(a) Except as expressly authorized in this section, a manufacturer or distributor cannot require a motor vehicle dealer to provide it customer information to the manufacturer or distributor unless necessary for the sale and delivery of a new motor vehicle to a consumer, to validate and pay consumer or dealer incentives, for manufacturer's marketing purposes, for evaluation of dealer performance, for analytics or to support claims submitted by the new motor vehicle dealer for reimbursement for warranty parts or repairs. Nothing in this section shall limit the manufacturer's ability to require or use customer information to satisfy any safety or recall notice obligation or other legal obligation.

(b) The dealer is only required to provide the customer information to the extent lawfully permissible; and to the extent the requested information relates solely to specific program requirements or goals associated with the manufacturer's or distributor's own vehicle makes. A manufacturer, factory branch, distributor, distributor branch, dealer management computer system vendor or any third party acting on behalf of any manufacturer, factory branch, distributor, distributor branch or dealer management computer system vendor may not prohibit a dealer from providing a means to regularly and continually monitor the specific data accessed from or written to the dealer's computer system and from complying with applicable state and federal laws and any rules or regulations promulgated thereunder. These provisions do not impose an obligation on a manufacturer, factory branch, distributor, distributor branch, dealer management computer system vendor or any third party acting on behalf of any manufacturer, factory branch, distributor, distributor branch or dealer management computer system vendor to provide that capability.

(c) A manufacturer, factory branch, distributor, distributor branch, dealer management computer system vendor, or any third party acting on behalf of any manufacturer, factory branch, distributor, distributor branch or dealer management computer system vendor, may not provide access to customer or dealership information maintained in a dealer management computer system used by a motor vehicle dealer located in this state, other than a subsidiary or affiliate of the manufacturer factory branch, distributor or distributor branch without first obtaining the dealer's prior express written consent, revocable by the dealer upon ten business days written notice, to provide the access.

Upon a written request from a motor vehicle dealer, the manufacturer, factory branch, distributor, distributor branch, dealer management computer system vendor, or any third party acting on behalf of or through any manufacturer, factory branch, distributor, distributor branch or dealer management computer system vendor shall provide to the dealer a written list of all specific third parties other than a subsidiary or affiliate of the manufacturer, factory branch, distributor or distributor branch to whom any data obtained from the dealer has actually been provided within the twelve-month period prior to date of dealer's written request. If requested by the dealer, the list shall further describe the scope and specific fields of the data provided. The consent does not change the person's obligations to comply with the terms of this section and any additional state or federal laws, and any rules or regulations promulgated thereunder, applicable to them with respect to the access.

(d) A manufacturer, factory branch, distributor, distributor branch, dealer management computer system vendor or any third party acting on behalf of or through any dealer management computer system vendor, having electronic access to customer or motor vehicle dealership data in a dealership management computer system used by a motor vehicle dealer located in this state shall provide notice in a reasonable timely manner to the dealer of any security breach of dealership or customer data obtained through the access.

(e) As used in this section:

(1) "Dealer management computer system" means a computer hardware and software system that is owned or leased by the dealer, including a dealer's use of web applications, excluding a web application operated by a manufacturer, software or hardware, whether located at the dealership or provided at a remote location and that provides access to customer records and transactions by a motor vehicle dealer located in this state and that allows the motor vehicle dealer timely information in order to sell vehicles, parts or services through the motor vehicle dealership.

(2) "Dealer management computer system vendor" means a seller or reseller of dealer management computer systems, a person that sells computer software for use on dealer management computer systems or a person who services or maintains dealer management computer systems.

(3) "Security breach" means an incident of unauthorized access to and acquisition of records or data containing dealership or dealership customer information where unauthorized use of the dealership or dealership customer information has occurred.

(4) "Customer information" means "nonpublic personal" as defined in 16 C. F. R. §313.

(f) Notwithstanding the terms or conditions of any consent, authorization, release, novation, franchise or other contract or agreement, every manufacturer, factory branch, distributor, distributor branch, dealer management computer system vendor or any third party acting on behalf of or through a manufacturer, factory branch, distributor, distributor branch or dealer management computer system vendor shall fully indemnify, defend and hold harmless any dealer or manufacturer, factory branch, distributor or distributor branch from all damages, attorney fees and costs, other costs and expenses incurred by the dealer from complaints, claims or actions arising out of manufacturer's, factory's branch, distributor's, distributor's branch, dealer management computer system vendor's or any third party for its willful, negligent or illegal use or disclosure of dealers consumer or customer data or other information in dealer's computer system. The indemnification includes, but is not limited to, judgments, settlements, fines, penalties, litigation costs, defense costs, court costs, costs related to the disclosure of security breaches and attorneys' fees arising out of complaints, claims, civil or administrative actions.

(g) This section applies to contracts entered into after the effective date of this section.