Processing of personal data in toll systems
Toll collection is fully automated from registration at the toll plaza to billing and registration of payment. Manual processing related to toll collection occurs only in exceptional cases.
This document explains how the toll systems collect and use your personal data.
Toll road operators (RBPS) and the Norwegian Public Roads Administration are so-called joint Data Controllers for personal data held in central systems in the toll road sector. Toll road systems graphically presented (PDF). The parties have entered into an agreement concerning the handling of this joint responsibility. Assignments are mainly shared as follows: The toll road operators are obliged to collect tolls and provide information to those people registered in the toll collection systems. The Norwegian Public Roads Administration shall enter into agreements with suppliers of central toll collection systems, provide overall information about the processing of personal data in these systems and notify the Norwegian Data Protection Authority of any discrepancies in the central toll collection systems. From 01.05.2021, personal data is also processed in new system solutions. See new toll road systems graphically presented (PDF).
The purpose of processing personal data is to collect toll payments in accordance with the decision of the Parliament, including the administration of the toll systems.
This is based on article 6 1. e) of the Personal Privacy Regulation and the fifth paragraph in section 27 of the Public Roads Act.
In those cases where toll road operators also issue electronic toll payment tags, this element of their activities has a legal basis for the processing of personal data on the basis of agreements (AutoPASS agreement) entered into with the individual customer, cf. article 6 1. b) of the Personal Privacy Regulation.
Categories of Personal Data
In total, 23 categories of personal data are processed by the toll collection systems. For each person, we only process data in those categories in which we hold information and which are necessary.
Name (First name/Given name, Middle name, Surname/Family name)
Address information (street address/PO box, postcode, city)
Contact information (telephone, e-mail address)
ID number (Birthday/ birthnumber (D-number))
Customer number / Agreement number
Customer’s role (in the organisation)
Employer and workplace
Tag number (PAN)
License plate number/ Country vehicle is registered in
Description of vehicle (price class, weight, length, make/model, fuel type, emission class, vehicle classification, chargeable yes/no)
Photo / video (of license plate number)
Time and location of transit
Parking permits for people with reduced mobility (sensitive personal information)
Reason for discount and exemption (in addition to category 13)
Notes and received documentation in relation to users’ contact with the toll road operator (free text field)
Bank account number
Invoice information (transit information, amount, due date, address information, etc.)
Payment rules (direct debit, paper invoice, in advance, etc.)
Invoice and payment history (accounting history)
Reason code for decision to stop seeking payment
Registration code (codes from toll stations for passages)
Status code (for customer, vehicle and contract)
Min Side Request ID for each search, previous log in date, password for users without ID-port.
According category 4 (ID-number) only birthday will be processed. Birthnumber/d-number will only be processed if sent in by customer.
Process of Personal Data
The toll collection systems process all transits through toll plazas regardless of whether a toll tag is used. The toll collection systems are used to automatically identify vehicles that transit through the toll plaza, to establish the rate, discounts and exemptions from payment applicable to the individual vehicle transiting through, and to collect the tolls due. The toll collection systems also process AutoPASS contracts between the registered individual and the toll road operator.
Each toll road operator processes the personal data of those individuals who passing through the company’s toll plazas and of those individuals who have an AutoPASS contract with the company. The Norwegian Public Roads Administration processes personal data on behalf of all toll road operators in order to test and to make sure that the central toll collection systems work as they should. The Norwegian Public Roads Administration and toll road operators enter into data processing agreements with their respective subcontractors, who process personal data in the toll collection systems.
Personal data collected is stored for as long as the data controller requires them in order to collect tolls and process complains, maintain the IT system and compile aggregate statistics for tolls, and to meet the duty of retention under the Accounting law. Personal data that is subject to accounting is stored for five years in accordance with section 13 of the Accounting law.
Where personal data is obtained
Most data processed by the toll road operators are personal data that are not obtained directly from the registered individual. This applies to data that is registered when a vehicle transits through a toll plaza. Data is also generated when transit details are compiled together with details about the vehicle, from the Central Register of Motor Vehicles, AutoPASS contracts or foreign electronic toll payment tags, and the environmental register for fuels and emissions classifications.
Those individuals who enter into AutoPASS contracts provide details of the customer and their vehicle. Furthermore, registered individuals provide details whenever they contact toll road operators.
Who receives personal data
Individuals who have entered into AutoPASS contracts may see toll transits charged under the contract at My page or by contacting the toll road operator. In some cases, it is therefore not the individual who transited through the toll plaza who receives details of the time and location of said transit. For example, this applies if a car is hired or borrowed, belongs to an employer or car club, if it is a joint AutoPASS contract for several cars in the family, or the previous owner has not terminated their contract prior to selling the car. The vehicle may be covered by an AutoPASS contract even if the electronic toll payment tag is not fixed to the windscreen. You can ask one of the toll road operators if there is a contract in place for the vehicle you are using.
The toll road operators use foreign suppliers for some of this work. Collection of tolls from foreign-registered vehicles without electronic toll payment tags is carried out by ParkTrade based in Sweeden . ParkTrade processes personal data in the country where the vehicle that was driven in Norway is registered. The toll road operators use foreign suppliers both within and outside the EEA for the manual identification of registration numbers if the images from the toll plaza cannot be interpreted automatically.
Lists of valid electronic toll payment tags connected to registration numbers are sent to ferry and bridge companies outside of Norway that accept payment using AutoPASS tags.
Transits through toll plazas in Norway that are to be paid for using electronic toll payment tags from foreign tag issuers are sent to these issuers.
Lists of valid electronic toll payment tags connected to registration numbers for vehicles in tariff group 2 (vehicles over 3,500 kg) and only tag numbers for tariff group 1 are sent on a daily basis to Norwegian Customs, the police and the inspection unit at the Norwegian Public Roads Administration, which carries out checks relating to the regulations pertaining to mandatory heavy vehicle tags.
Personal data other than the above can only be disclosed if there is a legal basis, for example extradition to the police in accordance with the criminal procedure law.
It is automatically determined which tariff is to be charged when a vehicle transits through a toll plaza. This decision is taken on the basis of a list of applicable tariffs and rules for determining the weight class and emission class of vehicles with and without AutoPASS contracts. The toll tariffs are published on the toll companies' website.
All transits through toll plazas are divided into two weight classes. These are vehicles up to 3,500 kg (tariff group 1) and vehicles over 3,500 kg (tariff group 2). For vehicles with contracts, the weight class is registered in the agreement, while for vehicles without AutoPASS contracts the weight class is obtained from the relevant national vehicle registry. For vehicles with contracts, all vehicles in vehicle category M1 are registered in tariff group 1 regardless of weight.
In toll plazas with environmentally differentiated tariffs, the correct tariff is charged if the toll road operator is aware of the vehicle’s fuel type / emission class. This information is known for Norwegian-registered vehicles with and without AutoPASS contracts because it is obtained automatically from the national vehicle registry. The toll collection system does not have equivalent automated access to foreign vehicle registries. Foreign-registered vehicles with and without AutoPASS contracts may register and upload documentation pertaining to fuel/emission class at www.autopass.no/ed. If the toll collection systems do not have environmental ratings registered, they will charge the highest tariff for the vehicle’s weight class.
This is automatically determined based on which discount should be deducted from the toll for transit. Only vehicles with AutoPASS contracts receive a discount. The criteria for receiving a discount and the size of the discount are established by individual toll road projects. For example, the system will compare each transit with previous transits by the same electronic toll payment tag to grant a 100% discount after a maximum number of paid transits per month (monthly cap) and/or because the vehicle should only be charged for one transit per hour (hourly rule).
It will be determined automatically whether the transit is subject to exemption from payment. This decision is taken on the basis of the vehicle’s AutoPASS contract. Any individual who believes they are entitled to an exemption from payment may apply to the toll road operator for such an exemption. A list of groups entitled to exemptions from payment is available here and on the websites of the toll road operators.
Privacy when using the autopass.no website
The Norwegian Roads Administration's website for tolls, autopass.no, provides information on the Norwegian toll system. The pages have a link to log in to My Page and a link to form to create an AutoPASS appointment.