13-73-202. Service provider contracts -- Franchisors and third parties -- Prohibitions -- Requirements.
(1)
(a) A service provider contract may permit the franchisee to monitor the service provider's compliance with the contract through ongoing manual reviews, automated scans, regular assessments, audits, or other technical and operational testing, at least once every 12 months.
(b) If a service provider or vendor engages another person to assist the service provider or vendor in processing protected dealer data for a business purpose on behalf of the franchisee, or if another person engaged by the service provider or vendor engages a person to assist in processing protected dealer data for that business purpose, the service provider or vendor shall notify the franchisee of that engagement, and the engagement shall be pursuant to a written contract binding the person to observe all the requirements described in Subsection 13-73-101(16).
(2) A franchisor or third party may not:
(a) access, share, sell, copy, use, or transmit protected dealer data without prior express written consent;
(b) engage in any act of cyber ransom; or
(c) take action to prohibit or limit a franchisee's ability to protect, store, copy, share, or use protected dealer data, including:
(i) imposing a fee for, or other restriction on, the franchisee or authorized integrator:
(A) accessing or sharing protected dealer data;
(B) writing data to a dealer data system; or
(C) submitting or pushing data or information to the third party under Subsection 13-73-201(2);
(ii) unreasonably prohibiting a third party or an authorized integrator that satisfies STAR standards or other generally accepted standards from integrating into the franchisee's dealer data system; or
(iii) placing an unreasonable restriction on integration by an authorized integrator or third party.
(3)
(a) Notwithstanding Subsection (2)(c)(i)(A), a franchisor or a third party may charge a franchisee the franchisor's or third party's actual third party costs, including a reasonable profit margin for providing access to protected dealer data to a franchisee, authorized integrator, or other third party if the franchisor or third party:
(i) discloses the charge to the franchisee in writing; and
(ii) upon written request by the franchisee, provides to the franchisee documentation that the charges were agreed to in writing by the franchisee or provided for in the contract for services or goods.
(b) If a third party fails to comply with Subsection (3)(a), a charge described in Subsection (3)(a) is a fee prohibited under Subsection (2)(c)(i).
(4)
(a) A franchisee may unilaterally revoke or amend the prior express written consent described in Subsection (2)(a):
(i) with 60 days notice without cause; or
(ii) immediately for cause.
(b)
(i) Except as provided in Subsection (4)(b)(ii), a franchisor may not seek or require prior express written consent as a condition of or factor for consideration or eligibility for a:
(A) franchisor program;
(B) standard or policy; or
(C) benefit to a franchisee.
(ii) If a franchisor's program reasonably requires delivery of information that is protected dealer data to qualify for the program and receive franchisor program benefits, a franchisee shall provide the information to participate in the franchisor program.
(5) This section does not:
(a) limit a franchisee's, franchisor's, or third party's obligations:
(i) as a service provider;
(ii) under federal, state, or local law, to protect and secure protected dealer data; or
(iii) regarding required manufacturer data; and
(b) require a franchisor to pay a benefit to a franchisee if the franchisee refuses to provide data reasonably necessary to participate in the franchisor program.
(6) A franchisor or franchisor's selected third party may not require a franchisee to pay a fee for sharing required manufacturer data if:
(a) the franchisor requires a franchisee to provide required manufacturer data through a specific third party that the franchisor selects;
(b) the franchisor does not allow the franchisee to submit the required manufacturer data using the franchisee's choice of a third party vendor;
(c) the franchisee's data is in a format that is compatible with the format required by the franchisor; and
(d) the third party vendor satisfies the STAR standards or other generally accepted standards.
(7) A franchisor may not access, sell, copy, use, transmit, or require a franchisee to share or provide access to protected dealer data, unless:
(a) the protected dealer data is required manufacturer data; or
(b) the franchisee provides prior express written consent.
(8) A franchisor may only use required manufacturer data that the franchisor obtains from a dealer data system for the purposes described in Subsection 13-73-101(14).
(9)
(a) A franchisor, authorized integrator, or other third party shall indemnify a franchisee for any claims or damages if:
(i) the claims or damages directly result from a violation of this section by the party from whom the franchisee is seeking indemnification;
(ii) the claims or damages directly result from a violation of this section by:
(A) a vendor or contractor as an agent acting on behalf of the party from whom the franchisee is seeking indemnification; or
(B) a vendor or other service provider who the party from whom the franchisee is seeking indemnification required the franchisee to use; and
(iii) the claims or damages result from a violation of this section for:
(A) accessing or providing access to protected dealer data;
(B) using protected dealer data; or
(C) disclosing protected dealer data.
(b) A franchisee bringing a cause of action against a franchisor, authorized integrator, or other third party for a violation of this section has the burden of proof.
(10) Notwithstanding Subsection (6), this chapter does not restrict or limit a franchisor's right to:
(a) access or obtain required manufacturer data;
(b) use, share, copy, or transmit required manufacturer data for the purposes described in Subsection 13-73-101(15); or
(c) use or control data that is:
(i) proprietary to the franchisor;
(ii) created by the franchisor;
(iii) obtained from a source other than the franchisee; or
(iv) public information.
Enacted by Chapter 212, 2024 General Session
