On February 9, 2024, Senate Bill 215 for Motor Vehicle Consumer Data Protection was introduced to the Utah State Senate and thereafter proceeded to the House of Representatives, on February 20, 2024, following its third reading in the Senate.

Scope

The bill does not:

• govern or apply to data outside of a dealer data system, including data that is generated by a motor vehicle or a device that a consumer connects to a motor vehicle;
• authorize a franchisee or third party to use data that the franchisee or third party obtains from a person in a manner that is consistent with:
  • an agreement with the person; or
  • the purposes for which the person provides the data to the franchisee or third party; or
• except as necessary to fulfill a franchisee's obligation to provide warranty, repair, or service to a consumer, grant a franchisee:
  • ownership of motor vehicle diagnostic data; or
  • rights to share or use motor vehicle diagnostic data.

Vendor management and contracts

In particular, the bill outlines requirements and restrictions in relation to vendor management. Specifically, the bill provides that a dealer data vendor must adopt and make available to a franchisee and authorized integrator in a standardized framework:

• the exchange, integration, and sharing of data between a dealer data system and authorized integrator; and
• the retrieval of data by an authorized integrator.

A dealer data vendor and an authorized integrator may access, use, store, or share protected dealer data or any other data from a dealer data system only to the extent allowed in the written agreement with the franchisee. They must also, upon the franchisee's request, provide the franchisee with a list of all persons with whom the data is being shared, or has been shared with, or to whom they are allowing or have allowed access.

In addition, the bill outlines that a service provider contract may permit the franchisee to monitor the service provider's compliance with the contract through ongoing manual reviews, automated scans, assessments, audits, or other technical and operational testing, at least once a year. Where a service provider or vendor engages another person in processing for that business purpose, the service provider must notify the franchisee of that engagement and the engagement must be made pursuant to a contract binding the person to observe requirements under the bill.

Regarding prohibitions on sharing data with vendors, a franchisor or third party may not:

• access, share, sell, copy, use, or transmit protected dealer data without prior express consent;
• engage in any act of cyber ransom; or
• take action to prohibit or limit a franchisee's ability to protect, store, copy, share, or use protected dealer data, including:
  • unreasonably prohibiting a third party or an authorized integrator that satisfies Standards for Technology in Automotive Retail (STAR) or other generally accepted standards from integrating into the franchisee's dealer data system; or
  • placing an unreasonable restriction on integration by an unauthorized integrator or third party.

You can read the bill and track its progress here.

Update: March 1, 2024

Bill passes third reading in House

On February 29, 2024, the bill passed its third reading in the House and was thereafter signed, on the same date, by the Speaker of the House. The bill must now be enrolled and signed by the Governor of Utah before its passage. 

You can read the bill and track its progress here.

Update: March 18, 2024

Bill signed by Governor

On March 13, 2024, the bill was signed by the Governor.

The bill enters into effect on May 1, 2024.

You can read the bill and track its progress here.

Update: May 1, 2024

Act enters into force

On May 1, 2024, the Act entered into force.

You can read the Act and view its legislative history here.