KRYSTEN BAIRES-RODRIGUEZ v ST. FRANCIS COLLEGE

In November/December 2018, St. Francis discovered it was the victim of a Data Security Incident.  An unknown third-party gained unauthorized access to St. Francis’ software and/or systems, which may have resulted in the accessibility of employees and students’ personal identifiable information (PII), including names, addresses, Social Security numbers, financial account numbers, passport numbers, driver’s license numbers and/or health information.  St. Francis took steps to remediate and investigate the Data Security Incident and has notified current and former employees and current and former students whose personal information may have been accessed in the Data Security Incident.

Thereafter, Kyrsten Baires-Rodriguez filed a class action lawsuit alleging that she and other individuals were affected by the Data Security Incident.  Kyrsten Baires-Rodriguez is the “Plaintiff” or “Class Representative” and she sued St. Francis College, the “Defendant,” on behalf of people who she alleges have similar claims (the “Class”).  The lawsuit alleges St. Francis did not adequately protect the Class Members’ personal information.  St. Francis denies all allegations of wrongdoing.

The Court did not reach a final decision in favor of the Class or St. Francis. Instead, both sides agreed to a proposed Settlement to resolve the lawsuit. A settlement avoids the costs and uncertainty of a trial and related appeals, while providing benefits to the Class.

The Class Representative and Class Counsel believe the proposed Settlement is best for all members of the Class. The Court in charge of the lawsuit has granted preliminary approval of the proposed Settlement and has ordered that the Notice be made available to explain it.

You are a Class Member and are affected by the proposed Settlement if you were notified by St. Francis that your personal information was or may have been accessed in the Data Security Incident that occurred in or around November/December 2018.

If you have questions about whether you are a Class Member, you may contact the Settlement Administrator at 800-641-9096 or Class Counsel (see Question 10 below).

If you are a Class Member, you are eligible to obtain benefits under the proposed Settlement. The available benefits and process for submitting claims to receive benefits are described in Questions 4 and 6 below.

The Settlement provides the following benefits:

Identity Protection Services.
Members of the Class can elect to enroll in Pango Identity Defense Complete identity protection services for a total period of three (3) years. Pango Identity Defense Complete includes credit monitoring from one bureau, dark web monitoring, monthly credit scores, access to credit reports, authentication alerts, high risk transaction monitoring, address change monitoring, and $1 million in identity theft insurance.

In order to receive the credit monitoring and identity theft protection service, you must submit a valid Claim Form. If you previously signed up for identity protection coverage through St. Francis after receiving the notice of the Data Security Incident, you must still submit a valid Claim Form in order to receive an additional three (3) years of identity theft protection coverage under the Settlement. If you did not previously sign up for identity protection services, and you submit a valid Claim Form, you will receive three (3) years of identity theft protection coverage.
To be eligible to receive identity theft protection coverage, you must submit a completed Claim Form by February 21, 2023.

Reimbursement for Out-of-Pocket Losses
If you incurred expenses that are actual, documented and traceable to the Data Security Incident, that were not reimbursed by another source, including but not limited to the IDX MyIDCareidentity theft insurance that was initially made available to Class Members by St. Francis or any other credit card, credit monitoring/identity protection or financial service, and submit the Claim Form by the Claim Deadline, you can be reimbursed up to $150. Examples of reimbursable Out-of-Pocket Losses include:
• costs, expenses, losses or charges incurred a result of identity theft or identity fraud, falsified tax returns, or other possible misuse of your personal information;
• costs associated with accessing or freezing/unfreezing credit reports with any credit reporting agency; or
• other miscellaneous expenses incurred related to any Out-of-Pocket Loss such as notary, fax, postage, copying, mileage, and long-distance telephone charges.

If you submit a claim for Reimbursement of Out-of-Pocket Losses, you must provide the Settlement Administrator with your contact information as well as documents that show what happened and how much you lost or spent so that you can be repaid. You must also state whether you were reimbursed for the loss by another source.
You can, but do not need to, submit a claim for credit monitoring and identity theft protection service in order to submit a claim for Reimbursement of Out-of-Pocket Losses.
A claim for Reimbursement of Out-of-Pocket Losses may be combined with a claim for Reimbursement of Attested Time (discussed below), but the maximum total amount of both of those combined claims is $150.00.

To be eligible to receive Reimbursement for Out-of-Pocket Losses, you must submit a completed Claim Form by February 21, 2023.

Reimbursement for Attested Time
If you submit a claim for Reimbursement of Out-of-Pocket Losses and spent time remedying issues related to identify theft directly caused by the Data Security Incident, you can submit a claim for $20 per hour for up to four (4) total hours.

If you submit a claim for Reimbursement for Attested Time, you must provide the Settlement Administrator with your contact information as well as the actions you took in response to the Data Security Incident and the time each action took.

You can, but do not need to, submit a claim for credit monitoring and identity theft protection service in order to submit a claim for Reimbursement of Attested Time.

A claim for Reimbursement for Attested Time must be combined with a claim for Reimbursement of Out-of-Pocket Losses, but the maximum total amount of both of those combined claims is $150.00.

To be eligible to receive Reimbursement for Attested Time, you must submit a completed Claim Form by February 21, 2023.

Security Measures
As part of the settlement, St. Francis will confirm cybersecurity improvements implemented since the Data Security Incident to help prevent against future data incidents. By no later than fourteen (14) days following the Preliminary Approval Order, St. Francis will provide reasonable confirmatory discovery to confirm cybersecurity improvements implemented since the Data Security Incident, including as to the additional training provided, additional security measures (such as password changes) and cybersecurity policies or procedure changes, as well as any additional monitoring that will be done to the system where the relevant PII at issue was located.

If the Court approves the proposed Settlement and you do not opt out of the Settlement, you will no longer be able to sue St. Francis for claims relating to the Data Security Incident (see Question 8 below).

The Settlement Agreement describes the Released Claims specifically, so read it carefully. Section I of the Settlement Agreement describes the specific claims you are giving up against St. Francis. You will be releasing St. Francis and all related people as described in Paragraph 53 of the Settlement Agreement.  Talk to Class Counsel (see Question 10 in the section on “The Lawyers Representing You” below) or your own lawyer if you have questions about the Released Claims or what they mean.

You must submit a Claim Form to receive Settlement benefits. The Claim Form must be submitted online, on or before February 21, 2023 or by mail postmarked on or before February 21, 2023.

You can access and submit the Claim Form online. Alternatively, you can submit the Claim Form by printing the forms or requesting paper copies from the Settlement Administrator and mailing the completed Claim Form to the Settlement Administrator at Baires-Rodriguez et al. v. St. Francis College, PO Box 23648, Jacksonville, FL 32241-3648.

You must sign the Claim Form.  If you submit your Claim Form online, typing your name in the signature box will constitute your legal signature.

If you move after submitting a Claim Form, it is your responsibility to provide your new address to the Settlement Administrator. The Settlement Administrator will use the most recent address it has on file for providing benefits under the Settlement

As a Class Member, you can object to the proposed Settlement if you do not think the proposed Settlement is fair, reasonable, or adequate by filing a written objection. You cannot ask the Court to order a larger settlement; the Court can only approve or deny the Settlement. If the Court denies approval, the Class Members will not receive the benefits described in the Notice, and the lawsuit will continue.

You may object to the proposed Settlement in writing and appear at the Final Approval Hearing, either in person or through your own attorney, at your own expense, if the Court allows. If you appear through your own attorney, you are responsible for paying that attorney. All written objections and supporting papers must include:

i. the name of the proceedings (“Baires-Rodriguez, et al. v. St. Francis College”);

ii. your full name, current mailing address, and telephone number;

iii. a statement of the specific grounds for the objection, as well as any documents supporting the objection;

iv. a statement as to whether the objection applies only to you, to a specific subset of the class, or to the entire class;

v. the identity of any attorney(s) representing you;

vi. a statement regarding whether you (or your attorney) intend to appear at the Final Approval Hearing;

vii. all other cases in which you (or your attorney) have filed an objection to any other proposed class action settlement within the past three (3) years; and

viii. either your or your attorney’s signature.

CLASS MEMBERS MUST MAIL OBJECTIONS TO THE SETTLEMENT ADMINISTRATOR POSTMARKED BY JANUARY 22, 2023.
If you wish to be heard at the Final Approval Hearing, you must send a signed Notice of Intention to Appear to the Settlement Administrator postmarked no later than January 22, 2023. The Notice of Intention to Appear must include the following:

i. the name of this Action (“Baires-Rodriguez, et al. v. St. Francis College”);

ii. your full name, address, and telephone number if you intend to appear at the Final Approval Hearing;

iii. the words “Notice of Intention to Appear” at the top of the document;

iv. the points you wish to speak about at the Final Approval Hearing; and

v. the identity (name, address, and telephone number) of any lawyer who will speak on your behalf.

If you object and the Settlement is approved, you will still be entitled to receive benefits under the Settlement that you qualify for, but you must submit a valid Claim Form to do so (see Question 6 above). Submitting a Claim Form does not waive your objection to the Settlement.

If you want to keep the right you may have, if any, to sue St. Francis based on the Data Security Incident, you must exclude yourself from the Settlement Class, as described below in Question 8.

To opt out and not be part of the Class, you must mail a letter to the Settlement Administrator stating that you wish to do so.

Your opt-out request should state: “I request that I be excluded from the settlement class in Baires-Rodriguez, et al. v. St. Francis College, and do not wish to participate in the Settlement.” The letter must include: (1) your full name and current address; and (2) your signature. Your request for exclusion must be postmarked no later than January 22, 2023 and must be mailed to:

Baires-Rodriguez v. St. Francis College, PO Box 23648, Jacksonville 32241-33648

REQUESTS TO OPT-OUT THAT ARE NOT POSTMARKED ON OR BEFORE JANUARY 22, 2023 WILL NOT BE HONORED.

If you opt-out of the Settlement, you cannot also object to the Settlement.

No. If you do not exclude yourself from the Settlement, and the Court approves the proposed Settlement, you give up the right you may have, if any, to sue St. Francis and the Released Persons for any claims arising out of the Data Security Incident. See the answer to Question 5 above.

The Court has appointed the following lawyers to represent you and the other Settlement Class Members:

J. Nelson Thomas
Jessica L. Lukasiewicz
Thomas & Solomon, LLP
693 East Avenue
Rochester, NY 14607

These lawyers are called Class Counsel. Class Members will not be charged by these lawyers for their work on the case.  If you want to be represented by your own lawyer, you may hire one at your own expense.

You can contact Class Counsel at 585-272-0540 or at [email protected].

The Parties have not reached an agreement regarding the attorneys’ fees and expenses. In the event the Court grants Final Approval of the settlement, the amount St. Francis will pay in attorneys’ fees and expenses will be determined through binding arbitration. Any attorneys’ fees and expenses approved will be paid by St. Francis, and the amount of any such award will not affect the benefits to be provided to eligible Settlement Class Members as described above.

THE COURT’S FINAL APPROVAL HEARING

The Court will hold a Final Approval Hearing on February 16, 2023 at 9:30 A.M. at the Supreme Court of the State of New York County of Monroe, 545 Hall of Justice, Rochester, New York 14614, or the hearing may be conducted virtually by online or telephonic means. The date of the hearing may change.If you plan to attend, please check the Settlement website at https://www.sfcdatasettlement.com. If the hearing is conducted virtually, instructions for how Class Members may attend the hearing will be posted at https://www.sfcdatasettlement.com.

At this hearing, the Court will consider whether the proposed Settlement is fair, reasonable and adequate. If there are objections, the Court will consider them. The Court may listen to people who have submitted timely requests to speak at the hearing. The Court may also decide whether the Class Representative will receive a service award up to $3,500 for her services. At or after the hearing, the Court will decide whether to approve the proposed settlement. We do not know how long these decisions will take.

YOU ARE NOT OBLIGATED TO ATTEND THIS HEARING.

If you do nothing, you will be included in the Settlement Class, and will not be able to pursue any other lawsuit against St. Francis and the Released Persons concerning or relating to the Data Security Incident. If you previously signed up for identity protection services when offered by St. Francis, you will not receive any further benefits other than the identity protection services you have already received. If you did not previously sign up for identity protection services, and you do nothing, you will not receive any further benefits from the Settlement.

Prior to entry of the Final Approval Order and Judgment, the Settlement Agreement may, with approval of the Court, be modified by written agreement of the Parties or their counsel, who may only sign with the permission of their clients, without giving any additional notice to the Settlement Class, provided that such modifications are not materially adverse to the Settlement Class. To the extent that Class Members desire to be notified regarding any additional changes as described in this paragraph, or otherwise after the initial notice of the Settlement, the preliminary approval hearing and the Final Approval Hearing, they must file with the Court a request for the notice, or send such a request in writing to the Settlement Administrator or Class Counsel, who shall maintain a list of all such requests that are received. Class Members who have and who provide an e-mail address agree to electronic notification.

The Notice summarizes the proposed Settlement.
 

PLEASE DO NOT CONTACT ST. FRANCIS, THE COURT, OR THE COURT CLERK’S OFFICE TO INQUIRE ABOUT THIS SETTLEMENT OR THE CLAIMS PROCESS. CLASS COUNSEL OR THE SETTLEMENT ADMINISTRATOR ARE AVAILABLE TO ASSIST YOU SHOULD YOU HAVE ANY QUESTIONS.