1(2)
Klarna Bank AB
Sveavägen 46
111 34 Stockholm [email protected]
Our ref:
DI-2020-10546, IMI no.155160 Final decision in IMI case reg no
155160 – Supervision under the GDPR
Date:
2021-01-25
against Klarna Bank AB
Decision of the Swedish Authority for Privacy
Protection (IMY)
The case will be written off from further investigation.
Description of the supervisory case
The Swedish Authority for Data Protection (the Swedish SA) has initiated an
investigation against Klarna Bank AB (the company) due to a complaint. The complaint
has been submitted to the Swedish SA, in its capacity as lead supervisory authority for
the company’s operations pursuant to Article 56 of the GDPR, from the supervisory
authority in the country where the complainant has lodged the complaint in accordance
with the Regulation’s provisions on cooperation in cross-border matters.
The complainant stated that the company has sent direct marketing e-mails to him
despite having objected to processing of personal data for direct marketing purposes.
Furthermore, the complainant has argued that he has not received information that his
personal data will be processed for direct marketing purposes and that he has not
given his consent to such processing of personal data.
Klarna Bank AB has essentially stated the following. The company is not the controller
for the processing concerned in this complaint. The company does not know who is
behind these mailings and are not able to further investigate the matter based on the
screenshots attached to the complaint. According to the company, the e-mails that
form the basis of the complaint constitute so-called spam. The company has
previously received notice of e-mails sent from the address [email protected].
The company then initiated an internal investigation and concluded that these e-mails
Postadress: constituted spam. The company believes that the approach for sending these emails is
Box 8114 spoofing, i.e. the sender tries to imitate or mimic Klarna as the sender. The company
104 20 Stockholm states that they cannot prevent or affect these mailings as the company is not involved
Webbplats:
in the processing in question. Furthermore, the company adds that they have
previously informed their customers about spam emails from [email protected] by
www.imy.se
temporarily publishing a banner on their website.
E-post:
[email protected]
In light of the complaint involving cross-border processing, the Swedish SA has used
Telefon: the mechanisms for cooperation and consistency contained in Chapter VII of the
08-657 61 00
Integritetsskyddsmyndigheten Diarienummer: DI-2020-10546 2(2)
Datum: 2021-01-25
GDPR. The supervisory authorities concerned have been the data protection
authorities in Norway, Denmark, Finland, Germany, Belgium, Italy and Spain.
Justification of the decision
Applicable provisions
Article 4(1) of the GDPR defines the concept of personal data as any information
relating to an identified or identifiable natural person.
Article 4.2 states that processing refers to any operation or set of operations which is
performed on personal data or on sets of personal data.
According to Article 4.7, the controller entails a natural or legal person, public authority,
agency or other body that alone or jointly with others determines the purposes and
means of the processing personal data.
The Swedish Authority for Privacy Protection’s assessment
The Swedish SA constituted that processing of personal data has taken place by the
emails sent with direct marketing to the complainant’s e-mail address. However, the
company had put forward that they are not the controller responsible for the
processing of personal data that has taken place. There has been no reason to
question the company’s information. The case will thus be written off from further
investigation.
This decision has been taken by Head of Unit after presentation
by legal adviser
Notice. This document is an unofficial translation of the Swedish Authority for Privacy
Protections (IMY) decision 2021-01-25, no. DI-2020-10546. Only the Swedish version
of the decision is deemed authentic.