(a) (1) In this section the following words have the meanings indicated.
(2) (i) “Consumer data” means nonpublic personal information, as defined in 15 U.S.C. § 6809(4), collected by a dealer and provided by the dealer directly to a manufacturer, distributor, or factory branch, or its agent.
(ii) “Consumer data” does not include the same or similar data that is obtained by a manufacturer from any other source.
(3) “Data management system” means a computer hardware or software system that:
(i) Is owned, leased, or licensed by a dealer, including a system of web-based applications;
(ii) Is located at the dealership or hosted remotely; and
(iii) Stores and provides access to consumer data collected and stored by the dealer.
(b) Notwithstanding the provisions of any franchise agreement, a manufacturer, distributor, or factory branch, or its agent:
(1) Shall allow a dealer to furnish consumer data in a widely accepted file format, such as comma-separated values, and through a third-party vendor selected by the dealer;
(2) May access or obtain consumer data directly from a dealer’s data management system only with the express written consent of the dealer;
(3) May not take any adverse action against a dealer for refusing to grant access to the dealer’s data management system;
(4) May require that a franchised dealer of the manufacturer, distributor, or factory branch provide consumer data or transactional data that pertains to:
(i) Claims for warranty parts or repairs;
(ii) Sales and deliveries of new or certified pre-owned vehicles of any line make of the manufacturer, distributor, or factory branch;
(iii) Safety or recall obligations; or
(iv) Validation and payment of customer or dealer incentives; and
(5) Shall indemnify the dealer for any third-party claims asserted against or damages incurred by the dealer to the extent the claims of damages are caused by access to and unlawful disclosure of consumer data resulting from a breach caused by the manufacturer, distributor, or factory branch, or its agent, or a third party to which the manufacturer, distributor, or factory branch, or its agent, has provided the consumer data in violation of this section.
(c) A manufacturer, distributor, or factory branch, or its agent, may not require that a dealer grant the manufacturer, distributor, or factory branch, or its agent, access to the dealer’s data management system through a franchise agreement or as a condition of renewal or continuation of the franchise agreement.
(d) Written consent under subsection (b)(2) of this section:
(1) Shall be separate from the dealer franchise agreement;
(2) Shall be executed by the dealer; and
(3) May be withdrawn by the dealer on 30 days’ written notice to the manufacturer, distributor, or factory branch.