Your rights and obligations
Processing of personal data in toll systems
Introduction
Toll collection is fully automated from registration at the toll plaza to billing and registration of payment. Manual processing related to toll collection occurs only in exceptional cases.
This document explains how the toll systems collect and use your personal data.
Data Controller
Toll road operators (RBPS) and the Norwegian Public Roads Administration (NPRA) are so-called joint Data Controllers for personal data held in central systems in the toll road sector. Toll road systems graphically presented (PDF). The parties have entered into an agreement concerning the handling of this joint responsibility. Assignments are mainly shared as follows: The toll road operators are obliged to collect tolls and provide information to those people registered in the toll collection systems. The NPRA shall enter into agreements with suppliers of central toll collection systems, provide overall information about the processing of personal data in these systems and notify the Norwegian Data Protection Authority of any discrepancies in the central toll collection systems. From 01.05.2021, personal data is also processed in new system solutions. See new toll road systems graphically presented (PDF).
The NPRA and each toll road operator will publish a privacy policy with information specific to their company.
Purpose
The purpose of processing personal data is to collect toll payments in accordance with the decision of the Parliament, including the administration of the toll systems.
Legal basis
The legal basis for RBPS and NPRA is based on article 6 1. e) of the Personal Privacy Regulation and the fifth paragraph in section 27 of the Public Roads Act.
The legal basis for toll service providers is based on Article 6 (1) (e) and Article 6 (1) (b) of the GDPR, and the fifth paragraph of Section 27 of the Norwegian Public Roads Act. See the list of toll service providers and toll chargers in AutoPASS Samvirke.
Categories of Personal Data
In total, 23 categories of personal data are processed by the toll collection systems. For each person, we only process data in those categories in which we hold information and which are necessary.
- Name (First name/Given name, Middle name, Surname/Family name)
- Address information (street address/PO box, postcode, city)
- Contact information (telephone, e-mail address)
- ID number (Birthday/ birthnumber (D-number))
- Customer number / Agreement number
- Customer’s role (in the organisation)
- Employer and workplaceTag number (PAN)
- License plate number/ Country vehicle is registered in Description of vehicle (price class, weight, length, make/model, fuel type, emission class, vehicle classification, chargeable yes/no) Photo / video (of license plate number)
- Time and location of transit
- Parking permits for people with reduced mobility (sensitive personal information)
- Reason for discount and exemption (in addition to category 13)
- Notes and received documentation in relation to users’ contact with the toll road operator (free text field)
- Bank account number
- Invoice information (transit information, amount, due date, address information, etc.)
- Payment rules (direct debit, paper invoice, in advance, etc.)
- Invoice and payment history (accounting history)
- Reason code for decision to stop seeking paymen
- Registration code (codes from toll stations for passages)
- Status code (for customer, vehicle and contract)
- Min Side
- Request ID for each search, previous log in date, password for users without ID-port.
- According category 4 (ID-number) only birthday will be processed.
- Birthnumber/d-number will only be processed if sent in by customer.
Process of Personal Data
The toll collection systems process all transits through toll plazas regardless of whether a toll tag is used. The toll collection systems are used to automatically identify vehicles that transit through the toll plaza, to establish the rate, discounts and exemptions from payment applicable to the individual vehicle transiting through, and to collect the tolls due. The toll collection systems also process user contracts for toll tags between the registered individual and the toll service provider.
Each toll road operator processes the personal data of those individuals who is passing through the company’s toll plazas. Each toll service provider processes the personal data of those individuals who has a user contract for toll tag with the company. The NPRA processes personal data to identify and price toll passings, and in order to test and to make sure that the central toll collection systems work as they should. The NPRA and toll road operators enter into data processing agreements with their respective subcontractors, who process personal data in the toll collection systems.
Personal data that are necessary for each party to perform their duties are exchanged continuously among the toll charger, the NPRA and the toll service provider.
Personal data collected is stored for as long as the data controller requires them in order to collect tolls and process complains, maintain the IT system and to meet the duty of retention under the Accounting law. Personal data that is subject to accounting is stored for five years in accordance with section 13 of the Accounting law.
Where personal data is obtained
Most data processed by the toll road operators are personal data that are not obtained directly from the registered individual. This applies to data that is registered when a vehicle transits through a toll plaza. Data is also generated when transit details are compiled together with details about the vehicle, from the Central Register of Motor Vehicles, user contracts for toll payment tags, and the environmental information about fuels, weight and emissions classifications.
Those individuals who enter into user contracts with the toll service providers provide details of the customer and their vehicle. Furthermore, registered individuals provide details whenever they contact toll road operators and toll service providers.
Who receives personal data
Individuals who have entered into user contracts for toll tags may see toll transits charged under the contract at My page at their toll service provider. In some cases, it is therefore not the individual who transited through the toll plaza who receives details of the time and location of said transit. For example, this applies if a car is hired or borrowed, belongs to an employer or car club, if it is a joint user contract for toll tags for several cars in the family, or the previous owner has not terminated their contract prior to selling the car. The vehicle may be covered by a user contract for toll tags even if the electronic toll payment tag is not fixed to the windscreen. You can ask one of the toll road operators if there is a contract in place for the vehicle you are using.
The toll road operators use foreign suppliers for some of this work. Collection of tolls from foreign-registered vehicles without electronic toll payment tags is carried out by ParkTrade based in Sweeden . ParkTrade processes personal data in the country where the vehicle that was driven in Norway is registered. The toll road operators use foreign suppliers both within and outside the EEA for the manual identification of registration numbers if the images from the toll plaza cannot be interpreted automatically.
Lists of valid electronic toll payment tags connected to registration numbers for vehicles over 3,500 kg, are sent on a daily basis to the inspection unit at the NPRA, which carries out checks relating to the regulations pertaining to mandatory heavy vehicle tags.
Personal data other than the above can only be disclosed if there is a legal basis, for example extradition to the police in accordance with the criminal procedure law.
Automated decisions
It is automatically determined which tariff is to be charged when a vehicle transits through a toll plaza. This decision is taken on the basis of a list of applicable tariffs and rules for determining the weight class and emission class of vehicles with and without user contracts. The toll tariffs are published on the toll companies' website.
All transits through toll plazas are divided into two weight classes. These are vehicles up to 3,500 kg (tariff group 1) and vehicles over 3,500 kg (tariff group 2). For vehicles with contracts, the weight class is registered in the agreement, while for vehicles without user contracts the weight class is obtained from the relevant national vehicle registry. For vehicles with contracts, all vehicles in vehicle category M1 are registered in tariff group 1 regardless of weight.
In toll plazas with environmentally differentiated tariffs, the correct tariff is charged if the NPRA is aware of the vehicle’s weight and fuel type / emission class. This information is known for Norwegian-registered vehicles with and without user contracts because it is obtained automatically from the national vehicle registry. The toll collection system does not have equivalent automated access to foreign vehicle registries. Foreign-registered vehicles without user contracts and toll tags may register and upload documentation pertaining to fuel/emission class at www.autopass.no/ed. Foreign-registered vehicles with user contracts and toll tags may register fuel/emission class at their toll service provider. If the toll collection systems do not have environmental ratings registered, they will charge the highest tariff for the vehicle’s weight class.
This is automatically determined based on which discount should be deducted from the toll for transit. Only vehicles with user contracts receive a discount. The criteria for receiving a discount and the size of the discount are established by individual toll road projects. For example, the system will compare each transit with previous transits by the same electronic toll payment tag to grant a 100% discount after a maximum number of paid transits per month (monthly cap) and/or because the vehicle should only be charged for one transit per hour (hourly rule).
It will be determined automatically whether the transit is subject to exemption from payment. This decision is taken on the basis of the vehicle’s user contract and the list of payment exemptions granted. Any individual who believes they are entitled to an exemption from payment may apply to the toll road operator for such an exemption. A list of groups entitled to exemptions from payment is available here and on the websites of the toll road operators.
Privacy when using the autopass.no website
The NPRA's website for tolls, autopass.no, provides information on the Norwegian toll system. The pages have a link to toll operators and toll service providers.