Field Notes

concept

Swedish personal identity number

StatusStableReviewdue UpdatedStands on4 sourcesSupportsnotes

The Swedish personal identity number, or personnummer, is a persistent identifier used across public administration and much of the private economy. It makes records about the same person easy to retrieve and reconcile, which reduces administrative ambiguity. The same property makes it an unusually effective correlation key.

Practically permanent

The number normally remains the same for life. There is no ordinary route to replace a correct personnummer because it has become widely exposed. The narrow exceptions serve other purposes: Skatteverket assigns a new number after correction of a registered birth date or a change of legal sex, and fictitious personal data used in exceptional danger include new identity details.1 Birth-date correction requires proof that the registered date is wrong. Fictitious personal data are available only when a person risks serious crime against their life, health, freedom, or peace and protected population registration is insufficient. Changing legal sex produces a new number, as part of that legal procedure. A privacy-motivated identifier reset remains unavailable.

The comparison with peer systems sharpens what is unusual here: Denmark assigns a new CPR number in special cases where the number has been involved in misuse of identity, the US Social Security Administration assigns a new number for harassment, abuse, life endangerment, or persistent identity theft, and Japan’s My Number can be changed when leak or misuse is risked. Sweden and Norway stand out in offering no misuse-driven reset at all — the irreversibility half of the analysis in Public-by-default identity in international comparison.

The ordinary ten digits encode a birth date, a three-digit birth number, and a checksum. One digit of the birth number records legal sex. If birth date and sex are known, the candidate space is small; in many cases there is no need to guess because the full number can be obtained from a public record or directory.

This means a personnummer should not be treated as a secret. Its exposure is primarily a privacy and linkage problem, not proof that the possessor is the person named.

Identifier is not authenticator

Vem där distinguishes a registered identity from verification that a claimant is connected to it. A personnummer selects the account or record. An identity document, electronic identification, or another strong process authenticates the person.

Fraud becomes easier when a workflow confuses the two, or when public biographical attributes can answer weak knowledge-based checks. The secure response is not to make the existing number a password. It is to remove it from authentication decisions, use strong electronic or documentary proof, minimize displayed attributes, and monitor high-risk changes and transactions.

Special Swedish protection does not make it secret

IMY describes personal identity numbers as specially protected under Swedish data-protection law, although they are not one of the GDPR’s special categories of sensitive data. Without consent, processing must be clearly justified by the purpose, secure identification, or another noteworthy reason. Controllers should expose as little of the number as possible.

That rule constrains a controller’s use; it does not turn the number into confidential authentication material. The tension is structural: the same stable identifier is valuable because authorities and firms can agree on who a record concerns, but that shared agreement also makes cross-context joining cheap.

Better identity architecture

A privacy-preserving system would separate functions that one universal number currently performs:

  • a confidential internal record key for each organization;
  • a strong authentication method for proving control of an identity;
  • narrowly disclosed attributes, such as age eligibility without full birth date;
  • sector-specific or pairwise identifiers that cannot be joined outside their intended relationship;
  • an accountable legal route for necessary cross-sector matching.

Migration would be difficult because the personnummer is embedded throughout Swedish administration. Near-term controls should therefore focus on data minimization, masking, purpose limitation, strong authentication, and limits on bulk correlation.

Its place in the wider transparency system is analyzed in Swedish public-record privacy.

  1. Skatteverket’s current personnummer guidance lists correction of birth date and change of legal sex under “Byte av personnummer”; local copy. Police guidance on fictitious personal data describes the exceptional-danger threshold; local copy. ↩

Built on 4 sources (4 external).

Working out connections…