A federal appeals court rejected an effort to block enforcement of an Arizona law designed to give auto retailers more control of data inside dealership management systems, upholding a similar decision last year by a lower court.
In a decision Monday, a three-judge panel of the U.S. Court of Appeals for the Ninth Circuit agreed with a federal district judge’s July 2020 opinion that DMS giants CDK Global Inc. and Reynolds and Reynolds Co. “were unlikely to succeed on the merits of their claims” in a legal challenge to the state data law.
The law, passed in 2019, took effect in July 2020 after U.S. District Judge G. Murray Snow denied CDK’s and Reynolds’ request for an injunction. CDK and Reynolds later appealed that injunction decision.
It was not immediately clear Tuesday how CDK and Reynolds will respond. A CDK spokesman on Tuesday said the company does not comment on active legal matters, while a spokesman for Reynolds and Reynolds did not immediately respond to a message seeking comment.
Bobbi Sparrow, president of the Arizona Automobile Dealers Association, which intervened in the case, said the association is “thrilled” with the appeals court’s opinion and that the statute could serve as a legal framework for other states considering similar legislation.
“I think it’s now the road map for the other states,” she said, adding that it is a positive outcome for both auto dealers and consumers.
Arizona Gov. Doug Ducey signed the law in April 2019. It allows dealerships to share data stored within their DMS with third-party vendors considered authorized integrators, and prevents companies including CDK and Reynolds from charging fees or placing other restrictions on that data access. Other states have adopted similar laws, including Montana, Oregon and Hawaii.
CDK and Reynolds first filed suit in July 2019 against Arizona Attorney General Mark Brnovich and John Halikowski, director of the state transportation department, though Halikowski eventually was removed as a defendant.
In a statement, Katie Conner, a spokeswoman for the Arizona Attorney General’s office, said: “Today is a great day for consumers and for the protection of their personal information.”
Several original claims were dismissed in May 2020 and CDK and Reynolds later filed a revised complaint.
The DMS companies claim the data law is unconstitutional and vague, and leaves consumers’ personal information potentially vulnerable to cyber threats and misuse. In their revised complaint, CDK and Reynolds wrote that the law interferes with their DMS contracts with dealerships and requires giving “free and unfettered access” to third parties, including potential malicious actors.
“These provisions retroactively rewrite Plaintiffs” negotiated contracts and undercut Plaintiffs” extensive efforts to protect the confidentiality, integrity and availability of their DMSs by limiting access to authorized users and barring or detecting unauthorized intrusions,” according to their amended complaint.
The Ninth Circuit panel, however, wrote that Arizona’s law contains provisions to ensure that data is secured, adding that “CDK may disagree with the State’s policy choice, but that does not mean that the law violates the Constitution.”
Brad Miller, director of legal and regulatory affairs and senior counsel of digital affairs for the National Automobile Dealers Association, which supported Arizona’s dealership association in the litigation, said in a statement that the Ninth Circuit decision “is a clear victory for the AADA and Arizona dealers.”
