Homeowner association has duty to protect records and documents

Question: I’m the president of our homeowner association mainly because no one else wants the job. We live in a prestigious area of Los Angeles and have fewer than 30 units. Because nobody wants to be on our board we hired a management company. They’re not a California company. Their head office is out of state, and we’ve never seen or been to their California place of business and do not know where it is or that they even have a California office. A management representative came and picked up our files and documents, including owners’ personal information and accounts, and gave us their P.O. box number. All we have to do is pay them. So far there have been no complaints until an owner asked the board where our files were. Do we have to give the owner the management company’s physical address?

Answer: Whether you have 30 or 3,000 units, removal, let alone relinquishment, of the association’s original documents and records, including titleholder information and accounts, should be treated as a security issue.

Homeowner associations should have in place not only security procedures but also a procedure detailing chain of custody protocol so that its records and documents can be tracked and accessed at any given time. Many of the problems that lead to litigation in these communities occur because there appears to be no type of central control and no written assurances of security from third parties with access to this information or who have physical custody of the records.

Owners with concerns that their personal information is being mishandled or disclosed, or wanting to know where their personal documents are being housed, need written assurances from the board as to safekeeping methods. Directors that liaison with third-party vendors should require written assurances from management companies regarding all association documents, titleholder information, board correspondence and other matters concerning privacy. Under Civil Code section 1798.83(e)(3), “disclose� means to disclose, release, transfer, disseminate or otherwise communicate orally, in writing, by electronic or any other means to any third party.

In addition to association-related document control, board directors have a duty that cannot be delegated to actively take necessary precautions to protect all owner and resident-related personal information and data from theft or criminal activity. This includes implementing security measures to protect all such information.

Hiring a management company does nothing to reduce the board’s obligations. It only adds the additional duty of overseeing management, pursuant to Corporations Code 7231(a). Paying a non-vetted third party to store such items at an undisclosed location is a huge liability to the association. The entity in possession of such corporate documents is also vested with “custody and control.� Those duties remain with the board, and should never be allowed to be turned over to a management company representative or anyone else.

If the association has obtained a resident’s or owner’s personal information, including such things as employment information and Social Security number, it must also provide written assurances of its safeguarding of this information and should describe what happens to the information after the owners sell their property.

Association directors have a duty to inspect, manage and safeguard such documents, and titleholders have a right to inspect them, according to Corporations Code sections 8330, 8333, 8334; Civil Code sections 5200, 5210.

The owner’s inquiries about the management company are within his rights. Owners have a right to know the location of their and the association’s documents and be able to inspect them on request. Further, the management company’s P.O. box number does not fulfill the requirements of Civil Code sections 5310, 5655, wherein the association shall provide an address for overnight payments of assessments; owners have the right to receive a payment receipt and such receipts must be provided on request. The receipt shall indicate the date of payment and the person’s name that received it. If this owner makes a demand for inspection that the board cannot satisfy, then the owner can bring an action to enforce his rights and will be entitled to the costs associated with enforcement, including reasonable attorney’s fees, under Corporations Code sections 8336, 8337.

Pursuant to Civil Code section 5655(c), the association shall provide a mailing address for overnight payment of assessments. If these payments are going to a management company, there should be a physical address where owners are able to deliver a payment in person, even if it is an after-hours lockbox.

As fiduciaries entrusted with the interests of the association and its titleholders, the board should ask itself why sensitive documents were delivered to an out-of-state company with no investigation regarding its California operations.

Owners are encouraged to take steps to protect themselves from identity theft. If the board has no rules regarding security and safekeeping of such information, it should make them now. Any vendor who fails to abide by those rules should be terminated.

Zachary Levine, partner at Wolk & Levine, a business and intellectual property law firm, co-wrote this column. Vanitzian is an arbitrator and mediator. Send questions to Donie Vanitzian JD, P.O. Box 10490, Marina del Rey, CA 90295 or [email protected].