10-1-632. Protection of consumer data in motor vehicle sales or lease transactions; burden of proof for violations.

With respect to consumer data, a franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, distributor, or affiliate thereof:#

1. (1)

   Shall comply with and shall not cause a dealer to violate any applicable restrictions on reuse or disclosure of the consumer data established by federal or state law;#

2. (2)

   Shall provide a written statement to the dealer upon request describing the established procedures adopted by such franchisor, manufacturer, distributor, or affiliate thereof or third party acting on behalf of the franchisor, manufacturer, or distributor which meet or exceed any federal or state requirements to safeguard the consumer data, including, but not limited to, those established in the federal Gramm-Leach-Bliley Act, 15 U.S.C. Section 6801, et seq.;#

3. (3)

   Shall, upon the written request of the dealer, provide a written list of the consumer data obtained from the dealer and all persons to whom any consumer data has been provided by the franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor during the preceding six months. The dealer may make such a request no more than once every six months. The list must indicate the specific fields of consumer data which were provided to each person. Notwithstanding the foregoing, such a list shall not be required to include:#

   1. (A)

      A person to whom consumer data was provided, or the specific consumer data provided to such person, if the person was, at the time such consumer data was provided, a service provider, subcontractor, or consultant acting in the course of performance of services on behalf of or for the benefit of the dealer, franchisor, manufacturer, distributor, third party, or affiliate, provided that the dealer, franchisor, manufacturer, distributor, third party, or affiliate has entered into an agreement with such person requiring that such person comply with the safeguard requirements of applicable state and federal law, including, but not limited to, those established in the federal Gramm-Leach-Bliley Act, 15 U.S.C. Section 6801, et seq.;#

   2. (B)

      A person to whom consumer data was provided, or the specific consumer data provided to such person, if the dealer has previously consented in writing to such person receiving such consumer data and the dealer has not withdrawn such consent in writing; and#

   3. (C)

      A person to whom consumer data was provided, or the specific consumer data provided to such person, if that would require a franchisor, manufacturer, distributor, or affiliate thereof to violate any applicable restrictions on reuse or disclosure of the consumer data established by federal or state law;#

4. (4)

   May not require that a dealer grant the franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor direct or indirect access to such dealer’s data management system to obtain consumer data. A franchisor, manufacturer, distributor, affiliate, or a third party acting on behalf of a franchisor, manufacturer, or distributor shall permit a dealer to furnish consumer data in a widely accepted file format, such as comma delimited, and through a third-party vendor selected by the dealer; provided, however, that a franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor may access or obtain consumer data directly from a dealer’s data management system with the express consent of the dealer. Such consent shall be in the form of a written document that is separate from the parties’ franchise agreement, is executed by the dealer, and allow for withdrawal by the dealer upon 30 days’ written notice to the franchisor, manufacturer, or distributor as applicable. For incentive programs beginning on or after July 1, 2019, such consent shall not be required as a condition to a motor vehicle dealer’s participation in an incentive program unless such consent is necessary to obtain consumer data to implement the program; and#

5. (5)

   Shall indemnify the dealer for any third-party claims asserted against or damages incurred by the dealer to the extent caused by access to, use of, or disclosure of consumer data in violation of this Code section by the franchisor, manufacturer, distributor, or affiliate thereof or a third party to whom the franchisor, manufacturer, or distributor has provided consumer data.#

Nothing contained in this Code section shall limit the ability of a franchisor, manufacturer, distributor, or affiliate thereof to require that the dealer provide, or use in accordance with the law, such customer information related solely to such manufacturer’s or distributor’s own vehicle makes to the extent necessary to do any of the following:#

1. (1)

   Satisfy any safety or recall notice obligations or other legal notice obligations on the part of the manufacturer;#

2. (2)

   Complete the sale and delivery of a new motor vehicle to a customer;#

3. (3)

   Validate and pay customer or dealer incentives;#

4. (4)

   Submit to the franchisor, manufacturer, or distributor claims for any services supplied by the dealer for any claim for warranty parts or repairs;#

5. (5)

   Market analysis;#

6. (6)

   Evaluate sales and service customer satisfaction with the dealer, including surveys; or#

7. (7)

   Reasonable marketing purposes that benefit the dealer.#

In any cause of action against a franchisor, manufacturer, distributor, or affiliate thereof for a violation of this Code section, the party bringing the action shall have the burden of proof.#