28-4654. Dealer data vendors; authorized integrators; requirements

A. A dealer data vendor shall:

1. Adopt and make available a standardized framework for the exchange, integration and sharing of data from dealer data systems with authorized integrators and the retrieval of data by authorized integrators using the star standards or a standard that is compatible with the star standards.

2. Provide access to open application programming interfaces to authorized integrators. If the application programming interfaces are not the reasonable commercial or technical standard for secure data integration, the dealer data vendor may provide a similar open access integration method if that method provides the same or better access to authorized integrators as an application programming interface and uses the required standardized framework.

B. A dealer data vendor and authorized integrator:

1. May access, use, store or share protected dealer data or any other data from a dealer data system only to the extent allowed in the written agreement with the dealer.

2. Must make any agreement relating to access to, sharing or selling of, copying, using or transmitting protected dealer data terminable on ninety days' notice from the dealer.

3. On notice of the dealer's intent to terminate the agreement, in order to prevent any risk of consumer harm or inconvenience, must work to ensure a secure transition of all protected dealer data to a successor dealer data vendor or authorized integrator, including:

(a) Providing access to or an electronic copy of all protected dealer data and all other data stored in the dealer data system in a commercially reasonable time and format that a successor dealer data vendor or authorized integrator can access and use.

(b) Deleting or returning to the dealer all protected dealer data before the contract terminates pursuant to the dealer's written directions.

4. On a dealer's request, must provide the dealer with a listing of all entities with whom it is sharing protected dealer data or with whom it has allowed access to protected dealer data.

5. Must allow a dealer to audit the dealer data vendor or authorized integrator's access to and use of any protected dealer data.