One upside of everyone's name, date of birth, address and personal ID number being public knowledge in Sweden is that organisations don't treat knowing any of those as proof of your identity. It's absurd how that's not the case in other places.
In the US the financial institutions and the credit reporting and collection agencies have used rather insidious language like "stolen identity" to describe the situation where fraud was perpetrated on one of those agencies by an unknown 3rd party who presumably bore the ID credentials of the person in question thereby passing through the institution's identity checks.
The fraud in these cases is not the problem of the institution, it's the problem of the individual. They use that specific language to train everyone into thinking and accepting that it's their individual problem...you know, since someone "stole their identity".
Then, when the giant companies that collect and "securely store and process" the information that is typically used to perform ID verifications get hacked and this data leaks out for 300M+ people... oh well, tiny fine and a bit of bad press for a week. Then it's swept under the rug and the individuals in the society have to live with those consequences.
It's super fucked...and super stupid.
'Merica.
But once you adjust to it for a second, it's quite nice. My personnummer is public info, and that's fine. With just that number alone, you can't do jack shit. Everywhere it's used online requires you to confirm/sign an action with BankID, or requires a valid ID and physical presence IRL. That's not to say it's impossible to social engineer your way into getting a BankID issued to you for your victim, but it's on the level of "getting someone's social security number" in other countries hard. Any site using BankID for auth doesn't get access to the cert so they can't leak it, and you can revoke your BankID for individual authenticators (like your phone) which you can't do with an SSN.
I guess that's better than the US where the SSN can take over someone's life and is completely unregulated and not at all locked down
Another upside that wasn't mentioned in the post is that all this legally required information really simplifies a lot of bureaucracy. It could be done without the info being public I guess, but the law requiring that you register your place of residence makes voting and paying taxes really easy. The state already knows what municipality you live in, so you don't need to register to vote yourself and you don't have to figure out what taxes you need to pay (unless you're self-employed).
The US system could be fixed much more efficiently by putting the burden of proof on the businesses who made the transaction instead of the individuals whose data got stolen (gave someone a loan who gave you a stolen SSN? better find out who you really gave it to).
Edit: The above might not be entirely accurate, check out the thread below. Some of these lookup sites may reveal the personnummer on registration and possibly payment. I've never tried this so can't confirm for sure, however.
There are several sites (upplysning.se for example) that show full length of the personal ID. How does that work if it is not public information?
Edit: I think you may be right and that registration and possibly payment could reveal the whole personnummer: https://www.imy.se/privatperson/dataskydd/introduktion-till-...
TIL!
Anyone can call the tax office and ask for the full person number of any person and they will give it.
Swedes are super confused about this so lots of people do the thing you talk about and think it's private but it's absolutely not. This disconnect between folk lore and reality is quite dangerous as people who believe the folk lore can start doing stupid shit like accepting the personnummer as alone being a guarantee of anything.
I'm curious about this part of your comment:
> so lots of people do the thing you talk about
What is "the thing" you're referring to?
> Some of these lookup sites may reveal the personnummer on registration and possibly payment
"some"? It's THE TAX OFFICE OF THE COUNTRY
"may"? WILL
"on registration"? No. YOU JUST CALL THEM. No questions asked.
Your comment with the edit is still enormously wrong.
If so, can you mention just a few more?
The address change fraud is a real problem, but the personnummer is used for identification and not authentication in that case as well.
The government cannot mandate all citizens to have e-IDs, so other alternatives to change your address must be provided. Since having an up to date address is mandatory, this alternative process must also be accessible (e.g. the closest tax office might be far away, so requiring the alternative process to be in-person would be impractical).
So the alternative process is that you fill in a form, sign it, and send it to the tax agency. To specify whose address is being changed, the form asks for your personnummer (it also asks for your name, but neither is intended to authenticate you). As verification, the tax agency sends a letter to your current address.
If the fraudster is able to intercept your mail, or if you do not notice the verification letter, the fraud is successful.
The e-ID alternative cannot be easily made opt-out, because the people who need the manual process also would be unable to opt out electronically. So as it stands, it’s opt-in, and almost everyone should opt into it.
Is this a mess, and a consequence of having a mandatory public address registry? Yes. But the personnummer isn’t used for authentication anywhere in this mess.
> the closest tax office might be far away, so requiring the alternative process to be in-person would be impractical.
Some countries require that the police visit you at home to verify that you live there, the closest police is hopefully not as far away as the closest tax office.