Condo Media - April 2011 - 34

COVER STORY

ommunity associations haven’t been among the first (or second or third) to embrace new Web-related technologies, but slowly and with varying degrees of enthusiasm, they have been joining the Internet parade. Many, if not most, associations now have their own Web sites; even the smallest communities are communicating regularly via e-mail; a growing number allow owners to make payments online; some sponsor online chat rooms; and a few are venturing into the social media realm, creating Facebook pages and opening Twitter accounts.

C

Data Security: A Growing Concern
Of the two, data management risks are probably better-known, because, at least until recently, they have gotten more attention. Widely reported incidents of computer hacking, computer fraud and security breaches have heightened awareness of the need to protect personal information and to strengthen the defenses against cybercrimes and the increasingly creative criminals who perpetrate them. In Massachusetts, computer security breaches at TJX and the Hannaford Bros. Supermarket chain produced what are said to be among the broadest

New and not-so-new innovations offer an array of benefits, but they also create a panoply of risks that association boards need to recognize, manage and often insure against.
All of these new and not-so-new innovations offer an array of benefits — cost-savings, operating efficiencies and improved communication among them. But they also create a panoply of risks that association boards need to recognize, manage and often insure against. “The business world does not fully appreciate how interconnected the Internet has made us, which translates into unseen liabilities and financial blind spots for companies that do not adequately plan for the potential of catastrophic Internet attacks, failures, abuses, outages. … cyber risk is irreversible and geometrically expanding.” Although that warning, from a June 2010 report by Betterley Risk Consultants, is aimed at corporations, it applies equally to the risks confronting community associations, as they expand their usage of and reliance on Internet-based tools. Those risks fall roughly into two major categories: data management and communications. data security regulations in the country. Although not aimed specifically at community associations, the regulations, issued by the state Office of Consumer affairs and Business Regulations, catch association boards, along with businesses of all types and sizes in a far-reaching compliance net. The regulations apply to any entity that collects private consumer information, defined as the first and last name or first initial and last name of a Massachusetts resident, in combination with any one of the following: • Social Security number • Driver's license number or stateissued identification card number • Financial account number • Credit or debit card number The rules generally require entities to protect the personal information they collect, specify the steps they

will take in the event of a security breach, and to create a written information security program (WISP), describing their security protocols. The law anticipates that the security measures will match the nature of the information collected and the risks incurred, and community associations will typically rank low on that risk scale, observes Moira Casey, director of human resources at the Massachusetts law firm Marcus, Errico, Emmer & Brooks. “But everyone has to do something [to comply],” she emphasizes, because the penalties for non-compliance are stiff — starting at $5,000 and including the possibility of treble damages for failing to implement security measures and up to $50,000 for failing to report security breaches.

“Common Sense” Requirements
Although the regulations may seem “overwhelming,” Casey says, in fact, “compliance for community associations is not as daunting as it may appear. It’s really just a combination of common sense and good business practices.” Associations do have to create written security plans, but their plans don’t have to be particularly detailed or comprehensive. Casey’s suggestions: • Limit access to personal information to board members, association representatives and employees who have a business-related “need to know.” • Make sure that anyone who has access to the information understands the privacy regulations and the importance of compliance. • Collect only the information the association needs, don’t hold it for any longer than necessary and dispose of it properly. Security specialists recommend that boards approve a formal, written document retention and disposal policy, specifying how long information will be held and how it will be destroyed.

34

CONDO MEDIA • APRIL 2011
Condo Media - April 2011

Table of Contents for the Digital Edition of Condo Media - April 2011
