30-11-720. Dealer data vendors -- authorized integrators -- requirements. (1) A dealer data vendor shall:

(a) adopt and make available a standardized framework for the exchange, integration, and sharing of data from dealer data systems with authorized integrators and the retrieval of data by authorized integrators using the STAR standards or a standard that is compatible with the STAR standards; and

(b) provide access to open application programming interfaces to authorized integrators. If the application programming interfaces are not the reasonable commercial or technical standard for secure data integration, the dealer data vendor may provide a similar open access integration method if that method provides the same or better access to authorized integrators as an application programming interface and uses the required standardized framework.

(2) A dealer data vendor and authorized integrator:

(a) may access, use, store, or share protected dealer data or any other data from a dealer data system only to the extent allowed in the written agreement with the dealer;

(b) shall make any agreement relating to access to, sharing or selling of, copying, using, or transmitting protected dealer data terminable on 90-day notice from the dealer;

(c) on notice of the dealer's intent to terminate the agreement, in order to prevent any risk of consumer harm or inconvenience, shall work to ensure a secure transition of all protected dealer data to a successor dealer data vendor or authorized integrator, including:

(i) providing access to or an electronic copy of all protected dealer data and all other data stored in the dealer data system in a commercially reasonable time and format that a successor dealer data vendor or authorized integrator can access and use; and

(ii) deleting or returning to the dealer all protected dealer data before the contract terminates pursuant to the dealer's written directions;

(d) on a dealer's request, shall provide the dealer with a listing of all entities with whom it is sharing protected dealer data or whom it has allowed access to protected dealer data; and

(e) shall allow a dealer to audit the dealer data vendor or authorized integrator's access to and use of any protected dealer data.