Arizona a ‘guinea pig' in case involving access to DMS data

Auto dealers in Arizona are optimistic that they will prevail in a federal lawsuit brought by two U.S. dealership management system giants over control of data inside a retailer's central operating system.

Dealerships logged a win last month after a federal judge denied a request by CDK Global Inc. and Reynolds and Reynolds Co. to stop enforcement of a new Arizona statute that gives retailers more access to data contained inside their systems. That step means the law, adopted last year but put on hold while the DMS companies' preliminary injunction request was pending, can now take effect while litigation proceeds.

CDK and Reynolds appealed the injunction decision late last month. Longer term, the outcome of the case — and what it means for broader issues surrounding data access and security — could have ramifications beyond Arizona, even if the decision ultimately is not binding on other states.

Arizona is "kind of the guinea pig out there right now," said Bobbi Sparrow, president of the Arizona Automobile Dealers Association, which intervened in the lawsuit CDK and Reynolds filed in 2019 against state Attorney General Mark Brnovich.

The law allows dealerships to share data stored within their systems with third-party vendors deemed to be authorized integrators, and prevents companies including CDK and Reynolds from charging fees or placing other restrictions on that access. It is similar to statutes adopted in states such as Montana, Oregon and Hawaii.

Reynolds spokesman Tom Schwartz told Automotive News that the company doesn't speculate on potential actions in other states.

CDK and Reynolds contend Arizona's statute is unconstitutional and vague, and that it would make consumers' personal information vulnerable to cyber threats and misuse. They asked that enforcement of the law be stayed during the appeal process.

"This is one more step in the legal process, and we will wait to see how the judge responds to our request," Schwartz said in an email.

A CDK spokesman said the company is "disappointed" in the judge's order.

In his order denying an injunction, U.S. District Judge G. Murray Snow said CDK and Reynolds "have not proven a likelihood of success on the merits of their claims."

Brad Miller, director of legal and regulatory affairs and senior counsel for the National Automobile Dealers Association, said Snow's decision follows his dismissal in May of several claims in CDK's and Reynolds' original complaint.

NADA deemed Snow's July order a "major" victory for dealerships in a recent blog post, adding it gave more than $500,000 to the Arizona dealers association for legal fees.

"This was a relatively comprehensive law that was in a somewhat newish area, and it was subject to a very comprehensive challenge," Miller said. "The court has now had a chance to opine on all the claims presented before it, and all positively from the dealer's perspective."

"We'll see where it goes from here," he added, "but we're certainly encouraged by the court's ruling."

CDK and Reynolds contend in a revised complaint filed in June that the law interferes with their DMS contracts with dealerships and requires "free and unfettered access" to third parties, including potential malicious actors, at dealerships' request.

"These provisions retroactively rewrite plaintiffs' negotiated contracts and undercut plaintiffs' extensive efforts to protect the confidentiality, integrity and availability of their DMSs by limiting access to authorized users and barring or detecting unauthorized intrusions," according to their complaint.

In the future, CDK and Reynolds may have to phase out the integration fees that have given dealerships heartburn for years, because of market pressures, said John Darmento, director of the Gillrie Institute, a dealership technology consultant.

CDK in February said it would eliminate third-party data access fees under a new customer rewards program. Darmento said the fees have been excluded from every DMS deal Gillrie has worked on involving CDK in the past six months.

In an email to Automotive News last week, a CDK spokesman said, "We do understand that partner program fees have been a source of frustration for some of our customers and the Rewards Program relieves that by eliminating most of those fees."

Chris Apgar, CEO of Apgar & Associates LLC, an information privacy and security company in Oregon, said access or extraction of data should be negotiated. One concern is that not all dealerships may have appropriate security protocols in place to protect that information, Apgar said.

"There need to be some steps in place to say, 'OK, if you're going to enter into this vendor relationship, here are the things you need to do to make sure that data is secure,' " he said.

Sparrow said data security remains dealerships' top issue — one that is more prominent now that the coronavirus pandemic has accelerated digital retailing.

"We're right with the curve; we're not going against [it]," she said. "This is the way the whole world is going."