Pharmacies tighten identity checks after CPR data leak

Danish pharmacies are increasing checks when handing out medicines and health information after a leak of data from the national civil registration system, DR reports. The checks will be particularly strict for medicines with a risk of misuse, the Danish Association of Pharmacies said.

Giving a CPR number alone will normally no longer be enough to collect medicine. Customers may be asked to show identification, such as a physical or digital health card, or answer questions to verify their identity.

People collecting medicine for someone else will also face extra checks to ensure the medicine and personal information go to the right person. The association said the simplest option is to bring that person’s health card or other identification. If that is not possible, the pharmacy will ask relevant verification questions.

The announcement followed comments by Laila Reenberg, director of the Agency for Societal Security, at a briefing on the data leak earlier on Tuesday. She said pharmacies would need to find other ways to verify customers, such as asking them to show a health card. A CPR number can no longer be relied on to identify a specific person, she said.

On Monday, it emerged that unauthorised users had accessed information on 8.8 million people in the CPR system over 10 days in September. The data included records of people who are living, deceased or have emigrated. The access was obtained by misusing a private Danish company’s lawful access to search the system.

The case has been reported to the Danish Data Protection Agency and is being investigated by the National Special Crime Unit. It is not yet known who was responsible or whether any people will need new CPR numbers. DR has also contacted the Organisation of General Practitioners about whether patients can still call their doctor and renew prescriptions by giving their CPR number.