Florida Senate - 2016 SB 960
By Senator Bradley
7-00308C-16 2016960__
1
2 A bill to be entitled
3 An act relating to protection of motor vehicle
4 dealers’ consumer data; creating s. 320.646, F.S.;
5 defining the terms “consumer data” and “data
6 management system”; requiring that a licensee or a
7 third party comply with certain restrictions on reuse
8 or disclosure of consumer data received from a motor
9 vehicle dealer; requiring that such person provide a
10 written statement to the motor vehicle dealer
11 delineating the established procedures adopted by the
12 person which meet or exceed certain requirements to
13 safeguard consumer data; requiring that upon request
14 of a motor vehicle dealer a licensee provide a list of
15 the consumer data obtained and all persons to whom any
16 of the data has been disclosed, subject to certain
17 requirements; prohibiting a licensee from requiring a
18 motor vehicle dealer to grant the licensee or a third
19 party access to the dealer’s data management system;
20 requiring a licensee to permit a motor vehicle dealer
21 to furnish consumer data in a widely accepted file
22 format and through a third-party vendor selected by
23 the motor vehicle dealer; authorizing a licensee to
24 access or obtain consumer data from a motor vehicle
25 dealer’s data management system with the dealer’s
26 express written consent, subject to certain
27 requirements; requiring the licensee to indemnify the
28 motor vehicle dealer for certain claims or damages;
29 reenacting s. 320.6992, F.S., relating to the
30 provisions that apply to established systems of
31 distribution of motor vehicles in this state, to
32 incorporate s. 320.646, F.S., as created by the act,
33 in a reference thereto; providing an effective date.
34
35 Be It Enacted by the Legislature of the State of Florida:
36
37 Section 1. Section 320.646, Florida Statutes, is created to
38 read:
39 320.646 Consumer data protection.—
40 (1) As used in this section, the term:
41 (a) “Consumer data” means any information collected or
42 record created by a motor vehicle dealer which contains personal
43 information about a consumer, including, but not limited to, the
44 consumer’s name, address, telephone number, e-mail address,
45 social security number, date of birth, driver license number,
46 credit card number, or any other information from which the
47 identity of the consumer could be derived.
48 (b) “Data management system” means a computer hardware or
49 software system that is owned, leased, or licensed by a motor
50 vehicle dealer, including a system of web-based applications,
51 computer software, or computer hardware, whether located at the
52 motor vehicle dealership or hosted remotely, and that stores and
53 provides access to consumer data collected or stored by a motor
54 vehicle dealer. The term includes, but is not limited to,
55 dealership management systems and customer relations management
56 systems.
57 (2) Notwithstanding the provisions of any franchise
58 agreement, a licensee that receives consumer data from a motor
59 vehicle dealer or requires that a motor vehicle dealer provide
60 consumer data to a third party:
61 (a) Must comply with all restrictions on reuse or
62 disclosure of data established by federal and state law and must
63 provide a written statement to the motor vehicle dealer
64 delineating the established procedures adopted by the licensee
65 or a third party which meet or exceed any federal or state
66 requirements to safeguard consumer data, including, but not
67 limited to, those established in the Gramm-Leach-Bliley Act, 15
68 U.S.C. ss. 6801 et seq.
69 (b) Must, upon the written request of the motor vehicle
70 dealer, provide a written list of the consumer data obtained
71 from a motor vehicle dealer and all persons to whom any of the
72 consumer data has been provided by the licensee or a third party
73 during the preceding 12 months. The dealer may make such a
74 request no more than once every 6 months. The list must indicate
75 the specific fields of the consumer data which were provided to
76 each person.
77 (c) May not require that a motor vehicle dealer grant the
78 licensee or a third party direct or indirect access to the
79 dealer’s data management system to collect consumer data. A
80 licensee must permit a motor vehicle dealer to furnish consumer
81 data in a widely accepted file format, such as comma delineated,
82 and through a third-party vendor selected by the motor vehicle
83 dealer. However, a licensee may access or obtain consumer data
84 directly from a motor vehicle dealer’s data management system
85 with the express consent of the dealer. The consent must be in
86 the form of a written document that is separate from the
87 parties’ franchise agreement, is executed by the motor vehicle
88 dealer, and may be withdrawn by the dealer at any time.
89 (d) Must indemnify the motor vehicle dealer for any claims
90 asserted against or damages incurred by the motor vehicle dealer
91 as a result of the licensee’s or a third party’s access, use, or
92 disclosure of the consumer data.
93 Section 2. For the purpose of incorporating section
94 320.646, Florida Statutes, as created by this act, in a
95 reference thereto, section 320.6992, Florida Statutes, is
96 reenacted to read:
97 320.6992 Application.—Sections 320.60-320.70, including
98 amendments to ss. 320.60-320.70, apply to all presently existing
99 or hereafter established systems of distribution of motor
100 vehicles in this state, except to the extent that such
101 application would impair valid contractual agreements in
102 violation of the State Constitution or Federal Constitution.
103 Sections 320.60-320.70 do not apply to any judicial or
104 administrative proceeding pending as of October 1, 1988. All
105 agreements renewed, amended, or entered into subsequent to
106 October 1, 1988, shall be governed by ss. 320.60-320.70,
107 including any amendments to ss. 320.60-320.70 which have been or
108 may be from time to time adopted, unless the amendment
109 specifically provides otherwise, and except to the extent that
110 such application would impair valid contractual agreements in
111 violation of the State Constitution or Federal Constitution.
112 Section 3. This act shall take effect upon becoming a law.