Boards spend a great deal of time on physical risks such as slip and fall claims, storm damage, and aging buildings. Data security gets less attention, even though associations hold the kind of information criminals want. Names, addresses, email addresses, phone numbers, bank account details for automatic payments, and sometimes background check results are kept by most associations or their managers.
This article is general information and is not legal advice. The association's attorney should be consulted.
What Florida Law Says About Owner Data
Florida's official records laws already treat much of this information as protected. Under section 720.303(5) for HOAs and section 718.111(12) for condominiums, certain records are not available for owner inspection. They include social security numbers, driver license numbers, credit card numbers, email addresses, telephone numbers, emergency contact information, and other personal identifying information, other than the owner's name, property address, and mailing address. Electronic security measures used to safeguard data, including passwords, are also excluded from inspection.
Florida's data breach statute, section 501.171, requires a covered entity to take reasonable measures to protect electronic personal information. If a breach occurs, notice to affected individuals is generally due within 30 days, and notice to the Department of Legal Affairs is required when 500 or more Florida residents are affected. Whether and how the statute applies to a particular association should be reviewed with the association's attorney, but its standards are a sensible guide for any board.
How Attacks Usually Happen
Phishing. An email that appears to come from a bank, a vendor, or another board member asks the recipient to click a link or enter login details. Once credentials are given, accounts can be accessed by the criminal.
Payment fraud. A message that looks like it came from the association's president or a regular vendor asks for an urgent payment or a change in bank account information. If the request is not verified, funds are sent to the criminal.
Ransomware. Malicious software locks files or systems until a payment is made.
Lost or poorly secured devices. Records kept on personal laptops, phones, or email accounts of volunteers can be exposed when a device is lost or an account is compromised.
Many of these schemes depend on urgency and fear. A simple rule that no payment or bank change is made without a phone call to a known number stops a large share of them. Warning signs of financial misconduct are also discussed in
HOA fraud: know the signs.
Review the Association's Insurance
A directors and officers policy protects the board against claims of wrongful acts, but it often does not cover cyber losses unless that coverage is specifically included. The crime or fidelity policy, which protects association funds, should be reviewed for endorsements such as:
- Computer fraud, covering loss from the fraudulent use of a computer to transfer funds
- Funds transfer fraud, covering theft through fraudulent instructions to a bank
- Social engineering or fraudulently induced transfers, covering losses when someone is tricked into sending money
Cyber liability coverage should also be considered. First party coverage pays the association's own costs, and third party coverage responds to claims by others. Policies commonly address legal and forensic services, notification costs, crisis management, and credit monitoring. The retroactive date on any claims made policy should be checked, because incidents that began before that date may not be covered.
Practical Steps to Improve Security
- Owner data should be kept in the management system or another secure, association controlled platform, not in personal email or on home computers.
- Strong, unique passwords and multi factor authentication should be required for every account.
- Access to personal information and banking should be limited to people whose roles require it.
- Access should be removed promptly when a director leaves the board.
- Two people should approve payments above a set amount, and any change to vendor bank details should be confirmed by phone.
- Directors should be reminded regularly about phishing and payment fraud.
- Paper records with personal information should be stored securely and shredded when no longer needed.
- Data security practices should be discussed with the management company each year.
Help Protecting Association Records
Records, owner data, and payment controls are maintained by Condominium Associates for the communities it manages. More on owner access rules is available in
who can access HOA documents. To talk about your association's safeguards,
contact us.
