Field Notes

synthesis

Sweden’s identity-exposure system is Nordic-normal in its parts and singular in its composition

StatusStableReviewdue UpdatedStands on14 sourcesSupportsnotes

Swedish public-record privacy describes Sweden’s identity-exposure system as a composition failure: the world’s oldest freedom-of-information principle, a state-run population-data distribution backbone, a practically permanent universal identifier, and — until the CJEU’s July 2026 ruling in Legal Newsdesk Sweden C-199-24 — a constitutional publication regime that people-search services used to resist data rights. The comparative question is how much of that is peculiarly Swedish. Is Sweden, as the charge goes, systematically doxxing every citizen irreversibly in a way other democracies do not?

The answer decomposes into three findings.

First, no component of the Swedish system is unique. Universal population-register identifiers are Nordic-normal (Sweden 1947, Norway 1964, Denmark 1968, Finland 1971, Iceland, Estonia); tax-data publication is shared with Norway and Finland; address-by-name lookup is purchasable in Germany and was fully open in Iceland; commercial people-search dossiers are an American industry at far larger scale; and journalistic exemptions from data-protection law are required of every EU member state by GDPR Article 85.

Second, the composition is singular. No other examined country combines, at once: a universal identifier that is public in practice and never resettable for misuse; a criminal-enforced duty to register and keep current one’s true sleeping address; a state-maintained distribution system (SPAR) propagating identity and address data into commercial systems; constitutional anonymity for requesters with no query logging; retail name-searchable conviction databases; and paid monitoring alerts that notify the watcher but not the watched — with the dossier’s core records state-certified rather than third-party inferences. Statistics Sweden’s own institutional history makes the same point from the inside: similar numbers exist in other countries, but Sweden is unique in the breadth of use and general acceptance the personnummer has achieved.1

Third, on irreversibility specifically, Sweden is an outlier even among exposed systems. Denmark assigns a new CPR number when the old one has been involved in identity misuse; the US Social Security Administration assigns a new number for harassment, abuse, life endangerment, or persistent identity theft; Japan’s My Number can be changed when leak or misuse is risked. Sweden offers birth-date correction, legal-sex change, and a threat-level fictitious identity — and nothing for the ordinary person whose correct number has simply become universally searchable.234

The comparison table

“Not established” marks cells this session did not verify; the rows carry the citations for their claims.

Identifier status Misuse reset Address lookup Personal tax data Convictions name-searchable Retail dossier industry Subject-visible query logs
Sweden Universal, public in practice None SPAR distribution + people-search Public on request + commercial republication Yes (certificate-shielded until 2026) Yes, with paid monitoring alerts, on state-certified records Credit reports only (since 1973)
Norway Universal, legally non-confidential, purpose-limited use None Authorized distribution; directory services Public: login, cap, one year, searcher visible to target No; own record only Directory-level Yes (tax lists, population register)
Denmark Universal, confidential by statute Yes (identity misuse) Restricted; own data only Not public No; own record only Essentially none Limited
Finland Universal, restricted use Not established Restricted Public at tax-office terminals or phone; never online; no identifier shown No; own record only Media tax portals only No
Iceland Universal, use restricted by law Not established Official name search closed; commercial API sells register access incl. bulk Not established No public database established Licensed register data sales Not established
Estonia Universal (isikukood) Not established Access logged, subject-visible Not public Own record only None Yes, mandatory expanding
Germany Tax ID protected; no public universal number n/a § 44 fee-fenced, purpose-declared, blockable Not public No; certificate self-only None Subject-notification duties
UK No national number in public use n/a Open electoral register (opt-out since 2003); Companies House home addresses private Not public No; spent convictions legally erased from public discourse 192.com and brokers, opt-out based n/a
US SSN semi-secret administrative Yes (abuse, identity theft) Broker aggregation of public records Not public Court records public; commercial background checks; sex-offender registries public by design Very large, opt-out based; third-party inferences on official fragments n/a
Japan My Number locked by law; collection prohibited even with consent Yes (leak or misuse risk) Resident-register access restricted Not public No None Mynaportal exchange history

Six architectures

Denmark: the confidential identifier. Denmark runs the same population-register infrastructure as Sweden and treats the identifier as confidential by statute: CPR numbers may not be published without consent, private processing is confined to defined purposes, criminal-offence data is locked to the data subject absent an outweighing interest, and tax data are not public.5 Denmark demonstrates that nothing about Nordic tax administration, welfare delivery, or register-based government requires Sweden’s exposure choices. It also demonstrates the reset Sweden lacks: a new CPR number is available when the old one has been involved in misuse of identity.2

Norway: transparency with watched watchers. Norway shares Sweden’s publicity instincts — the population register’s core data is legally non-confidential by default, and personal tax data is published with no opt-out — but engineers the access: login, age limit, monthly cap, one-year availability, and, since 2014, the searched person can see who searched them. Searches fell about 85 percent when anonymity ended, while compliance tips reportedly held steady.67 The population-register law gives the registered person access to query information about themselves. Norway’s fødselsnummer, like Sweden’s personnummer, has no misuse reset — but it is purpose-limited by statute (not to be used where name, address, and birth date suffice) and is not republished in dossier products.8

Finland: published income, stripped identifier, fenced access. Finland publishes individual tax data by statute but never online: viewable at tax-office terminals with no copying possible and no logging of viewers, or by phone. The public dataset carries name, birth year, county, and income facts — never the henkilötunnus, address, or family data. Media receive the file for journalistic use, and Finland’s courts upheld media tax portals under the same GDPR journalistic exemption that Sweden stretched to cover conviction dossiers.9 Finland is the proof that Sweden’s conflict with the GDPR was not caused by publishing tax data; it was caused by what else Sweden let the shield cover.

Iceland: the open-registry experiment, tightened. Iceland ran the system Sweden is accused of running: for years, anyone with a bank login could look up anyone’s kennitala and home address in the national registry by name. The domestic defense was that openness is security: every official act triggers a letter to the registered address, so fraud announces itself, and it is the private SSN’s secrecy that makes American identity theft profitable.10 The experiment has since been partly reversed: the official name search is closed, while licensed commercial access (including bulk register data) continues. Iceland shows both that a full-disclosure registry is operable — and that even the country that defended it most eloquently eventually narrowed it.

Estonia: watched state, not watched citizens. Estonia built the opposite architecture from Sweden’s: a universal identifier and total e-government, but every query against personal data in connected state systems is logged and visible to the subject through the Estonian Data Tracker. The 2025-26 legislative push makes that logging mandatory across nearly all public databases. Estonia’s answer to “how do you run a number-based digital state without doxxing people” is: expose the watchers, not the watched.11

Germany: the fee-fenced, purpose-declared lookup. Germany’s BMG § 44 lets anyone obtain a specific person’s current address for a fee — but requires unambiguous identification, a declaration that the data will not feed advertising or address trading (which requires the subject’s written consent), purpose limitation for declared commercial uses, and neutral responses that reveal nothing when a § 51 block exists. Recipients of extended extracts must inform the subject under GDPR Article 14.12 Germany has no public tax data, no conviction database, and no universal public identifier. Its model shows that “anyone can get an address” and “no one can build a dossier industry” are compatible.

United Kingdom: privatized addresses and expiring convictions. The UK splits the electoral register: the full version everyone is on (limited to elections, crime prevention, credit checks, jury service) and the open version anyone can buy — from which anyone may opt out, as millions have since 2003. Companies House home addresses went private in 2009, with only month and year of birth shown and removal routes available. And under the Rehabilitation of Offenders Act 1974, most convictions eventually become “spent”: the person is treated in law as never convicted, and an official who discloses spent-conviction information commits an offence.1314 The UK’s convictions expire from public discourse; Sweden’s are archived indefinitely by private certificate holders even after the official register erases them.

United States: the fragmented-broker model. The US has no population register and no public universal identifier; what it has is worse on some axes and better on others. Worse: a vast data-broker industry aggregating voter rolls, court records, property records, and marketing data into paid dossiers with relatives and associates; public-by-design sex-offender registries that cannot be opted out of; public court records and a mugshot industry. Better: opt-out rights (imperfect, whack-a-mole, but real), about twenty state privacy laws, no published tax data, and — the datum that surprised this research — an official route to a new SSN for victims of harassment, abuse, life endangerment, or persistent identity theft.315 The country with the weakest privacy law offers the identifier reset Sweden refuses.

Japan: the locked identifier. Japan studied US and Korean number abuse and designed the negative image: My Number may be used only for enumerated social-security, tax, and disaster procedures; collecting or storing another person’s number is prohibited even with consent; agencies link records through special codes rather than the number itself; and the number can be changed when leak or misuse is risked.4 Japan’s tax data are not public. It is the comparison’s proof that a modern administrative state can run a universal identifier with none of Sweden’s exposure.

Where Sweden is genuinely singular

Set against the table, the Swedish system’s distinctive properties are not its components but four joints:

  1. No friction anywhere. Norway logs and shows queries; Germany charges, fences, and notifies; Finland strips identifiers and bans copying; Estonia logs everything; Sweden’s FOI layer is anonymous by constitutional design and its commercial layer is unlogged. Sweden is the only examined country where a person cannot, in principle, find out who has been looking at them — except when a credit bureau is asked.16
  2. No reset. Every examined system with an exposed or misused identifier offers some escape — Denmark, the US, Japan. Sweden offers none below the exceptional-danger threshold of fictitious identity.2
  3. The dossier product itself. Paid alerts when a searched person moves, changes name or marital status, or acquires a vehicle — without notifying the subject — have no equivalent in any examined country, including the US broker market, whose products are passive reports rather than subject monitoring.
  4. The constitutional shield. Every EU state must exempt journalism from parts of data-protection law; Sweden alone built a certificate regime read as exempting any database with an editor’s name on it, and defended that reading through HFD, HD, and finally Luxembourg. The EU’s two foundational internet-privacy judgments both came from Sweden: Lindqvist in 2003, where a catechist was fined for publishing colleagues’ details on a parish homepage, and Legal Newsdesk in 2026, where a corporation’s population-scale conviction database had claimed constitutional immunity.17 The arc between those two cases is the Swedish anomaly in miniature: the little publisher prosecuted, the industrial publisher shielded.

Testing the doxxing charge in both directions

The comparison disciplines the accusation in both directions: four corrections sharpen it beyond the formulation the charge started from, and four calibrations bound it.

Sharper than the charge

  • The state mandates the doxxing, then distributes it. Swedish law does not merely tolerate the exposure; it compels the underlying record. Every resident must be registered at the property where they actually sleep (their dygnsvila), must report a move within a week, and faces criminal liability for false or missing registration — fines or up to six months, and up to two years in gross cases — which Skatteverket is obliged to report for prosecution. Högsta domstolen has upheld a conviction of a man who stayed registered at his old address while actually living at his girlfriend’s.18 That legally compelled, current, true home address is then distributed commercially through SPAR and republished by people-search services. The compulsion itself is not unique — Germany and the other Nordics have registration duties — but Germany fences the lookup behind fees, purpose declarations, and blocks, while Sweden pairs the compulsion with open commercial redistribution and no opt-out below the threat threshold. “No single open dump” is therefore the wrong consolation: there is a legally enforced duty to be findable at one’s real home, and the state sells the lookup.
  • The state runs the join’s identifier backbone. No single open file dumps every personnummer — but the commercial join is state-enabled, not an independent abuse. The state puts full personal identity numbers into public judgments and company filings, publishes tax data, and operates SPAR as a licensed distribution service for population data. The dossier industry is a derivative of infrastructure the state built and continues to supply; Norway’s register data is legally non-confidential on similar terms, but Norway logs queries and Sweden does not.
  • Health-data secrecy has a court-mediated public channel. Register-layer secrecy is real, but the criminal process converts it. A court-ordered forensic psychiatric evaluation (rättspsykiatrisk undersökning) overrides medical and social-services secrecy by statute: the RPU act obliges record holders to hand over what the evaluation needs “trots sekretessen” (despite the secrecy), including health, social-insurance, and prison records.19 The evaluation’s report goes to the court with summaries of medical history, substance use, and personal circumstances, and the judgment — a public document — quotes or paraphrases it at the court’s discretion. What the patient told a psychiatrist in confidence can thus end inside a public judgment, without any breach of formal secrecy anywhere.
  • The FUP is more invasive than the mugshot. Swedish police do not publish mugshots — but at the moment charges are filed, the preliminary-investigation file becomes a public document obtainable by anyone: the prosecutor’s own guidance states “förundersökningen blir offentlig när åtal väcks.” Courts hand out far more than 100,000 investigation files a year to media, commercial collectors, and the public, masked only after a per-request secrecy review whose scale has driven the courts to build an AI masking tool.20 The secrecy that survives charging is oriented toward the complainant; the accused person’s own intimate material — including, in sexual-offence cases, explicit images sitting in the file — has no victim-secrecy provision to invoke. An unflattering arrest photograph would be among the least invasive items in such a file.21

Where the charge overshoots

  • Openness has a real security argument. Iceland’s defense — that a registered-address tripwire makes identity fraud self-announcing — and Norway’s finding that most curiosity searching evaporates when made visible both cut against the assumption that secrecy is the only protective posture. The problem is never publicity alone; it is publicity without access-transparency and without a reset.
  • The US is worse on some axes, and weaker in authority. Public sex-offender registries with no opt-out, mugshot publishing, and broker dossiers richer than anything Ratsit sells — but the American dossier is a third-party claim. Brokers stitch ad-tech inferences, marketing data, and scraped social fragments around official pieces (voter rolls, court records, property filings), and no institution stands behind the result.15 Its known unreliability gives the American subject a plausible deniability the Swede lacks: “the broker is wrong about me” is believable to an employer, a date, or a fraudster, while “the state’s register is wrong about me” is not. The Swedish dossier reproduces legally compelled, state-certified records; that certification is exactly what the buyer pays for, and it works against the subject in both directions — the data is trusted when weaponized, and an error stays authoritative until the state itself corrects it.
  • Some categories remain protected. There is no public electoral roll, full credit files require legitimate need and trigger a copy to the subject, and register-layer health secrecy is strong wherever no court order routes it into a case file.
  • Official erasure exists; private archives defeat it. Swedish criminal-record entries are erased from the official register years after release — but judgments archived by certificate holders are not bound by the erasure. The “irreversible” part of the doxxing charge lives in that private-copy asymmetry, not in the state’s register.

What the comparison adds to the vault’s Swedish analysis

The reform menu in Swedish public-record privacy was written without comparative templates. The table supplies them:

  • Access-transparency (Norway, Estonia, Germany, Japan): log queries and show them to the subject. Sweden invented one instance — the 1973 credit-report copy — and never generalized it.16 Access-transparency develops the pattern.
  • Purpose fencing (Germany): identification requirements, declared purposes, consent for commercial reuse, subject notification.
  • Identifier stripping (Finland): publish facts without the join key.
  • Confidential identifier (Denmark): treat the number as publishable only with consent.
  • Misuse reset (Denmark, US, Japan): an administrative route to a new identifier when the old one is compromised — the single gap with no Swedish analogue at all.
  • Expiring publicity (UK): spent-conviction doctrine with criminal penalties for official disclosure — the opposite of Sweden’s permanent private archives.

None of these requires abandoning offentlighetsprincipen’s scrutiny function, which the comparison shows no other country needs Sweden to sacrifice: Norway catches tax cheats with watched tax lists, Estonia runs total e-government with watched officials, and Germany runs a complete register with a fenced counter.

Open research

  • Establish Iceland’s current register-access rules (the closed official search versus licensed bulk API) and whether kennitala has any reset route.
  • Establish Finnish hetu change rules and Finnish population-register query logging.
  • Verify whether Norway has ever granted a new fødselsnummer for misuse or protection beyond the protected-identity scheme.
  • Quantify Swedish people-search revenue and query volumes against the US broker market for a like-for-like dossier-industry comparison.
  • Track the Swedish application of C-199/24 and whether it reaches the non-judgment data categories (address, income, monitoring alerts) or only criminal-offence data.
  • Compare protected-identity schemes (Swedish skyddad folkbokföring, Danish name/address protection, German § 51, UK anonymous voter registration) for accessibility and coverage.

  1. Skatteverket, “Folkbokföringens historia” (saved copy); the uniqueness-of-breadth observation is from Statistics Sweden’s 2016 Personnummer overview (BE96BR1601). For analysis, Ludvigsson et al., “The Swedish personal identity number: possibilities and pitfalls in health care,” BMC Medical Informatics and Decision Making 9 (2009), PMC2773709: ~75,600 number changes through 2008 (errors, immigration, legal-sex change) and documented reuse of 1950s-60s number combinations. ↩

  2. cpr.dk, “Kan jeg få et nyt personnummer?” (saved copy): new number for errors, for special identity-misuse cases (Personregister consolidation 2022/702), and for legal gender change. ↩↩↩

  3. US Social Security Administration, “Can I change my Social Security number?” (saved copy, captured from the Wayback Machine after ssa.gov returned 403): new number for duplicate/sequential problems, ongoing identity theft, harassment, abuse or life endangerment, and religious or cultural objections. ↩↩

  4. Japan Digital Agency, My Number FAQ (saved copy): lifetime number, not freely changeable, but changeable on application or by the municipal mayor where leak and misuse is risked; collection and storage of others’ numbers prohibited even with consent. ↩↩

  5. Datatilsynet, “When can you process personal data?” (saved copy): CPR numbers may not be published without consent; criminal-offence processing and disclosure confined to consent or outweighing interest. ↩

  6. Skatteetaten, “Search the tax lists” (saved copy); the 2014 notification reform (Finansdepartementet consultation, 2014) and the tax director’s “Peeping Tom” framing per Statistics Norway’s account. ↩

  7. Bø, Skaar, and Thoresen, “Public disclosure of tax information: compliance tool or social network?”, Statistics Norway DP 975 (2020) (saved copy): ~85 percent search decline after non-anonymity; homophily and celebrity-search patterns. ↩

  8. Datatilsynet (Norway), “Fødselsnummer”: not confidential as a category but usable only when objectively necessary for secure identification (personopplysningsloven § 12); folkeregisterloven (2016) kap. 9 on non-confidential register data, and the Folkeregister handbook § 10-1 on disclosure and the registered person’s access to query information. ↩

  9. Vero guidance (saved copy); media-portal rulings: Finnish Data Protection Ombudsman (2021), Administrative Courts of Helsinki and Hämeenlinna (2023), KHO December 2022 on media disclosure. ↩

  10. Ian Watson, “We Know Your Identity Number,” Reykjavík Grapevine, 7 October 2005 (saved copy); Registers Iceland’s current site states that individuals cannot be searched in the National Registry; commercial access continues via licensed API (gagnatorg.ja.is documentation). ↩

  11. RIA, “Data tracker” (saved copy, captured via pure.md after the origin returned 403); Estonian PDPA § 36 logging duty; ERR News (13 August, 16 December 2025) on the mandatory-expansion bill. ↩

  12. Bundesmeldegesetz § 44 (saved copy); § 51 Auskunftssperre at gesetze-im-internet.de/bmg/__51.html; fee and practice detail per the Bundesbeauftragte für den Datenschutz (BfDI) registration-law guidance. ↩

  13. GOV.UK, “The electoral register and the ‘open register’” (saved copy); GOV.UK, “Your personal information on the Companies House register”: home addresses private since 2009, month/year of birth only, removal and protection routes. ↩

  14. Rehabilitation of Offenders Act 1974, s. 9 (unauthorized disclosure of spent convictions an offence); GOV.UK guidance on the 1974 Act. ↩

  15. US Federal Trade Commission, “What to know about people search sites that sell your information” (2022) and Consumer Reports’ data-broker removal guide (2024): broker aggregation from public records, opt-out mechanics and their limits, non-opt-outable categories including sex-offender status. ↩↩

  16. Kreditupplysningslagen (1973:1173) 11 §, riksdagen text: the kreditupplysningskopia — free automatic notice to the subject identifying the requester and the data given out; the third paragraph exempts disclosures made by publication under TF/YGL; IMY’s credit-information guidance: disclosure requires legitimate need. ↩↩

  17. Case C-101/01, Bodil Lindqvist, ECLI:EU:C:2003:596 (EUR-Lex): the CJEU’s first internet data-protection judgment, from Göta hovrätt, fining a parish volunteer for publishing colleagues’ personal data online. For the 2026 bookend, Legal Newsdesk Sweden C-199-24. ↩

  18. Folkbokföringslagen (1991:481), 7 § (bosättning följer dygnsvilan), 25 § (anmälan inom en vecka), 42 § (folkbokföringsbrott); NJA 2022 s. 287 (B 2765-21), day-fines for failing to report the actual sleeping address; Skatteverket, “Att vara folkbokförd”, on the 2018 strengthening and the agency’s duty to report suspicions. From 1 December 2026 a further promotion offence (främjande av oriktig folkbokföring) applies. ↩

  19. Lag (1991:1137) om rättspsykiatrisk undersökning, 14-14 a §§: record holders covered by health, social-services, social-insurance, prison, and migration secrecy must disclose what the evaluation needs notwithstanding that secrecy; Socialstyrelsen HSLF-FS 2015:31, on the report’s required content (medical history, psychiatric contacts, substance use, personal circumstances). Judgments’ use of the report varies; the channel exists by design, not by breach. ↩

  20. Sveriges Domstolar, “AI hjälper domstolarna att maskera handlingar” (saved copy): when the FUP is filed with the court at charge, the investigation secrecy lapses; courts release far more than 100,000 FUPs a year to commercial collectors, media, and the public, each after a masking review for which the courts built an AI tool because files can run to thousands of pages. ↩

  21. Åklagarmyndigheten, “Sekretess under förundersökningen” (saved copy): “Förundersökningen blir offentlig när åtal väcks”; continuing secrecy after charge is described through the complainant’s interest (“i sexualmål lämnar målsäganden ofta känsliga och intima uppgifter”), which is the provision protecting the victim, not the accused. ↩

Built on 14 sources (12 archived here, 2 external).

Working out connections…