(a) Except as expressly authorized in this section, a manufacturer or distributor cannot require a motor vehicle dealer to provide its customer information to the manufacturer or distributor unless necessary for the sale and delivery of a new motor vehicle to a consumer, to validate and pay consumer or dealer incentives, for manufacturers marketing purposes, for evaluation of dealer performance, for analytics, or to support claims submitted by the new motor vehicle dealer for reimbursement for warranty parts or repairs. Nothing in this section shall limit the manufacturers ability to require or use customer information to satisfy any safety or recall notice obligation or other legal obligation.
(b) The dealer is only required to provide the customer information to the extent lawfully permissible, and to the extent the requested information relates solely to specific program requirements or goals associated with the manufacturers or distributors own vehicle makes. A manufacturer, factory branch, distributor, distributor branch, dealer, data systems vendor, or any third party acting on behalf of any manufacturer, factory branch, distributor, distributor branch or dealer or data systems vendor may not prohibit a dealer from providing a means to regularly and continually monitor, or conduct an audit of, the specific data accessed from or written to the dealers data systems and from complying with applicable state and federal laws and any rules or regulations promulgated thereunder. These provisions do not impose an obligation on a manufacturer, factory branch, distributor, distributor branch, dealer, vendor, or any third party acting on behalf of any manufacturer, factory branch, distributor, distributor branch, dealer, or data systems vendor to provide that capability.
(c) A manufacturer, factory branch, distributor, distributor branch, dealer, data systems vendor, or any third party acting on behalf of any manufacturer, factory branch, distributor, distributor branch or dealer, or data systems vendor, may not provide access to customer or dealership information maintained in a dealer data systems used by a motor vehicle dealer located in this state, other than a subsidiary or affiliate of the manufacturer factory branch, distributor or distributor branch without first obtaining the dealers prior express written consent and agreement, revocable by the dealer upon 10 business days written notice, to provide the access.
(d) Upon a written request from a motor vehicle dealer, the manufacturer, factory branch, distributor, distributor branch, dealer, or data systems vendor, or any third party acting on behalf of or through any manufacturer, factory branch, distributor, distributor branch or dealer data systems vendor shall provide to the dealer a written list of all specific third parties other than a subsidiary or affiliate of the manufacturer, factory branch, distributor or distributor branch to whom any data obtained from the dealer has actually been provided within the 12 month period prior to date of dealers written request. If requested by the dealer, the list shall further describe the scope and specific fields of the data provided. The consent does not change the persons obligations to comply with the terms of this section and any additional state or federal laws, and any rules or regulations promulgated thereunder, applicable to them with respect to the access.
(e) A manufacturer, factory branch, distributor, distributor branch, dealer, data systems vendor, or any third party acting on behalf of or through any dealer, or data systems vendor, having electronic access to customer or motor vehicle dealer data in a dealership data system used by a motor vehicle dealer located in this state shall provide notice in a reasonable timely manner to the dealer of any security breach of dealership or customer data obtained through the access.
(f) A manufacturer or distributor or a third party acting on behalf of a manufacturer or distributor may not require a dealer to provide any customer information: Any individual who is not a customer of such manufacturers or distributors own vehicle makes; for any purpose other than for reasonable marketing purposes on behalf of that dealer, market research, consumer surveys, market analysis, or dealership performance analysis; if sharing that information would not be permissible under local, state, or federal law; except to the extent the requested information relates solely to specific program requirements or goals associated with such manufacturers or distributors own vehicle makes; that is general customer information or other information related to the dealer, unless the requested information can be provided in a manner consistent with dealers current privacy policies and Gramm-Leach-Bliley Act privacy notice, a dealer may not be required to amend that notice to accommodate data sharing with the manufacturer or distributor.
(g) As used in this section:
(1) “Authorized Integrator” means any third party with whom a dealer has entered into a written contract to perform a specific function for a dealer that permits the third party to access protected dealer data and/or to write data to a dealer data system to carry out the specified function (the “authorized integrator contract”).