Boundeal launches controlled-disclosure data room for financial-sector M&A

Denmark is facing a major personal data breach after unauthorised individuals accessed the records of approximately 8.8 million people in the country's central civil registration database, covering names, addresses and national identity numbers. The Danish government said on Monday that the perpetrator, who has not yet been identified, misused the legitimate system access of a private Danish company to look up information in the Central Person Register, or CPR. The company's access to the system has now been suspended and police are investigating the incident. Authorities said it is too early to conclude who was behind it. Christina Egelund, Denmark's Minister for Digital Affairs, described the incident as extremely serious, ordered a comprehensive review of the CPR's security, and urged the public to be wary of suspicious phone calls or emails that could use the leaked data for fraud. The agency that manages the system first detected unusual activity on 2 October, before finding that unauthorised lookups had taken place during September. People registered for name and address protection in the system were not affected by the incident.

Japanese authorities plan to amend the economic security law to require companies and organizations holding big data to notify the government before transferring or disclosing sensitive personal information to third parties. Kyodo News reported that the government aims to submit the amendment bill to the ordinary session of the Diet next year, amid concerns that malicious actors abroad may misuse the data as artificial intelligence technology advances, potentially posing a threat to national security. Sensitive personal information covers medical treatment histories, location data, biometric data such as fingerprints and facial recognition data, genetic information, as well as financial transaction histories. Sources said the reporting requirement will be based on the volume of data an organization holds, and is expected to cover several hundred organizations, including banks and hospitals. The government also plans to enforce the requirement when organizations store data with external cloud services or data centers. In addition, the government is considering establishing a system to assess whether data transfers should be permitted, based primarily on national security factors. A panel of experts is expected to begin discussions late this month on the proposed system, including penalties for those who evade reporting, before submitting the bill to the Diet next year. There is a tendency to discuss regulation of data center and cloud service providers, while trying to avoid unnecessarily affecting these companies' business activities. The spread of generative AI has made personal information a strategic resource with implications for both the economy and national security, since large datasets may contain information used to surveil or blackmail individuals, including those involved in important decision-making. The economic security promotion law, which took effect in 2022, covers measures to support the development of critical technologies, strengthen supply chains, and conduct advance screening of equipment used by companies operating critical infrastructure.