30-11-719. Other responsibilities and restrictions. (1) All dealer data vendors and authorized integrators:

(a) may access, use, store, or share protected dealer data only to the extent permitted in the contract with the dealer;

(b) shall make any agreement regarding access to, sharing or selling of, copying, using, or transmitting protected dealer data terminable upon no more than 90 days' notice from the dealer;

(c) must, on notice of the dealer's intent to terminate its contract and in order to prevent any risk of consumer harm or inconvenience, work to ensure a secure transition of all protected dealer data to a successor dealer data vendor or authorized integrator, including but not limited to:

(i) providing unrestricted access to, or an electronic copy of, all protected dealer data and all other data stored in the dealer data system in a format that a successor dealer data vendor or authorized integrator can access and use; and

(ii) deleting or returning to the dealer all protected dealer data prior to termination of the contract pursuant to any written directions of the dealer;

(d) shall provide a dealer, on request, with a listing of all entities with whom it is sharing dealer data or with whom it has allowed access to protected dealer data; and

(e) shall allow a dealer to audit the dealer data vendor's or authorized integrator's access to and use of any protected dealer data.

(2) Unless a dealer gives prior express written consent, a manufacturer may not access, share, sell, copy, use, or transmit or require a dealer to share or provide access to protected dealer data beyond the required manufacturer data and may use any required manufacturer data obtained from a dealer data system for the purposes described in subsection (5).

(3) A manufacturer may not engage in an act of cyber ransom or take an action by contract, technical means, or otherwise to prohibit or limit a dealer's ability to protect, store, copy, share, or use protected dealer data, including actions described in subsection (3)(b)(ii). A manufacturer or a manufacturer's selected third party may not require a dealer to pay a fee for the sharing of required manufacturer data if the manufacturer both:

(a) requires a dealer to provide required manufacturer data through a specific third party that the manufacturer selects; and

(b) does not allow the dealer to submit the data using the dealer's choice of a third-party vendor and both of the following apply:

(i) the data is in a format that is compatible with the file format required by the manufacturer; and

(ii) the third-party vendor satisfies or is in compliance with the STAR standards or other generally accepted standards that are at least as comprehensive as the STAR standards.

(4) A manufacturer shall indemnify a dealer for any third-party claims asserted against or damages incurred by the dealer to the extent caused by access to, use of, or disclosure of protected dealer data in violation of this section by the manufacturer or a third party acting on behalf of a manufacturer to whom the manufacturer has provided the protected dealer data. A dealer bringing a cause of action against a manufacturer for a violation of this section has the burden of proof.

(5) Except as provided in subsection (2), this section does not restrict or limit a manufacturer's right to obtain required manufacturer data, use required manufacturer data for the purposes prescribed by 30-11-717(9), or use or control data that is proprietary to the manufacturer, or created by the manufacturer, obtained from a source other than the dealer or that is public information.

(6) A manufacturer or a third party may not require a dealer to grant the manufacturer, the third party, or any person acting on behalf of the manufacturer or third party direct or indirect access to the dealer's dealer data system. Instead of providing a manufacturer or third party with access to the dealer's data system, a dealer may submit or push data or information to a manufacturer or third party through any widely acceptable electronic file format or protocol that complies with the STAR standards or other generally accepted standards that are at least as comprehensive as the STAR standards.