Shown verbatim: the complete text as captured from the official PDF posted by the Oklahoma Legislature, fetched 2026-07-23. Page and line markers are part of the official record; nothing is edited or removed. The official bill page.
1 STATE OF OKLAHOMA
1
2 1st Session of the 60th Legislature (2025)
2
3 SENATE BILL 604 By: Gollihare
3
4
4
5
5
6 AS INTRODUCED
6
7 An Act relating to motor vehicle dealers; amending
7 Section 1, Chapter 29, O.S.L. 2023 (47 O.S. Supp.
8 2024, Section 564.3), which relates to dealer
8 management system providers; clarifying parameters of
9 certain data security standards; and providing an
9 effective date.
10
10
11
11
12 BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
12
13 SECTION 1. AMENDATORY Section 1, Chapter 29, O.S.L. 2023
13
14 (47 O.S. Supp. 2024, Section 564.3), is amended to read as follows:
14
15 Section 564.3. A. As used in this section:
15
16 1. "Access fee" means a requirement to pay money for access to
16
17 protected dealer data;
17
18 2. "Authorized integrator" means a person who a dealer has a
18
19 contractual relationship with or the dealer otherwise gives express
19
20 written authorization to have access to protected dealer data stored
20
21 on a dealer data system or to write protected dealer data to the
21
22 dealer data system for the purpose of performing a specific function
22
23 for the dealer;
23
24
24
Req. No. 776 Page 1
1 3. "Dealer data system" means software, hardware, or firmware
1
2 that a dealer leases or rents from a dealer management system
2
3 provider for the purpose of storing protected dealer data;
3
4 4. "Dealer management system provider" means a person who, for
4
5 compensation, maintains and provides access to a dealer data system
5
6 in which a dealer stores protected dealer data;
6
7 5. "Protected dealer data" means:
7
8 a. consumer data that a dealer generated or that the
8
9 consumer provided to the dealer that is not otherwise
9
10 publicly available and the consumer has not otherwise
10
11 provided consent or acknowledgment to share the
11
12 information, and
12
13 b. any other dealer data in connection with the dealer's
13
14 daily business operations in which a dealer has rights
14
15 in a dealer data system; and
15
16 6. Authorized integrator and dealer management system provider
16
17 do not include:
17
18 a. a manufacturer, distributor, importer, or any entity
18
19 that is a subsidiary or affiliate of, or acts on
19
20 behalf of, a manufacturer, distributor, or importer,
20
21 or
21
22 b. a governmental body or other person that is acting in
22
23 accordance with federal, state, or local law, or a
23
24 valid court order.
24
Req. No. 776 Page 2
1 B. A dealer management system provider may:
1
2 1. Condition access and ability of a dealer or authorized
2
3 integrator to receive, share, copy, use, write, or transmit
3
4 protected dealer data from or to a dealer data system on the
4
5 dealer's or authorized integrator's compliance with commercially
5
6 reasonable data security standards;
6
7 2. Require an authorized integrator to have express written
7
8 authorization from a dealer before allowing the authorized
8
9 integrator to gain access to, receive, share, copy, use, or transmit
9
10 protected dealer data; and
10
11 3. Deny access to a dealer data system to a dealer if the
11
12 dealer fails to pay an amount due to the dealer management system
12
13 provider under a lease, contract, or other agreement concerning the
13
14 dealer's access to or use of the dealer data system.
14
15 C. Except as provided in subsection B of this section, a dealer
15
16 management system provider shall not take any action that would
16
17 limit or prohibit the ability of a dealer or an authorized
17
18 integrator to receive, protect, store, copy, share, or use protected
18
19 dealer data using means that include, but are not limited to:
19
20 1. Imposing an access fee on a dealer or authorized integrator;
20
21 and
21
22 2. Restricting a dealer or an authorized integrator from
22
23 sharing protected dealer data or writing data or having access to a
23
24
24
Req. No. 776 Page 3
1 dealer data system. Prohibited restrictions pursuant to this
1
2 paragraph include, but are not limited to:
2
3 a. limits on the scope or nature of protected dealer data
3
4 to which a dealer or authorized integrator has access
4
5 or may share or write to a dealer data system, and
5
6 b. a requirement for a dealer or authorized integrator to
6
7 provide sensitive or confidential business information
7
8 or information that a dealer or authorized integrator
8
9 uses for competitive purposes in return for access to
9
10 protected dealer data or an authorization to share or
10
11 write protected dealer data to a dealer data system.
11
12 D. Except as otherwise provided in this section, any term or
12
13 condition of a contract with a dealer management system provider
13
14 that conflicts with the requirements set forth in subsection C of
14
15 this section is void and unenforceable to the extent of the
15
16 conflict.
16
17 E. An authorized integrator shall:
17
18 1. Obtain express written authorization from a dealer before
18
19 gaining access to, receiving, sharing, copying, using, writing, or
19
20 transmitting protected dealer data;
20
21 2. Comply with security standards in gaining access to,
21
22 receiving, sharing, copying, using, writing, or transmitting
22
23 protected dealer data; and
23
24
24
Req. No. 776 Page 4
1 3. Allow a dealer to withdraw, revoke, or amend any express
1
2 written authorization the dealer provides under paragraph 1 of this
2
3 subsection:
3
4 a. at the sole discretion of the dealer, if the dealer
4
5 gives a thirty-day prior notice to an authorized
5
6 integrator, or
6
7 b. immediately, for good cause.
7
8 F. 1. This section does not prevent a dealer, a dealer
8
9 management system provider, or an authorized integrator from
9
10 discharging the obligations of a dealer, dealer management system
10
11 provider, or of an authorized integrator under federal, state, or
11
12 local law to secure and prevent unauthorized access to protected
12
13 dealer data, or from limiting the scope of the obligations, in
13
14 accordance with federal, state, or local law.
14
15 2. A dealer management system provider is not liable for any
15
16 action that a dealer takes directly with respect to securing or
16
17 preventing unauthorized access to protected dealer data, or for
17
18 actions that an authorized integrator takes in appropriately
18
19 following the written instructions of the dealer for securing or
19
20 preventing unauthorized access to protected dealer data, to the
20
21 extent that the actions prevent the dealer management system
21
22 provider from meeting a legal obligation to secure or prevent
22
23 unauthorized access to protected dealer data.
23
24
24
Req. No. 776 Page 5
1 3. A dealer is not liable for any action that an authorized
1
2 integrator takes directly with respect to securing or preventing
2
3 unauthorized access to protected dealer data, or for actions that
3
4 the authorized integrator takes in appropriately following the
4
5 written instructions of the dealer for securing or preventing
5
6 unauthorized access to protected dealer data, to the extent that the
6
7 actions prevent the dealer from meeting a legal obligation to secure
7
8 or prevent unauthorized access to protected dealer data.
8
9 4. An authorized integrator is not liable for any action that a
9
10 dealer takes directly with respect to securing or preventing
10
11 unauthorized access to protected dealer data, or for actions that
11
12 the dealer takes in appropriately following the written instructions
12
13 of the authorized integrator for securing or preventing unauthorized
13
14 access to protected dealer data, to the extent that the actions
14
15 prevent the authorized integrator from meeting a legal obligation to
15
16 secure or prevent unauthorized access to protected dealer data.
16
17 5. A manufacturer, distributor, importer, or any entity that is
17
18 a subsidiary or affiliate of, or acts on behalf of, a manufacturer,
18
19 distributor, or importer is not liable for any action that a dealer,
19
20 dealer management system provider, authorized integrator, or other
20
21 third party, except for a third party who the manufacturer has
21
22 provided the data to as provided for in paragraph 7 of this
22
23 subsection, takes directly with respect to securing or preventing
23
24 unauthorized access to protected dealer data or for actions that an
24
Req. No. 776 Page 6
1 authorized integrator, dealer management system provider, or other
1
2 third party takes in appropriately following the written
2
3 instructions of the dealer for securing or preventing unauthorized
3
4 access to protected dealer data.
4
5 6. Notwithstanding any other agreement, an authorized
5
6 integrator shall indemnify and hold the new motor vehicle dealer
6
7 harmless from any third-party claims asserted against or damages
7
8 incurred by the new motor vehicle dealer to the extent caused by
8
9 access to, use of, or disclosure of consumer data in violation of
9
10 this section.
10
11 7. Notwithstanding any other agreement, a manufacturer,
11
12 distributor, importer, or any entity that is a subsidiary or
12
13 affiliate of, or acts on behalf of, a manufacturer, distributor, or
13
14 importer shall indemnify the dealer for any third-party claims
14
15 asserted against or damages incurred by the dealer to the extent the
15
16 claims or damages are caused by the access to and unlawful
16
17 disclosure of protected dealer data resulting from a breach caused
17
18 by the manufacturer or distributor or a third party to which the
18
19 manufacturer or distributor has provided the protected dealer data
19
20 in violation of this section, the written consent granted by the
20
21 dealer, or other applicable state or federal law.
21
22 SECTION 2. This act shall become effective November 1, 2025.
22
23
23
24 60-1-776 CAD 1/19/2025 5:39:50 AM
24
Req. No. 776 Page 7Every fact on this page links to its source, starting with the official bill record.