Third party practices; prohibited conduct; use of protected dealer data; unreasonable restrictions.

Sec. 7. (1) A third party shall not do any of the following: (a) Access, share, sell, copy, use, or transmit protected dealer data without prior express written consent. (b) Engage in an act of cyber ransom. (c) Take an action by contract, technical means, or any other means to prohibit or limit a dealer's ability to protect, store, copy, share, or use protected dealer data, including, but not limited to, any of the following actions: (i) Imposing a fee or other restriction on a dealer or an authorized integrator for accessing or sharing protected dealer data or for writing data to a dealer data system, including a fee on a dealer that submits or pushes data or information to a third party under section 5. A charge is considered a fee under this subparagraph unless a third party discloses the charge to the dealer and justifies the charge by documentation of the costs associated with access and, on written request by the dealer, provides the dealer with documentation that the charges were agreed to in writing by the dealer or provided for in the contract for service or goods. (ii) Prohibiting a third party that is compliant with star standards or other generally accepted cybersecurity standards that are at least as comprehensive as star standards and that the dealer has identified as an authorized integrator from integrating into the dealer's dealer data system. (iii) Placing an unreasonable restriction on integration by an authorized integrator or a third party that the dealer wishes to be an authorized integrator. (d) Access or permit access to protected dealer data without prior express written consent. (2) An unreasonable restriction under subsection (1)(c)(iii) includes all of the following: (a) An unreasonable limitation or condition on the scope or nature of the protected dealer data that is shared with an authorized integrator. (b) An unreasonable limitation or condition on the ability of the authorized integrator to write data to a dealer data system. (c) An unreasonable limitation or condition on a third party that accesses or shares protected dealer data or that writes data to a dealer system. (d) A requirement of unreasonable access to sensitive, competitive, or other confidential business information of a third party as a condition for access to protected dealer data or sharing protected dealer data with an authorized integrator.