Florida Senate - 2016 CS for SB 960
By the Committee on Transportation; and Senator Bradley
596-02373-16 2016960c1
1 A bill to be entitled
2 An act relating to protection of motor vehicle
3 dealers’ consumer data; creating s. 320.646, F.S.;
4 defining the terms “consumer data” and “data
5 management system”; requiring that a licensee or a
6 third party comply with certain restrictions on reuse
7 or disclosure of consumer data received from a motor
8 vehicle dealer; requiring that such person provide a
9 written statement to the motor vehicle dealer
10 delineating the established procedures adopted by the
11 person which meet or exceed certain requirements to
12 safeguard consumer data; requiring that upon request
13 of a motor vehicle dealer a licensee provide a list of
14 the consumer data obtained and all persons to whom any
15 of the data has been disclosed, subject to certain
16 requirements; prohibiting a licensee from requiring a
17 motor vehicle dealer to grant the licensee or third
18 party access to the dealer’s data management system;
19 requiring a licensee to permit a motor vehicle dealer
20 to furnish consumer data in a widely accepted file
21 format and through a third-party vendor selected by
22 the motor vehicle dealer; authorizing a licensee to
23 access or obtain consumer data from a motor vehicle
24 dealer’s data management system with the dealer’s
25 express written consent, subject to certain
26 requirements; requiring the licensee to indemnify the
27 motor vehicle dealer for certain claims or damages;
28 providing that a person bringing a specified cause of
29 action for certain violations must meet certain
30 requirements; reenacting s. 320.6992, F.S., relating
31 to the provisions that apply to established systems of
32 distribution of motor vehicles in this state, to
33 incorporate s. 320.646, F.S., as created by the act,
34 in a reference thereto; providing an effective date.
35
36 Be It Enacted by the Legislature of the State of Florida:
37
38 Section 1. Section 320.646, Florida Statutes, is created to
39 read:
40 320.646 Consumer data protection.—
41 (1) As used in this section, the term:
42 (a) “Consumer data” means “nonpublic personal information”
43 as such term is defined in 15 U.S.C. s. 6809(4) collected by a
44 motor vehicle dealer and which is provided by the motor vehicle
45 dealer directly to a licensee or third party acting on behalf of
46 a licensee. Consumer data does not include the same or similar
47 data which is obtained by a licensee from any other source.
48 (b) “Data management system” means a computer hardware or
49 software system that is owned, leased, or licensed by a motor
50 vehicle dealer, including a system of web-based applications,
51 computer software, or computer hardware, whether located at the
52 motor vehicle dealership or hosted remotely, and that stores and
53 provides access to consumer data collected or stored by a motor
54 vehicle dealer. The term includes, but is not limited to,
55 dealership management systems and customer relations management
56 systems.
57 (2) Notwithstanding the provisions of any franchise
58 agreement, with respect to consumer data a licensee or a third
59 party acting on behalf of a licensee:
60 (a) Shall comply with all, and not knowingly cause a motor
61 vehicle dealer to violate any, applicable restrictions on reuse
62 or disclosure of the consumer data established by federal or
63 state law and must provide a written statement to the motor
64 vehicle dealer upon request describing the established
65 procedures adopted by the licensee or third party acting on
66 behalf of the licensee which meet or exceed any federal or state
67 requirements to safeguard the consumer data, including, but not
68 limited to, those established in the Gramm-Leach-Bliley Act, 15
69 U.S.C. ss. 6801 et seq.
70 (b) Shall, upon the written request of the motor vehicle
71 dealer, provide a written list of the consumer data obtained
72 from the motor vehicle dealer and all persons to whom any
73 consumer data has been provided by the licensee or a third party
74 acting on behalf of a licensee during the preceding 6 months.
75 The dealer may make such a request no more than once every 6
76 months. The list must indicate the specific fields of consumer
77 data which were provided to each person. Notwithstanding the
78 foregoing, such a list need not include:
79 1. A person to whom consumer data was provided, or the
80 specific consumer data provided to such person, if the person
81 was, at the time the consumer data was provided, one of the
82 licensee’s service providers, subcontractors or consultants
83 acting in the course of such person’s performance of services on
84 behalf of or for the benefit of the licensee or motor vehicle
85 dealer, provided that the licensee has entered into an agreement
86 with such person requiring that the person comply with the
87 safeguard requirements of applicable state and federal law,
88 including, but not limited to, those established in the Gramm
89 Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq; or
90 2. A person to whom consumer data was provided, or the
91 specific consumer data provided to such person, if the motor
92 vehicle dealer has previously consented in writing to such
93 person receiving the consumer data provided and the motor
94 vehicle dealer has not withdrawn such consent in writing.
95 (c) May not require that a motor vehicle dealer grant the
96 licensee or a third party direct or indirect access to the
97 dealer’s data management system to obtain consumer data. A
98 licensee must permit a motor vehicle dealer to furnish consumer
99 data in a widely accepted file format, such as comma delimited,
100 and through a third-party vendor selected by the motor vehicle
101 dealer. However, a licensee may access or obtain consumer data
102 directly from a motor vehicle dealer’s data management system
103 with the express consent of the dealer. The consent must be in
104 the form of a written document that is separate from the
105 parties’ franchise agreement, is executed by the motor vehicle
106 dealer, and may be withdrawn by the dealer upon 30 days’ written
107 notice to the licensee.
108 (d) Must indemnify the motor vehicle dealer for any third
109 party claims asserted against or damages incurred by the motor
110 vehicle dealer to the extent caused by access to, use of, or
111 disclosure of consumer data in violation of this section by the
112 licensee, a third party acting on behalf of the licensee, or a
113 third party to whom the licensee has provided consumer data.
114 (3) In any cause of action against a licensee pursuant to
115 s. 320.697 for a violation of paragraphs (2)(a), (2)(b), or
116 (2)(c), the person bringing the action has the burden of proving
117 that the violation was willful or with sufficient frequency to
118 establish a pattern of wrongdoing with respect to such person’s
119 consumer data.
120 Section 2. For the purpose of incorporating section
121 320.646, Florida Statutes, as created by this act, in a
122 reference thereto, section 320.6992, Florida Statutes, is
123 reenacted to read:
124 320.6992 Application.—Sections 320.60-320.70, including
125 amendments to ss. 320.60-320.70, apply to all presently existing
126 or hereafter established systems of distribution of motor
127 vehicles in this state, except to the extent that such
128 application would impair valid contractual agreements in
129 violation of the State Constitution or Federal Constitution.
130 Sections 320.60-320.70 do not apply to any judicial or
131 administrative proceeding pending as of October 1, 1988. All
132 agreements renewed, amended, or entered into subsequent to
133 October 1, 1988, shall be governed by ss. 320.60-320.70,
134 including any amendments to ss. 320.60-320.70 which have been or
135 may be from time to time adopted, unless the amendment
136 specifically provides otherwise, and except to the extent that
137 such application would impair valid contractual agreements in
138 violation of the State Constitution or Federal Constitution.
139 Section 3. This act shall take effect upon becoming a law.