Authenticom, Inc. v. CDK Global, LLC et al

Filing 198

Transmission of Notice of Appeal, Docketing Statement, Preliminary Injunction and Docket Sheet to Seventh Circuit Court of Appeals re: 194 Notice of Appeal, (Attachments: # 1 Docketing Statement, # 2 Preliminary Injunction, # 3 Docket Sheet) (lak)

Download PDF
IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WISCONSIN AUTHENTICOM, INC., Plaintiff, v. CDK GLOBAL, LLC and THE REYNOLDS AND REYNOLDS COMPANY, ORDER FOR PRELIMINARY INJUNCTION AGAINST CDK GLOBAL, LLC 17-cv-318-jdp Defendants. Based on the parties’ written submissions, documentary evidence, and the evidence presented at an evidentiary hearing, the court concluded that Authenticom is entitled to a preliminary injunction. Dkt. 172. As explained more fully in the court’s July 14, 2017 opinion and order, (1) Authenticom has made the requisite showing of likelihood of success on the merits of its antitrust claims; (2) Authenticom will suffer irreparable harm if the court did not grant preliminary relief; (3) the balance of hardships tips in Authenticom’s favor; and (4) the public interest is not disserved by the entry of a preliminary injunction. Accordingly, defendant CDK Global, LLC, is preliminarily enjoined as provided in this order. Those enjoined include defendant CDK Global, LLC, and its officers, employees, agents, attorneys, and all those acting in active concert or participation with them, which the court will refer to collectively as CDK. CDK is preliminarily enjoined as follows: 1. CDK must not prevent Authenticom from using dealer login credentials to provide data integration services for dealers who, as of May 1, 2017, had authorized Authenticom to provide data integration services, subject to the following conditions: a. Authenticom may access only the parts of the CDK DMS that an authorizing dealer itself is authorized to access. b. Authenticom may access and extract only the data fields that the dealer authorizes Authenticom to access and that are reasonably necessary for Authenticom to provide the data integration services that the dealer requests. Authenticom must destroy any other information that it incidentally extracts during any screen-scraping process. c. Authenticom’s access to the CDK DMS is generally limited to read-only data exporting. Notwithstanding this general limitation, Authenticom may use “write-back” functionality to provide data-cleansing services for those dealers for whom it was providing data-cleansing as of May 1, 2017. d. This order does not prevent CDK from blocking Authenticom’s access to the CDK DMS that exceeds the access authorized in this order. 2. This order will be implemented through the following procedure: a. Within five business days of entry of this order, Authenticom will provide to CDK a list of dealers (with sufficient information to uniquely identify each dealer) for whom Authenticom was providing data integration services using dealer-provided login credentials as of May 1, 2017, along with all usernames and passwords Authenticom uses at each dealer. b. Within two business days of receipt of that list, CDK will cease blocking or disabling the identified dealer login credentials for 45 days. During the 45day period, Authenticom will be able to access dealer data on CDK’s DMS as provided in paragraph 1 of this order. 2 c. During that 45-day period, Authenticom will request that each CDK dealer that intends to use Authenticom for data integration services during the pendency of this preliminary injunction sign a dealer authorization form. The dealer authorization form will authorize CDK to issue a single username and password to Authenticom, created specifically for Authenticom to provide data integration services for that dealer. d. The dealer authorization form must: be signed by an individual authorized to bind the dealer and to authorize the release of dealer data; identify the specific data fields and accounts within the DMS that the dealer authorizes Authenticom to access; agree that the Authenticom-specific username and password will not be used by or shared with any person or entity other than Authenticom; and acknowledge that the dealer will not attempt to hold CDK responsible for misuse of the Authenticom-specific credentials or the data acquired with it. e. Within two business days of receipt of a dealer authorization form, CDK will issue an Authenticom-specific username and password to Authenticom for its use in providing data integration services for that dealer in accordance with this order. f. CDK may disable or block any username or password identified pursuant to paragraph 2.a. if it does not receive a dealer authorization form within the 45-day period. After that, if CDK eventually receives a dealer authorization form for a dealer disclosed pursuant to paragraph 2.a., it will 3 issue an Authenticom-specific username and password within two business days. g. Authenticom may not disclose its CDK usernames and passwords to anyone other than its employees who need to know them. Authenticom must adopt security measures to protect all user credentials associated with the CDK DMS. Such measures must include, but are not limited to, not transmitting credentials by unencrypted email. h. Once CDK issues an Authenticom-specific username and password to Authenticom for a given dealer, Authenticom will use only that username and password in providing data integration services for that dealer, and CDK may disable or block any other usernames or passwords Authenticom has used or uses for that dealer. i. If a dealer receiving Authenticom’s data integration services pursuant to this order elects to discontinue those services, Authenticom must promptly notify CDK in writing. CDK may then immediately disable the Authenticom-specific username and password for the terminated dealer. j. For dealers that do not require more than one daily data refresh, Authenticom must access the CDK DMS for bulk-data queries between the hours of 10 p.m. and 6 a.m. (dealer local time). k. Within five business days of entry of this order, Authenticom must identify those dealers that require more than one daily data refresh. Authenticom must make all reasonable efforts to minimize the number of queries executed for those dealers during business hours. 4 3. If CDK detects either (1) a material security breach on its DMS that it believes, in good faith, is attributable to Authenticom’s access to the DMS, or (2) the use of Authenticom’s credentials by someone other than Authenticom, CDK may temporarily suspend the affected Authenticom-specific username and password. In the event of such a suspension, CDK must immediately notify Authenticom and promptly investigate the security event. If CDK does not restore or replace the affected usernames and passwords within 48 hours, it must explain in writing to Authenticom why it has not done so. This section does not limit CDK’s ability to follow its standard security protocols if it experiences a security breach. 4. CDK may continue to perform normal or routine maintenance on its systems or to continue to implement standard security protocols (other than protocols that prohibit automated access by Authenticom, as provided here), such as routine prompts for password changes. 5. CDK may comply with any request by any dealer to disable Authenticom’s access to that dealer’s data. 6. CDK may not enforce those provisions in its contracts with dealers or vendors that restrict, or have the effect of restricting, any dealer or vendor from obtaining data integration services from Authenticom. Such provisions include, for example, those that would require, or have the effect of requiring, a software vendor to obtain integration services exclusively from CDK for all of that vendor’s applications or all of that vendor’s dealer customers. 7. CDK may not retaliate against any dealer or vendor as result of its decision to do business with Authenticom, such as by terminating or blocking a vendor from the 5 3PA program, or by imposing financial penalties, such as invoking liquidated damages clauses. 8. Within 10 business days of entry of this order, Authenticom must provide security in the amount of $1 million, in a form agreed to by the parties or approved by the court. This single $1 million bond will serve as security for both injunction orders issued in this case. This order will take effect immediately and will remain in place until entry of final judgment in this matter or until the court orders otherwise. Entered July 28, 2017. BY THE COURT: /s/ ________________________________________ JAMES D. PETERSON District Judge 6

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?