, not guesses

The statute asks for the breach in general terms. A sentence that says what kind of event it was, and when the company found it, does the job. A theory about the attacker does not belong.

Naming the data, not the server

Line (d) is about the information that was exposed: names, Social Security numbers, license numbers or account numbers. It is not about the server, the vendor or the software.

A phone line that answers

Line (f) needs a telephone number where a recipient can get help or more information. The number works only if a person picks up, and the person has the same facts as the notice.

Letter, email or a live voice

Subsection (5) lets the business choose among written notice to the postal address in its records, written notice sent electronically, and notice by telephone. A public relations firm in Michigan writes one text that survives all three.

Subsection (7) adds that a notice may be provided under an agreement with another business if it does not conflict with the section. Whether an agreement covers a particular notice is for counsel.

Substitute notice and major statewide media

Substitute notice is available if the business shows that a letter, email or call would cost more than $250,000 or that it must notify more than 500,000 Michigan residents. It means doing all three of the following.

• Email notice to the residents whose email addresses the business has.
• A conspicuous posting of the notice on the business’s website, if it keeps one.
• Notice to major statewide media, which must include a telephone number or website address people can use for assistance and information.

Does substitute notice replace the letter?

It applies when the business shows that the cost would exceed $250,000 or that it must notify more than 500,000 Michigan residents, and it requires all three parts. Counsel confirms that the threshold is met.

The website post and the media notice say the same five lines as the letter. A newsroom reading the post and a customer reading the letter should find one story.

Retainers and notice work, priced

Pricing depends on scope and is set in the written proposal, and published prices are subject to change. A notice project covers the drafting, and a retainer can also cover the call script and media questions. Progression quotes after a written scope.

Waiting for the scope, or for the police

Notice goes without unreasonable delay. Subsection (4) allows two delays. One is a delay necessary to take the measures needed to determine the scope of the breach and restore the reasonable integrity of the database. The other is when a law enforcement agency determines and advises that notice will impede a criminal or civil investigation or jeopardize homeland or national security. After either, notice goes without unreasonable delay.

What does the holding statement say?

That the company is looking into an event involving customer information and that notice will follow. It adds the phone number, and nothing the investigation has not confirmed.

The holding statement says notice will follow, and says nothing the investigation has not confirmed.

• Say that notice will follow.
• Do not describe what has not been confirmed.
• Let counsel decide when a delay applies.
• Date every draft.
• Review the holding statement when facts change.
• Never promise a date for the notice before counsel confirms it.

Names linked to numbers

The definitions are in MCL 445.63. Personal information is a Michigan resident’s first name or first initial and last name linked to one or more of a Social Security number, a driver license or state identification number, or a financial account, credit card or debit card number combined with any required security code, access code or password.

After the letters: the credit bureaus

After giving notice, the business notifies each nationwide consumer reporting agency, as defined in 15 USC 1681a(p), without unreasonable delay. The notification includes the number of notices sent to Michigan residents and their timing.

What goes to the credit bureaus?

The number of notices sent to Michigan residents and the timing of those notices, as subsection (8) describes.

The duty does not apply if 1,000 or fewer residents must be notified, or if the business is subject to 15 USC 6801 to 6809.

Banks, clinics and utilities under other rules

A financial institution with notification procedures subject to examination under the federal interagency guidance on response programs for unauthorized access to customer information, or similar National Credit Union Administration guidance, and its affiliates, is considered in compliance. So is a person or agency that is subject to and complies with HIPAA and 45 CFR parts 160 and 164 for preventing unauthorized access and customer notice.

Which rules does the business follow?

Whichever applies to it. A bank, a clinic and a utility each have a path of their own in the statute, and counsel confirms which one fits.

A public utility that sends monthly bills to postal addresses may give notice another way: email notice as applicable, notice to the media reasonably calculated to inform its customers, a conspicuous website posting and written notice with the monthly bill. Counsel confirms which rules apply to a particular business.

PR in Detroit when a reporter calls before the letters land

Public relations firms in Detroit and across the state know that a reporter may hear first. The statement given that day carries the same general description and the same phone number as the notice, and it gives no count of affected people until it is counted.

Subsection (18) makes the section a matter of statewide concern and preempts any local charter, ordinance, resolution, regulation or rule on the same matters. A Detroit business and a Traverse City business answer to the same section, and PR firms in Michigan write the same text for both.

• Use the notice’s own description for the press.
• Give the same phone number to reporters.
• Give no count until one exists.
• Send a reporter’s follow-up questions to one named person.
• Keep a log of what each person said and when.
• Update the statement when the notice is updated.

Fines for silence, and for a false alarm

Subsection (13) says a person that knowingly fails to give a required notice may be ordered to pay a civil fine of up to $250 for each failure, brought by the attorney general or a prosecuting attorney, and the total for failures arising from the same breach cannot exceed $750,000. Subsection (12) makes it a misdemeanor to send a breach notice when no breach occurred, with the intent to defraud.

Does this page predict fines?

No. It states the statute and leaves every liability question to counsel.

Other civil remedies are not affected. The liability call belongs to counsel, and a public relations firm in Michigan leaves it there.

The notice folder, ready before the call

Six items go into one folder before anyone needs it. Our crisis management PR firm page covers the first hours of an incident, and our crisis communications page covers who hears what, and in what order.

Also in Michigan, our marketing agency in Detroit page covers other work.

Frequently asked questions