Identity Provider Outage Claims in Denmark

Introduction

Denmark has one of the world’s most digitized public infrastructures. Core public and private services depend heavily on electronic identity systems such as MitID and the older NemID. These systems authenticate users for banking, taxation, healthcare, courts, e-government services, and digital communications.

Because of this dependence, outages affecting identity providers (IdPs) create major legal, constitutional, administrative, cybersecurity, and data-protection concerns. Danish law, EU GDPR obligations, eIDAS regulations, cybersecurity governance, and administrative law principles all become relevant when citizens lose access to digital identity infrastructure.

The issue became especially significant after major outages in NemID and MitID systems between 2022 and 2026. Danish regulators and courts increasingly treated these outages not merely as technical failures but as failures affecting access to public rights and essential digital infrastructure.

1. Understanding Identity Provider Outages in Denmark

An Identity Provider (IdP) outage occurs when authentication infrastructure fails, preventing users from accessing systems requiring electronic identification.

In Denmark, such outages affect:

• Banking access
• Healthcare portals
• Court systems
• Tax administration
• e-Boks digital mail
• Public self-service portals
• Business authentication

The most important Danish digital identity systems are:

1. NemID
2. MitID

MitID replaced NemID gradually from 2021 onward.

The outages raised legal questions concerning:

• State responsibility
• Data controller liability
• GDPR Article 32 security obligations
• Continuity of critical infrastructure
• Citizens’ right to access public services
• Administrative proportionality
• Disaster recovery obligations

Recent investigations found that failures in backup testing and recovery planning caused prolonged service interruptions.

2. Legal Framework Governing Danish Identity Systems

A. GDPR (General Data Protection Regulation)

Key provisions:

• Article 5 — integrity and confidentiality
• Article 24 — controller responsibility
• Article 25 — data protection by design
• Article 32 — security of processing
• Article 33 — breach notification obligations

The Danish Data Protection Authority concluded that inadequate backup testing and recovery procedures violated GDPR Article 32 obligations.

B. eIDAS Regulation

The EU eIDAS Regulation governs electronic identification and trust services.

Relevant principles:

• Reliability
• Availability
• Interoperability
• Security assurance levels
• Cross-border recognition

Identity outages may undermine “high assurance” authentication requirements expected under eIDAS-compliant systems.

C. Danish Administrative Law

Danish public law imposes duties of:

• proportionality,
• accessibility,
• continuity of governance,
• equal treatment.

Where digital identity becomes mandatory, authorities must ensure citizens are not arbitrarily deprived of access to state functions.

3. Major Danish Identity Provider Outages

A. NemID Outage (June 2022)

The most serious outage occurred between 21–26 June 2022.

Effects:

• Approximately 1.5 million users affected
• Citizens unable to access:
  • healthcare services,
  • courts,
  • tax systems,
  • e-Boks,
  • government portals.

The outage was caused by:

• human error,
• infrastructure misconfiguration,
• failed disaster recovery systems,
• untested backup restoration.

The Danish Data Protection Authority later issued “serious criticism” against Nets DanID A/S.

B. MitID Outages (2024–2026)

Several later disruptions affected MitID services.

Authorities confirmed:

• instability,
• authentication failures,
• inability to complete online payments,
• inability to log into government services. 

These incidents demonstrated Denmark’s systemic dependency on centralized authentication systems.

4. Detailed Legal Analysis

A. Critical Infrastructure Responsibility

The Danish regulator emphasized that NemID constituted “critical national infrastructure.”

This classification increases:

• expected security standards,
• redundancy obligations,
• backup testing requirements,
• operational resilience duties.

The legal standard becomes higher because outages directly interfere with democratic administration and essential services.

B. GDPR Article 32 Liability

Article 32 requires:

• resilience,
• restoration capability,
• regular testing,
• risk assessment.

The Danish regulator found that:

• backup systems were not adequately tested,
• recovery mechanisms were ineffective,
• emergency procedures had not been verified for nearly two years. 

Thus the outage was treated as a compliance failure rather than merely an operational accident.

C. Access to Justice and Public Services

Identity outages affected:

• court portal access,
• tax communication,
• digital legal notices,
• healthcare administration.

This raises constitutional concerns:

• procedural fairness,
• due process,
• equal access to public administration.

When governments require mandatory digital authentication, uninterrupted operation becomes legally significant.

5. Six Important Case Laws / Regulatory Decisions

Case 1: Danish Data Protection Authority v. Nets DanID A/S (2024)

Core Issue

Failure of NemID infrastructure and backup systems.

Holding

The Danish Data Protection Authority issued “serious criticism” for violating GDPR Article 32.

Importance

This is Denmark’s leading regulatory decision on identity-provider outage liability.

Case 2: Finanstilsynet Order on NemID Authentication Security (2022)

Core Issue

Weak customer authentication standards.

Holding

The Danish Financial Supervisory Authority ordered banks to discontinue use of NemID key cards because they failed strong customer authentication requirements.

Importance

Demonstrated regulatory recognition that identity infrastructure must satisfy heightened security standards.

Case 3: Schrems II

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

Court

Court of Justice of the European Union (CJEU)

Principle

Security and data transfer safeguards must provide “essentially equivalent” protection.

Relevance to Denmark

Identity systems relying on centralized processing must maintain robust security and resilience standards.

Case 4: Digital Rights Ireland Ltd v Minister for Communications

Digital Rights Ireland Judgment

Principle

Massive digital infrastructures handling citizen identity data require strict proportionality and safeguards.

Relevance

Supports arguments that digital identity systems require high operational integrity because they affect fundamental rights.

Case 5: Tele2 Sverige AB v Post- och telestyrelsen

Tele2 Sverige Judgment

Principle

Government-linked digital systems must maintain necessity, proportionality, and safeguards.

Relevance

Identity outages affecting communication and authentication can interfere with protected digital rights.

Case 6: Glawischnig-Piesczek v Facebook Ireland

Glawischnig-Piesczek v Facebook Ireland

Principle

Platforms operating large-scale digital infrastructures carry extensive compliance responsibilities.

Relevance

Supports broader European jurisprudence imposing accountability on digital infrastructure operators.

6. Human Rights Dimension

Identity outages may implicate:

• Article 6 ECHR (fair trial access)
• Article 8 ECHR (private life)
• EU Charter Articles 7 and 8
• Access-to-government principles

Where digital authentication becomes mandatory, outages can effectively suspend citizens’ participation in public administration.

7. Cybersecurity and Operational Risks

The Danish incidents exposed:

Authorities increasingly classify national identity systems as “high resilience infrastructure.”

8. Public Criticism and Social Impact

Citizens reported:

• inability to access tax systems,
• inability to authenticate banking transactions,
• failed healthcare access,
• app crashes,
• login instability. 

Some commentators argued that Denmark became excessively dependent on digital authentication systems.

9. Conclusion

Identity provider outages in Denmark represent more than technical failures. They are now treated as:

• GDPR compliance issues,
• critical infrastructure failures,
• administrative law concerns,
• cybersecurity governance failures,
• digital rights problems.

The NemID and MitID incidents demonstrated that when an entire society depends on centralized digital identity systems, outages can disrupt constitutional access to healthcare, banking, justice, and governance.

The Danish Data Protection Authority’s findings against Nets DanID established an important precedent: operators of national digital identity systems must maintain tested backup systems, resilient infrastructure, and operational continuity consistent with GDPR Article 32 and broader European digital governance standards.