ORS 319.915: Confidentiality of personally identifiable information used for reporting and collecting road usage charge; exceptions; records to be destroyed; exceptions; Department of Transportation to provide for penalties.

(1) As used in this section: (a) “Certified service provider” means an entity that has entered into an agreement with the Department of Transportation under ORS 367.806 for reporting metered use by a subject vehicle or for administrative services related to the collection of per-mile road usage charges and authorized employees of the entity. (b) “Personally identifiable information” means any information that identifies or describes a person, including, but not limited to, the person’s travel pattern data, per-mile road usage charge account number, address, telephone number, electronic mail address, driver license or identification card number, registration plate number, photograph, recorded images, bank account information and credit card number. (c) “VIN summary report” means a monthly report by the department or a certified service provider that includes a summary of all vehicle identification numbers of subject vehicles and associated total metered use during the month. The report may not include location information. (2) Except as provided in subsections (3) and (4) of this section, personally identifiable information used for reporting metered use or for administrative services related to the collection of the per-mile road usage charge imposed under ORS 319.885 is confidential within the meaning of ORS 192.355 (9)(a) and is a public record exempt from disclosure under ORS 192.311 to 192.478. (3)(a) The department, a certified service provider or a contractor for a certified service provider may not disclose personally identifiable information used or developed for reporting metered use by a subject vehicle or for administrative services related to the collection of per-mile road usage charges to any person except: (A) The registered owner or lessee; (B) A financial institution, for the purpose of collecting per-mile road usage charges owed; (C) Employees of the department; (D) A certified service provider; (E) A contractor for a certified service provider, but only to the extent the contractor provides services directly related to the certified service provider’s agreement with the department; (F) An entity expressly approved to receive the information by the registered owner or lessee of the subject vehicle; or (G) A police officer pursuant to a valid court order based on probable cause and issued at the request of a federal, state or local law enforcement agency in an authorized criminal investigation involving a person to whom the requested information pertains. (b) Disclosure under paragraph (a) of this subsection is limited to personally identifiable information necessary to the respective recipient’s function under ORS 319.883 to 319.946. (4)(a) Not later than 30 days after completion of payment processing, dispute resolution for a single reporting period or a noncompliance investigation, whichever is latest, the department and certified service providers shall destroy records of the location and daily metered use of subject vehicles. (b) Notwithstanding paragraph (a) of this subsection: (A) For purposes of traffic management and research, the department and certified service providers may retain, aggregate and use information in the records after removing personally identifiable information. (B) A certified service provider may retain the records if the registered owner or lessee consents to the retention. Consent under this subparagraph does not entitle the department to obtain or use the records or the information contained in the records. (C) Monthly summaries of metered use by subject vehicles may be retained in VIN summary reports by the department and certified service providers. (5) The department, in any agreement with a certified service provider, shall provide for penalties if the certified service provider violates this section. [2013 c.781 §9]