"It was horrifying to have such detailed information at my fingertips. It was horrifying to think that although I am an honest citizen, many people are not," Haring tells New Times, explaining that the files included social security numbers, bank statements, and medical records. "If I wanted to, I could have walked away with millions [of dollars]. Most disconcerting is that I will always be at risk because I don't know how many people he shared my personal information with or who those people really are."
Haring understands that the files were most likely sent to her by accident. But for nearly two years, she says, she has tried to get Ozelie to acknowledge the data breach and notify his clients. After being dismissed and rebuffed by Ozelie, she filed a formal complaint with the Florida Bar and a police report with the Boca Raton Police Department (BRPD) and is taking Ozelie to court.
She has also taken it upon herself to inform Ozelie's clients about the breach.
"On January 19, 2022, I got an unusual text from someone who identified themselves as Priscilla Oxendine-Haring. She identified me by my business tax ID number, and she sent me a screenshot showing all the PDFs she had received with my name on them," Ozelie's former client Adrienne Marlowe tells New Times. "That's when I went into panic mode and became horrified."
Reached by New Times by phone, Ozelie declined to comment.
The alleged snafu dates back to June of 2020, a juncture at which, Haring says, she resolved to cut ties with Ozelie because 11 months had passed and she was still married. According to Haring's complaint, she requested that the Boca Raton attorney return all her private documents. After being sent several Dropbox links that didn't work or didn't contain her files, Haring says, one of Ozelie's paralegals emailed her a 30-day Dropbox link to a folder titled "Public," which, she found, contained the social security numbers, bank statements, and medical records of dozens of people she didn't know.
In an email exchange on June 21, 2020, Haring notified one of Ozelie's paralegals that she'd inadvertently been sent confidential client information.
"I'm writing to inform you that the manner in which you delivered my files electronically was alarming as well as to tell you that I am in complete disbelief and horror of your business practices regarding my confidentiality and privacy," Haring wrote. "Have you stopped to think that this link that you provide has all of my details and all of your clients' information[?]"
"The files accessible in the link were only available to you. No one else had access to your files except Richard, [another paralegal] and myself," the paralegal responded. "All documents shared with [the opposing counsel]'s office were redacted."
According to Haring's complaint, the Dropbox link contained "unredacted banking information, videos in which [Ozelie's] clients have an altercation, health information breaching [the Family Educational Rights and Privacy Act] FERPA, tax returns, deeds, retirement plans, divorce proceedings and documents and other sensitive disclosure which violate the trusted client/attorney relationship."
"As soon as she realized what the files were she contacted [Ozelie's office] and described the error. Upon a request [Ozelie] failed to acknowledge the breach and failed to provide direction as to what to do next," the complaint states. Ozelie "denied that such private data of his clients was sent to the Plaintiff/Client and proceeded to take no measures to inform his clients of this breach."
According to Florida Bar rules, an attorney must make reasonable efforts to prevent the disclosure of private information related to their clients, and in the digital age, that means employing measures to prevent breaches of clients' online documents. If a data breach does occur, an attorney bears the responsibility of fixing the issue and notifying clients that their private information was accessed by an outside party, according to Anthony V. Alfieri, director of the Center for Ethics and Public Service at the University of Miami School of Law."Anything someone could possibly need to assume my family's identities is there at their fingertips."
tweet this
"The alleged conduct at issue in this case — namely, the unauthorized public disclosure of confidential client information apparently without communication or consultation with the broad, affected class of clients and, likewise, apparently without diligent, reasonable remedial action to avoid or mitigate the potential, adverse consequences to such clients — raises concerns about the possible lawyer violation of the Florida Rules of Professional Conduct," Alfieri tells New Times via email.
Haring says she immediately notified the Florida Bar of the data breach. A year later, little had been done, so she filed a police report. When Boca Raton police contacted Ozelie, the attorney denied that Haring had been given access to confidential files.
"Ozelie clarified that they did not provide Oxendine-Haring with access to any other clients' documentation and information, and no data leak exists," the BRPD investigator wrote.
The department closed the case without further investigation, finding that no criminal activity had taken place.
Also in the summer of 2021, Haring filed a formal bar complaint against Ozelie. When he responded, on January 17, 2022, he denied her claims and theorized that she had a mental disorder.
"In conclusion, I strongly believe that Mrs. Haring suffers a psychological disorder (compulsive or pathological liar?) and that her Complaint should be denied," he wrote in response to the bar complaint, which is pending.
In late January, Haring notified another woman, Crystal Lugo, that she was in possession of her private information, including tax statements that contained her children's schools and social security numbers. When Lugo, whose ex-husband was Ozelie's client, emailed the attorney and asked if there had been a leak of her confidential data, Ozelie did not confirm or take responsibility for the breach.
"Ms. Lugo, if you do have any evidence that someone has been able to access our client files (which you have never been) or your information from our client files please immediately provide same to us so that we can take all appropriate actions," Ozelie wrote to Lugo via email on January 25.
Lugo tells New Times that the personal data leak and Ozelie's responses caused her great concern.
"Anything someone could possibly need to assume my family's identities is there at their fingertips," Lugo says. "Everything they need is on that tax form: bank account numbers, pay stubs, social security."
Around that time, Haring notified Adrienne Marlowe that she was in possession of Marlowe's private information. After the two spoke on the phone, Marlowe says, she contacted Ozelie about the breach. She says the attorney sent a memo to her and other clients on January 28, 2022 — more than 18 months after Haring first complained — informing them their files may have been breached.
"Between June 19, 2020, and June 21, 2020, a former client gained access to a limited number of OzelieLaw, LLC client files. Our original investigation into the matter indicated that this former client did not access any of the client records, however it has recently come to our attention that this former client may have accessed an unknown number of client records," Ozelie wrote in the memo. "OzelieLaw, LLC has contacted law enforcement and the Florida Bar regarding this matter and we will update you once the investigation has concluded."
Haring was shocked that the first notification she saw Ozelie give to clients about the confidentiality breach appeared to insinuate that she had somehow hacked into his files, rather than that his office inadvertently sent them.
"These people are being led to believe that someone went into their files. Like I'm some criminal that has gone into his law firm to get access to his files," she says. "I feel incriminated."
Marlowe and Lugo tell New Times they also filed complaints against Ozelie with the Florida Bar this year but have yet to hear back.
In March, Haring sued Ozelie for negligence and professional malpractice. She's representing herself without an attorney.
"Should this guy be representing people? If he does not care about any of his clients' confidentiality, why should he be practicing?" she says.
