Introduction

The Personal Data Act applies to any processing of personal data that is wholly or partially automated. Toll collection is fully automated from registration at the toll plaza to billing and registration of payment, and is therefore covered by the Personal Data Act. Manual processing related to toll collection occurs only in exceptional cases.

This document explains how the toll systems collect and use your personal data. The content is based on section 1 of the Personal Data Act and articles 13 and 14 of the Personal Privacy Regulation.

Data Controller

Toll road operators and the Norwegian Public Roads Administration are joint Data Controllers for personal data held in central systems in the toll road sector. Toll road systems graphically presented (PDF). In the summer of 2018, the parties will enter into an agreement concerning distribution of this joint responsibility. The toll road operators are obliged to collect tolls and provide information to those people registered in the toll collection systems. The Norwegian Public Roads Administration shall enter into agreements with suppliers of central toll collection systems, provide overall information about the processing of personal data in these systems and notify the Norwegian Data Protection Authority of any discrepancies in the central toll collection systems.

The Norwegian Public Roads Administration and each toll road operator will publish a privacy policy with information specific to their company.

Purpose

The purpose of processing personal data is to collect toll payments in accordance with the decision of the Storting.

Legal basis

This is based on section 1 of the Personal Data Act, article 6 1. e) of the Personal Privacy Regulation and the new paragraph in section 27 (5) of the Public Roads Act. This legal basis applies to both the Norwegian Public Roads Administration (fifth paragraph, second point) and toll road operators (fifth paragraph, first point).

In those cases where toll road operators also issue electronic toll payment tags, this element of their activities has a legal basis for the processing of personal data on the basis of agreements (AutoPASS agreement) entered into with the individual customer, cf. section 1 of the Personal Data Act and article 6 1. b) of the Personal Privacy Regulation.

Categories of Personal Data

In total, 24 categories of personal data are processed (information about an identifiable natural person) by the toll collection systems. For each person, we only process data in those categories in which we hold information and which are necessary.

  1. Name (First name/Given name, Middle name, Surname/Family name)
  2. Address
  3. Post / zip code
  4. Town
  5. Personal identification number / date of birth
  6. Telephone number
  7. Email address
  8. Licence plate / country (vehicle)
  9. Photo / film
  10. Vehicle description (colour, size, model, environmental ratings etc.)
  11. Time and location of transit
  12. Parking permits for people with reduced mobility*
  13. Other reasons for discounts and exemptions
  14. Role (in the organisation)
  15. Notes in relation to users’ contact with the toll road operator (free text field)
  16. Employer and workplace
  17. Account information
  18. Reason code for decision to stop seeking payment
  19. Billing details (transits, sum, due date, etc.)
  20. Payment rules (direct debit, paper invoice, in advance, etc.)
  21. Invoice and payment history (accounting history)
  22. Tag number (PAN)
  23. Customer number / Agreement number
  24. Request ID for each search in MyPage

* = sensitive personal data

The Norwegian Public Roads Administration’s website for toll roads at www.autopass.no provides details of the Norwegian toll road system. The website includes links to log in to MyPage and to the form to create an AutoPASS contract. The website uses cookies and works the same way that other websites do. Further information about privacy when using the website www.autopass.no.

Process of Personal Data

The toll collection systems process all transits through toll plazas regardless of whether a toll tag is used. The toll collection systems are used to automatically identify vehicles that transit through the toll plaza, to establish the price, discounts and exemptions from payment applicable to the individual vehicle transiting through, and to collect the tolls due. The toll collection systems also process AutoPASS contracts between the registered individual and the toll road operator.

Each toll road operator processes the personal data of those individuals who drive through the company’s toll plazas and of those individuals who have an AutoPASS contract with the company. The Norwegian Public Roads Administration processes personal data on behalf of all toll road operators when necessary in order to test and maintain central toll collection systems. The Norwegian Public Roads Administration and toll road operators enter into data processing agreements with any of their suppliers who process personal data in the toll collection systems.

Personal data collected is stored for as long as the data controller requires them in order to collect tolls and process complains, maintain the IT system and prepare aggregated statistics concerning tolls (statistics without personal data). Personal data that is subject to section 13 of the Bookkeeping Act will be retained in accordance with the law. During the course of 2018, extraordinary deletion of historic data that is no longer required will be carried out.

Where personal data is obtained

Most data processed by the toll road operators are personal data that are not obtained directly from the registered individual. This applies to data that is registered when a vehicle transits through a toll plaza. Data is also generated when transit details are compiled together with details about the vehicle, from the Central Register of Motor Vehicles, AutoPASS contracts or foreign electronic toll payment tags, and the environmental register for fuels and emissions classifications.

Those individuals who enter into AutoPASS contracts provide details of their vehicle and addresses. Furthermore, registered individuals provide details whenever they contact toll road operators.

Who receives personal data

Individuals who have entered into AutoPASS contracts may see toll transits charged under the contract. This is necessary in order to check the invoice. In some cases, it is therefore not the individual who transited through a toll plaza who receives details of the time and location of said transit. For example, this applies if a car is hired or borrowed, belongs to an employer or car club, if it is a joint AutoPASS contract for several cars in the family, or the previous owner has not terminated their contract prior to selling the car. The vehicle may be covered by an AutoPASS contract even if the electronic toll payment tag is not fixed to the windscreen. You can ask one of the toll road operators if there is a contract in place for the vehicle you are using.

The toll road operators and the Norwegian Public Roads Administration use foreign suppliers for some of this work. Collection of tolls from foreign-registered vehicles without electronic toll payment tags is carried out by Euro Parking Collection (EPC), who are based in the UK. EPC processes personal data in the country where the vehicle that was driven in Norway is registered. The toll road operators use foreign suppliers both within and outside the EEA for the manual identification of registration numbers if the images from the toll plaza cannot be interpreted automatically.

Lists of valid electronic toll payment tags connected to registration numbers are sent to ferry and bridge companies outside of Norway that accept payment using AutoPASS tags. This applies to the Øresund Bridge, the Great Belt Bridge and the following Scandlines ferry routes: Helsingborg-Helsingør, Rødby-Puttgarden and Gedser-Rostock.

Transits through toll plazas in Norway that are to be paid for using electronic toll payment tags from foreign tag issuers are sent to these issuers. This applies to Brobizz AS and Øresundsbro Konsortiet (Denmark).

Lists of valid electronic toll payment tags connected to registration numbers for vehicles in tariff group 2 (vehicles over 3,500 kg) and only tag numbers for tariff group 1 are sent on a daily basis to Norwegian Customs, the police and the inspection unit at the Norwegian Public Roads Administration, which carries out checks relating to the regulations pertaining to mandatory heavy vehicle tags.

Personal data beyond the above may only be disclosed where there is a legal basis to do so. This applies to disclosures to the police effective 20 July 2018.

Automated decisions

It is automatically determined which tariff is to be charged when a vehicle transits through a toll plaza. This decision is taken on the basis of a list of applicable tariffs and rules for determining the weight class and emission class of vehicles with and without AutoPASS contracts. These tariffs are published at www.autopass.no and on the websites of the toll road operators.

All transits through toll plazas are divided into two weight classes. These are vehicles up to 3,500 kg (tariff group 1) and vehicles over 3,500 kg (tariff group 2). For vehicles with contracts, the weight class is registered in the agreement, while for vehicles without AutoPASS contracts the weight class is obtained from the relevant national vehicle registry. For vehicles with contracts, all vehicles in vehicle category M1 are registered in tariff group 1 regardless of weight.

In toll areas with environmentally differentiated tariffs, the correct tariff is charged if the toll road operator is aware of the vehicle’s fuel type / emission class. This information is known for Norwegian-registered vehicles with and without AutoPASS contracts because it is obtained automatically from the national vehicle registry. The toll collection system does not have equivalent automated access to foreign vehicle registries. Foreign-registered vehicles with and without AutoPASS contracts may register and upload documentation pertaining to fuel/emission class at www.autopass.no/ed. If the toll collection systems do not have environmental ratings registered, they will charge the highest tariff for the vehicle’s weight class.

This is automatically determined based on which discount should be deducted from the toll for transit. Only vehicles with AutoPASS contracts receive a discount. The criteria for receiving a discount and the size of the discount are established by individual toll road projects. For example, the system will compare each transit with previous transits by the same electronic toll payment tag to grant a 100% discount after a maximum number of paid transits per month (monthly cap) and/or because the vehicle should only be charged for one transit per hour (hourly rule).

It will be determined automatically whether the transit is subject to exemption from payment. This decision is taken on the basis of the vehicle’s AutoPASS contract. Any individual who believes they are entitled to an exemption from payment may apply to the toll road operator for such an exemption. A list of groups entitled to exemptions from payment is available here and on the websites of the toll road operators.

Basically, you are anonymous when visiting our website. When visiting, only your computer's domain name (IP address) is registered. We do not record your email address.

This information is used for statistical measurement and analysis to improve the website. Apart from IP addresses, no further information containing identifiable personal data is collected. For example, information is collected about which browser and version you are using, in addition to your IP address. This is done using a script and cookie from the Google Analytics tool.

The following information is stored for each page you visit:

  • Which page you are visiting
  • Date and time
  • Which browser you are using
  • Your IP address

The Norwegian Public Roads Administration has chosen to add script that removes the last few digits from your IP address before the information is stored by Google Analytics. This means that the analysis tool can estimate the user's geographical location, but the address cannot be used to identify the individual. The information received is subject to Google's privacy policy. 

Cookies

Cookies are small text files placed on your computer when you download a website, such as autopass.no.

There are two types of cookies. The first type are ‘persistent cookies’, which are stored on the visitor’s PC for a longer period of time. The second type are ‘session cookies’, which are deleted when you leave our website or close your browser.

The following cookies are used on autopass.no

Persistent cookies

We use a cookie to count the number of unique users on autopass.no. This tells us if autopass.no has a small number of regular visitors, or a large number of infrequent visitors.

When you fill in a form to send us information, a FormCookie is stored on your computer. Such forms are used on pages where you can provide us with feedback about ‘Did you find what you were looking for?’. This cookie is stored on your computer so that we can control whether you are able to send the notification once or several times. 

Session cookies 

Cookies when using contact forms: If you send us a notification about the processing of your personal data by using an electronic contact form, a cookie will be stored on your computer. This is necessary for the form to function. 

ID-porten 

ID-porten uses cookies to manage the login session, and for load balancing the system so that all users can be assured of the best possible experience. These cookies will be deleted automatically when you close your browser.

The Agency for Public Management and eGovernment (Difi) is the data controller for personal data that is processed with a common login to public services. DiFi is also responsible for processing information that is used to administer MinID.

The suppliers of the electronic IDs (BankID, Buypass and Commfides) are the data controllers for personal data that is necessary for administering their log-in solutions.

More information about ID-porten can be found here: http://eid.difi.no/en/security-and-privacy  

Google Analytics 

Google Analytics uses cookies to analyse how users use the site. The information generated by such a cookie by the use of that website, including your IP address, will be sent to Google and stored on servers in the United States.

MyPage uses anonymizeIP, a function that removes the last few digits from your IP address before the information is stored by Google Analytics. This means that the analysis tool can estimate the user's geographical location, but the address cannot be used to identify the individual. The information received is subject to Google's privacy policy, https://www.google.com/intl/no/policies/privacy/