30-11-718. Prohibited actions. (1) A third party may not do any of the following:

(a) access, share, sell, copy, use, or transmit protected dealer data from a dealer data system without the prior express written consent of the dealer;

(b) take any action by contract, technical means, or otherwise to prohibit or limit a dealer's ability to protect, store, copy, share, or use protected dealer data, including all of the following:

(i) imposing any fee or other restriction on the dealer or an authorized integrator for accessing or sharing protected dealer data or for writing data to a dealer data system, including any fee on a dealer that chooses to submit or push data or information to the third party as prescribed in this section. A third party shall disclose a charge to the dealer and justify the charge by documentary evidence of the costs associated with access or the charge is a fee pursuant to this subsection (1)(b)(i).

(ii) prohibiting a third party that has satisfied or is compliant with the STAR standards or other generally accepted standards that are at least as comprehensive as the STAR standards and that the dealer has identified as one of its authorized integrators from integrating into the dealer's dealer data system or placing an unreasonable restriction on integration by an authorized integrator or other third party that the dealer wishes to be an authorized integrator. For the purposes of this subsection (1)(b)(ii), "unreasonable restriction" includes:

(A) an unreasonable limitation or condition on the scope or nature of the data that is shared with an authorized integrator;

(B) an unreasonable limitation on the ability of the authorized integrator to write data to a dealer data system;

(C) an unreasonable limitation or condition on a third party that accesses or shares protected dealer data or that writes data to a dealer data system; and

(D) requiring unreasonable access to a third party's sensitive, competitive, or other confidential business information as a condition for accessing protected dealer data or sharing protected dealer data with an authorized integrator.

(c) prohibit or limit a dealer's ability to store, copy, or securely share or use protected dealer data outside of the dealer data system in any manner and for any reason;

(d) allow access to or access protected dealer data without prior express written consent; or

(e) engage in any act of cyber ransom.

(2) Prior express written consent may:

(a) be unilaterally revoked or amended by the dealer with 30 days' notice without cause and immediately for cause;

(b) not be sought or required as a condition of or factor for consideration or eligibility for any manufacturer program, standard, or policy, including those that offer or relate to a bonus, incentive, rebate, or other payment or benefit to a dealer, except that if the bonus, incentive, rebate, or other payment program requires the delivery of the information that is protected dealer data to qualify for the program and receive the program benefits, a dealer shall supply the information to participate in the program.

(3) This section does not prevent a dealer, manufacturer, or third party from discharging its obligations as a service provider or otherwise under federal, state, or local law to protect and secure protected dealer data or to otherwise limit those responsibilities.

(4) A dealer data vendor or an authorized integrator is not responsible for any action taken directly by the dealer, or for any action the dealer data vendor or authorized integrator takes in appropriately following the written instructions of the dealer, to the extent that the action prevents it from meeting any legal obligation regarding the protection of protected dealer data or results in any liability as a consequence of such actions by the dealer.

(5) A dealer is not responsible for any action taken directly by any of its dealer data vendors or authorized integrators, or for any action the dealer takes directly in appropriately following the written instructions of any of its dealer data vendors or authorized integrators, to the extent that the action prevents it from meeting any legal obligation regarding the protection of protected dealer data or results in any liability as a consequence of such actions by the dealer data vendor or authorized integrator.