(1) A domestic credit union that utilizes automated information processing services of a vendor must enter into a written contract, lease, or licensing agreement with the vendor for those services. The credit union board shall review the contract, lease, or licensing agreement to ensure the interests of the domestic credit union are protected. Approval of the contract, lease, or licensing agreement by the credit union board or its designee is required before any automated information processing services are performed or provided to the domestic credit union.

    (2) A domestic credit union that utilizes the services of a vendor under subsection (1) retains permanent and exclusive ownership of all internal information and member information in the possession of the vendor. The vendor shall not disclose any of that information to third parties except as explicitly authorized in writing by the domestic credit union; the vendor shall not use any of that information for the vendor's own purposes except as explicitly authorized in writing by the domestic credit union; and if the vendor or any subcontractor of the vendor has access to any member information, the vendor or that subcontractor are subject to regulation and examination by the director.

    (3) As used in this section:

    (a) "Automated information processing" means automated processing, updating, and storage of internal information or member information.

    (b) "Internal information" means the accounts, books, and records of a domestic credit union maintained in any form.

    (c) "Member information" means the share, deposit, loan account balances, or other information related to any member of a domestic credit union maintained in any form.

    (d) "Vendor" means a person who supplies hardware, software, or systems used for automated information processing services to a domestic credit union or performs automated information processing services for a domestic credit union. The term includes a subcontractor of a vendor.