Authenticom, Inc. v. CDK Global, LLC et al

Filing 193

PRELIMINARY INJUNCTION Against CDK Global, LLC. Signed by District Judge James D. Peterson on 7/28/2017. (kwf)

IN THE UNITED STATES DISTRICT COURT
FOR THE WESTERN DISTRICT OF WISCONSIN

AUTHENTICOM, INC.,
Plaintiff,

v.

CDK GLOBAL, LLC and
THE REYNOLDS AND REYNOLDS COMPANY,

ORDER FOR
PRELIMINARY INJUNCTION
AGAINST CDK GLOBAL, LLC
17-cv-318-jdp

Defendants.
Based on the parties’ written submissions, documentary evidence, and the evidence
presented at an evidentiary hearing, the court concluded that Authenticom is entitled to a
preliminary injunction. Dkt. 172. As explained more fully in the court’s July 14, 2017
opinion and order, (1) Authenticom has made the requisite showing of likelihood of success
on the merits of its antitrust claims; (2) Authenticom will suffer irreparable harm if the court
did not grant preliminary relief; (3) the balance of hardships tips in Authenticom’s favor; and
(4) the public interest is not disserved by the entry of a preliminary injunction. Accordingly,
defendant CDK Global, LLC, is preliminarily enjoined as provided in this order. Those
enjoined include defendant CDK Global, LLC, and its officers, employees, agents, attorneys,
and all those acting in active concert or participation with them, which the court will refer to
collectively as CDK.
CDK is preliminarily enjoined as follows:
1. CDK must not prevent Authenticom from using dealer login credentials to provide
data integration services for dealers who, as of May 1, 2017, had authorized
Authenticom to provide data integration services, subject to the following
conditions:

a. Authenticom may access only the parts of the CDK DMS that an
authorizing dealer itself is authorized to access.
b. Authenticom may access and extract only the data fields that the dealer
authorizes Authenticom to access and that are reasonably necessary for
Authenticom to provide the data integration services that the dealer
requests. Authenticom must destroy any other information that it
incidentally extracts during any screen-scraping process.
c. Authenticom’s access to the CDK DMS is generally limited to read-only
data exporting. Notwithstanding this general limitation, Authenticom may
use “write-back” functionality to provide data-cleansing services for those
dealers for whom it was providing data-cleansing as of May 1, 2017.
d. This order does not prevent CDK from blocking Authenticom’s access to
the CDK DMS that exceeds the access authorized in this order.
2. This order will be implemented through the following procedure:
a. Within five business days of entry of this order, Authenticom will provide
to CDK a list of dealers (with sufficient information to uniquely identify
each dealer) for whom Authenticom was providing data integration services
using dealer-provided login credentials as of May 1, 2017, along with all
usernames and passwords Authenticom uses at each dealer.
b. Within two business days of receipt of that list, CDK will cease blocking or
disabling the identified dealer login credentials for 45 days. During the 45day period, Authenticom will be able to access dealer data on CDK’s DMS
as provided in paragraph 1 of this order.

2

c. During that 45-day period, Authenticom will request that each CDK dealer
that intends to use Authenticom for data integration services during the
pendency of this preliminary injunction sign a dealer authorization form.
The dealer authorization form will authorize CDK to issue a single
username

and

password

to

Authenticom,

created

specifically

for

Authenticom to provide data integration services for that dealer.
d. The dealer authorization form must: be signed by an individual authorized
to bind the dealer and to authorize the release of dealer data; identify the
specific data fields and accounts within the DMS that the dealer authorizes
Authenticom to access; agree that the Authenticom-specific username and
password will not be used by or shared with any person or entity other
than Authenticom; and acknowledge that the dealer will not attempt to
hold CDK responsible for misuse of the Authenticom-specific credentials or
the data acquired with it.
e. Within two business days of receipt of a dealer authorization form, CDK
will issue an Authenticom-specific username and password to Authenticom
for its use in providing data integration services for that dealer in
accordance with this order.
f.

CDK may disable or block any username or password identified pursuant
to paragraph 2.a. if it does not receive a dealer authorization form within
the 45-day period. After that, if CDK eventually receives a dealer
authorization form for a dealer disclosed pursuant to paragraph 2.a., it will

3

issue an Authenticom-specific username and password within two business
days.
g. Authenticom may not disclose its CDK usernames and passwords to
anyone other than its employees who need to know them. Authenticom
must adopt security measures to protect all user credentials associated with
the CDK DMS. Such measures must include, but are not limited to, not
transmitting credentials by unencrypted email.
h. Once CDK issues an Authenticom-specific username and password to
Authenticom for a given dealer, Authenticom will use only that username
and password in providing data integration services for that dealer, and
CDK may disable or block any other usernames or passwords Authenticom
has used or uses for that dealer.
i.

If a dealer receiving Authenticom’s data integration services pursuant to
this order elects to discontinue those services, Authenticom must promptly
notify CDK in writing. CDK may then immediately disable the
Authenticom-specific username and password for the terminated dealer.

j.

For dealers that do not require more than one daily data refresh,
Authenticom must access the CDK DMS for bulk-data queries between the
hours of 10 p.m. and 6 a.m. (dealer local time).

k. Within five business days of entry of this order, Authenticom must identify
those dealers that require more than one daily data refresh. Authenticom
must make all reasonable efforts to minimize the number of queries
executed for those dealers during business hours.

4

3. If CDK detects either (1) a material security breach on its DMS that it believes, in
good faith, is attributable to Authenticom’s access to the DMS, or (2) the use of
Authenticom’s credentials by someone other than Authenticom, CDK may
temporarily suspend the affected Authenticom-specific username and password. In
the event of such a suspension, CDK must immediately notify Authenticom and
promptly investigate the security event. If CDK does not restore or replace the
affected usernames and passwords within 48 hours, it must explain in writing to
Authenticom why it has not done so. This section does not limit CDK’s ability to
follow its standard security protocols if it experiences a security breach.
4. CDK may continue to perform normal or routine maintenance on its systems or to
continue to implement standard security protocols (other than protocols that
prohibit automated access by Authenticom, as provided here), such as routine
prompts for password changes.
5. CDK may comply with any request by any dealer to disable Authenticom’s access
to that dealer’s data.
6. CDK may not enforce those provisions in its contracts with dealers or vendors that
restrict, or have the effect of restricting, any dealer or vendor from obtaining data
integration services from Authenticom. Such provisions include, for example, those
that would require, or have the effect of requiring, a software vendor to obtain
integration services exclusively from CDK for all of that vendor’s applications or
all of that vendor’s dealer customers.
7. CDK may not retaliate against any dealer or vendor as result of its decision to do
business with Authenticom, such as by terminating or blocking a vendor from the

5

3PA program, or by imposing financial penalties, such as invoking liquidated
damages clauses.
8. Within 10 business days of entry of this order, Authenticom must provide security
in the amount of $1 million, in a form agreed to by the parties or approved by the
court. This single $1 million bond will serve as security for both injunction orders
issued in this case.
This order will take effect immediately and will remain in place until entry of final
judgment in this matter or until the court orders otherwise.
Entered July 28, 2017.
BY THE COURT:
/s/
________________________________________
JAMES D. PETERSON
District Judge

6