Access to the CPR data of about 8.8 million people has reopened a debate in Denmark over whether the country’s central person registry should be replaced.
DR reported on October 11 that the breach has triggered a broader discussion about data security and whether it is time to retire Det Centrale Personregister. The broadcaster asked Peter Lauritsen, professor of information science at Aarhus University, to explain on P1 Morgen how Denmark ended up here, in its account of the CPR number’s history.
According to the CPR Administration, unauthorized parties obtained names, addresses and CPR numbers belonging to roughly 8.8 million registered people. The figure covers living, emigrated and deceased people. People with protected names and addresses were not included in the exposed data, the administration’s review found.
The access came through a small Danish company’s legitimate connection to the CPR system. TV 2 reported that the firm Pays ApS confirmed its access was the one misused.
The CPR Administration said the company’s access was stopped, the case was reported to the Danish Data Protection Authority, and police are investigating with other authorities. Ingeniøren reported that the irregular activity was detected on October 2, after it had taken place during September.
Private companies’ access to the register was briefly suspended during the incident. According to Dansk Industri, access was restored on October 5 at 11:57.
Why the 1968 system is hard to replace
Per DR, the CPR number was introduced on June 10, 1968, when 4.7 million Danes received a personnummerbevis in the mail. Lauritsen told P1 Morgen that the final push came from the plan to introduce kildeskat, the withholding tax system where employers deduct tax before wages are paid.
Before 1968, the state relied on censuses, church books and military conscription lists, none of which gave a central overview, Lauritsen said. What made the CPR number different was that it was tied to the person rather than to a single activity such as tax or pension.
Digitalisation Minister Christina Egelund of the Moderates will examine whether the time has come for an entirely new system, DR reported. Lauritsen described the CPR system as the backbone of the Danish welfare society, built into a very large number of other systems. Replacing it overnight would be a practically difficult task, he said, while the breach could prompt a sharp tightening of security.
What the breach means for internationals with a CPR number
The CPR number is the personal identifier used for tax, the yellow health insurance card, banking, MitID and borger.dk. Internationals normally receive one after registering an address at a Borgerservice or an International House, in most cases after a residence permit or EU registration certificate. The register also covers people who have since left the country, and the CPR Administration’s figure of 8.8 million includes emigrated and deceased people.
Egelund told TV 2 that it was too early to say whether some citizens would need new CPR numbers. No authority has published a list of affected individuals, and the police investigation and the Data Protection Authority case remain open. Misuse of CPR numbers has previously reached Danish courts, including the case of a former student who sold CPR numbers, and digital fraud in Denmark has been the subject of recent research.
