Ninth Circuit Upholds Arizona Car Dealer Data Privacy Law

On Monday, a panel in Phoenix, Arizona sided with the state in a constitutional and federal law preemption challenge to its 2019 “Dealer Law.” In affirming the lower court’s denial of a preliminary injunction, the unanimous court rejected arguments by plaintiff-appellants CDK Global LLC and Reynolds and Reynolds Co., two database providers that license dealer management systems (DMS) to auto dealers.

The 27-page opinion recounted that Arizona enacted the statute to enhance privacy protections for consumers whose data is collected by car dealers and to restrict anticompetitive practices by technology companies that provide database services to dealers. In particular, the Dealer Law prevents database providers such as the plaintiffs from “limiting access to dealer data by dealer-authorized third parties and requires providers to create a standardized framework to facilitate such access,” the panel said.

CDK and Reynolds sought declaratory and injunctive relief on grounds that the statute is preempted by the Copyright Act and the Computer Fraud and Abuse Act (CFAA), violates the U.S. Constitution’s Contracts Clause and the Takings Clause, and is void for vagueness.  

At the outset, the panel ruled that it had jurisdiction to consider the order denying injunctive relief, but that it lacked pendent appellate jurisdiction over the CFAA and vagueness claims. 

The court then addressed the plaintiffs’ assertion that the Dealer Law conflicts with the Copyright Act because it grants dealers and their authorized integrators the right to access to the plaintiffs’ systems and create unlicensed copies of its DMS, its open application programming interface (API), and its data compilations.

Among other copyright holdings, the panel ruled that there was no conflict preemption because the Dealer Law and federal laws were not irreconcilable. The court explained that the plaintiffs’ expert testimony lent credence to the possibility that they could comply with the Dealer Law without being forced to create a new copy of their software to process third-party requests. Secondarily, the panel ruled that even if the plaintiffs were forced to create new copies of their DMS on their own servers in response to third-party requests, they did not establish that those copies would infringe their reproduction rights.

The panel further determined that CGK and Reynolds were unlikely to prevail on the merits of their constitutional claims for various reasons, including that some were forfeited. In the case of their takings claim, the court ruled that the law neither effected a per se physical taking, nor did it constitute a regulatory taking.

CGK and Reynolds are represented by Mayer Brown LLP, Sheppard Mullin Richter & Hampton LLP, Quarles & Brady LLP, and Gibbs & Bruns LLP.