(2) (i) “Consumer data” means nonpublic personal information, as defined in 15 U.S.C. § 6809(4), collected by a dealer and provided by the dealer directly to a manufacturer, distributor, or factory branch, or its agent.

(ii) “Consumer data” does not include the same or similar data that is obtained by a manufacturer from any other source.

(3) “Data management system” means a computer hardware or software system that:

(i) Is owned, leased, or licensed by a dealer, including a system of web-based applications;

(ii) Is located at the dealership or hosted remotely; and

(iii) Stores and provides access to consumer data collected and stored by the dealer.

(b) Notwithstanding the provisions of any franchise agreement, a manufacturer, distributor, or factory branch, or its agent:

(1) Shall allow a dealer to furnish consumer data in a widely accepted file format, such as comma-separated values, and through a third-party vendor selected by the dealer;

(2) May access or obtain consumer data directly from a dealer’s data management system only with the express written consent of the dealer;

(3) May not take any adverse action against a dealer for refusing to grant access to the dealer’s data management system;

(4) May require that a franchised dealer of the manufacturer, distributor, or factory branch provide consumer data or transactional data that pertains to:

(i) Claims for warranty parts or repairs;

(ii) Sales and deliveries of new or certified pre-owned vehicles of any line make of the manufacturer, distributor, or factory branch;

(iii) Safety or recall obligations; or

(iv) Validation and payment of customer or dealer incentives; and

(5) Shall indemnify the dealer for any third-party claims asserted against or damages incurred by the dealer to the extent the claims of damages are caused by access to and unlawful disclosure of consumer data resulting from a breach caused by the manufacturer, distributor, or factory branch, or its agent, or a third party to which the manufacturer, distributor, or factory branch, or its agent, has provided the consumer data in violation of this section.

(c) A manufacturer, distributor, or factory branch, or its agent, may not require that a dealer grant the manufacturer, distributor, or factory branch, or its agent, access to the dealer’s data management system through a franchise agreement or as a condition of renewal or continuation of the franchise agreement.

(d) Written consent under subsection (b)(2) of this section:

(1) Shall be separate from the dealer franchise agreement;

(2) Shall be executed by the dealer; and

(3) May be withdrawn by the dealer on 30 days’ written notice to the manufacturer, distributor, or factory branch.