The Personal Data Act applies to any processing of personal data that is wholly or partially automated. Toll collection is fully automated from registration at the toll plaza to billing and registration of payment, and is therefore covered by the Personal Data Act. Manual processing related to toll collection occurs only in exceptional cases.
This document explains how the toll systems collect and use your personal data. The content is based on section 1 of the Personal Data Act and articles 13 and 14 of the Personal Privacy Regulation.
Toll road operators and the Norwegian Public Roads Administration are joint Data Controllers for personal data held in central systems in the toll road sector. Toll road systems graphically presented (PDF). In the summer of 2018, the parties will enter into an agreement concerning distribution of this joint responsibility. The toll road operators are obliged to collect tolls and provide information to those people registered in the toll collection systems. The Norwegian Public Roads Administration shall enter into agreements with suppliers of central toll collection systems, provide overall information about the processing of personal data in these systems and notify the Norwegian Data Protection Authority of any discrepancies in the central toll collection systems.
The purpose of processing personal data is to collect toll payments in accordance with the decision of the Storting.
This is based on section 1 of the Personal Data Act, article 6 1. e) of the Personal Privacy Regulation and the new paragraph in section 27 (5) of the Public Roads Act. This legal basis applies to both the Norwegian Public Roads Administration (fifth paragraph, second point) and toll road operators (fifth paragraph, first point).
In those cases where toll road operators also issue electronic toll payment tags, this element of their activities has a legal basis for the processing of personal data on the basis of agreements (AutoPASS agreement) entered into with the individual customer, cf. section 1 of the Personal Data Act and article 6 1. b) of the Personal Privacy Regulation.
Categories of Personal Data
In total, 24 categories of personal data are processed (information about an identifiable natural person) by the toll collection systems. For each person, we only process data in those categories in which we hold information and which are necessary.
- Name (First name/Given name, Middle name, Surname/Family name)
- Post / zip code
- Personal identification number / date of birth
- Telephone number
- Email address
- Licence plate / country (vehicle)
- Photo / film
- Vehicle description (colour, size, model, environmental ratings etc.)
- Time and location of transit
- Parking permits for people with reduced mobility*
- Other reasons for discounts and exemptions
- Role (in the organisation)
- Notes in relation to users’ contact with the toll road operator (free text field)
- Employer and workplace
- Account information
- Reason code for decision to stop seeking payment
- Billing details (transits, sum, due date, etc.)
- Payment rules (direct debit, paper invoice, in advance, etc.)
- Invoice and payment history (accounting history)
- Tag number (PAN)
- Customer number / Agreement number
- Request ID for each search in MyPage
* = sensitive personal data
Process of Personal Data
The toll collection systems process all transits through toll plazas regardless of whether a toll tag is used. The toll collection systems are used to automatically identify vehicles that transit through the toll plaza, to establish the price, discounts and exemptions from payment applicable to the individual vehicle transiting through, and to collect the tolls due. The toll collection systems also process AutoPASS contracts between the registered individual and the toll road operator.
Each toll road operator processes the personal data of those individuals who drive through the company’s toll plazas and of those individuals who have an AutoPASS contract with the company. The Norwegian Public Roads Administration processes personal data on behalf of all toll road operators when necessary in order to test and maintain central toll collection systems. The Norwegian Public Roads Administration and toll road operators enter into data processing agreements with any of their suppliers who process personal data in the toll collection systems.
Personal data collected is stored for as long as the data controller requires them in order to collect tolls and process complains, maintain the IT system and prepare aggregated statistics concerning tolls (statistics without personal data). Personal data that is subject to section 13 of the Bookkeeping Act will be retained in accordance with the law. During the course of 2018, extraordinary deletion of historic data that is no longer required will be carried out.
Where personal data is obtained
Most data processed by the toll road operators are personal data that are not obtained directly from the registered individual. This applies to data that is registered when a vehicle transits through a toll plaza. Data is also generated when transit details are compiled together with details about the vehicle, from the Central Register of Motor Vehicles, AutoPASS contracts or foreign electronic toll payment tags, and the environmental register for fuels and emissions classifications.
Those individuals who enter into AutoPASS contracts provide details of their vehicle and addresses. Furthermore, registered individuals provide details whenever they contact toll road operators.
Who receives personal data
Individuals who have entered into AutoPASS contracts may see toll transits charged under the contract. This is necessary in order to check the invoice. In some cases, it is therefore not the individual who transited through a toll plaza who receives details of the time and location of said transit. For example, this applies if a car is hired or borrowed, belongs to an employer or car club, if it is a joint AutoPASS contract for several cars in the family, or the previous owner has not terminated their contract prior to selling the car. The vehicle may be covered by an AutoPASS contract even if the electronic toll payment tag is not fixed to the windscreen. You can ask one of the toll road operators if there is a contract in place for the vehicle you are using.
The toll road operators and the Norwegian Public Roads Administration use foreign suppliers for some of this work. Collection of tolls from foreign-registered vehicles without electronic toll payment tags is carried out by Euro Parking Collection (EPC), who are based in the UK. EPC processes personal data in the country where the vehicle that was driven in Norway is registered. The toll road operators use foreign suppliers both within and outside the EEA for the manual identification of registration numbers if the images from the toll plaza cannot be interpreted automatically.
Lists of valid electronic toll payment tags connected to registration numbers are sent to ferry and bridge companies outside of Norway that accept payment using AutoPASS tags. This applies to the Øresund Bridge, the Great Belt Bridge and the following Scandlines ferry routes: Helsingborg-Helsingør, Rødby-Puttgarden and Gedser-Rostock.
Transits through toll plazas in Norway that are to be paid for using electronic toll payment tags from foreign tag issuers are sent to these issuers. This applies to Brobizz AS and Øresundsbro Konsortiet (Denmark).
Lists of valid electronic toll payment tags connected to registration numbers for vehicles in tariff group 2 (vehicles over 3,500 kg) and only tag numbers for tariff group 1 are sent on a daily basis to Norwegian Customs, the police and the inspection unit at the Norwegian Public Roads Administration, which carries out checks relating to the regulations pertaining to mandatory heavy vehicle tags.
Personal data beyond the above may only be disclosed where there is a legal basis to do so. This applies to disclosures to the police effective 20 July 2018.
It is automatically determined which tariff is to be charged when a vehicle transits through a toll plaza. This decision is taken on the basis of a list of applicable tariffs and rules for determining the weight class and emission class of vehicles with and without AutoPASS contracts. These tariffs are published at www.autopass.no and on the websites of the toll road operators.
All transits through toll plazas are divided into two weight classes. These are vehicles up to 3,500 kg (tariff group 1) and vehicles over 3,500 kg (tariff group 2). For vehicles with contracts, the weight class is registered in the agreement, while for vehicles without AutoPASS contracts the weight class is obtained from the relevant national vehicle registry. For vehicles with contracts, all vehicles in vehicle category M1 are registered in tariff group 1 regardless of weight.
In toll areas with environmentally differentiated tariffs, the correct tariff is charged if the toll road operator is aware of the vehicle’s fuel type / emission class. This information is known for Norwegian-registered vehicles with and without AutoPASS contracts because it is obtained automatically from the national vehicle registry. The toll collection system does not have equivalent automated access to foreign vehicle registries. Foreign-registered vehicles with and without AutoPASS contracts may register and upload documentation pertaining to fuel/emission class at www.autopass.no/ed. If the toll collection systems do not have environmental ratings registered, they will charge the highest tariff for the vehicle’s weight class.
This is automatically determined based on which discount should be deducted from the toll for transit. Only vehicles with AutoPASS contracts receive a discount. The criteria for receiving a discount and the size of the discount are established by individual toll road projects. For example, the system will compare each transit with previous transits by the same electronic toll payment tag to grant a 100% discount after a maximum number of paid transits per month (monthly cap) and/or because the vehicle should only be charged for one transit per hour (hourly rule).
It will be determined automatically whether the transit is subject to exemption from payment. This decision is taken on the basis of the vehicle’s AutoPASS contract. Any individual who believes they are entitled to an exemption from payment may apply to the toll road operator for such an exemption. A list of groups entitled to exemptions from payment is available here and on the websites of the toll road operators.