A. OVERVIEW
Management of Road Usage Charge (RUC) accounts requires the collection and/or generation as well as the use and limited disclosure of certain information concerning the RUC users for the purposes of setting up accounts, monitoring usage, invoicing, collection, troubleshooting RUC user service issues, and investigating user complaints, among other purposes. Some of this information constitutes “Personally Identifiable Information” as that term is used in ORS 319.883 to 319.945 (“PII”) or “Personal Information” as that term is used in the Oregon Consumer Identity Theft Protection Act ORS 646A.602(11) (“PI”), including Social Security numbers. PII and Personal Information are both types of confidential information that are subject to additional protection under Oregon law. This Data Retention and Privacy Policy explains how OReGO Account Manager protects such information from unauthorized use or disclosure, and how and when records containing such information are destroyed.
B. WHAT INFORMATION DO WE COLLECT, AND WHAT DO WE USE IT FOR?
The information we collect, and the purposes for which we use it, include the following:
- Road Usage Charge (RUC) user’s name, company, residential address, mailing address, telephone number and e-mail address—used for identifying and communicating with the RUC user concerning his/her account.
- License plate number, vehicle identification number, weight of the vehicle, odometer reading—used to identify the RUC user’s vehicle with his or her RUC account, and, verify his eligibility to the program.
- RUC user’s travel pattern data—used to determine the amounts chargeable to the RUC user under the RUC Program, and, when aggregated with other users’ travel pattern data, to analyze usage of the system as a whole.
- RUC user’s messages sent to OReGO Account Manager – used to respond to RUC user inquiries and questions.
C. PERSONALLY IDENTIFIABLE INFORMATION.
“Personally Identifiable Information” (“PII”) is any information that identifies or describes a person. Oregon Revised Statutes Sec. 319.915 protects RUC users’ PII by limiting the ways in which it can be used and the people to whom it can be disclosed. RUC users’ PII that is used for reporting metered use or for administrative services related to the collection of the per-mile road usage charge is confidential information that is generally protected from public disclosure under the Oregon Public Records and Meetings law. Such information must be kept separate from non-exempt information and may not be disclosed except as specifically authorized by law.
PII may be disclosed to the following persons, but only to the extent necessary to their respective functions:
- The registered owner or lessee of the enrolled vehicle;
- A financial institution, for the purpose of collecting per-mile road usage charges owed;
- Employees of the department of transportation;
- A certified service provider under contract to the department of transportation;
- A contractor for a certified service provider, but only to the extent the contractor provides services directly related to the certified service providers agreement with the department;
- An entity expressly approved to receive the information by the registered owner or lessee of the subject vehicle; or
- A police officer pursuant to a valid court order based on probable cause and issued at the request of a federal, state or local law enforcement agency in an authorized criminal investigation involving a person to whom the requested information pertains.
D. PERSONAL INFORMATION
“Personal Information” is defined by the Oregon Consumer Identity Theft Protection Act (Oregon Revised Statutes Sec. 646A.600 and following), as the combination of an individual’s first name or first initial with his or her last name, plus any of the data listed below, unless such data have been encrypted (without the encryption code being acquired by an intruder along with the data):
- Social Security number;
- Driver license number or state identification card number issued by the Department of Transportation;
- Passport number or other United States issued identification number; or
- Financial account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to a consumer’s financial account.
We are required to report to our customers immediately if we discover or are notified that any of their Personal Information held in our computer network has been breached. Such notice may be delayed, however, if a federal, state or local law enforcement agency requests a delay because it has determined that reporting the breach immediately would impede a criminal investigation. RUC users may instruct us to “freeze” their Personal Information, that is, to refrain from providing any of their Personal Information to credit reporting agencies.
E. DESTRUCTION OF VEHICLE USE RECORDS.
We are required under Oregon Revised Statutes Sec. 319.915 to destroy records of the location and daily metered use of a subject vehicle within thirty (30) calendar days after (1) the completion of the payment processing for the most recent reporting period for the subject vehicle, or (2) the final completion, if later, of any dispute resolution concerning the subject vehicle’s participation in the RUC Program or the RUC payment compliance with respect to the subject vehicle for any particular reporting period, unless one of the exceptions in ORS 319.915(4)(b) applies. We and/or the Department of Transportation may, however, retain such information for certain specific purposes as long as all Personally Identifiable Information is removed. The purposes for which such information may be retained are (a) traffic management and research and (b) the creation of “VIN summary reports,” that is, monthly reports that include a summary of all vehicle identification numbers of subject vehicles and associated total metered use during the month. VIN summary reports may not include location information.
F. DESTRUCTION OF OTHER RECORDS.
To maintain the efficiency of our operating networks, it is OReGO Account Manager’s policy to purge from our computer systems any electronic records that are not required to be preserved for legal or commercial purposes. Electronic records will not be destroyed if we have reason to believe that they may be relevant to a potential dispute.
G. WEBSITE USE.
Visitors to our website provide certain information that we use to improve our service and to better understand our customers’ needs and expectations. The information we collect depends upon what individuals do when visiting this site. In general, we collect two types of information: 1) personal information individuals supply voluntarily; and 2) aggregated information about website users as a whole. Any Personally Identifiable Information or Personal Information (as those terms are defined in Oregon Revised Statutes Sec. 319.915 and Sec. 646A.604, respectively) are handled in accordance with the policies described above in this Data Retention and Privacy Policy.
1. Individual User Information
We may collect information when individual users submit comments to OReGO Account Manager or sign up for customer subscription services. This user information may include the individual’s name, email address, phone number, street address, etc.
2. Aggregated Information
We collect certain types of information about general activity at the OReGO Account Manager website. This does not include Personally Identifiable Information, but does include how many times OReGO Account Manager's website has been visited, what pages or search terms have been requested most, what domain names (i.e., www.google.com) visitors have arrived at our website from as well as the date and time of each visit. OReGO Account Manager gathers and compiles this information into an aggregate form for statistical analysis and reporting purposes. These reports track website activity overall rather than on an individual level. OReGO Account Manager uses third party measurement software to gather and compile aggregated information. This software does not collect, track or have any access to individual user information received at the OReGO Account Manager website.
3. Web Cookies
A “cookie” is a small data file that websites commonly send to browsers. A cookie file contains information that can identify individuals anonymously in order to track traffic patterns and add functionality to the website. Cookies don't identify people personally, but rather identify their computer when they visit our site. A cookie can't read data off hard disks or read cookie files created by other sites. A browser can be set to warn the computer user before accepting cookies. In this case, the computer user will receive the warning message with each cookie. The computer user may choose to refuse cookies by turning them off in their browser. One does not need to have cookies turned on to use the majority of the OReGO Account Manager website, however one may need to them in certain areas of the site to perform certain functions.
4. Children’s Privacy and Parental Supervision
OReGO Account Manager encourages parents and guardians to be aware of how their children spend their time online and to participate with them in their online activities. Visitors to the OReGO Account Manager website who are under the age of majority should not submit any information, including but not limited to Personally Identifiable Information or Personal Information, without the consent of a parent or guardian.
5. Consent
By using the OReGO Account Manager website, visitors consent to the collection and use of information as described above.
H. PRIVACY POLICY UPDATES
If we decide to update our RUC User Data Retention and Privacy Policy, we will update our web page so that visitors are always aware of what information we collect, how we use it, and under what circumstances we disclose it. OReGO Account Manager reserves the right to update this policy at any time.
I. REFUND POLICY
To request a refund, please contact OReGO at myOReGO@odot.state.or.us Refunds will be issued by check.
J. QUESTIONS OR CONCERNS.
If you have any questions or concerns about this User Data Retention and Privacy Policy, please contact OReGO Account Manager’s Data Security and Privacy Coordinator by phone at 800-347-9415 or by e-mail to contact@myOReGOaccount.org.