Although potentially customized and of a different vintage for each dealer, we looked at a copy of CDK’s Master Services Agreement (the “MSA”) to see how it addresses CDKs privacy and cybersecurity obligations and liability.

Language in the MSA requires CDK to maintain reasonable security measures to prevent unauthorized access to, or loss or alteration of, dealership client data and to protect dealership client data consistent with applicable state and federal laws.

However, importantly, the MSA explicitly states that CDK does not guarantee against any unauthorized access or loss of dealership client data. As such, it is anticipated that analysis of CDK’s contractual liability will focus heavily on whether CDK maintained “reasonable security measures” to prevent cyberattacks.

Even if CDK were to be found in breach of its safeguarding obligations under the MSA, pursuing damages is further complicated by the limitations on liability provisions in the MSA. For example, the MSA provides that CDK would, regardless of the legal claim, be liable only for the lesser of either (1) the amount of actual damages incurred by the dealership or (2) an amount equal to one month’s average monthly payment to CDK averaged over the prior 12-month period.

The MSA also contains language that CDK would not be responsible, under any circumstances, for loss profits or interruption to a dealership’s business, especially those that are out of CDK’s reasonable control. While an analysis of whether the cyberattack was outside of CDK’s reasonable control requires additional factual information not yet made available, CDK has an arsenal of liability-reducing protections in the MSA.

Moreover, the MSA contains a mandatory arbitration clause with an Illinois choice of law. Whether the arbitration clause is subject to attack or is not applicable for certain claims remains to be seen. However, claims that are subject to arbitration generally cannot be pursued on a class action basis.

This article was written for Getting to Go, a buy/sell newsletter from Scali Rasmussen.