No data is centralized. There is a central service that grants access tokens. You can revoke the login name (default is CPR, our equivalent to SSN, but can be c

No data is centralized. There is a central service that grants access tokens. You can revoke the login name (default is CPR, our equivalent to SSN, but can be changed to anything, mine is for instance), card or dongle seed. It is in essence a public login name, a secret password, and a one time key. It is state of the art security for every single individuals interaction with the government and when applying for financing, banking, ect. Should the central service be compromised, there is a kill switch in the system until the service is secure again. There is multiple layers of security at play here, including seperated logging entities such that there is no traffic that isn't logged, always leaving a paper trail of what services was used by the adversary. If you want to gain access to impersonate someone, there are others a significantly more effective ways utilizing social engineering. Not to say it's easy, because you need to obtain an official card (sygesikringsbevis), then use that to request a new passport with your photo, hope they do not have old photos in record, then use the passport to change address and then order NemId key card, and hope the person is not reading the mail and text about a new card being send.