(A) If a franchisor, manufacturer, distributor, or third party acting on behalf of a franchisor, manufacturer, or distributor handles consumer data, then the franchisor, manufacturer, distributor, or third party:

(1) must comply with and shall not cause a dealer to violate applicable restrictions regarding reuse or consumer data disclosure established by federal or state law;

(2) upon a dealer’s written request, must provide a statement to the dealer describing procedures that meet or exceed any federal or state consumer data protection requirements;

(3) upon a dealer’s written request, must provide a written list of the consumer data obtained from the dealer and all persons to whom any consumer data has been furnished during the preceding six months. The dealer may make such a request no more than once every six months. The list must indicate the specific fields of consumer data that were provided to each person. Notwithstanding the foregoing, such a list may not be required to include:

(a) a person to whom consumer data was provided, or the specific consumer data provided to such person, if the person was, at the time the consumer data was provided, a service provider or subcontractor acting in the course of performance of services on behalf of or for the benefit of the franchisor, manufacturer, or distributor, provided that the franchisor, manufacturer, or distributor has entered into an agreement with the person requiring that the person comply with the safeguard requirements of applicable state and federal law including, but not limited to, those established in the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, et seq.; or

(b) a person to whom consumer data was provided, or the specific consumer data provided to the person, if the dealer has previously consented in writing to the person receiving the consumer data and the dealer has not withdrawn the consent in writing;

(4)(a) may not require a dealer to provide direct or indirect access to the dealer’s data management system for obtaining consumer data. A dealer may furnish consumer data in a widely accepted file format, such as comma delimited, and through a third-party vendor selected by the dealer;

(b) may directly access or obtain consumer data from a dealer’s data management system with the express written consent from the dealer. The consent must be a separate document executed by the dealer principal and may be withdrawn by the dealer upon providing a thirty-day written notice to the manufacturer or distributor. Consent is not required as a condition of a new motor vehicle dealer’s participation in an incentive program, unless consent is necessary to obtain consumer data to implement the program; and

(5) must indemnify the dealer for any third-party claims or damages incurred by the dealer to the extent the damage is caused by access to, use of, or disclosure of consumer data in violation of this section by the franchisor, manufacturer, distributor, or a third party to whom the franchisor, manufacturer, or distributor has provided consumer data.

(B) This section is not a limitation on a franchisor’s, manufacturer’s, or distributor’s ability to require the dealer to provide or use customer information exclusively related to the manufacturer or distributor’s own vehicle makes to the extent necessary to:

(1) satisfy safety, recall, warranty, or other legal notice obligations required of the manufacturer;

(2) complete the sale and delivery of a new motor vehicle to a customer;

(3) validate and pay customer or dealer incentives;

(4) submit claims for any services supplied by the dealer for any claim for warranty parts or repair;

(5) perform market analysis;

(6) perform sales or service consumer satisfaction surveys; or

(7) perform reasonable marketing that benefits the dealer.