Ride the Lightning

Cybersecurity and Future of Law Practice Blog
by Sharon D. Nelson Esq., President of Sensei Enterprises, Inc.

Florida Attorney Allegedly Leaked Confidential Client Files

June 15, 2022

On May 10, the Miami New Times reported that Boca Raton attorney Richard Ozelie allegedly leaked confidential client files.

Priscilla Haring wanted a divorce and hired divorce attorney Richard Glenn Ozelie. But. according to her complaint filed in Broward civil court in March, what she got was scores of confidential files belonging to “a minimum of 96 individuals.”   

“It was horrifying to have such detailed information at my fingertips. It was horrifying to think that although I am an honest citizen, many people are not,” Haring told New Times, explaining that the files included social security numbers, bank statements, and medical records.  

Haring understands that the files were probably sent to her by accident. But for nearly two years, she says, she has tried to get Ozelie to acknowledge the data breach and notify his clients. After being dismissed and rebuffed by Ozelie, she filed a formal complaint with the Florida Bar and a police report with the Boca Raton Police Department (BRPD) and is taking Ozelie to court. She has also informed Ozelie’s clients about the breach.

Reached by New Times by phone, Ozelie declined to comment.

How did the records get to Haring? In June of 2020, Haring cut ties with Ozelie because 11 months had gone by and she was still married. According to Haring’s complaint, she requested that the Ozelie return all her private documents. After being sent several Dropbox links that didn’t work or didn’t contain her files, Haring says, one of Ozelie’s paralegals emailed her a 30-day Dropbox link to a folder titled “Public,” which, she found, contained the social security numbers, bank statements, and medical records of dozens of people she didn’t know.

In an email exchange on June 21, 2020, Haring notified one of Ozelie’s paralegals that she had inadvertently been sent confidential client information.

“I’m writing to inform you that the manner in which you delivered my files electronically was alarming as well as to tell you that I am in complete disbelief and horror of your business practices regarding my confidentiality and privacy,” Haring wrote. “Have you stopped to think that this link that you provide has all of my details and all of your clients’ information[?]”

“The files accessible in the link were only available to you. No one else had access to your files except Richard, [another paralegal] and myself,” the paralegal responded. “All documents shared with [the opposing counsel]’s office were redacted.”

According to Haring’s complaint, the Dropbox link contained “unredacted banking information, videos in which [Ozelie’s] clients have an altercation, health information breaching [the Family Educational Rights and Privacy Act] FERPA, tax returns, deeds, retirement plans, divorce proceedings and documents and other sensitive disclosure which violate the trusted client/attorney relationship.”

“As soon as she realized what the files were she contacted [Ozelie’s office] and described the error. Upon a request [Ozelie] failed to acknowledge the breach and failed to provide direction as to what to do next,” the complaint states. Ozelie “denied that such private data of his clients was sent to the Plaintiff/Client and proceeded to take no measures to inform his clients of this breach.”  

According to Florida Bar rules, an attorney must make reasonable efforts to prevent the disclosure of private information related to their clients and that means employing measures to prevent breaches of clients’ online documents. If a data breach occurs, an attorney bears the responsibility of fixing the issue and notifying clients that their private information was accessed by an outside party, according to Anthony V. Alfieri, director of the Center for Ethics and Public Service at the University of Miami School of Law.

“The alleged conduct at issue in this case — namely, the unauthorized public disclosure of confidential client information apparently without communication or consultation with the broad, affected class of clients and, likewise, apparently without diligent, reasonable remedial action to avoid or mitigate the potential, adverse consequences to such clients — raises concerns about the possible lawyer violation of the Florida Rules of Professional Conduct,” Alfieri told New Times via email.

Haring says she immediately notified the Florida Bar of the data breach. A year later, little had been done, so she filed a police report. When Boca Raton police contacted Ozelie, the attorney denied that Haring had been given access to confidential files.

“Ozelie clarified that they did not provide Oxendine-Haring with access to any other clients’ documentation and information, and no data leak exists,” the BRPD investigator wrote.

The department closed the case without further investigation, finding that no criminal activity had taken place.

In the summer of 2021, Haring filed a formal bar complaint against Ozelie. When he responded, on January 17, 2022, he denied her claims and theorized that she had a mental disorder.

“In conclusion, I strongly believe that Mrs. Haring suffers a psychological disorder (compulsive or pathological liar?) and that her Complaint should be denied,” he wrote in response to the bar complaint, which is pending.

In late January, Haring notified another woman, Crystal Lugo, that she was in possession of her private information, including tax statements that contained her children’s schools and social security numbers. When Lugo, whose ex-husband was Ozelie’s client, emailed the attorney and asked if there had been a leak of her confidential data, Ozelie did not confirm or take responsibility for the breach.

“Ms. Lugo, if you do have any evidence that someone has been able to access our client files (which you have never been) or your information from our client files please immediately provide same to us so that we can take all appropriate actions,” Ozelie wrote to Lugo via email on January 25.

Lugo told New Times that the personal data leak and Ozelie’s responses caused her great concern.

“Anything someone could possibly need to assume my family’s identities is there at their fingertips,” Lugo says. “Everything they need is on that tax form: bank account numbers, pay stubs, social security.”

About the same time, Haring notified Adrienne Marlowe that she was in possession of Marlowe’s private information. After the two spoke on the phone, Marlowe says, she contacted Ozelie about the breach. She said the attorney sent a memo to her and other clients on January 28, 2022 — more than 18 months after Haring first complained — informing them their files may have been breached.

“Between June 19, 2020, and June 21, 2020, a former client gained access to a limited number of OzelieLaw, LLC client files. Our original investigation into the matter indicated that this former client did not access any of the client records, however it has recently come to our attention that this former client may have accessed an unknown number of client records,” Ozelie wrote in the memo. “OzelieLaw, LLC has contacted law enforcement and the Florida Bar regarding this matter and we will update you once the investigation has concluded.”

Haring was shocked that the first notification she saw Ozelie give to clients about the confidentiality breach appeared to insinuate that she had somehow hacked into his files, rather than that his office inadvertently sent them.

“These people are being led to believe that someone went into their files. Like I’m some criminal that has gone into his law firm to get access to his files,” she says. “I feel incriminated.”

Marlowe and Lugo tell New Times they also filed complaints against Ozelie with the Florida Bar this year but have yet to hear back.

In March, Haring sued Ozelie for negligence and professional malpractice. She’s representing herself without an attorney.

Quite the convoluted story, isn’t it? I am not sure why the Florida Bar has been so slow to address what appears to be a serious violation of legal ethics. Though a paralegal may have made the original error, the attorney bears ethical responsibility under the rules involving supervision. Quite the tangled web here. It will be interesting to see how the lawsuit turns out and whether the Florida Bar finds that an ethical violation has occurred – and what action it takes if it does find fault in Ozelie’s conduct.

Sharon D. Nelson, Esq., PresidentSensei Enterprises, Inc.
3975 University Drive, Suite 225Fairfax, VA 22030
Email:   Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson