Florida Senate - 2016                        COMMITTEE AMENDMENT
       Bill No. SB 960
                              LEGISLATIVE ACTION                        
                    Senate             .             House              
                  Comm: RCS            .                                
                  01/21/2016           .                                

       The Committee on Transportation (Grimsley) recommended the
    1         Senate Amendment (with title amendment)
    3         Delete everything after the enacting clause
    4  and insert:
    5         Section 1. Section 320.646, Florida Statutes, is created to
    6  read:
    7         320.646 Consumer data protection.—
    8         (1)As used in this section, the term:
    9         (a) “Consumer data” means “nonpublic personal information”
   10  as such term is defined in 15 U.S.C. s. 6809(4) collected by a
   11  motor vehicle dealer and which is provided by the motor vehicle
   12  dealer directly to a licensee or third party acting on behalf of
   13  a licensee. Consumer data does not include the same or similar
   14  data which is obtained by a licensee from any other source.
   15         (b) “Data management system” means a computer hardware or
   16  software system that is owned, leased, or licensed by a motor
   17  vehicle dealer, including a system of web-based applications,
   18  computer software, or computer hardware, whether located at the
   19  motor vehicle dealership or hosted remotely, and that stores and
   20  provides access to consumer data collected or stored by a motor
   21  vehicle dealer. The term includes, but is not limited to,
   22  dealership management systems and customer relations management
   23  systems.
   24         (2) Notwithstanding the provisions of any franchise
   25  agreement, with respect to consumer data a licensee or a third
   26  party acting on behalf of a licensee:
   27         (a) Shall comply with all, and not knowingly cause a motor
   28  vehicle dealer to violate any, applicable restrictions on reuse
   29  or disclosure of the consumer data established by federal or
   30  state law and must provide a written statement to the motor
   31  vehicle dealer upon request describing the established
   32  procedures adopted by the licensee or third party acting on
   33  behalf of the licensee which meet or exceed any federal or state
   34  requirements to safeguard the consumer data, including, but not
   35  limited to, those established in the Gramm-Leach-Bliley Act, 15
   36  U.S.C. ss. 6801 et seq.
   37         (b) Shall, upon the written request of the motor vehicle
   38  dealer, provide a written list of the consumer data obtained
   39  from the motor vehicle dealer and all persons to whom any
   40  consumer data has been provided by the licensee or a third party
   41  acting on behalf of a licensee during the preceding 6 months.
   42  The dealer may make such a request no more than once every 6
   43  months. The list must indicate the specific fields of consumer
   44  data which were provided to each person. Notwithstanding the
   45  foregoing, such a list need not include:
   46         1. A person to whom consumer data was provided, or the
   47  specific consumer data provided to such person, if the person
   48  was, at the time the consumer data was provided, one of the
   49  licensee’s service providers, subcontractors or consultants
   50  acting in the course of such person’s performance of services on
   51  behalf of or for the benefit of the licensee or motor vehicle
   52  dealer, provided that the licensee has entered into an agreement
   53  with such person requiring that the person comply with the
   54  safeguard requirements of applicable state and federal law,
   55  including, but not limited to, those established in the Gramm
   56  Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq; or
   57         2. A person to whom consumer data was provided, or the
   58  specific consumer data provided to such person, if the motor
   59  vehicle dealer has previously consented in writing to such
   60  person receiving the consumer data provided and the motor
   61  vehicle dealer has not withdrawn such consent in writing.
   62         (c) May not require that a motor vehicle dealer grant the
   63  licensee or a third party direct or indirect access to the
   64  dealer’s data management system to obtain consumer data. A
   65  licensee must permit a motor vehicle dealer to furnish consumer
   66  data in a widely accepted file format, such as comma delimited,
   67  and through a third-party vendor selected by the motor vehicle
   68  dealer. However, a licensee may access or obtain consumer data
   69  directly from a motor vehicle dealer’s data management system
   70  with the express consent of the dealer. The consent must be in
   71  the form of a written document that is separate from the
   72  parties’ franchise agreement, is executed by the motor vehicle
   73  dealer, and may be withdrawn by the dealer upon 30 days’ written
   74  notice to the licensee.
   75         (d) Must indemnify the motor vehicle dealer for any third
   76  party claims asserted against or damages incurred by the motor
   77  vehicle dealer to the extent caused by access to, use of, or
   78  disclosure of consumer data in violation of this section by the
   79  licensee, a third party acting on behalf of the licensee, or a
   80  third party to whom the licensee has provided consumer data.
   81         (3) In any cause of action against a licensee pursuant to
   82  s. 320.697 for a violation of paragraphs (2)(a), (2)(b), or
   83  (2)(c), the person bringing the action has the burden of proving
   84  that the violation was willful or with sufficient frequency to
   85  establish a pattern of wrongdoing with respect to such person’s
   86  consumer data.
   87         Section 2. For the purpose of incorporating section
   88  320.646, Florida Statutes, as created by this act, in a
   89  reference thereto, section 320.6992, Florida Statutes, is
   90  reenacted to read:
   91         320.6992 Application.—Sections 320.60-320.70, including
   92  amendments to ss. 320.60-320.70, apply to all presently existing
   93  or hereafter established systems of distribution of motor
   94  vehicles in this state, except to the extent that such
   95  application would impair valid contractual agreements in
   96  violation of the State Constitution or Federal Constitution.
   97  Sections 320.60-320.70 do not apply to any judicial or
   98  administrative proceeding pending as of October 1, 1988. All
   99  agreements renewed, amended, or entered into subsequent to
  100  October 1, 1988, shall be governed by ss. 320.60-320.70,
  101  including any amendments to ss. 320.60-320.70 which have been or
  102  may be from time to time adopted, unless the amendment
  103  specifically provides otherwise, and except to the extent that
  104  such application would impair valid contractual agreements in
  105  violation of the State Constitution or Federal Constitution.
  106         Section 3. This act shall take effect upon becoming a law.
  107  ================= T I T L E  A M E N D M E N T ================
  108  And the title is amended as follows:
  109         Delete everything before the enacting clause
  110  and insert:
  111                        A bill to be entitled                      
  112         An act relating to protection of motor vehicle
  113         dealers’ consumer data; creating s. 320.646, F.S.;
  114         defining the terms “consumer data” and “data
  115         management system”; requiring that a licensee or a
  116         third party comply with certain restrictions on reuse
  117         or disclosure of consumer data received from a motor
  118         vehicle dealer; requiring that such person provide a
  119         written statement to the motor vehicle dealer
  120         delineating the established procedures adopted by the
  121         person which meet or exceed certain requirements to
  122         safeguard consumer data; requiring that upon request
  123         of a motor vehicle dealer a licensee provide a list of
  124         the consumer data obtained and all persons to whom any
  125         of the data has been disclosed, subject to certain
  126         requirements; prohibiting a licensee from requiring a
  127         motor vehicle dealer to grant the licensee or third
  128         party access to the dealer’s data management system;
  129         requiring a licensee to permit a motor vehicle dealer
  130         to furnish consumer data in a widely accepted file
  131         format and through a third-party vendor selected by
  132         the motor vehicle dealer; authorizing a licensee to
  133         access or obtain consumer data from a motor vehicle
  134         dealer’s data management system with the dealer’s
  135         express written consent, subject to certain
  136         requirements; requiring the licensee to indemnify the
  137         motor vehicle dealer for certain claims or damages;
  138         providing that a person bringing a specified cause of
  139         action for certain violations must meet certain
  140         requirements; reenacting s. 320.6992, F.S., relating
  141         to the provisions that apply to established systems of
  142         distribution of motor vehicles in this state, to
  143         incorporate s. 320.646, F.S., as created by the act,
  144         in a reference thereto; providing an effective date.