Okla. Stat. tit. 47, § 47-564.3

Restrictions—Authorized integrators.

A. As used in this section:

1. "Access fee" means a requirement to pay money for access to

protected dealer data that is in addition to an amount specified in

a written and executed contract for goods and services;

2. "Authorized integrator" means a person who a dealer has a

contractual relationship with or the dealer otherwise gives express

written authorization to have access to protected dealer data stored

on a dealer data system or to write protected dealer data to the

dealer data system for the purpose of performing a specific function

for the dealer;

3. "Dealer data system" means software, hardware, or firmware

that a dealer leases or rents from a dealer management system

provider for the purpose of storing protected dealer data;

4. "Dealer management system provider" means a person who, for

compensation, maintains and provides access to a dealer data system

in which a dealer stores protected dealer data;

5. "Protected dealer data" means:

a. consumer data that a dealer generated or that the

consumer provided to the dealer that is not otherwise

publicly available and the consumer has not otherwise

provided consent or acknowledgment to share the

information, and

b. any other dealer data in connection with the dealer's

daily business operations in which a dealer has rights

in a dealer data system; and

6. Authorized integrator and dealer management system provider

do not include:

a. a factory or any entity that acts on behalf of, a

factory, including any subsidiary or affiliate of a

factory, or

b. a governmental body or other person that is acting in

accordance with federal, state, or local law, or a

valid court order.

B. A dealer management system provider may:

1. Condition access and ability of a dealer or authorized

integrator to receive, share, copy, use, write, or transmit

protected dealer data from or to a dealer data system on the

Oklahoma Statutes - Title 47. Motor Vehicles Page 814

dealer's or authorized integrator's compliance with commercially

reasonable data security standards;

2. Require an authorized integrator to have express written

authorization from a dealer before allowing the authorized

integrator to gain access to, receive, share, copy, use, or transmit

protected dealer data; and

3. Deny access to a dealer data system to a dealer if the

dealer fails to pay an amount due to the dealer management system

provider under a lease, contract, or other agreement concerning the

dealer's access to or use of the dealer data system.

C. Except as provided in subsection B of this section, a dealer

management system provider shall not take any action that would

limit or prohibit the ability of a dealer or an authorized

integrator to receive, protect, store, copy, share, or use protected

dealer data using means that include, but are not limited to:

1. Imposing an access fee on a dealer or authorized integrator;

and

2. Restricting a dealer or an authorized integrator from

sharing protected dealer data or writing data or having access to a

dealer data system. Prohibited restrictions pursuant to this

paragraph include, but are not limited to:

a. limits on the scope or nature of protected dealer data

to which a dealer or authorized integrator has access

or may share or write to a dealer data system, and

b. a requirement for a dealer or authorized integrator to

provide sensitive or confidential business information

or information that a dealer or authorized integrator

uses for competitive purposes in return for access to

protected dealer data or an authorization to share or

write protected dealer data to a dealer data system.

D. Except as otherwise provided in this section, any term or

condition of a contract with a dealer management system provider

that conflicts with the requirements set forth in subsection C of

this section is void and unenforceable to the extent of the

conflict.
in return for access to

protected dealer data or an authorization to share or

write protected dealer data to a dealer data system.

D. Except as otherwise provided in this section, any term or

condition of a contract with a dealer management system provider

that conflicts with the requirements set forth in subsection C of

this section is void and unenforceable to the extent of the

conflict.

E. An authorized integrator shall:

1. Obtain express written authorization from a dealer before

gaining access to, receiving, sharing, copying, using, writing, or

transmitting protected dealer data;

2. Comply with security standards in gaining access to,

receiving, sharing, copying, using, writing, or transmitting

protected dealer data; and

3. Allow a dealer to withdraw, revoke, or amend any express

written authorization the dealer provides under paragraph 1 of this

subsection:

Oklahoma Statutes - Title 47. Motor Vehicles Page 815

a. at the sole discretion of the dealer, if the dealer

gives a thirty-day prior notice to an authorized

integrator, or

b. immediately, for good cause.

F. 1. This section does not prevent a dealer, a dealer

management system provider, or an authorized integrator from

discharging the obligations of a dealer, dealer management system

provider, or of an authorized integrator under federal, state, or

local law to secure and prevent unauthorized access to protected

dealer data, or from limiting the scope of the obligations, in

accordance with federal, state, or local law.

2. A dealer management system provider is not liable for any

action that a dealer takes directly with respect to securing or

preventing unauthorized access to protected dealer data, or for

actions that an authorized integrator takes in appropriately

following the written instructions of the dealer for securing or

preventing unauthorized access to protected dealer data, to the

extent that the actions prevent the dealer management system

provider from meeting a legal obligation to secure or prevent

unauthorized access to protected dealer data.

3. A dealer is not liable for any action that an authorized

integrator takes directly with respect to securing or preventing

unauthorized access to protected dealer data, or for actions that

the authorized integrator takes in appropriately following the

written instructions of the dealer for securing or preventing

unauthorized access to protected dealer data, to the extent that the

actions prevent the dealer from meeting a legal obligation to secure

or prevent unauthorized access to protected dealer data.

4. An authorized integrator is not liable for any action that a

dealer takes directly with respect to securing or preventing

unauthorized access to protected dealer data, or for actions that

the dealer takes in appropriately following the written instructions

of the authorized integrator for securing or preventing unauthorized

access to protected dealer data, to the extent that the actions

prevent the authorized integrator from meeting a legal obligation to

secure or prevent unauthorized access to protected dealer data.

5. A factory or any entity that acts on behalf of a factory,

including any subsidiary or affiliate of a factory, is not liable

for any action that a dealer, dealer management system provider,

authorized integrator, or other third party, except for a third

party who the manufacturer has provided the data to as provided for

in paragraph 7 of this subsection, takes directly with respect to

securing or preventing unauthorized access to protected dealer data

or for actions that an authorized integrator, dealer management

system provider, or other third party takes in appropriately

following the written instructions of the dealer for securing or

preventing unauthorized access to protected dealer data.

Oklahoma Statutes - Title 47. Motor Vehicles Page 816

6. Notwithstanding any other agreement, an authorized
horized access to protected dealer data

or for actions that an authorized integrator, dealer management

system provider, or other third party takes in appropriately

following the written instructions of the dealer for securing or

preventing unauthorized access to protected dealer data.

Oklahoma Statutes - Title 47. Motor Vehicles Page 816

6. Notwithstanding any other agreement, an authorized

integrator shall indemnify and hold the new motor vehicle dealer

harmless from any third-party claims asserted against or damages

incurred by the new motor vehicle dealer to the extent caused by

access to, use of, or disclosure of consumer data in violation of

this section.

7. Notwithstanding any other agreement, a factory or any entity

that acts on behalf of a factory, including any subsidiary or

affiliate of a factory, shall indemnify the dealer for any third-

party claims asserted against or damages incurred by the dealer to

the extent the claims or damages are caused by the access to and

unlawful disclosure of protected dealer data resulting from a breach

caused by the manufacturer or distributor or a third party to which

the manufacturer or distributor has provided the protected dealer

data in violation of this section, the written consent granted by

the dealer, or other applicable state or federal law.

G. A factory or entity that acts on behalf of, a factory,

including any subsidiary or affiliate of a factory, may not prohibit

an Authorized Integrator that has satisfied or is compliant with

commercially reasonable data security standards and that the dealer

has identified as one of its authorized integrators from integrating

into the dealer's dealer data system or place an unreasonable

restriction on integration by an authorized integrator or other

third party that the dealer wishes to be an authorized integrator.

For the purposes of this subsection, "unreasonable restriction"

includes:

1. Imposing an access fee on a dealer or authorized integrator;

2. An unreasonable limitation or condition on the scope or

nature of the data that is shared with an authorized integrator;

3. An unreasonable limitation on the ability of the authorized

integrator to write data to a dealer data system;

4. An unreasonable limitation or condition on an authorized

integrator that accesses or shares protected dealer data or that

writes data to a dealer data system; and

5. Requiring unreasonable access to an authorized integrator's

sensitive, competitive, or other confidential business information

as a condition for accessing protected dealer data or sharing

protected dealer data with an authorized integrator.

Notwithstanding paragraph 1 of this subsection, a factory, or

entity that acts on behalf of a factory, including any subsidiary or

affiliate of a factory may charge a motor vehicle dealer or

authorized integrator for actual costs associated with modifications

to a franchisor’s electronic systems to enable a functional and

secure interface with the authorized integrator’s system and

software.