[tixzdk]

And the letter, which was sent as priority mail, had been opened when they went to retrieve it...

[hooph00p]

Now they must assume that information is compromised and take action.

[danielweber]

Which is what? Give every Dane a new health record?

[OJFord]

I read that to mean _legal_ action.

IANAL, and can't profess to any knowledge whatsoever of Danish law, but opening a package clearly addressed to someone else without permission may be reasonable grounds for litigation.

Though to the question "what good will that do", you're right, it's not like new health records can be issued.

Depending on the details of what was shared and what ties them to an individual though, I suppose it might be possible to issue new IDs.

[erk__]

They wrote that they do not belive that there was a compromise of the data.

[microtonal]

So? An unencrypted CD was accessible for a time period to a third party. It's good security practice to consider the data to be compromised. Especially a powerful, malicious actor will put in effort to make it appear that this is not the case.

If anything, this requires a severe audit of the security practices of the affected organisations. Moreover, I think citizens of Denmark are entitled to know what information about their personal health records is leaked.