Video surveillance registrations in Austria

Abstract. Austrian law requires private video surveillance to be registered at the so-called data processing register. Since September 2012 public, anonymous online access is provided to this register. I wrote a little program that requests all datasets from this database and allows one to gain interesting statistical insight into video surveillance registrations in Austria. In particular, I created maps of all video surveillance registrations in Austria.

A brief overview of the legal position

In Austria, private video surveillance is regulated by the data protection act DSG 2000¹. In general, video surveillance needs to be registered at the so-called data processing register DVR² as data of identifiable persons is processed thereby. The Austrian data protection authority provides a summary of the current legal position concerning private video surveillance. I will list a few important points here:

• The registration needs to define the precise locality, rooms, etc. where video surveillance is performed.
• Video surveillance needs to follow the principle of proportionality, that is, one needs to precisely argue why video surveillance is necessary and cannot be substituted by other means.
• One may only perform video surveillance after finishing the registration process. Old installations (installed prior to DSG 2000) need to be registered too.
• Performing video surveillance without registration can be punished with a fine of up to 10000 EUR.

However, there are exceptions from the obligation to register video surveillance installations:

• Realtime surveillance without recordings or recordings only on analog media are excluded. In any case, recordings need to be erased after 72 hours.
• Recordings exclusively for personal and family reasons are excluded.
• Since 2010, the legal position to video surveillance defines a so-called “Standardanwendung Videoüberwachung” (standard application video surveillance). That means, video surveillance for banks, jewelers, tobacconists, gas stations, and private property does not need to be registered if it follows the conditions and requirements defined in the standard. This standard is defined in an amendment to the StMV act (Standard- und Muster-Verordnung).

Max Schrems, who became famous for the europe-vs-facebook initiative, published a monograph on private video surveillance in 2011: Private Videoüberwachung: Ein Leitfaden. The book description mentions that in practice the law is widely ignored despite potentially delicate fines. At the same time, the number of video surveillance installations is continuously growing.

In principle, if an affected person perceives that a video surveillance installation is not conforming to the DSG, this person can file a complaint at the data protection authority. Since September 2012, the data processing register (DVR) provides an anonymous web access to check whether a video surveillance installation is indeed registered.

The data processing register

The DVR’s website allows for searches based on the registration number (DVR number) or the registrant’s name. However, more elaborate queries — e.g., how many video surveillance installations are registered in Salzburg? — are not possible.

The URL of the webpage that displays the details of a registration contains an ID. A one-liner on a shell saves all datasets from the database by simply requesting all registrations with IDs in the range 1 to 200000³.

Afterwards, I wrote a small program (600 lines of python code) that parses the output provided by the DVR’s public webservice and inserts the respective data into a local database, which allows for more elaborate SQL queries than the original web interface. In addition, the program is able to translate the postal addresses to GPS coordinates using ordinary geocoding services of Microsoft and Google. Based on those coordinates, it can create maps showing the registrations matched by a particular SQL query using the Google Map API.

Discussion of the data

In Austria, we have 2717 registrations for video surveillance installations in the DVR database (as of January 14, 2014).⁴ In the following figure I illustrate the evolution of the registration count over time:

Note that we can only count those registrations that were still present at the day when I fetched the datasets. We can see that the number of registrations is indeed continuously growing by roughly 300-500 registrations per year. Only last year the growth rate decreased a little:

The above-average value of 2010 might have been caused by the amendment to the StMV, which clarified the registration obligations for many use cases. It is also interesting that the registration count jumped by 466 on May 30, 2008. In the following picture, I depict the most active registration days in the DVR database:

In other words, on May 30, 2008, roughly the same amount of registrations were made as in a whole year after 2008. It is unclear what the reason for this outlier is.

In order to check for illegitimately operated video surveillance installations, it is convenient to have a map that shows the geographical locations of the registrants’ addresses. For instance, the following map shows all 56 registrants in Salzburg:⁵

However, the locations shown above need to be treated with caution:

• We first need to distinguish between registrant (the person who registers a data processing activity and who gets a DVR number) and the registration (of a data processing activity). One registrant can register multiple video surveillance installations. FE Trading GmbH (DVR: 4000477) registered most installations, namely 50, at different locations in Austria for their gas stations. In total, 2338 registrants registered 2717 different video surveillance installations, so in most cases this is a one-to-one correspondence.

• The address of the registrant is not necessarily the location where the surveillance is taking place. For instance, the University of Salzburg registered a video surveillance installation at the Faculty of Natural Sciences. The address of the university is Kapitelgasse 4, but the surveillance is taking place in Hellbrunnerstraße 34. Even though the address of the installation is mentioned in the purpose description, it would be hard to automatically extract those. So I display the address of the registrant instead.

• Sometimes the geocoding results are quite imprecise. For instance, Google Maps locates the address “Mirabellplatz 1” of the “Stadtgemeinde Salzburg” near the airport. I used Bing for geocoding and Google as a fallback in case that Bing could not obtain a GPS location.

• Sometimes the addresses stored in the database are in a strange format. Probably the worst example is “Feldmühlgasse 11 11330-Wien Österreich” for DVR number 0895679. The correct zip code is 1130. Surprisingly, both Bing and Google translate this address to correct GPS coordinates.

Maps of Austria. The following links show different maps that together cover all video surveillance registrants in Austria.⁶ Since the Google API, which is used here, limits the number of entries to 400 per map, I split up the results into multiple maps according to the zip code of the registrant:

• Zip codes 10xx: 375 results
• Zip codes 11xx—12xx: 355 results
• Zip codes 2xxx—3xxx: 350 results
• Zip codes 4xxx: 333 results
• Zip codes 5xxx: 210 results
• Zip codes 6xxx—7xxx: 367 results
• Zip codes 8xxx—9xxx: 348 results

Fun facts about the database integrity

When building the database, I stumbled over some funny facts concerning the integrity of the DVR database:

• I initially thought that it is reasonable to assume that the DVR number would be unique. It turns out that the following DVR numbers correspond to two registrants — that is, two different IDs — in the database: 1091, 21792, 2111896, and 3002625. In one case (DVR: 2111896) the registrant’s address differs in both datasets, otherwise they appear to be identical.

• A registration in the DVR database is identified by a number of the form DVR/NUM, where DVR is the DVR-number of the registrant and NUM is a three digit auto-increment integer of each registration of the registrant. Again, I assumed that DVR/NUM would be unique for each registered purpose. Nevertheless, there are eight cases, where two registrations have the same number: 4009666/4, 14745/35, 13081/33, 24660/35, 16055/23, 82911/22, 17931/24, and 16110/33. Unfortunately, the purposes behind these duplicated numbers are quite different, so it is not just a duplication of data.