Bill Text: FL S0960 | 2016 | Regular Session | Comm Sub

---

Bill Title: Protection of Motor Vehicle Dealers' Consumer Data

Spectrum: Bipartisan Bill

Status: (Introduced - Dead) 2016-03-04 - Laid on Table, companion bill(s) passed, see CS/CS/HB 231 (Ch. 2016-77) [S0960 Detail]

Download: Florida-2016-S0960-Comm_Sub.html

---

       Florida Senate - 2016                              CS for SB 960
       
       
        
       By the Committee on Transportation; and Senator Bradley
       
       596-02373-16                                           2016960c1
    1                        A bill to be entitled                      
    2         An act relating to protection of motor vehicle
    3         dealers’ consumer data; creating s. 320.646, F.S.;
    4         defining the terms “consumer data” and “data
    5         management system”; requiring that a licensee or a
    6         third party comply with certain restrictions on reuse
    7         or disclosure of consumer data received from a motor
    8         vehicle dealer; requiring that such person provide a
    9         written statement to the motor vehicle dealer
   10         delineating the established procedures adopted by the
   11         person which meet or exceed certain requirements to
   12         safeguard consumer data; requiring that upon request
   13         of a motor vehicle dealer a licensee provide a list of
   14         the consumer data obtained and all persons to whom any
   15         of the data has been disclosed, subject to certain
   16         requirements; prohibiting a licensee from requiring a
   17         motor vehicle dealer to grant the licensee or third
   18         party access to the dealer’s data management system;
   19         requiring a licensee to permit a motor vehicle dealer
   20         to furnish consumer data in a widely accepted file
   21         format and through a third-party vendor selected by
   22         the motor vehicle dealer; authorizing a licensee to
   23         access or obtain consumer data from a motor vehicle
   24         dealer’s data management system with the dealer’s
   25         express written consent, subject to certain
   26         requirements; requiring the licensee to indemnify the
   27         motor vehicle dealer for certain claims or damages;
   28         providing that a person bringing a specified cause of
   29         action for certain violations must meet certain
   30         requirements; reenacting s. 320.6992, F.S., relating
   31         to the provisions that apply to established systems of
   32         distribution of motor vehicles in this state, to
   33         incorporate s. 320.646, F.S., as created by the act,
   34         in a reference thereto; providing an effective date.
   35          
   36  Be It Enacted by the Legislature of the State of Florida:
   37  
   38         Section 1. Section 320.646, Florida Statutes, is created to
   39  read:
   40         320.646 Consumer data protection.—
   41         (1) As used in this section, the term:
   42         (a) “Consumer data” means “nonpublic personal information”
   43  as such term is defined in 15 U.S.C. s. 6809(4) collected by a
   44  motor vehicle dealer and which is provided by the motor vehicle
   45  dealer directly to a licensee or third party acting on behalf of
   46  a licensee. Consumer data does not include the same or similar
   47  data which is obtained by a licensee from any other source.
   48         (b) “Data management system” means a computer hardware or
   49  software system that is owned, leased, or licensed by a motor
   50  vehicle dealer, including a system of web-based applications,
   51  computer software, or computer hardware, whether located at the
   52  motor vehicle dealership or hosted remotely, and that stores and
   53  provides access to consumer data collected or stored by a motor
   54  vehicle dealer. The term includes, but is not limited to,
   55  dealership management systems and customer relations management
   56  systems.
   57         (2) Notwithstanding the provisions of any franchise
   58  agreement, with respect to consumer data a licensee or a third
   59  party acting on behalf of a licensee:
   60         (a) Shall comply with all, and not knowingly cause a motor
   61  vehicle dealer to violate any, applicable restrictions on reuse
   62  or disclosure of the consumer data established by federal or
   63  state law and must provide a written statement to the motor
   64  vehicle dealer upon request describing the established
   65  procedures adopted by the licensee or third party acting on
   66  behalf of the licensee which meet or exceed any federal or state
   67  requirements to safeguard the consumer data, including, but not
   68  limited to, those established in the Gramm-Leach-Bliley Act, 15
   69  U.S.C. ss. 6801 et seq.
   70         (b) Shall, upon the written request of the motor vehicle
   71  dealer, provide a written list of the consumer data obtained
   72  from the motor vehicle dealer and all persons to whom any
   73  consumer data has been provided by the licensee or a third party
   74  acting on behalf of a licensee during the preceding 6 months.
   75  The dealer may make such a request no more than once every 6
   76  months. The list must indicate the specific fields of consumer
   77  data which were provided to each person. Notwithstanding the
   78  foregoing, such a list need not include:
   79         1. A person to whom consumer data was provided, or the
   80  specific consumer data provided to such person, if the person
   81  was, at the time the consumer data was provided, one of the
   82  licensee’s service providers, subcontractors or consultants
   83  acting in the course of such person’s performance of services on
   84  behalf of or for the benefit of the licensee or motor vehicle
   85  dealer, provided that the licensee has entered into an agreement
   86  with such person requiring that the person comply with the
   87  safeguard requirements of applicable state and federal law,
   88  including, but not limited to, those established in the Gramm
   89  Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq; or
   90         2. A person to whom consumer data was provided, or the
   91  specific consumer data provided to such person, if the motor
   92  vehicle dealer has previously consented in writing to such
   93  person receiving the consumer data provided and the motor
   94  vehicle dealer has not withdrawn such consent in writing.
   95         (c) May not require that a motor vehicle dealer grant the
   96  licensee or a third party direct or indirect access to the
   97  dealer’s data management system to obtain consumer data. A
   98  licensee must permit a motor vehicle dealer to furnish consumer
   99  data in a widely accepted file format, such as comma delimited,
  100  and through a third-party vendor selected by the motor vehicle
  101  dealer. However, a licensee may access or obtain consumer data
  102  directly from a motor vehicle dealer’s data management system
  103  with the express consent of the dealer. The consent must be in
  104  the form of a written document that is separate from the
  105  parties’ franchise agreement, is executed by the motor vehicle
  106  dealer, and may be withdrawn by the dealer upon 30 days’ written
  107  notice to the licensee.
  108         (d) Must indemnify the motor vehicle dealer for any third
  109  party claims asserted against or damages incurred by the motor
  110  vehicle dealer to the extent caused by access to, use of, or
  111  disclosure of consumer data in violation of this section by the
  112  licensee, a third party acting on behalf of the licensee, or a
  113  third party to whom the licensee has provided consumer data.
  114         (3) In any cause of action against a licensee pursuant to
  115  s. 320.697 for a violation of paragraphs (2)(a), (2)(b), or
  116  (2)(c), the person bringing the action has the burden of proving
  117  that the violation was willful or with sufficient frequency to
  118  establish a pattern of wrongdoing with respect to such person’s
  119  consumer data.
  120         Section 2. For the purpose of incorporating section
  121  320.646, Florida Statutes, as created by this act, in a
  122  reference thereto, section 320.6992, Florida Statutes, is
  123  reenacted to read:
  124         320.6992 Application.—Sections 320.60-320.70, including
  125  amendments to ss. 320.60-320.70, apply to all presently existing
  126  or hereafter established systems of distribution of motor
  127  vehicles in this state, except to the extent that such
  128  application would impair valid contractual agreements in
  129  violation of the State Constitution or Federal Constitution.
  130  Sections 320.60-320.70 do not apply to any judicial or
  131  administrative proceeding pending as of October 1, 1988. All
  132  agreements renewed, amended, or entered into subsequent to
  133  October 1, 1988, shall be governed by ss. 320.60-320.70,
  134  including any amendments to ss. 320.60-320.70 which have been or
  135  may be from time to time adopted, unless the amendment
  136  specifically provides otherwise, and except to the extent that
  137  such application would impair valid contractual agreements in
  138  violation of the State Constitution or Federal Constitution.
  139         Section 3. This act shall take effect upon becoming a law.