by Chris Cervellera, Esq.

Business Law, Cybersecurity Law, Real EstateDecember 28, 20180 comments 3 Likes

New Florida Laws in 2019: New Law Requires Certain Condominium Associations to Maintain Websites & Portals

In April 2018, Florida Governor Rick Scott signed into law, House Bill 841, which modified an already existing law (HB 1237) that requires certain condominium associations in Florida to maintain websites and portals. Florida’s new condominium website law clarified the previous law and postponed the effective date until January 1, 2019. Click here to view the complete text of the law [beginning at Section 12(g)].

Condominium associations that are within the scope of this law must comply on January 1, 2019. What does that mean if you are a unit owner in a condominium association or if you are on the board of a condominium association? This article outlines some of the important parts of this law and some issues that should be considered. As always, you or your condominium board should consult an attorney if you have specific questions about this, or any condominium laws.

An Overview of Florida’s New Condominium Website & Portal Law: 

Applicability of the Law:

The new condominium website law applies to all Condominium Associations that manage a condominium with 150 or more units (timeshare units excluded).

Type of Website / Portal: 

The law is clear—maintaining a generic, public website where you upload documents is not sufficient. The required documents and notices must be controlled by private access in a portal-like environment (i.e. accessible with credentials). Specifically, the law states that the portal must be a “protected electronic location that is inaccessible to the general public and accessible only to unit owners and employees.”

Access to the Condominium Website / Portal:

Once again, there needs to be a mechanism or credential that a unit owner and employees can utilize to access the documents and notices. How and when are these credentials issued? The law states, “Upon a unit owner’s written request, the association must provide the unit owner with a username and password and access to the protected sections of the association’s website that contain any notices, records, or documents that must be electronically provided.”

Documents & Records That Must Be Posted on the Condominium Website / Portal: 

Not only are there specific documents and notices that need to be posted, some of these documents must be posted within certain timeframes and in a certain manner. For example, Notices of Unit Owner Meetings, must be posted along with the meeting agenda, no later than 14 days before the meeting. Also, the law states that the Meeting Notice must be posted in “plain view on the front page of the website” or “ on a separate subpage of the website labeled ’Notices’”.

Below is the complete list of the required documents and notices, along with the manner and time of their required publication to the portal.

• a. The recorded declaration of condominium of each condominium operated by the association and each amendment to each declaration.
• b. The recorded bylaws of the association and each amendment to the bylaws.
• c. The articles of incorporation of the association, or other documents creating the association, and each amendment thereto. The copy posted pursuant to this sub-subparagraph must be a copy of the articles of incorporation filed with the Department of State.
• d. The rules of the association.
• e. A list of all executory contracts or documents to which the association is a party or under which the association or the unit owners have an obligation or responsibility and, after bidding for the related materials, equipment, or services has closed, a list of bids received by the association within the past year. Summaries of bids for materials, equipment, or services which exceed $500 must be maintained on the website for 1 year. In lieu of summaries, complete copies of the bids may be posted.
• f. The annual budget required by s. 718.112(2)(f) and any proposed budget to be considered at the annual meeting.
• g. The financial report required by subsection (13) and any monthly income or expense statement to be considered at a meeting.
• h. The certification of each director required by s. 718.112(2)(d)4.b.
• i. All contracts or transactions between the association and any director, officer, corporation, firm, or association that is not an affiliated condominium association or any other entity in which an association director is also a director or officer and financially interested.
• j. Any contract or document regarding a conflict of interest or possible conflict of interest as provided in ss. 468.436(2)(b)6. and 718.3027(3).
• k. The notice of any unit owner meeting and the agenda for the meeting, as required by s. 718.112(2)(d)3., no later than 14 days before the meeting. The notice must be posted in plain view on the front page of the website, or on a separate subpage of the website labeled “Notices” which is conspicuously visible and linked from the front page. The association must also post on its website any document to be considered and voted on by the owners during the meeting or any document listed on the agenda at least 7 days before the meeting at which the document or the information within the document will be considered.
• l. Notice of any board meeting, the agenda, and any other document required for the meeting as required by s. 718.112(2)(c), which must be posted no later than the date required for notice pursuant to s. 718.112(2)(c).

Non-Compliance:

On its face, the statute is silent about specific penalties or actions that could be taken by the State of Florida or individual unit owners (see below for penalties under Florida administrative rules). Subparagraph 4 of the statute states, “The failure of the association to post information required under subparagraph 2. is not in and of itself sufficient to invalidate any action or decision of the association’s board or its committees.” This means non-compliance with the law would not jeopardize the association board from carrying out its duties or invalidate their actions.

However, if a condominium association and its board have not taken action to comply with this law, unit owners could file complaints with Florida’s Department of Business and Professional Regulation Division of Florida Condominiums, Timeshares, and Mobile Homes or the department could monitor, audit, and enforce the law on its own.

In early December 2018, the Division of Condominiums, Timeshares, and Mobile Homes, through its rule-making authority, published Rule 61B-21.003 “Penalty Guidelines”. This rule, effective December 5, 2018, outlines the various penalties, including fines and corrective actions, that can be taken against condominium associations for non-compliance with the website and portal publication, in addition to a number of other condominium regulations. According to the rule, the penalty for non-compliance would be no less than $500, and varies based on the number of units ($10 to $30 per unit). The statutory maximum for penalties that can be levied by the Division of Florida Condominiums, Timeshares, and Mobile Homes is $5,000 for each violation (See FL Stat § 718.501.). 

Additionally, the possible removal or recall of association board members by a quorum of unit owners, as set-out by Florida Condominium Laws, could be a possible result of non-compliance with the law. Condominium Association Board members should always remember that they are fiduciaries who have a duty to keep accurate records and also comply with the law. The Board exists to serve and protect the interests of the association members.

What are some issues that Condominium Associations need to consider in complying with Florida’s new Condominium Website & Portal Law?

While this list is not exhaustive, here are a few issues that Condominium Associations should consider in complying with Florida’s new Condominium Website Law.

Existing Websites & Portals:

If your condominium association has an existing portal, does it comply with the specific standards that are set out in the new law (i.e. the specific documents that are required, the access given to unit owners, etc.)? You should not assume that it complies, and your Association Board and management company should conduct an audit to make sure that it fully complies with the law. Contact an attorney to make sure you understand the law and its requirements.

Switching Management Companies:

Many condominium and property management companies that are employed by condominium associations, offer websites and portals to their properties. However, if you are considering a new property management company, or if you are required to evaluate other companies every few years, transferring your existing data and records from one platform to a new platform could be a significant project that would require a tremendous amount of time and money. Your management company probably knows this, and they will most likely try to leverage this in your negotiations with them or during the bidding process. To level the playing field, condominium associations should begin to think about moving their documents and notices to an independent third-party solution that is not associated with their management company.

Cybersecurity:

Cybersecurity should actually be one of the very first things that an association considers when developing a web portal for their association. One of the biggest issues that should be addressed is the the limitation or elimination of publishing “Personally identifiable information” or “PII”?

In Florida, PII is defined by FL Statute § 501.171(1)(g). Based on the list of required documents and notices, it is unlikely that most of the PII classifications would be necessary for publication to a condominium portal or website. For example, a first name or first initial and last name, along with a social security number, drivers’ license number, etc.; would not be relevant for publication (see the statute for the full list of PII definitions). However, if your association takes payments via your website by credit cards or bank account withdrawals, then you have a number of issues and vulnerabilities to address. 

Additionally, PII also includes “a user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account.” This means, the condominium portal credentials themselves, such as the user name or email, with the password or security question, would constitute PII and should be protected.

If the aforementioned PII is accessed by an unauthorized party, such as a hacker, a former condo employee, or maybe even a renter of a unit (i.e. should a renter have access to an owners-only portal), this unauthorized access could trigger the various breach notification requirements under Florida law, and possibly other state laws should you have out-of-state unit owners. Your association should contact a cybersecurity lawyer to ensure your association creates and implements a data breach prevention and response plan.

Additionally, here are a few specific questions that you should ask your condominium board and IT provider:

• Does the condo website and portal employ an adequate level of encryption, such as SSL 256-bit encryption? This ensures that data will be encrypted when it is in transit between a user and the server.
• Is the data encrypted and not publicly accessible when it is “at rest” on the server? This helps to prevent anyone, including bots, from accessing specific files such as PDF or spreadsheets, without a user name and password.
• Do your portal and server utilize and store log files that can track access history and detect unauthorized access? This gives you the ability to detect a vulnerability or a breach in your system. Ignorance is not a defense to a breach.
• Can users have various levels of access to the site and files (i.e. administration or “Write Access” versus “Read Only” access)? This prevents an employee or others, who should not have access to certain information, from gaining access, thereby creating a data breach or accidentally deleting or modifying documents and files.

Thanks for reading this article. Please contact attorney Chris Cervellera at CERV LAW, PLLC if you have any questions or would like a consultation.

Note: This informational article should not be construed or interpreted as legal advice nor the formation of an attorney-client relationship. Always consult an attorney to learn how the law applies to your unique situation.