California Civil Code §§ 5100 & 5120

Secret ballot and tabulation

Director elections and several other association matters must be decided by secret ballot. Until the time and place at which the ballots are counted, nobody may open or view a ballot — or the tally sheet. That second clause is the one systems break.

What has to be secret, and from whom

The requirement is not that the association keeps results confidential until it announces them. It is that the link between a member and the contents of their ballot is never available to anyone who is not entitled to it, at any point — including the board, including the manager, and including the person operating the software.

Section 5100 fixes which matters require it. Elections of directors are the obvious case; amendments to governing documents, assessment votes and grants of exclusive use of common area are the others most associations meet. Where the section applies, the secrecy is structural, not procedural: you cannot satisfy it with a policy that says people will not look.

How the double envelope achieves it

The paper method separates the two things that have to stay apart. The member marks the ballot and seals it in an unmarked inner envelope. That envelope goes inside an outer envelope which the member signs and which identifies their unit.

At the count, the inspector works through the outer envelopes first — checking eligibility, marking the roll, resolving duplicates — and only then separates them from the sealed inner envelopes, which are mixed before any is opened. Eligibility is established by one artefact, the vote is carried by another, and the two are never in the same hand at the same moment.

The tally sheet is covered too

Section 5120 bars opening or viewing a ballot or the tally sheet before the time and place at which the ballots are counted. The second noun does most of the work and is routinely overlooked.

It means a running count is not something the association may look at while voting is open. Not the board, not the manager, not a dashboard. The reason is obvious once stated: an election where the people running it can watch the margin is an election where they can decide how hard to chase the remaining votes, and from whom.

Where this goes wrong in practice

• Administrator preview. At least one widely used community platform states plainly that managers and authorised personnel can see submissions before the meeting. Whatever that is useful for, it is not compatible with running a secret ballot.
• Counting one channel early. Opening the paper while the electronic poll is still open — to "get ahead of the work" — is a § 5120 problem even though no result is announced. See hybrid elections.
• Debug access. A support engineer who can read ballot contents in a database is a person who can view a ballot before the count. The separation has to be real, not operational discipline.
• Exports. A spreadsheet that pairs member names with choices, generated for any reason, is the thing the statute exists to prevent — and it tends to survive in inboxes long after the election.

The count itself

Ballots are counted at a time and place announced in advance, and members are entitled to observe. The inspector runs it; the board does not. Observation is not a courtesy — it is part of what makes the result defensible, because it produces witnesses to the procedure who are not employed by the association.

Once counted, the materials become records to be retained and made available for inspection, which is where §§ 5125 and 5200 take over.

Related

• § 5110 — the inspector, and the five technical requirements for electronic balloting.
• § 5130 — proxies, and why secrecy does not travel through one.
• § 5145 — what a secrecy defect costs when the election is challenged.
• Hybrid elections — why partial counts of one channel break this.
• Corp. Code §§ 7513 & 7615 — written ballots without a meeting, and why § 5100 still reaches them.