Self Storage Software and Lien Law

Looking for software for your Mini Storage?
Be careful, many companies are not equipped to handle the lien law for Califonia, Hawaii, Rhode Island, and Washington and do not protect the tenant information.

Federal Trade Comission Business Alert
Disposing of Consumer Report Information? New Rule Tells How

In an effort to protect the privacy of consumer information and reduce the risk of fraud and identity theft, a new federal rule is requiring businesses to take appropriate measures to dispose of sensitive information derived from consumers.

Proper disposal of information in consumer reports and records to protect against unauthorized access to or use of the information. The Federal Trade Commission, the nation's consumer protection agency, enforces the Disposal Rule.

What is proper disposal ?
The Disposal Rule requires disposal practices that are reasonable and appropriate to prevent the unauthorized access to, or use of, information in a consumer report. For example, reasonable measures for disposing of consumer report information could include establishing and complying with policies to:
destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed;
conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule.

Due diligence could include:
reviewing an independent audit of a disposal company's operations and/or its compliance with the Rule;
obtaining information about the disposal company from several references;
requiring that the disposal company be certified by a recognized trade association;
reviewing and evaluating the disposal company's information security policies or procedures.


In Canada, the Annual Report to Parliament, from the Office of the Privacy Commissioner of Canada, talks about reforming the Privacy Act. Below is some of the concerns that they will be addressing;
Privacy:
Collection. Personal information collected that is not required for an operating program or activity of the institution; personal information is not collected directly from the individual concerned; or the individual is not advised of the purpose of the collection of personal information. Retention and Disposal. Personal information is not kept in accordance with retention and disposal schedules (approved by the National Archives and published in INFOSOURCE): either destroyed too soon or kept too long. In addition, personal information used for an administrative purpose must be kept for at least two years after the last administrative action unless the individual consents to its disposal.

Use and Disclosure. Personal information is used or disclosed without the consent of the individual and does not meet one of the permissible disclosures without consent listed in section 8(2) of the Act.



If the computer you use for customer data (your storage software), accesses the internet. You need to make sure your data can not be breached. Some software companies use un-secured databases that can be read with a text editor. There are quite a few viruses, trojan horses, and spyware that will copy or steal mdb (Microsoft Database Database), and document files. This can cost an owner up to $3000 per tenant in California if your data is compromised.

An quick way to see if your data is at high risk, is to open your tenant data file with MS Notepad. If you can see in all of that information, any of your tenant's information, be concerned. You need to get protection, (firewall,ect), for your computer to protect it from any outside intruder. As an example, this might be what your part of your data looks like:

RonVanVardenAdvanced Mini Storage #12625 Monte Diablo Ave.Stockton952032094664444C1234567123456789StocktonAdvanced Mini Storage2625 Monte DiabloStockton95203209466444419890000advancedmini1@comcast.net
which is the following;
......... Name / Company / address / City /zip / phone / DL# / SSN / Billing adress /Work Phone /Home Phone / E-Mail Address



An an example of some of the trojan horse programs out there now.

When a hacker utility, back door, or Trojan Horse is installed on a system, e.g. NetBus, Back Orifice, Rootkit, etc. through email or a destructive website;

When Windows is restarted, the program executes and builds all .idx, .mdb, .pst, .htm, .snm, .pab, and .txt files on the hard drive. It also extracts all URLs (web addresses) from the Internet cache. All of this information is copied to a .dat data file and encrypted.
The trojan horse sends all of the collected information in the .dat file to a specific email address.

Since the access 97 mdb file can be read with the Notepad program, the recipients of the email will have all the tenant information.

Another viruse will take email address it finds in Microsoft Windows Address Book and in .dbx, .wab, .mbx, .eml, and .mdb files and email itself to them. How secure will a tenant feel about your facility and your safeguarding of their personal information when they receive a virus from you?


Many of the software companies that we have talked to, have taken this threat very seriously and are working to protect the data. TaskMaster uses a Pervasive Database, which is the same type of database used by banks. Sitelink has now added a 128 bit encrypted sql web access database. Some use non standard file name extensions.




Adam from Empower Software, (877-672-6257) brought a potential problem to our attention.
If you open your database with Notepad, make sure you DO NOT SAVE the database. It will corrupt your database, making your program unusable.

Kat Shenoy from E-SoftSys (Self Storage Manager 610-277-7457) has suggested that you keep the social security number only in the tenant's file, do not store it on the computer. It would still be available to you, if you needed it for collections or background check.


If you are not sure about doing it, don't. It would be better to make sure your computer with the database is isolated from the internet. I have helped more than one facility try to recover data after an employee surfed the web and picked up some serious viruses.

If you must be connected to the internet, contact a network security consultant. A good security consultant will start by assessing factors to determine the level of security you really need. Beware of the security company that tries to sell you a "one size fits all" solution.






Another Issue for Self Storage Software



Some of the software for the Self Storage Industry can not put an expiration date as required by law on the lien notices. These dates are not optional and they are specific, they require a specified date, not just 'expires 15 days from date of mailing'.

Many companies think they are legal because they can handle the multi-level late fee schedule, but they ignore the days between late events, and expiration dates on letters that is required in California, Hawaii, Rhode Island, and Washington

California Law also requires no less than 14 days between the Pre-Lien Letter and the Notice of Lien Letter (Calif. B and P Code 21704), there is no requirement on days past due, just days after a notice. If you mail your Pre-Lien notice on Thursday June 16th, 2005, you can not mail your Notice of Lien any earlier than Friday July 1st. You must also have the date the Notice of Lien will run on your pre-lien notice, in this example the expiration (specified) date on the letter would be June 30th 2005.

Most facilities use 15 or 16 days between the letters for a buffer, (couldn't make it to post office etc.).

This is a part of the Excel check-off list we have to use prior to sending a tenant to auction
Space Name..................Receipt......P/L Mail.......P/L Exp.....N/L Date
B013 LatePayer,Adam.....05/11/2003...11/16/2004....12/01/04....12/02/2004
B042 Superlate,Jane.....11/14/2003...12/16/2003....01/02/04....01/03/2004


If an error was made in the expiration date on the Pre-Lien or Notice of Lien. (employee click 'OK' instead of selecting a date from the menu), we would have to start the lien process over, (we had that happen a few months ago, when the Pre-Lien letters were ran, the employee clicked on 'OK' instead of selecting the expiration date. It was not found until they started attaching the postal receipts to our copy of the letter. We had to re-run and re-mail over 60 certified letters.)

Updated 10-14-05

Below is a response from some of the software companies about;
1. No Less than 14 days between the mailing of Pre Lien and Notice of Lien with the 'Termination Date' being printed on the Pre Lien and Notice of Lien
2.The customer data being protected from intruders. For owners / facility managers, this falls under the Due diligence as required by the Federal Trade Comission.