Arizona Laws 28-4654. Dealer data vendors; authorized integrators; requirements
A. A dealer data vendor shall:
Terms Used In Arizona Laws 28-4654
- Authorized Integrator: means a third party with whom a dealer enters into a contractual relationship to perform a specific function for a dealer that allows the third party to access protected dealer data or to write data to a dealer data system, or both, to carry out the specified function. See Arizona Laws 28-4651
- Contract: A legal written agreement that becomes binding when signed.
- Dealer: means a person who is engaged in the business of buying, selling or exchanging motor vehicles, trailers or semitrailers and who has an established place of business and has paid fees pursuant to section 28-4302. See Arizona Laws 28-101
- Dealer data vendor: means a dealer management system provider, consumer relationship management system provider or other vendor providing similar services that permissibly stores protected dealer data pursuant to a contract with the dealer. See Arizona Laws 28-4651
- including: means not limited to and is not a term of exclusion. See Arizona Laws 1-215
- Protected dealer data: means any:
(a) Personal, financial or other data relating to a consumer that a consumer provides to a dealer or that a dealer otherwise obtains and that is stored in the dealer's dealer data system. See Arizona Laws 28-4651
- Star standards: means the current, applicable security standards published by the standards for technology in automotive retail. See Arizona Laws 28-4651
1. Adopt and make available a standardized framework for the exchange, integration and sharing of data from dealer data systems with authorized integrators and the retrieval of data by authorized integrators using the star standards or a standard that is compatible with the star standards.
2. Provide access to open application programming interfaces to authorized integrators. If the application programming interfaces are not the reasonable commercial or technical standard for secure data integration, the dealer data vendor may provide a similar open access integration method if that method provides the same or better access to authorized integrators as an application programming interface and uses the required standardized framework.
B. A dealer data vendor and authorized integrator:
1. May access, use, store or share protected dealer data or any other data from a dealer data system only to the extent allowed in the written agreement with the dealer.
2. Must make any agreement relating to access to, sharing or selling of, copying, using or transmitting protected dealer data terminable on ninety days’ notice from the dealer.
3. On notice of the dealer’s intent to terminate the agreement, in order to prevent any risk of consumer harm or inconvenience, must work to ensure a secure transition of all protected dealer data to a successor dealer data vendor or authorized integrator, including:
(a) Providing access to or an electronic copy of all protected dealer data and all other data stored in the dealer data system in a commercially reasonable time and format that a successor dealer data vendor or authorized integrator can access and use.
(b) Deleting or returning to the dealer all protected dealer data before the contract terminates pursuant to the dealer’s written directions.
4. On a dealer’s request, must provide the dealer with a listing of all entities with whom it is sharing protected dealer data or with whom it has allowed access to protected dealer data.
5. Must allow a dealer to audit the dealer data vendor or authorized integrator’s access to and use of any protected dealer data.