(a) As used in this Code section, the term:

(1) “Authorized integrator” means a third party with whom a dealer has entered into a written contract to perform a specific function which requires such third party to access protected dealer data or write data to a dealer data system or both.

(2) “Data access overcharge” means any charge to a dealer or person authorized to perform integration that is greater than an amount which reimburses direct costs incurred by a dealer data systems vendor for integration. When a dealer data systems vendor fails to disclose the direct costs of integration and provide documentation of such costs, any direct costs sought to be reimbursed shall be considered a data access overcharge.

(3) “Dealer data system” means any software or hardware provided by a third party and used by a dealer in its business operations to store, process, or maintain protected dealer data.

(4) “Dealer data systems vendor” means any third party that stores protected dealer data pursuant to written contract with a dealer and shall include a dealer management system or customer relations management system provided by a third party. Such term shall not include a manufacturer, distributor, or affiliate subject to Code Section 10-1-632.

(5) “Integration” means access by an authorized integrator to protected dealer data which does not require access to any copyright protected material but allows for access to all protected dealer data and which can be accomplished by any commercially reasonable means not otherwise in violation of this Code section.

(6) “Prior express written consent” means written consent provided by the dealer that is contained in a document separate from any other consent, contract, franchise agreement, or other writing and that specifically outlines a dealer’s consent for an authorized integrator to obtain protected dealer data, including the scope and duration of such consent, and may be unilaterally revoked by the dealer upon 30 days’ notice without cause and immediately with cause.

(7) “Protected dealer data” means any of the following data that is stored in a dealer data system:

(A) Personal, financial, or other data pertaining to a consumer that is provided to a dealer by a consumer;

(B) Motor vehicle diagnostic data; or

(C) Any other data relating to the business operations of a dealer stored or maintained within a dealer data system.

(8) “Secure open application programming interface” or “secure open API” means an application programming interface that allows an authorized integrator to integrate with a dealer data system remotely and securely.

(9) “STAR standards” means standards for the automotive retail industry established by the Standards for Technology in Automotive Retail organization.

(10) “Third party” includes service providers, vendors, including dealer data systems vendors and authorized integrators, and any other individual or entity other than a dealer. Such term shall not include any manufacturer; distributor; affiliate of a manufacturer or distributor; a third party acting on behalf of or engaged contractually or by other agreement with a manufacturer or distributor or an affiliate thereof; any governmental entity acting pursuant to federal, state, or local law; or any third party acting pursuant to a valid court order.

(b) It shall be unlawful for a third party to:

(1) Access, share, sell, copy, use, or transmit protected dealer data from a dealer data system without the prior express written consent of a dealer;

(2) Take any action, by contract, technical means, or otherwise, that would prohibit or limit a dealer’s ability to protect, store, copy, share, or use any protected dealer data, including, but not limited to:

(A) Imposing any data access overcharges or other restrictions of any kind on the dealer or any authorized integrator for integration;

(B) Prohibiting an authorized integrator or any third party identified by a dealer as an authorized integrator that has satisfied or is compliant with the STAR standards, or a standard compatible with such standards, from performing integration or placing unreasonable restrictions on integration, which shall include, but not be limited to:

(i) Unreasonable restrictions on the scope or nature of the data shared with an authorized integrator;

(ii) Unreasonable restrictions on the ability of an authorized integrator to write data to a dealer data system;

(iii) Unreasonable restrictions or conditions on a third party accessing or sharing protected dealer data or writing data to a dealer data system; and

(iv) Requiring unreasonable access to sensitive, competitive, or other confidential business information of a third party as a condition for access to protected dealer data or as a condition to share protected dealer data with an authorized integrator;

(C) Prohibiting or limiting a dealer’s ability to store, copy, securely share, or use protected dealer data outside the dealer data system in any manner and for any reason; or

(D) Permitting access to or accessing protected dealer data without prior express written consent by the dealer.

(c)(1) A secure open application programming interface shall:

(A) Be made available by a dealer data systems vendor to any authorized integrator upon request by a dealer;

(B) Include all relevant endpoints to allow for access to all protected dealer data or to integrate with protected dealer data; and

(C) Provide granularity and control necessary for dealers and authorized integrators to integrate the data necessary pursuant to contract terms between the dealer and authorized integrator.

(2) For purposes of this Code section, secure open application programming shall not require that an application programming interface be available to the public or at no cost to an authorized integrator, provided that no data access overcharge may be assessed in connection with a secure open API.

(d)(1) A dealer data systems vendor shall adopt and make available a standardized integration framework that allows for integration through secure open APIs to authorized integrators. In the event that application programming interfaces are no longer the reasonable commercial or technical standard for secure data integration, a similar open access integration method may be provided to the extent such method provides the same or better secure integration to dealers and authorized integrators as a secure open API. Any dealer data systems vendor that utilizes STAR standards or a comparable system shall comply with the requirements of this subsection.

(2) A dealer data systems vendor and authorized integrator:

(A) Shall be authorized to integrate, or otherwise access, use, store, or share protected dealer data to the extent only outlined in and authorized by the dealer data systems vendor contract or authorized integrator contract;

(B) Shall provide that any dealer data systems vendor contract or authorized integrator contract may be terminated upon no more than 90 days’ notice from the dealer; and

(C) Shall, in order to prevent any risk of consumer harm or inconvenience, ensure a secure transition of all protected dealer data to a successor dealer data systems vendor or authorized integrator upon notice of a dealer’s intent to terminate a dealer data systems vendor contract or authorized integrator contract. The requirements of this subparagraph may be satisfied by taking any of the following actions:

(i) Providing unrestricted access to all protected dealer data and all other data stored in the dealer data system within a commercially reasonable time and in a format that a successor dealer data systems vendor or authorized integrator is capable of accessing and using;

(ii) Deleting or returning to the dealer all protected dealer data prior to termination of the contract pursuant to any written directions of the dealer;

(iii) Providing a dealer, upon request, with a list of all entities with whom it is sharing or has shared protected dealer data or to whom it has allowed access to protected dealer data; and

(iv) Allowing a dealer to audit access to and use of any protected dealer data by the dealer data systems vendor or authorized integrator access.

(3) Any dealer data systems vendor, authorized integrator, or third party acting pursuant to a written contract with or on behalf of a dealer shall indemnify the dealer for any third-party claims asserted against or damages incurred by the dealer from complaints, claims, or actions arising out of the willful, negligent, or impermissible use or disclosure of protected dealer data, customer data, or other sensitive information in a dealer data system by the dealer data system vendor, authorized integrator, or third party. Such indemnification shall include, but not be limited to, judgments, settlements, fines, penalties, litigation costs, defense costs, court costs, costs related to the disclosure of security breaches, and attorneys’ fees arising out of complaints, claims, civil,or administrative actions.

(e) A manufacturer, franchisor, distributor, or affiliate thereof, or any third party acting on behalf of a manufacturer, franchisor, distributor, or affiliate thereof; a data systems vendor; or dealer shall not prohibit a dealer from regularly and continually monitoring or auditing the specific data accessed from or written to a dealer data system or from complying with applicable state and federal laws or any rules or regulations promulgated thereunder. This subsection shall not impose an obligation on a manufacturer, franchisor, distributor, or affiliate thereof, a data systems vendor, or a third party to perform such monitoring or auditing.

(f) A manufacturer, franchisor, distributor, data systems vendor or any third party acting on behalf of a manufacturer, franchisor, distributor, data systems vendor, or dealer shall not prohibit a dealer from copying, storing, or backing up data stored on its dealer data systems, or duplicating the critical components or functions thereof, for the purpose of allowing a dealer to restore business operations in the event of a security breach or other event that renders a dealer data system inoperable. This subsection shall not impose an obligation on a manufacturer, franchisor, distributor, data systems vendor, or third party to provide such capabilities. This subsection shall not relieve a dealer from any contractual obligation relating to the safeguard, storage, copy, use, ownership, or sharing of or access to data.

(g) A dealer data systems vendor or authorized integrator shall not be held responsible for any action taken directly by a dealer or for any appropriately taken action upon written request of a dealer to the extent that such action prevents such vendor or integrator from meeting any legal obligation regarding the protection of protected dealer data or results in any liability as a consequence of such actions by the dealer.

(h) A dealer shall not be held responsible for any action taken directly by any of its dealer data systems vendors or authorized integrators or for any appropriately taken action upon written request of a dealer data systems vendor or authorized integrator to the extent that such action prevents such dealer from meeting any legal obligation regarding the protection of protected dealer data or results in any liability as a consequence of such actions by the dealer data systems vendor or authorized integrator.

(i) The rights conferred on dealers in this Code section are not waivable and may not be reduced or otherwise modified by any contract, agreement, or incentive program.

(j) Nothing in this Code section shall:

(1) Be interpreted to prevent a dealer or third party from discharging its obligations or limiting responsibilities as a service provider to protect and secure protected dealer data under an agreement or as otherwise required pursuant to federal, state, or local law;

(2) Give a new motor vehicle dealer any ownership or rights to share or use motor vehicle diagnostic data beyond what is necessary to fulfill a dealer’s obligation to provide warranty, repair, or service work to its customers;

(3) Govern, restrict, or apply to data that exists outside of a dealer data system; or

(4) Relieve a manufacturer, franchisor, distributor, third party acting on behalf of a manufacturer, franchisor, distributor, or affiliate thereof from the requirements of Code Section 10-1-632.