Shown verbatim: the complete text as captured from the official PDF posted by the Oklahoma Legislature, fetched 2026-07-23. Page and line markers are part of the official record; nothing is edited or removed. The official bill page.
1 STATE OF OKLAHOMA
2 1st Session of the 60th Legislature (2025)
3 HOUSE BILL 2158 By: Dobrinski
4
5
6 AS INTRODUCED
7 An Act relating to motor vehicles; amending Section
1, Chapter 29, O.S.L. 2023 (47 O.S. Supp. 2024,
8 Section 564.3), which relates to dealer management
system providers; modifying type of security
9 standards required; and providing an effective date.
10
11
12 BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
13 SECTION 1. AMENDATORY Section 1, Chapter 29, O.S.L. 2023
14 (47 O.S. Supp. 2024, Section 564.3), is amended to read as follows:
15 Section 564.3. A. As used in this section:
16 1. "Access fee" means a requirement to pay money for access to
17 protected dealer data;
18 2. "Authorized integrator" means a person who a dealer has a
19 contractual relationship with or the dealer otherwise gives express
20 written authorization to have access to protected dealer data stored
21 on a dealer data system or to write protected dealer data to the
22 dealer data system for the purpose of performing a specific function
23 for the dealer;
24
Req. No. 11597 Page 1
1 3. "Dealer data system" means software, hardware, or firmware
2 that a dealer leases or rents from a dealer management system
3 provider for the purpose of storing protected dealer data;
4 4. "Dealer management system provider" means a person who, for
5 compensation, maintains and provides access to a dealer data system
6 in which a dealer stores protected dealer data;
7 5. "Protected dealer data" means:
8 a. consumer data that a dealer generated or that the
9 consumer provided to the dealer that is not otherwise
10 publicly available and the consumer has not otherwise
11 provided consent or acknowledgment to share the
12 information, and
13 b. any other dealer data in connection with the dealer's
14 daily business operations in which a dealer has rights
15 in a dealer data system; and
16 6. Authorized integrator and dealer management system provider
17 do not include:
18 a. a manufacturer, distributor, importer, or any entity
19 that is a subsidiary or affiliate of, or acts on
20 behalf of, a manufacturer, distributor, or importer,
21 or
22 b. a governmental body or other person that is acting in
23 accordance with federal, state, or local law, or a
24 valid court order.
Req. No. 11597 Page 2
1 B. A dealer management system provider may:
2 1. Condition access and ability of a dealer or authorized
3 integrator to receive, share, copy, use, write, or transmit
4 protected dealer data from or to a dealer data system on the
5 dealer's or authorized integrator's compliance with commercially
6 reasonable data security standards;
7 2. Require an authorized integrator to have express written
8 authorization from a dealer before allowing the authorized
9 integrator to gain access to, receive, share, copy, use, or transmit
10 protected dealer data; and
11 3. Deny access to a dealer data system to a dealer if the
12 dealer fails to pay an amount due to the dealer management system
13 provider under a lease, contract, or other agreement concerning the
14 dealer's access to or use of the dealer data system.
15 C. Except as provided in subsection B of this section, a dealer
16 management system provider shall not take any action that would
17 limit or prohibit the ability of a dealer or an authorized
18 integrator to receive, protect, store, copy, share, or use protected
19 dealer data using means that include, but are not limited to:
20 1. Imposing an access fee on a dealer or authorized integrator;
21 and
22 2. Restricting a dealer or an authorized integrator from
23 sharing protected dealer data or writing data or having access to a
24
Req. No. 11597 Page 3
1 dealer data system. Prohibited restrictions pursuant to this
2 paragraph include, but are not limited to:
3 a. limits on the scope or nature of protected dealer data
4 to which a dealer or authorized integrator has access
5 or may share or write to a dealer data system, and
6 b. a requirement for a dealer or authorized integrator to
7 provide sensitive or confidential business information
8 or information that a dealer or authorized integrator
9 uses for competitive purposes in return for access to
10 protected dealer data or an authorization to share or
11 write protected dealer data to a dealer data system.
12 D. Except as otherwise provided in this section, any term or
13 condition of a contract with a dealer management system provider
14 that conflicts with the requirements set forth in subsection C of
15 this section is void and unenforceable to the extent of the
16 conflict.
17 E. An authorized integrator shall:
18 1. Obtain express written authorization from a dealer before
19 gaining access to, receiving, sharing, copying, using, writing, or
20 transmitting protected dealer data;
21 2. Comply with security standards in gaining access to,
22 receiving, sharing, copying, using, writing, or transmitting
23 protected dealer data; and
24
Req. No. 11597 Page 4
1 3. Allow a dealer to withdraw, revoke, or amend any express
2 written authorization the dealer provides under paragraph 1 of this
3 subsection:
4 a. at the sole discretion of the dealer, if the dealer
5 gives a thirty-day prior notice to an authorized
6 integrator, or
7 b. immediately, for good cause.
8 F. 1. This section does not prevent a dealer, a dealer
9 management system provider, or an authorized integrator from
10 discharging the obligations of a dealer, dealer management system
11 provider, or of an authorized integrator under federal, state, or
12 local law to secure and prevent unauthorized access to protected
13 dealer data, or from limiting the scope of the obligations, in
14 accordance with federal, state, or local law.
15 2. A dealer management system provider is not liable for any
16 action that a dealer takes directly with respect to securing or
17 preventing unauthorized access to protected dealer data, or for
18 actions that an authorized integrator takes in appropriately
19 following the written instructions of the dealer for securing or
20 preventing unauthorized access to protected dealer data, to the
21 extent that the actions prevent the dealer management system
22 provider from meeting a legal obligation to secure or prevent
23 unauthorized access to protected dealer data.
24
Req. No. 11597 Page 5
1 3. A dealer is not liable for any action that an authorized
2 integrator takes directly with respect to securing or preventing
3 unauthorized access to protected dealer data, or for actions that
4 the authorized integrator takes in appropriately following the
5 written instructions of the dealer for securing or preventing
6 unauthorized access to protected dealer data, to the extent that the
7 actions prevent the dealer from meeting a legal obligation to secure
8 or prevent unauthorized access to protected dealer data.
9 4. An authorized integrator is not liable for any action that a
10 dealer takes directly with respect to securing or preventing
11 unauthorized access to protected dealer data, or for actions that
12 the dealer takes in appropriately following the written instructions
13 of the authorized integrator for securing or preventing unauthorized
14 access to protected dealer data, to the extent that the actions
15 prevent the authorized integrator from meeting a legal obligation to
16 secure or prevent unauthorized access to protected dealer data.
17 5. A manufacturer, distributor, importer, or any entity that is
18 a subsidiary or affiliate of, or acts on behalf of, a manufacturer,
19 distributor, or importer is not liable for any action that a dealer,
20 dealer management system provider, authorized integrator, or other
21 third party, except for a third party who the manufacturer has
22 provided the data to as provided for in paragraph 7 of this
23 subsection, takes directly with respect to securing or preventing
24 unauthorized access to protected dealer data or for actions that an
Req. No. 11597 Page 6
1 authorized integrator, dealer management system provider, or other
2 third party takes in appropriately following the written
3 instructions of the dealer for securing or preventing unauthorized
4 access to protected dealer data.
5 6. Notwithstanding any other agreement, an authorized
6 integrator shall indemnify and hold the new motor vehicle dealer
7 harmless from any third-party claims asserted against or damages
8 incurred by the new motor vehicle dealer to the extent caused by
9 access to, use of, or disclosure of consumer data in violation of
10 this section.
11 7. Notwithstanding any other agreement, a manufacturer,
12 distributor, importer, or any entity that is a subsidiary or
13 affiliate of, or acts on behalf of, a manufacturer, distributor, or
14 importer shall indemnify the dealer for any third-party claims
15 asserted against or damages incurred by the dealer to the extent the
16 claims or damages are caused by the access to and unlawful
17 disclosure of protected dealer data resulting from a breach caused
18 by the manufacturer or distributor or a third party to which the
19 manufacturer or distributor has provided the protected dealer data
20 in violation of this section, the written consent granted by the
21 dealer, or other applicable state or federal law.
22 SECTION 2. This act shall become effective November 1, 2025.
23
24 60-1-11597 JBH 12/29/24
Req. No. 11597 Page 7Every fact on this page links to its source, starting with the official bill record.