Recently, our condo Board and Mgt. Co. didn't respond to two letters from a group of residents asking to set up a time to review the financial docs that Section 10(c) of 183A requires them to keep up-to-date and available for owners to review and/or copy during business hours. (I don't think anyone has been successful in doing this over many years.) Another letter was sent, certified, again listing the Section 10(c) language. This got a voice mail response left by one Board member for one of the residents, saying that the Board wasn't "not responding," but was checking with their lawyer to see what they can show residents per the 2010 Data Security Act (2010 DSA) and they would respond when they hear back from their lawyer. They also said that only two people could view the items, by appointment. Any others would have to make separate appointments.
Few, if any, of the items in Section 10(c) involve the kinds of personal info referred to in the 2010 DSA, so they could have given access to these, as required. It seems that if they were complying with Section 10(c) and keeping the files up-to-date, that would mean they are also compliant with the requirement in 2010 DSA (enacted early in 2010) to secure the personal info of residents in those files over a year later. Even without the 2010 DSA, this personal info should never have been kept in any such files that residents can view.
This is one of many examples of their often transparent (and even self-damning) excuses for the many ways they are not adhering to their legal requirements in the condo and state governing documents (including the one to maintain our buildings adequately). It's telling that when our Mgt. Co. was fired (before our Board brought them back 3 years later), they gave our condominium all the financial info on an outmoded type of disk. It was blank or unreadable, but they said they couldn't send another copy because they'd erased the original info from their computer--something they are not supposed to do for 7 years...
My question: I'm interested in any comments or advice on any of this, but does Section 10(c) not mean that the cited financial info is supposed to be ready to view and that we have the option to show up to view the financial info at our Mgt. Co. office during regular business hours (without an appointment)? Should they not give access to the many categories of info that doesn't contain personal info of residents?
Thank you for reading.
Review of condominium documents under 201 CMR 17.00
Once again, I find myself scratching my head and wondering about the behavior of a condominium board. I'm not sure what type of documents the Board could be worried about, unless the have, within their records, information that could be embarrassing to other current or former owners, such as documents regarding collections efforts. However, the types of documents you are interested in, the types of document and records specifically mentioned in Massachusetts General Laws Chapter 183A, Section 10(c) should not involve too many privacy issues. To the extent that they do, the Board must devise a plan to abide by Section 10(c) without violating the new privacy regulations, 201 CMR 17.00.
I agree with your reading of the language from 10(c):
Such records shall be kept in an up-to-date manner within the commonwealth and shall be available for reasonable inspection by any unit owner or by any mortgagee holding a recorded first mortgage on a unit during regular business hours and at such other times as may be provided in the agreement between the manager or managing agent and the organization of unit owners. Access to said records shall include the right to photocopy said records at the expense of the person or entity making the request.
Seems pretty clear to me. However, I guess it can't hurt to see what the Board's attorney has to say about the matter. I find it hard to believe that the Board will delay and obfuscate to the point that you will be forced to hire a MA real estate attorney. Good luck.
Clarification
Thank you for your response. Supposedly, the lawyer said that per the new Massachusetts Law - 201 CMR 17.00: "Standards for the Protection of Personal Information of Residents of the Commonwealth," the Board and Mgt. Co. must go through a long, expensive, detailed process to remove all TIN numbers, Bank Account Numbers, Financial Account Numbers, and Social Security Numbers on any and all invoices, bids, contracts, bank statements, receipts, insurance policies, financial records and statements for all residents, vendors and bidders, prior to showing any files. So, they couldn't show information going back 5 years, as requested. They offered to show the present year's info to start, then show earlier years, one at a time, as they go over them.
I am wondering if this jibes with your understanding of 201 CMR 17:00. Since they did not comply with it over a year ago when it was enacted--and thereby aren't in compliance with 183A, Section 10(c)-- is here any way they could be required to adhere to some sort of time table to get the files up-to-date and available? There is that issue I mentioned wherein they deleted our financial info when they were fired, rather than keep it for 7 years, so it seems in their interest to delay.
Thank you again.
New privacy regulations
Yes, the Board must find a way to abide by Section 10(c) without violating the new privacy regulations contained in 201 CMR 17.00. The regulation is relatively new and, understandably, condominium associations are still trying to figure out how to deal with its requirements. Eventually, the associations will devise methods of making records available to unit owners, pursuant to existing MA law, while complying with the new privacy regulations.
201 CMR 17.00 requires any organization that collects, uses, stores, transmits, or disposes of personal information about a Massachusetts resident to take “reasonable measures” to protect personal information from theft. The regulations define personal information to include a person’s full name and any sensitive or identifying numbers, such as Social Security, bank account, credit or debit card, driver’s license, or PIN.
So, yes, your condominium association is now required to come up with a plan to protect personal information. And this requirement is yet another reason why all condo boards should have ongoing relationships with a Massachusetts attorneys. As this is a relatively new issues, I cannot say how long a court would give the association to redact and then produce the information. I suspect it will come down to some sort of nebulous "reasonable effort" standard.
Re: New Privacy Regulations
Thank you again for responding. I have a couple more questions, if I haven't used up my allotment! (1) Does 201 CMR 17.00 require removal of the sensitive info of vendors and others who do business with our condominium, as well as those of unit owners from files residents can view? (2) Is our Board not required to immediately make available those items (below) that are cited in 183A, Section 10 (c), that do not contain personal information?:
(i) records of all receipts and expenditures, invoices and vouchers authorizing payments, receivables, and bank statements relating thereto;
(ii) records regarding the replacement reserve fund or any other funds of the organization of unit owners and bank statements relating thereto;
(iii) audits, reviews, accounting statements, and financial reports relating to the finances of the organization of unit owners;
(iv) contracts for work to be performed for or services to be provided to the organization of unit owners; and
(v) all current insurance policies of the organization of unit owners, or policies which name the organization as insured or obligee.
Our Board has said they can't give any access to anything right now, but it seems there are plenty of items we have a right to see, immediately, that do not contain the personal info of residents or those with whom we do business.
Thank you again for any further clarifications you are willing to give!