SB 81: Motor Vehicle Franchise Practices; protection of consumer data in motor vehicle sales; provide

Senate Bill 81

By: Senators Brass of the 6th, Walker III of the 20th, Summers of the 13th, Kennedy of the 18th, Jones II of the 22nd and others

AS PASSED

A BILL TO BE ENTITLED

AN ACT

To amend Article 22 of Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to motor vehicle franchise practices, so as provide for protection of consumer data in motor vehicle sales or lease transactions by affiliates of franchisors, manufacturers, and distributors; to provide for procedures, conditions, and limitations on the use of motor vehicle dealer data; to provide for standards for access and integration of data collected and maintained by dealers and by third parties on behalf of dealers; to provide for applicability; to provide for requirements of franchisors, manufacturers, and distributors in relation to dealers; to provide for additional unlawful activities by franchisors; to revise legislative findings; to provide for definitions; to amend Code Section 40-2-39 of the Official Code of Georgia Annotated, relating to registration and licensing of new motor vehicle dealers, temporary site permits, administrative fines, and penalty, so as to provide for activities which qualify as activity as a new motor vehicle dealer; to provide for related matters; to repeal conflicting laws; and for other purposes.

BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:

SECTION 1.

Article 22 of Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to motor vehicle franchise practices, is amended by revising Code Section 10-1-621, relating to legislative findings, as follows:

"10-1-621.

The General Assembly finds and declares that:

(1) The distribution and sale of motor vehicles within this state are vital to the general economy of this state and to the public interest and public welfare;

(2) The provision for warranty service, recall service, and the repair of predelivery transportation damages to motor vehicles is of substantial concern to the people of this state;

(3) Robust competition among dealers benefits consumers through competitive pricing, service, and convenient repair facilities, thus the The maintenance of full and fair inter-brand and intra-brand competition among dealers and others is in the public interest; and

(4) The maintenance of strong and sound dealerships is essential to provide continuing and necessary reliable services to the consuming public in this state, to the introduction of new automotive technology and support and maintenance of such after a sale, to protect against the creation or perpetuation of monopolies and other practices that are detrimental to public welfare and local businesses, and to provide stable employment to the citizens of this state."

SECTION 2.

Said article is further amended by revising Code Section 10-1-632, relating to protection of consumer data in motor vehicle sales or lease transactions and burden of proof for violations, as follows:

"10-1-632.

(a) With respect to consumer data, a franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor, or affiliate thereof:

(1) Shall comply with and shall not cause a dealer to violate any applicable restrictions on reuse or disclosure of the consumer data established by federal or state law;

(2) Shall provide a written statement to the dealer upon request describing the established procedures adopted by such franchisor, manufacturer, distributor, or affiliate thereof or third party acting on behalf of the franchisor, manufacturer, or distributor which meet or exceed any federal or state requirements to safeguard the consumer data, including, but not limited to, those established in the federal Gramm-Leach-Bliley Act, 15 U.S.C. Section 6801, et seq.;

(3) Shall, upon the written request of the dealer, provide a written list of the consumer data obtained from the dealer and all persons to whom any consumer data has been provided by the franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor during the preceding six months. The dealer may make such a request no more than once every six months. The list must indicate the specific fields of consumer data which were provided to each person. Notwithstanding the foregoing, such a list shall not be required to include:

(A) A person to whom consumer data was provided, or the specific consumer data provided to such person, if the person was, at the time such consumer data was provided, a service provider, subcontractor, or consultant acting in the course of performance of services on behalf of or for the benefit of the dealer, franchisor, manufacturer, distributor, third party, or dealer affiliate, provided that the dealer, franchisor, manufacturer, distributor, third party, or dealer affiliate has entered into an agreement with such person requiring that such person comply with the safeguard requirements of applicable state and federal law, including, but not limited to, those established in the federal Gramm-Leach-Bliley Act, 15 U.S.C. Section 6801, et seq.; and

(B) A person to whom consumer data was provided, or the specific consumer data provided to such person, if the dealer has previously consented in writing to such person receiving such consumer data and the dealer has not withdrawn such consent in writing; and

(C) A person to whom consumer data was provided, or the specific consumer data provided to such person, if that would require a franchisor, manufacturer, distributor, or affiliate thereof to violate any applicable restrictions on reuse or disclosure of the consumer data established by federal or state law;

(4) May not require that a dealer grant the franchisor, manufacturer, distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor direct or indirect access to such dealer's data management system to obtain consumer data. A franchisor, manufacturer, distributor, affiliate, or a third party acting on behalf of a franchisor, manufacturer, or distributor must shall permit a dealer to furnish consumer data in a widely accepted file format, such as comma delimited, and through a third-party vendor selected by the dealer.; provided, however, that However, a franchisor, manufacturer, or distributor, or affiliate thereof or a third party acting on behalf of a franchisor, manufacturer, or distributor may access or obtain consumer data directly from a dealer's data management system with the express consent of the dealer. Such consent shall The consent must be in the form of a written document that is separate from the parties' franchise agreement, is executed by the dealer, and may be withdrawn allow for withdrawal by the dealer upon 30 days' written notice to the franchisor, manufacturer, or distributor as applicable. For incentive programs beginning on or after July 1, 2019, such consent shall not be required as a condition to a motor vehicle dealer's participation in an incentive program unless such consent is necessary to obtain consumer data to implement the program; and

(5) Shall indemnify the dealer for any third-party claims asserted against or damages incurred by the dealer to the extent caused by access to, use of, or disclosure of consumer data in violation of this Code section by the franchisor, manufacturer, distributor, or affiliate thereof or a third party to whom the franchisor, manufacturer, or distributor has provided consumer data.

(b) Nothing contained in this Code section shall limit the ability of the a franchisor, the manufacturer, or distributor, or affiliate thereof to require that the dealer provide, or use in accordance with the law, such customer information related solely to such manufacturer's or distributor's own vehicle makes to the extent necessary to do any of the following:

(1) Satisfy any safety or recall notice obligations or other legal notice obligations on the part of the manufacturer;

(2) Complete the sale and delivery of a new motor vehicle to a customer;

(3) Validate and pay customer or dealer incentives;

(4) Submit to the franchisor, manufacturer, or distributor claims for any services supplied by the dealer for any claim for warranty parts or repairs;

(5) Market analysis;

(6) Evaluate sales and service customer satisfaction with the dealer, including surveys; or

(7) Reasonable marketing purposes that benefit the dealer.

(c) In any cause of action against a franchisor, manufacturer, or distributor, or affiliate thereof for a violation of this Code section, the party bringing the action shall have the burden of proof."

SECTION 3.

Said article is further amended by adding a new Code section to read as follows:

"10-1-633.

(a) As used in this Code section, the term:

(1) 'Authorized integrator' means a third party with whom a dealer has entered into a written contract to perform a specific function which requires such third party to access protected dealer data or write data to a dealer data system or both.

(2) 'Data access overcharge' means any charge to a dealer or person authorized to perform integration that is greater than an amount which reimburses direct costs incurred by a dealer data systems vendor for integration. When a dealer data systems vendor fails to disclose the direct costs of integration and provide documentation of such costs, any direct costs sought to be reimbursed shall be considered a data access overcharge.

(3) 'Dealer data system' means any software or hardware provided by a third party and used by a dealer in its business operations to store, process, or maintain protected dealer data.

(4) 'Dealer data systems vendor' means any third party that stores protected dealer data pursuant to written contract with a dealer and shall include a dealer management system or customer relations management system provided by a third party. Such term shall not include a manufacturer, distributor, or affiliate subject to Code Section 10-1-632.

(5) 'Integration' means access by an authorized integrator to protected dealer data which does not require access to any copyright protected material but allows for access to all protected dealer data and which can be accomplished by any commercially reasonable means not otherwise in violation of this Code section.

(6) 'Prior express written consent' means written consent provided by the dealer that is contained in a document separate from any other consent, contract, franchise agreement, or other writing and that specifically outlines a dealer's consent for an authorized integrator to obtain protected dealer data, including the scope and duration of such consent, and may be unilaterally revoked by the dealer upon 30 days' notice without cause and immediately with cause.

(7) 'Protected dealer data' means any of the following data that is stored in a dealer data system:

(A) Personal, financial, or other data pertaining to a consumer that is provided to a dealer by a consumer;

(B) Motor vehicle diagnostic data; or

(C) Any other data relating to the business operations of a dealer stored or maintained within a dealer data system.

(8) 'Secure open application programming interface' or 'secure open API' means an application programming interface that allows an authorized integrator to integrate with a dealer data system remotely and securely.

(9) 'STAR standards' means standards for the automotive retail industry established by the Standards for Technology in Automotive Retail organization.

(10) 'Third party' includes service providers, vendors, including dealer data systems vendors and authorized integrators, and any other individual or entity other than a dealer. Such term shall not include any manufacturer; distributor; affiliate of a manufacturer or distributor; a third party acting on behalf of or engaged contractually or by other agreement with a manufacturer or distributor or an affiliate thereof; any governmental entity acting pursuant to federal, state, or local law; or any third party acting pursuant to a valid court order.

(b) It shall be unlawful for a third party to:

(1) Access, share, sell, copy, use, or transmit protected dealer data from a dealer data system without the prior express written consent of a dealer;

(2) Take any action, by contract, technical means, or otherwise, that would prohibit or limit a dealer's ability to protect, store, copy, share, or use any protected dealer data, including, but not limited to:

(A) Imposing any data access overcharges or other restrictions of any kind on the dealer or any authorized integrator for integration;

(B) Prohibiting an authorized integrator or any third party identified by a dealer as an authorized integrator that has satisfied or is compliant with the STAR standards, or a standard compatible with such standards, from performing integration or placing unreasonable restrictions on integration, which shall include, but not be limited to:

(i) Unreasonable restrictions on the scope or nature of the data shared with an authorized integrator;

(ii) Unreasonable restrictions on the ability of an authorized integrator to write data to a dealer data system;

(iii) Unreasonable restrictions or conditions on a third party accessing or sharing protected dealer data or writing data to a dealer data system; and

(iv) Requiring unreasonable access to sensitive, competitive, or other confidential business information of a third party as a condition for access to protected dealer data or as a condition to share protected dealer data with an authorized integrator;

(C) Prohibiting or limiting a dealer's ability to store, copy, securely share, or use protected dealer data outside the dealer data system in any manner and for any reason; or

(D) Permitting access to or accessing protected dealer data without prior express written consent by the dealer.

(c)(1) A secure open application programming interface shall:

(A) Be made available by a dealer data systems vendor to any authorized integrator upon request by a dealer;

(B) Include all relevant endpoints to allow for access to all protected dealer data or to integrate with protected dealer data; and

(C) Provide granularity and control necessary for dealers and authorized integrators to integrate the data necessary pursuant to contract terms between the dealer and authorized integrator.

(2) For purposes of this Code section, secure open application programming shall not require that an application programming interface be available to the public or at no cost to an authorized integrator, provided that no data access overcharge may be assessed in connection with a secure open API.

(d)(1) A dealer data systems vendor shall adopt and make available a standardized integration framework that allows for integration through secure open APIs to authorized integrators. In the event that application programming interfaces are no longer the reasonable commercial or technical standard for secure data integration, a similar open access integration method may be provided to the extent such method provides the same or better secure integration to dealers and authorized integrators as a secure open API. Any dealer data systems vendor that utilizes STAR standards or a comparable system shall comply with the requirements of this subsection.

(2) A dealer data systems vendor and authorized integrator:

(A) Shall be authorized to integrate, or otherwise access, use, store, or share protected dealer data to the extent only outlined in and authorized by the dealer data systems vendor contract or authorized integrator contract;

(B) Shall provide that any dealer data systems vendor contract or authorized integrator contract may be terminated upon no more than 90 days' notice from the dealer; and

(C) Shall, in order to prevent any risk of consumer harm or inconvenience, ensure a secure transition of all protected dealer data to a successor dealer data systems vendor or authorized integrator upon notice of a dealer's intent to terminate a dealer data systems vendor contract or authorized integrator contract. The requirements of this subparagraph may be satisfied by taking any of the following actions:

(i) Providing unrestricted access to all protected dealer data and all other data stored in the dealer data system within a commercially reasonable time and in a format that a successor dealer data systems vendor or authorized integrator is capable of accessing and using;

(ii) Deleting or returning to the dealer all protected dealer data prior to termination of the contract pursuant to any written directions of the dealer;

(iii) Providing a dealer, upon request, with a list of all entities with whom it is sharing or has shared protected dealer data or to whom it has allowed access to protected dealer data; and

(iv) Allowing a dealer to audit access to and use of any protected dealer data by the dealer data systems vendor or authorized integrator access.

(3) Any dealer data systems vendor, authorized integrator, or third party acting pursuant to a written contract with or on behalf of a dealer shall indemnify the dealer for any third-party claims asserted against or damages incurred by the dealer from complaints, claims, or actions arising out of the willful, negligent, or impermissible use or disclosure of protected dealer data, customer data, or other sensitive information in a dealer data system by the dealer data system vendor, authorized integrator, or third party. Such indemnification shall include, but not be limited to, judgments, settlements, fines, penalties, litigation costs, defense costs, court costs, costs related to the disclosure of security breaches, and attorneys' fees arising out of complaints, claims, civil, or administrative actions.

(e) A manufacturer, franchisor, distributor, or affiliate thereof, or any third party acting on behalf of a manufacturer, franchisor, distributor, or affiliate thereof; a data systems vendor; or dealer shall not prohibit a dealer from regularly and continually monitoring or auditing the specific data accessed from or written to a dealer data system or from complying with applicable state and federal laws or any rules or regulations promulgated thereunder. This subsection shall not impose an obligation on a manufacturer, franchisor, distributor, or affiliate thereof, a data systems vendor, or a third party to perform such monitoring or auditing.

(f) A manufacturer, franchisor, distributor, data systems vendor or any third party acting on behalf of a manufacturer, franchisor, distributor, data systems vendor, or dealer shall not prohibit a dealer from copying, storing, or backing up data stored on its dealer data systems, or duplicating the critical components or functions thereof, for the purpose of allowing a dealer to restore business operations in the event of a security breach or other event that renders a dealer data system inoperable. This subsection shall not impose an obligation on a manufacturer, franchisor, distributor, data systems vendor, or third party to provide such capabilities. This subsection shall not relieve a dealer from any contractual obligation relating to the safeguard, storage, copy, use, ownership, or sharing of or access to data.

(g) A dealer data systems vendor or authorized integrator shall not be held responsible for any action taken directly by a dealer or for any appropriately taken action upon written request of a dealer to the extent that such action prevents such vendor or integrator from meeting any legal obligation regarding the protection of protected dealer data or results in any liability as a consequence of such actions by the dealer.

(h) A dealer shall not be held responsible for any action taken directly by any of its dealer data systems vendors or authorized integrators or for any appropriately taken action upon written request of a dealer data systems vendor or authorized integrator to the extent that such action prevents such dealer from meeting any legal obligation regarding the protection of protected dealer data or results in any liability as a consequence of such actions by the dealer data systems vendor or authorized integrator.

(i) The rights conferred on dealers in this Code section are not waivable and may not be reduced or otherwise modified by any contract, agreement, or incentive program.

(j) Nothing in this Code section shall:

(1) Be interpreted to prevent a dealer or third party from discharging its obligations or limiting responsibilities as a service provider to protect and secure protected dealer data under an agreement or as otherwise required pursuant to federal, state, or local law;

(2) Give a new motor vehicle dealer any ownership or rights to share or use motor vehicle diagnostic data beyond what is necessary to fulfill a dealer's obligation to provide warranty, repair, or service work to its customers;

(3) Govern, restrict, or apply to data that exists outside of a dealer data system; or

(4) Relieve a manufacturer, franchisor, distributor, third party acting on behalf of a manufacturer, franchisor, distributor, or affiliate thereof from the requirements of Code Section 10-1-632."

SECTION 4.

Said article is further amended in Code Section 10-1-641, relating to requirements of franchisor, manufacturer, and distributor, reasonable compensation for parts and labor, recall notices, and stop-sales, by revising paragraph (1) of subsection (a) as follows: "(a)(1) Each franchisor, manufacturer, or distributor:

(A) Shall specify in writing to each of its dealers in this state the dealer's obligations for predelivery preparation including the repair of damages incurred in the transportation of vehicles as set forth in Code Section 10-1-642, recall work, and warranty service on its products;

(B) Shall, at the election of the dealer, reasonably compensate the dealer for parts and labor provided for such warranty service work as provided in paragraph (2) of this subsection;

(C) Shall provide the dealer with a schedule of compensation to be paid such dealer for parts, work, and service in connection therewith; and

(D) Shall provide the dealer with a schedule of the time allowance for the performance of such work and service. Any such schedule of compensation shall include reasonable compensation for diagnostic work, repair service, and labor. Time allowances for the diagnosis and performance of such work and service shall be reasonable and adequate for the work to be performed; and

(E) Shall provide compensation to the dealer for assistance provided to a retail buyer or lessee whose vehicle required a change, repair, or update by remote means to any part, system, or accessory or to any function of his or her vehicle by the vehicle manufacturer, franchisor, or distributor when such assistance was performed at the dealership or by dealership personnel at another location authorized by the manufacturer or distributor at the request of the customer or at the request of the manufacturer, franchisor, or distributor on behalf of the customer."

SECTION 5.

Said article is further amended in Code Section 10-1-662, relating to unlawful activities by franchisors, by revising paragraphs (1), (20), and (21) of and adding a new paragraph to subsection (a) to read as follows:

"(1)(A) To delay, refuse, or fail to deliver new motor vehicles or new motor vehicle parts or accessories in a reasonable time and in reasonable quantity if such vehicles, parts, or accessories are publicly advertised as being available for immediate delivery. Upon written request of the dealer, the franchisor shall communicate its allocation process in writing in a clear and concise manner within 30 days from receipt of the dealer's request. For purposes of this paragraph, a reasonable quantity of vehicles:

(i) Is fair and equitable to all line-make dealers in this state; and

(ii) Does not unfairly discriminate among line-make dealers in its allocation process. (B) This paragraph is not violated, however, if such failure is caused by acts or causes the occurrence of temporary international, national, or regional product or services shortages resulting from natural disaster; unavailability or scarcity of parts or service; labor strikes; supply chain disruptions; product recalls; or other factors and events beyond the control of the franchisor that temporarily reduce the supply of a franchisor or if a state or federal law, rule, or regulation necessitates modification of the allocation.

(C) Nothing contained in this paragraph shall relieve a manufacturer, franchise or distributor from its obligations under paragraph (9) of subsection (b) of Code Section 10-1-661;"

"(20) To take any materially adverse action against a dealer, including a dealer's ability to participate in or receive a benefit or payment owed from any incentive or reimbursement program, based on criteria it has established, implemented, or enforced for measuring the performance, including, but not limited to, sales or service performance, of a dealer unless such criteria:

(A) Is fair, reasonable, and equitable; and

(B) Is based on accurate and relevant information; or

(21) To deny, delay payment for, restrict, or bill back a claim by a dealer for payment or reimbursement for incentives, hold-backs, sales or service promotion or other special program money, or any other amount owed to such dealer by the franchisor, if based solely on the dealer's compliance with a specific program requirement of the franchisor that would cause the dealer to violate a law or any properly promulgated rule or regulation of this state; or

(22) To fail to provide to the dealer a written disclosure, which may be provided to a potential consumer of a new motor vehicle, of each accessory or function of the motor vehicle that may be initiated, updated, changed, or maintained by the manufacturer or distributor through remote means, and the charge to the consumer for the initiation, update, change, or maintenance that is known at the time of the transaction. A manufacturer or distributor may comply with this paragraph by notifying the dealer that the information is available on a public website or by other digital means."

SECTION 6.

Code Section 40-2-39 of the Official Code of Georgia Annotated, relating to registration and licensing of new motor vehicle dealers, temporary site permits, administrative fines, and penalty, is amended by revising paragraph (2) of subsection (b) as follows: "(2)(A) It shall be unlawful for any person to engage in any activity as a new motor vehicle dealer except at an established place of business which has been registered as such under this Code section and Code Section 40-2-38 or at a temporary site.

(B) For purposes of this Code section, activity as a new motor vehicle dealer shall include:

(i) Selling, leasing, offering to sell or lease, or negotiating binding terms with a retail consumer for the purchase or lease of a new motor vehicle;

(ii) Soliciting, accepting, or receiving a deposit or other payment for the retail purchase or lease of a new motor vehicle;

(iii) Soliciting, accepting, or processing a reservation from a retail consumer for a specific motor vehicle; or

(iv) Soliciting, accepting, offering, or negotiating with a retail consumer a binding value for a motor vehicle being traded in as part of the purchase or lease of a new motor vehicle.

(C) For purposes of this Code section, activity as a new motor vehicle dealer shall not include:

(i) Facilitating the receipt of a deposit or a payment under a retail installment sale contract or lease on behalf of a dealer;

(ii) The disclosure of a manufacturer's suggested retail price;

(iii) The display of new motor vehicles for information or demonstration purposes only;

(iv) The operation of a public website or other means of electronic communication that identifies to a consumer any conditional prices or financing rates, available financing sources, add-on product prices, or conditional trade-in values that are not binding on a dealer;

(v) Sales, leasing, marketing, or advertising activities of manufacturers, franchisors, and distributors by or through their line-make dealers in accordance with Article 22 of Chapter 1 of Title 10;

(vi) Facilitating a vehicle reservation system that allows a retail consumer to request the opportunity to purchase or lease a new vehicle, when the vehicle becomes available for sale to the public, through a franchised new motor vehicle dealer, provided that the final terms of sale are negotiated between the retail consumer and franchised new motor vehicle dealer; or

(vii) Processing a new vehicle sold order for a specific new motor vehicle entered by a franchised new motor vehicle dealer on behalf of a specific consumer, provided that all final terms of sale are negotiated between the franchised new motor vehicle dealer and the consumer."

SECTION 7.

All laws and parts of laws in conflict with this Act are repealed.