Introduction

Toll collection is fully automated from registration at the toll plaza to billing and registration of payment. Manual processing related to toll collection occurs only in exceptional cases.

This document explains how the toll systems collect and use your personal data.

Data Controller

Toll road operators and the Norwegian Public Roads Administration are so-called joint Data Controllers for personal data held in central systems in the toll road sector. Toll road systems graphically presented (PDF). The parties have entered into an agreement concerning the handling of this joint responsibility. Assignments are mainly shared as follows: The toll road operators are obliged to collect tolls and provide information to those people registered in the toll collection systems. The Norwegian Public Roads Administration shall enter into agreements with suppliers of central toll collection systems, provide overall information about the processing of personal data in these systems and notify the Norwegian Data Protection Authority of any discrepancies in the central toll collection systems.

The Norwegian Public Roads Administration and each toll road operator will publish a privacy policy with information specific to their company.

Purpose

The purpose of processing personal data is to collect toll payments in accordance with the decision of the Parliament, including the administration of the toll systems. 

Legal basis

This is based on article 6 1. e) of the Personal Privacy Regulation and the fifth paragraph in section 27 of the Public Roads Act.

In those cases where toll road operators also issue electronic toll payment tags, this element of their activities has a legal basis for the processing of personal data on the basis of agreements (AutoPASS agreement) entered into with the individual customer, cf. article 6 1. b) of the Personal Privacy Regulation.

Categories of Personal Data

In total, 23 categories of personal data are processed by the toll collection systems. For each person, we only process data in those categories in which we hold information and which are necessary.

  1. Name (First name/Given name, Middle name, Surname/Family name)
  2. Address information (street address/PO box, postcode, city)
  3. Contact information (telephone, e-mail address)
  4. ID number (Birthday/ birthnumber (D-number))
  5. Customer number / Agreement number
  6. Customer’s role (in the organisation)
  7. Employer and workplace
  8. Tag number (PAN)
  9. License plate number/ Country vehicle is registered in 
  10. Description of vehicle (price class, weight, length, make/model, fuel type, emission class, vehicle classification, chargeable yes/no) 
  11. Photo / video (of license plate number)
  12. Time and location of transit
  13. Parking permits for people with reduced mobility (sensitive personal information) 
  14. Reason for discount and exemption (in addition to category 13) 
  15. Notes and received documentation in relation to users’ contact with the toll road operator (free text field)
  16. Bank account number 
  17. Invoice information (transit information, amount, due date, address information, etc.)
  18. Payment rules (direct debit, paper invoice, in advance, etc.)
  19. Invoice and payment history (accounting history)
  20. Reason code for decision to stop seeking payment
  21. Registration code (codes from toll stations for passages)
  22. Status code (for customer, vehicle and contract)
  23. Min Side Request ID for each search, previous log in date, password for users without ID-port. 

According category 4 (ID-number) only birthday will be processed. Birthnumber/d-number will only be processed if sent in by customer.

Process of Personal Data

The toll collection systems process all transits through toll plazas regardless of whether a toll tag is used. The toll collection systems are used to automatically identify vehicles that transit through the toll plaza, to establish the rate, discounts and exemptions from payment applicable to the individual vehicle transiting through, and to collect the tolls due. The toll collection systems also process AutoPASS contracts between the registered individual and the toll road operator.

Each toll road operator processes the personal data of those individuals who passing through the company’s toll plazas and of those individuals who have an AutoPASS contract with the company. The Norwegian Public Roads Administration processes personal data on behalf of all toll road operators in order to test and to make sure that the central toll collection systems work as they should. The Norwegian Public Roads Administration and toll road operators enter into data processing agreements with their respective subcontractors, who process personal data in the toll collection systems.

Personal data collected is stored for as long as the data controller requires them in order to collect tolls and process complains, maintain the IT system and compile aggregate statistics for tolls, and to meet the duty of retention under the Accounting law. Personal data that is subject to accounting is stored for five years in accordance with section 13 of the Accounting law. During the course of 2019, extraordinary deletion of historic data that is no longer required will be carried out.

Where personal data is obtained

Most data processed by the toll road operators are personal data that are not obtained directly from the registered individual. This applies to data that is registered when a vehicle transits through a toll plaza. Data is also generated when transit details are compiled together with details about the vehicle, from the Central Register of Motor Vehicles, AutoPASS contracts or foreign electronic toll payment tags, and the environmental register for fuels and emissions classifications.

Those individuals who enter into AutoPASS contracts provide details of the customer and their vehicle. Furthermore, registered individuals provide details whenever they contact toll road operators.

Who receives personal data

Individuals who have entered into AutoPASS contracts may see toll transits charged under the contract at My page or by contacting the toll road operator. In some cases, it is therefore not the individual who transited through the toll plaza who receives details of the time and location of said transit. For example, this applies if a car is hired or borrowed, belongs to an employer or car club, if it is a joint AutoPASS contract for several cars in the family, or the previous owner has not terminated their contract prior to selling the car. The vehicle may be covered by an AutoPASS contract even if the electronic toll payment tag is not fixed to the windscreen. You can ask one of the toll road operators if there is a contract in place for the vehicle you are using.

The toll road operators and the Norwegian Public Roads Administration use foreign suppliers for some of this work. Collection of tolls from foreign-registered vehicles without electronic toll payment tags is carried out by Euro Parking Collection (EPC), who are based in the UK. EPC processes personal data in the country where the vehicle that was driven in Norway is registered. The toll road operators use foreign suppliers both within and outside the EEA for the manual identification of registration numbers if the images from the toll plaza cannot be interpreted automatically.

Lists of valid electronic toll payment tags connected to registration numbers are sent to ferry and bridge companies outside of Norway that accept payment using AutoPASS tags. This applies to the Øresund Bridge, the Great Belt Bridge and the following Scandlines ferry routes: Helsingborg-Helsingør, Rødby-Puttgarden and Gedser-Rostock.

Transits through toll plazas in Norway that are to be paid for using electronic toll payment tags from foreign tag issuers are sent to these issuers. This applies to Brobizz AS and Øresundsbro Konsortiet (Denmark).

Lists of valid electronic toll payment tags connected to registration numbers for vehicles in tariff group 2 (vehicles over 3,500 kg) and only tag numbers for tariff group 1 are sent on a daily basis to Norwegian Customs, the police and the inspection unit at the Norwegian Public Roads Administration, which carries out checks relating to the regulations pertaining to mandatory heavy vehicle tags.

Personal data other than the above can only be disclosed if there is a legal basis, for example extradition to the police in accordance with the criminal procedure law.

Automated decisions

It is automatically determined which tariff is to be charged when a vehicle transits through a toll plaza. This decision is taken on the basis of a list of applicable tariffs and rules for determining the weight class and emission class of vehicles with and without AutoPASS contracts. The toll tariffs are published on the toll companies' website.

All transits through toll plazas are divided into two weight classes. These are vehicles up to 3,500 kg (tariff group 1) and vehicles over 3,500 kg (tariff group 2). For vehicles with contracts, the weight class is registered in the agreement, while for vehicles without AutoPASS contracts the weight class is obtained from the relevant national vehicle registry. For vehicles with contracts, all vehicles in vehicle category M1 are registered in tariff group 1 regardless of weight.

In toll plazas with environmentally differentiated tariffs, the correct tariff is charged if the toll road operator is aware of the vehicle’s fuel type / emission class. This information is known for Norwegian-registered vehicles with and without AutoPASS contracts because it is obtained automatically from the national vehicle registry. The toll collection system does not have equivalent automated access to foreign vehicle registries. Foreign-registered vehicles with and without AutoPASS contracts may register and upload documentation pertaining to fuel/emission class at www.autopass.no/ed. If the toll collection systems do not have environmental ratings registered, they will charge the highest tariff for the vehicle’s weight class.

This is automatically determined based on which discount should be deducted from the toll for transit. Only vehicles with AutoPASS contracts receive a discount. The criteria for receiving a discount and the size of the discount are established by individual toll road projects. For example, the system will compare each transit with previous transits by the same electronic toll payment tag to grant a 100% discount after a maximum number of paid transits per month (monthly cap) and/or because the vehicle should only be charged for one transit per hour (hourly rule).

It will be determined automatically whether the transit is subject to exemption from payment. This decision is taken on the basis of the vehicle’s AutoPASS contract. Any individual who believes they are entitled to an exemption from payment may apply to the toll road operator for such an exemption. A list of groups entitled to exemptions from payment is available here and on the websites of the toll road operators.

The Norwegian Roads Administration's website for tolls, autopass.no, provides information on the Norwegian toll system. The pages have a link to log in to My Page and a link to form to create an AutoPASS appointment.

Web analysis

When visiting the AutoPASS website (www.autopass.no and minside.autopass.no) we use a tool, Google Analytics, to analyse your use of the website. The purpose is to develop statistics that we use to improve and develop our information service. Examples of what the statistics tell us include how many people who visit different pages – and at what times, how long visits last, and which browsers that are used.

The information that is processed is anonymous. This means that we cannot trace the information we collect back to individual users. We see the whole IP address, but we anonymise it using anonymizeIP, which is a feature that removes the last digits from your IP address before it is saved by Google Analytics. This means that the analysis tool can estimate the user's geographical location, but the IP address cannot be used to identify the individual. The information received is subject to Google's privacy policy, see https://www.google.com/intl/no/policies/privacy/.

The processing basis for this is the General Data Protection Regulations article 6 no. 1 f), which permits us to process data that is necessary to pursue a legitimate interest that is more important than considerations to the individual’s privacy. The legitimate interest is to ensure the quality of our services.

Cookies

Cookies are small text files placed on your computer when you download a website. We use cookies on the AutoPASS website to enable various services to work, and to provide the best possible user experience.

There are two types of cookies. One type is session cookies. These are cookies that are deleted when you leave our website or close your browser. The other type is persistent cookies that are stored on your computer for an extended period.

Session cookies

Session cookies are used on the AutoPASS website in connection with Google Analytics. The scope and purpose of these are explained above, in the “Web analysis” section».

In addition, if you use AutoPASS Min Side, cookies about you are processed to manage log-in sessions. Cookies are also used for load balancing of the system so that all users are ensured the best possible experience.

Persistent cookies

We use persistent cookies on the AutoPASS website to count the number of unique users. This tells us if we have a small number of regular visitors or a large number of infrequent visitors. A cookie is also used to store which language the user has chosen. This is done to so you avoid making the choice each time you visit the site.

The processing basis for this is the General Data Protection Regulations article 6 no. 1 f), which permits us to process data that is necessary to pursue a legitimate interest that is more important than considerations to the individual’s privacy. The legitimate interest is to enable services on the website to work.

Read more about how you manage cookies (nettvett.no)

Min Side/ID-porten

Users who use AutoPASS and the Norwegian Public Roads Administration’s service Min Side will ordinarily log on using ID-porten. This is a common national login solution for public services.

The Agency for Public Management and eGovernment (Difi) is the data controller for personal data that is processed in ID-porten. DiFi is also responsible for processing information that is used to administer MinID.

The suppliers of the electronic IDs (BankID, Buypass and Commfides) are the data controllers for personal data that is necessary for administering their log-in solutions.

You can find more information on ID-porten here: http://eid.difi.no/nb/sikkerhet-og-informasjonskapsler

You can find more information on Min Side here: www.autopass.no/en/guide-to-mypage