Florida Senate - 2016 SB 960 By Senator Bradley 7-00308C-16 2016960__ 1 2 A bill to be entitled 3 An act relating to protection of motor vehicle 4 dealers’ consumer data; creating s. 320.646, F.S.; 5 defining the terms “consumer data” and “data 6 management system”; requiring that a licensee or a 7 third party comply with certain restrictions on reuse 8 or disclosure of consumer data received from a motor 9 vehicle dealer; requiring that such person provide a 10 written statement to the motor vehicle dealer 11 delineating the established procedures adopted by the 12 person which meet or exceed certain requirements to 13 safeguard consumer data; requiring that upon request 14 of a motor vehicle dealer a licensee provide a list of 15 the consumer data obtained and all persons to whom any 16 of the data has been disclosed, subject to certain 17 requirements; prohibiting a licensee from requiring a 18 motor vehicle dealer to grant the licensee or a third 19 party access to the dealer’s data management system; 20 requiring a licensee to permit a motor vehicle dealer 21 to furnish consumer data in a widely accepted file 22 format and through a third-party vendor selected by 23 the motor vehicle dealer; authorizing a licensee to 24 access or obtain consumer data from a motor vehicle 25 dealer’s data management system with the dealer’s 26 express written consent, subject to certain 27 requirements; requiring the licensee to indemnify the 28 motor vehicle dealer for certain claims or damages; 29 reenacting s. 320.6992, F.S., relating to the 30 provisions that apply to established systems of 31 distribution of motor vehicles in this state, to 32 incorporate s. 320.646, F.S., as created by the act, 33 in a reference thereto; providing an effective date. 34 35 Be It Enacted by the Legislature of the State of Florida: 36 37 Section 1. Section 320.646, Florida Statutes, is created to 38 read: 39 320.646 Consumer data protection.— 40 (1) As used in this section, the term: 41 (a) “Consumer data” means any information collected or 42 record created by a motor vehicle dealer which contains personal 43 information about a consumer, including, but not limited to, the 44 consumer’s name, address, telephone number, e-mail address, 45 social security number, date of birth, driver license number, 46 credit card number, or any other information from which the 47 identity of the consumer could be derived. 48 (b) “Data management system” means a computer hardware or 49 software system that is owned, leased, or licensed by a motor 50 vehicle dealer, including a system of web-based applications, 51 computer software, or computer hardware, whether located at the 52 motor vehicle dealership or hosted remotely, and that stores and 53 provides access to consumer data collected or stored by a motor 54 vehicle dealer. The term includes, but is not limited to, 55 dealership management systems and customer relations management 56 systems. 57 (2) Notwithstanding the provisions of any franchise 58 agreement, a licensee that receives consumer data from a motor 59 vehicle dealer or requires that a motor vehicle dealer provide 60 consumer data to a third party: 61 (a) Must comply with all restrictions on reuse or 62 disclosure of data established by federal and state law and must 63 provide a written statement to the motor vehicle dealer 64 delineating the established procedures adopted by the licensee 65 or a third party which meet or exceed any federal or state 66 requirements to safeguard consumer data, including, but not 67 limited to, those established in the Gramm-Leach-Bliley Act, 15 68 U.S.C. ss. 6801 et seq. 69 (b) Must, upon the written request of the motor vehicle 70 dealer, provide a written list of the consumer data obtained 71 from a motor vehicle dealer and all persons to whom any of the 72 consumer data has been provided by the licensee or a third party 73 during the preceding 12 months. The dealer may make such a 74 request no more than once every 6 months. The list must indicate 75 the specific fields of the consumer data which were provided to 76 each person. 77 (c) May not require that a motor vehicle dealer grant the 78 licensee or a third party direct or indirect access to the 79 dealer’s data management system to collect consumer data. A 80 licensee must permit a motor vehicle dealer to furnish consumer 81 data in a widely accepted file format, such as comma delineated, 82 and through a third-party vendor selected by the motor vehicle 83 dealer. However, a licensee may access or obtain consumer data 84 directly from a motor vehicle dealer’s data management system 85 with the express consent of the dealer. The consent must be in 86 the form of a written document that is separate from the 87 parties’ franchise agreement, is executed by the motor vehicle 88 dealer, and may be withdrawn by the dealer at any time. 89 (d) Must indemnify the motor vehicle dealer for any claims 90 asserted against or damages incurred by the motor vehicle dealer 91 as a result of the licensee’s or a third party’s access, use, or 92 disclosure of the consumer data. 93 Section 2. For the purpose of incorporating section 94 320.646, Florida Statutes, as created by this act, in a 95 reference thereto, section 320.6992, Florida Statutes, is 96 reenacted to read: 97 320.6992 Application.—Sections 320.60-320.70, including 98 amendments to ss. 320.60-320.70, apply to all presently existing 99 or hereafter established systems of distribution of motor 100 vehicles in this state, except to the extent that such 101 application would impair valid contractual agreements in 102 violation of the State Constitution or Federal Constitution. 103 Sections 320.60-320.70 do not apply to any judicial or 104 administrative proceeding pending as of October 1, 1988. All 105 agreements renewed, amended, or entered into subsequent to 106 October 1, 1988, shall be governed by ss. 320.60-320.70, 107 including any amendments to ss. 320.60-320.70 which have been or 108 may be from time to time adopted, unless the amendment 109 specifically provides otherwise, and except to the extent that 110 such application would impair valid contractual agreements in 111 violation of the State Constitution or Federal Constitution. 112 Section 3. This act shall take effect upon becoming a law.