{"data":{"id":"us-ok/okla.-stat.-tit.-47-47-564.3","jurisdiction":"us-ok","citation":"Okla. Stat. tit. 47, § 47-564.3","heading":"Dealer management system providers—Authorized actions—","body":"Restrictions—Authorized integrators.\n\nA. As used in this section:\n\n1. \"Access fee\" means a requirement to pay money for access to\n\nprotected dealer data that is in addition to an amount specified in\n\na written and executed contract for goods and services;\n\n2. \"Authorized integrator\" means a person who a dealer has a\n\ncontractual relationship with or the dealer otherwise gives express\n\nwritten authorization to have access to protected dealer data stored\n\non a dealer data system or to write protected dealer data to the\n\ndealer data system for the purpose of performing a specific function\n\nfor the dealer;\n\n3. \"Dealer data system\" means software, hardware, or firmware\n\nthat a dealer leases or rents from a dealer management system\n\nprovider for the purpose of storing protected dealer data;\n\n4. \"Dealer management system provider\" means a person who, for\n\ncompensation, maintains and provides access to a dealer data system\n\nin which a dealer stores protected dealer data;\n\n5. \"Protected dealer data\" means:\n\na. consumer data that a dealer generated or that the\n\nconsumer provided to the dealer that is not otherwise\n\npublicly available and the consumer has not otherwise\n\nprovided consent or acknowledgment to share the\n\ninformation, and\n\nb. any other dealer data in connection with the dealer's\n\ndaily business operations in which a dealer has rights\n\nin a dealer data system; and\n\n6. Authorized integrator and dealer management system provider\n\ndo not include:\n\na. a factory or any entity that acts on behalf of, a\n\nfactory, including any subsidiary or affiliate of a\n\nfactory, or\n\nb. a governmental body or other person that is acting in\n\naccordance with federal, state, or local law, or a\n\nvalid court order.\n\nB. A dealer management system provider may:\n\n1. Condition access and ability of a dealer or authorized\n\nintegrator to receive, share, copy, use, write, or transmit\n\nprotected dealer data from or to a dealer data system on the\n\ndealer's or authorized integrator's compliance with commercially\n\nreasonable data security standards;\n\n2. Require an authorized integrator to have express written\n\nauthorization from a dealer before allowing the authorized\n\nintegrator to gain access to, receive, share, copy, use, or transmit\n\nprotected dealer data; and\n\n3. Deny access to a dealer data system to a dealer if the\n\ndealer fails to pay an amount due to the dealer management system\n\nprovider under a lease, contract, or other agreement concerning the\n\ndealer's access to or use of the dealer data system.\n\nC. Except as provided in subsection B of this section, a dealer\n\nmanagement system provider shall not take any action that would\n\nlimit or prohibit the ability of a dealer or an authorized\n\nintegrator to receive, protect, store, copy, share, or use protected\n\ndealer data using means that include, but are not limited to:\n\n1. Imposing an access fee on a dealer or authorized integrator;\n\nand\n\n2. Restricting a dealer or an authorized integrator from\n\nsharing protected dealer data or writing data or having access to a\n\ndealer data system. Prohibited restrictions pursuant to this\n\nparagraph include, but are not limited to:\n\na. limits on the scope or nature of protected dealer data\n\nto which a dealer or authorized integrator has access\n\nor may share or write to a dealer data system, and\n\nb. a requirement for a dealer or authorized integrator to\n\nprovide sensitive or confidential business information\n\nor information that a dealer or authorized integrator\n\nuses for competitive purposes in return for access to\n\nprotected dealer data or an authorization to share or\n\nwrite protected dealer data to a dealer data system.\n\nD. Except as otherwise provided in this section, any term or\n\ncondition of a contract with a dealer management system provider\n\nthat conflicts with the requirements set forth in subsection C of\n\nthis section is void and unenforceable to the extent of the\n\nconflict.\nin return for access to\n\nprotected dealer data or an authorization to share or\n\nwrite protected dealer data to a dealer data system.\n\nD. Except as otherwise provided in this section, any term or\n\ncondition of a contract with a dealer management system provider\n\nthat conflicts with the requirements set forth in subsection C of\n\nthis section is void and unenforceable to the extent of the\n\nconflict.\n\nE. An authorized integrator shall:\n\n1. Obtain express written authorization from a dealer before\n\ngaining access to, receiving, sharing, copying, using, writing, or\n\ntransmitting protected dealer data;\n\n2. Comply with security standards in gaining access to,\n\nreceiving, sharing, copying, using, writing, or transmitting\n\nprotected dealer data; and\n\n3. Allow a dealer to withdraw, revoke, or amend any express\n\nwritten authorization the dealer provides under paragraph 1 of this\n\nsubsection:\n\na. at the sole discretion of the dealer, if the dealer\n\ngives a thirty-day prior notice to an authorized\n\nintegrator, or\n\nb. immediately, for good cause.\n\nF. 1. This section does not prevent a dealer, a dealer\n\nmanagement system provider, or an authorized integrator from\n\ndischarging the obligations of a dealer, dealer management system\n\nprovider, or of an authorized integrator under federal, state, or\n\nlocal law to secure and prevent unauthorized access to protected\n\ndealer data, or from limiting the scope of the obligations, in\n\naccordance with federal, state, or local law.\n\n2. A dealer management system provider is not liable for any\n\naction that a dealer takes directly with respect to securing or\n\npreventing unauthorized access to protected dealer data, or for\n\nactions that an authorized integrator takes in appropriately\n\nfollowing the written instructions of the dealer for securing or\n\npreventing unauthorized access to protected dealer data, to the\n\nextent that the actions prevent the dealer management system\n\nprovider from meeting a legal obligation to secure or prevent\n\nunauthorized access to protected dealer data.\n\n3. A dealer is not liable for any action that an authorized\n\nintegrator takes directly with respect to securing or preventing\n\nunauthorized access to protected dealer data, or for actions that\n\nthe authorized integrator takes in appropriately following the\n\nwritten instructions of the dealer for securing or preventing\n\nunauthorized access to protected dealer data, to the extent that the\n\nactions prevent the dealer from meeting a legal obligation to secure\n\nor prevent unauthorized access to protected dealer data.\n\n4. An authorized integrator is not liable for any action that a\n\ndealer takes directly with respect to securing or preventing\n\nunauthorized access to protected dealer data, or for actions that\n\nthe dealer takes in appropriately following the written instructions\n\nof the authorized integrator for securing or preventing unauthorized\n\naccess to protected dealer data, to the extent that the actions\n\nprevent the authorized integrator from meeting a legal obligation to\n\nsecure or prevent unauthorized access to protected dealer data.\n\n5. A factory or any entity that acts on behalf of a factory,\n\nincluding any subsidiary or affiliate of a factory, is not liable\n\nfor any action that a dealer, dealer management system provider,\n\nauthorized integrator, or other third party, except for a third\n\nparty who the manufacturer has provided the data to as provided for\n\nin paragraph 7 of this subsection, takes directly with respect to\n\nsecuring or preventing unauthorized access to protected dealer data\n\nor for actions that an authorized integrator, dealer management\n\nsystem provider, or other third party takes in appropriately\n\nfollowing the written instructions of the dealer for securing or\n\npreventing unauthorized access to protected dealer data.\n\n6. Notwithstanding any other agreement, an authorized\nhorized access to protected dealer data\n\nor for actions that an authorized integrator, dealer management\n\nsystem provider, or other third party takes in appropriately\n\nfollowing the written instructions of the dealer for securing or\n\npreventing unauthorized access to protected dealer data.\n\n6. Notwithstanding any other agreement, an authorized\n\nintegrator shall indemnify and hold the new motor vehicle dealer\n\nharmless from any third-party claims asserted against or damages\n\nincurred by the new motor vehicle dealer to the extent caused by\n\naccess to, use of, or disclosure of consumer data in violation of\n\nthis section.\n\n7. Notwithstanding any other agreement, a factory or any entity\n\nthat acts on behalf of a factory, including any subsidiary or\n\naffiliate of a factory, shall indemnify the dealer for any third-\n\nparty claims asserted against or damages incurred by the dealer to\n\nthe extent the claims or damages are caused by the access to and\n\nunlawful disclosure of protected dealer data resulting from a breach\n\ncaused by the manufacturer or distributor or a third party to which\n\nthe manufacturer or distributor has provided the protected dealer\n\ndata in violation of this section, the written consent granted by\n\nthe dealer, or other applicable state or federal law.\n\nG. A factory or entity that acts on behalf of, a factory,\n\nincluding any subsidiary or affiliate of a factory, may not prohibit\n\nan Authorized Integrator that has satisfied or is compliant with\n\ncommercially reasonable data security standards and that the dealer\n\nhas identified as one of its authorized integrators from integrating\n\ninto the dealer's dealer data system or place an unreasonable\n\nrestriction on integration by an authorized integrator or other\n\nthird party that the dealer wishes to be an authorized integrator.\n\nFor the purposes of this subsection, \"unreasonable restriction\"\n\nincludes:\n\n1. Imposing an access fee on a dealer or authorized integrator;\n\n2. An unreasonable limitation or condition on the scope or\n\nnature of the data that is shared with an authorized integrator;\n\n3. An unreasonable limitation on the ability of the authorized\n\nintegrator to write data to a dealer data system;\n\n4. An unreasonable limitation or condition on an authorized\n\nintegrator that accesses or shares protected dealer data or that\n\nwrites data to a dealer data system; and\n\n5. Requiring unreasonable access to an authorized integrator's\n\nsensitive, competitive, or other confidential business information\n\nas a condition for accessing protected dealer data or sharing\n\nprotected dealer data with an authorized integrator.\n\nNotwithstanding paragraph 1 of this subsection, a factory, or\n\nentity that acts on behalf of a factory, including any subsidiary or\n\naffiliate of a factory may charge a motor vehicle dealer or\n\nauthorized integrator for actual costs associated with modifications\n\nto a franchisor’s electronic systems to enable a functional and\n\nsecure interface with the authorized integrator’s system and\n\nsoftware.","path":["OK Code","Title 47"],"source_url":"https://www.oklegislature.gov/OK_Statutes/CompleteTitles/os47.pdf","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:36Z","sha256":"0832e4c43c2e6dd68e1d90ae4e41e487dd848faf60931368cc495acdcc80a8e7","source_id":"us-ok","stale":false,"prev":"us-ok/okla.-stat.-tit.-47-47-564.2","next":"us-ok/okla.-stat.-tit.-47-47-564v1"},"notice":"GroundRules: Original legal text. Not legal advice."}