Data protection and security

The German government, represented by the Federal Office for Goods Transport (BAG), is responsible for the truck toll system, since it is a sovereign matter. As the operator of the toll system, Toll Collect is a subcontractor for BAG. In this statutorily defined role, Toll Collect implements the requirements of the German Federal Trunk Road Toll Act (BFStrMG) and the Truck Toll Regulation as well as the Federal Data Protection Act. As the client, BAG must define the requirements to be implemented and can issue instructions.

In this regard, a data protection and security policy was developed at the tender offer stage. Since then, this policy has been updated and made more specific as the system has been established. This data protection policy is continuously coordinated with BAG and the Federal Commissioner for Data Protection, which are the competent oversight authorities. This is the basis for implementing data protection law requirements in ongoing operations.

Permission to process data for the toll system is provided primarily by the BFStrMG and the Truck Toll Regulation. However, the provisions not only permit data processing, but at the same time prescribe strict earmarking for a specific purpose and short deletion deadlines for the operator. Toll Collect processes data for the purpose of operating the toll system only within the confines of this statutory permission. Only the data listed in § 4 Section 3, § 7 Section 2 and § 8 of the BFStrMG and in the Truck Toll Regulation is recorded. This data is processed by the operator, as an agent of the sovereign acting on behalf of BAG, strictly in accordance with data protection guidelines and exclusively for the statutorily prescribed purpose of toll collection.

Vehicle information is recorded at the enforcement gantries in accordance with the legislative guidelines. § 7 Section 2 of the BFStrMG permits photographing vehicles and recording their number plate for the purpose of monitoring compliance with the provisions of the Toll Act. Under § 9 Section 5 of the BFStrMG, this data is to be deleted immediately after the enforcement process if the vehicle is not required to pay toll. Toll Collect processes photos of vehicles and number plate data only for the listed statutory purposes and in accordance with the provisions on deletion. The drivers cannot be recognized in the photos. Moreover, when vehicles that are determined to be toll exempt, the photo is not evaluated with respect to the number plate, but is deleted within a fraction of a second.

Only the registered customer will receive information from Toll Collect regarding what route the truck was driving on at what time, and what toll amount must be paid by the customer. It is not possible for third parties to create travel profiles because only BAG and Toll Collect GmbH have access to billing data. The bill lists only the starting time of each route billed for. No average speed can be determined on this basis for use by law enforcement authorities. The On-Board Unit does not record any information on the speed of the truck and its load.