Record CPR leak renews debate over Denmark’s national register

A leak involving 8.8 million Danish personal identification numbers has reignited debate over the Central Person Register, or CPR, DR reports. Unauthorised parties accessed the numbers through a small Danish company, in what is the largest breach of the register to date.

DR spoke with Peter Lauritsen, a professor of information science at Aarhus University who researches register-based societies, about the system’s history and future. Denmark introduced the CPR on June 10, 1968. That year, 4.7 million Danes received certificates bearing their new numbers.

Before the CPR, Denmark used censuses, church books and conscription rolls to record information about the population. Church books noted births, confirmations, engagements, marriages and deaths, while conscription rolls listed people liable for military service. These records made it difficult to get an efficient central overview, Lauritsen said.

The drive to make the public sector more efficient, combined with new data-processing technology in the 1960s, made a central register possible. The introduction of withholding tax provided the final push, Lauritsen said: employers needed to deduct tax from wages, which required reliable information about where people lived and what they earned.

Unlike numbers linked to a particular activity, such as pensions or tax, the CPR number is tied to the individual. Debate about how the state might use its citizens’ information began within a few years of the system’s introduction, Lauritsen said. Critics feared the information could be misused by a totalitarian government or by people opposed to democratic principles.

Digitalisation Minister Christina Egelund is now considering whether Denmark should create an entirely new system. But the CPR is embedded in many systems and is a backbone of the Danish welfare state, making a rapid replacement difficult, Lauritsen said. He also noted its benefits for public administration, tax collection and the payment of benefits.

Lauritsen said the breach could prompt a substantial tightening of security. He described digital security as a serious challenge, with systems under pressure and attack in what he called a situation resembling hybrid warfare.

In general, the CPR has attracted relatively little public debate over the past 60 years, Lauritsen said. He attributed this partly to greater trust in the state and its systems in Denmark than in Germany, where the history of persecution of Jews and the GDR’s surveillance society has contributed to stronger resistance to centralised state records.