OAR 731-090-0010: Confidentiality

(1) An Account Manager may not disclose Personally Identifiable Information (PII) used or developed for reporting metered use by a subject vehicle or for administration services related to the collection of Road Usage Charges to any person except as allowed by ORS 319.915(3). An ODOT Account Manager may not disclose PII without written approval of the Department. (2) If the RUC Payer declines to give express approval for disclosure of PII to an entity, such an act must not invalidate any Road Usage Charge service agreement existing between the Account Manager and the RUC Payer. (3) Not later than 30 days after completion of payment processing, dispute resolution for a single payment period or a noncompliance investigation, whichever is latest, the Account Manager shall destroy records of location and daily metered use of subject vehicles. (a) A Commercial Account Manager may retain and use records of location and daily metered use of subject vehicles if the RUC Payer consents to the retention and use. (b) If the RUC Payer files for a refund under ORS 319.280, records of location and daily metered use of subject vehicles will be destroyed 30 days after check issuance, dispute resolution for a single reporting period, or a noncompliance investigation, whichever is latest. (4) An Account Manager may retain, aggregate and use, for the purposes of traffic management and research, records of the location and daily metered use of subject vehicles after removing Personally Identifiable Information. (5) Upon request of the RUC Payer, an Account Manager and its contractor shall provide the RUC Payer the following rights regarding Personally Identifiable Information (PII): (a) The right to inquire about the nature, accuracy, status and use of the RUC Payer’s PII; (b) The right to examine the RUC Payer’s PII or a reasonable facsimile of the RUC Payer’s PII; (c) The right to request corrections of the RUC Payer’s PII should the RUC Payer provide reasonable evidence that the RUC Payer’s PII has errors or has changed; (d) The right to delete the location and daily metered use data that has not been destroyed within the required period of time, as per ORS 319.915 (4); and (e) An Account Manager, and its contractor, shall respond to all such requests within five (5) business days of receipt of the request.