Denmark's digitalisation minister Christina Egelund and minister for societal security and preparedness Lisbeth Bech-Nielsen face a parliamentary consultation today over the theft of 8.8 million CPR numbers earlier this month. The Folketing's Business and Digitalisation Committee has called them before the consultation, which is begin at 12, DR reported.
The committee wants the ministers to address whether the case "gives reason to rethink the digital infrastructure and use of the CPR system".
The leak has led two experts to say it no longer makes sense to use the CPR number to confirm identity at a pharmacy or when taking out a loan. "At a basic level we must recognise that the CPR number is compromised. And this case is just the final nail in the coffin," says Jacob Herbst, chair of the Cyber Security Council.
Jan Kaastrup, digital investigator at cybersecurity company CSIS, says the idea of a secret number used to authenticate at the doctor, pharmacy, for a DSB fine or a quick loan must be replaced by other solutions.
Herbst says the CPR number now sits between two stools. It contains personal information about date of birth and gender, so it cannot simply be laid out freely. "But we must also recognise that it is compromised. it may not make much sense to use a huge amount of resources to protect it," he says.
The Cyber Security Council proposes a ban on using the CPR number as a means of authentication. Tools such as MitID and the new AltID are better, it says.
, the CPR number should be regarded solely as an identification number, according to Herbst, a way to tell the difference between two people both named Jens Hansen. Kaastrup proposes a unique number for all residents in Denmark that does not contain personally sensitive information. He agrees another tool such as MitID should be used for authentication.
"We still need a number that can identify us. We can't really do without it," he says.