(a) (1) In this section the following words have the meanings indicated.
(2) (i) “Consumer data” means nonpublic personal information, as defined in 15 U.S.C. § 6809(4), collected by a dealer and provided by the dealer directly to a manufacturer, distributor, or factory branch, or its agent.
(ii) “Consumer data” does not include the same or similar data that is obtained by a manufacturer from any other source.
(3) “Data management system” means a computer hardware or software system that:
(i) Is owned, leased, or licensed by a dealer, including a system of web–based applications;
(ii) Is located at the dealership or hosted remotely; and
(iii) Stores and provides access to consumer data collected and stored by the dealer.
(b) Notwithstanding the provisions of any franchise agreement, a manufacturer, distributor, or factory branch, or its agent:
(1) Shall allow a dealer to furnish consumer data in a widely accepted file format, such as comma–separated values, and through a third–party vendor selected by the dealer;
(2) May access or obtain consumer data directly from a dealer’s data management system only with the express written consent of the dealer;
(3) May not take any adverse action against a dealer for refusing to grant access to the dealer’s data management system;
(4) May require that a franchised dealer of the manufacturer, distributor, or factory branch provide consumer data or transactional data that pertains to:
(i) Claims for warranty parts or repairs;
(ii) Sales and deliveries of new or certified pre–owned vehicles of any line make of the manufacturer, distributor, or factory branch;
(iii) Safety or recall obligations; or
(iv) Validation and payment of customer or dealer incentives; and
(5) Shall indemnify the dealer for any third–party claims asserted against or damages incurred by the dealer to the extent the claims of damages are caused by access to and unlawful disclosure of consumer data resulting from a breach caused by the manufacturer, distributor, or factory branch, or its agent, or a third party to which the manufacturer, distributor, or factory branch, or its agent, has provided the consumer data in violation of this section.
(c) A manufacturer, distributor, or factory branch, or its agent, may not require that a dealer grant the manufacturer, distributor, or factory branch, or its agent, access to the dealer’s data management system through a franchise agreement or as a condition of renewal or continuation of the franchise agreement.
(d) Written consent under subsection (b)(2) of this section:
(1) Shall be separate from the dealer franchise agreement;
(2) Shall be executed by the dealer; and
(3) May be withdrawn by the dealer on 30 days’ written notice to the manufacturer, distributor, or factory branch.