I-PASS Privacy Policy

I-PASS Privacy Policy (pdf)

Definitions

• "Electronic toll collection system" is a system where a transponder, camera based vehicle identification system, or other electronic medium, is used to deduct payment of a toll from a subscriber's account or to establish an obligation to pay a toll.
• "Personally identifiable information (PII)" means any information that identifies or describes an electronic toll collection system user, including but not limited to email address, telephone number, credit card number, bank account information, license plate number, or travel pattern data.
• "Tollway," "our" or "we" refers to the Illinois State Toll Highway Authority.
• "You" refers to any natural person who subscribes to an electronic toll collection system or any natural person who uses a tolled transportation facility that employs the Tollway's electronic toll collection system.

I. Purpose:

The purpose of this policy is to comply with PA 097-0342: FOIA and Tollway Collected Personal Information and to set forth Tollway procedures regarding the collection and use of personally identifiable information. The effective date of this policy is January 1, 2012.

II. Policy – Third Parties:

We will not sell, share, or rent the information we collect to others except as disclosed in this privacy policy. Examples of personally identifiable information (PII) that we may use include your name, email address, mailing address, telephone number, credit card billing information, bank account information, driver's license number, license plate number (only when linked to other PII), other contact information you voluntarily transmit with your communication to us, toll transaction photograph, and travel pattern data (only when specifically linked to other PII data in such a manner that it makes individuals identifiable, rather than aggregated into general traffic reports or data sets). We also may collect information about you during your use of our website.

The Tollway uses PII data to serve your needs and our legitimate business purposes. We may use PII data to perform account functions (e.g., billing, account settlement, toll violation enforcement), to research any of your I-PASS account concerns you bring to us to address, and to verify your authority to make updates, changes, or queries of your account either by phone, online, or in person. We also may use PII data to verify your authority to improve the content and general administration of your account, to provide you with notice regarding your account status, and to track aggregate traffic patterns. We may use IP addresses from our log files to analyze trends, administer the website, track user movements, and gather broad demographic information for aggregate use. IP addresses are not linked to PII.

The Tollway may share PII data with third-parties who assist the Tollway in the activities noted above, so long as the third-party is prohibited from using the data for any other purposes. Categories of third-parties include: vendors who assist the Tollway in performing account functions (e.g., call centers, collection agencies) or marketing/information functions (e.g., retail outlets distributing transponders, parking garages offering to accept transponder transactions for payment); other tolling organizations that collaborate with the Tollway in providing toll interoperability among tolling systems; research partners who assist the Tollway in performing research on traffic trends; vendors who assist the Tollway in any data migration or research that must occur to fix or upgrade electronic tolling technologies; any individual who has a warrant, subpoena or lawful order from a court of competent jurisdiction; law enforcement agencies in the case of an emergency when obtaining a warrant or subpoena would be impractical as described in Section III of this policy; and the Tollway's Inspector General or, at the Inspector General's direction, to law enforcement agencies as described in Section III of this policy.

We employ reasonable and current security methods to prevent unauthorized access, maintain data accuracy, and ensure correct use of information. Your personal data is stored in a database located behind a firewall for added security. The server housing the database is physically protected at a secure site and is monitored by security personnel 24 hours a day. Only authorized personnel can access the data center and the particular server housing the database. The Tollway does not have control over the security of your computer, or other computer systems or networks you may use. Therefore, no data transmission you send to us from your computer over the Internet or wireless network can be guaranteed to be secure. While we try to protect your personal information, we cannot ensure or guarantee the security of information you transmit to us and you do so at your own risk. We do not encrypt normal web sessions; however, any transactions occurring on the e-commerce portion the Tollway's website (that portion of the site where you are required to login, found at https://www.getipass.com), uses SSL encryption to help protect the data.

In any agreement allowing another public entity to use the Tollway's toll collection system in a transportation facility, the Tollway will require the other public entity to comply with the requirements of this policy.

III. Policy – Law Enforcement:

The Tollway requires outside law enforcement and regulatory agencies (e.g., secretaries of states, departments of motor vehicles) to obtain a subpoena for I-PASS records, including toll transaction history, unless otherwise required by law, or the law enforcement or regulatory agency articulates the existence of a bona fide emergency requiring immediate access to specific I-PASS records and transmits a written request to the Tollway identifying the records needed and the nature of the emergency. An emergency exists if the requesting agency does not have time to secure a subpoena or court order in order to address an immediate public safety concern. Examples of such emergencies include but are not limited to an Amber Alert, pursuit of a criminal suspect fleeing a crime scene, or someone transporting a kidnapping victim.

Federal, state, county, and municipal law enforcement and regulatory agencies regularly request access to I-PASS records to perform their duties and the information is considered necessary to protect the public. Frequently, these outside agencies do not need the information immediately and have easy access to subpoenas. Occasionally, an outside agency needs the information quickly to protect the public and save lives.

The Intergovernmental Cooperation Act (5 ILCS 220/3) provides a mechanism for the Tollway to share the information with outside law enforcement and regulatory agencies. It states, "Any power or powers, privileges, functions, or authority exercised or which may be exercised by a public agency of this State may be exercised, combined, transferred, and enjoyed jointly with any other public agency of this State and jointly with any public agency of any other state or of the United States to the extent that laws of such other state or of the United States do not prohibit joint exercise or enjoyment and except where specifically and expressly prohibited by law."

A. Procedures for Law Enforcement:

Nonemergency Requests:
Subpoenas for non-emergency outside agency requests should be sent to the Video Surveillance and Service Operations Supervisor (VSSOS) who will refer them to the Tollway's Inspector General's Office. The Inspector General's Office will collect the information from Tollway's Business Systems Department and provide copies to the requesting agency.

Emergency Requests:

1. Emergency requests shall be referred during regular business hours to the VSSOS who will refer them to the Inspector General's Office.
2. Outside of normal business hours, emergency requests shall be referred to the Illinois State Police District 15 Shift Commander (Illinois State Police District 15 is considered internal law enforcement by virtue of its contractual relationship with the Tollway).
   • The Shift Commander will contact the VSSOS who will determine whether the emergency request for I-PASS records should be accommodated and, if so, handle the request appropriately. The VSSOS will then notify the Inspector General's Office and the Legal Department by email of the request and the response.
   • If the Shift Commander is unable to reach the VSSOS or determines that notifying him/her is not reasonably feasible, the Shift Commander will have the trained personnel with access to the I-PASS database run the request, provided the Shift Commander reasonably believes that an emergency exists. The Shift Commander will then notify the VSSOS, the Inspector General's Office, and the Legal Department by email of the request and the response.
3. Emergency requests for I-PASS data must be faxed on the outside agency's letterhead or sent by email with the governmental entity's email address extension prior to receiving a response. Only license plate data, with vehicle description and suspected driver's name, will be transmitted by e-mail.
4. Responses to proactively initiated I-PASS data queries by the VSSOS or District 15 personnel for outside agencies will be handled in the same manner.

B. Documentation:

A copy of all emergency and nonemergency outside requests and responses are to be sent to the Tollway Inspector General's Office and the Tollway Legal Department for record keeping. The Tollway Inspector General's Office may discuss, when necessary, any nonemergency and emergency requests with the Tollway Legal Department.

VI. Changes to PII:

You can review and change your name, email address, mailing address, telephone number, credit card billing information, bank account information, driver's license number, license plate number, other contact information by accessing your account profile by phone, online, or in person.

VII. Changes to This Privacy Policy:

The Tollway may periodically change its privacy policy. If we materially change our policy, we will post notice of the new policy on our home page and send a notice through the Tollway's electronic newsletter. The Tollway encourages you to review this privacy policy regularly for changes. Your continued use of your I-PASS account and provision of PII will be subject to the terms of the current privacy policy. If you have questions or concerns about our posted privacy policy, call our customer service department at (630) 241-6800, x4320 or write to the Chief of Business Systems, The Illinois Tollway, 2700 Ogden Avenue, Downers Grove, IL 60515.